Remove the hardwired speed limit on the Hydra

[op9080]

Address 0x86E104 - float constant, square of the maximum speed of the Hydra (actually, all planes)

Unit: 2500 meters^2/sec^2

Value: 2.25 (gives a maximum speed of 75 m/s)

 

Code that checks the limit:

 

 006DADDD: D8 1D 04 E1 86 00  fcomp       dword ptr ds:[0086E104h] 006DADE3: DF E0              fnstsw      ax 006DADE5: F6 C4 41           test        ah,41h 006DADE8: 75 60              jne         006DAE4A

 

 

How to remove:

Change byte at 0x6DADE8 from 0x75 to 0xEB to change it to an unconditional jmp and ignore the test.

 

If you have GTA hoodlum, you can patch it with a hex editor at file address 0x2DA1E8.

 

These numbers hold for both US & EU exes.

 

The Hydra's speed is also limited by the drag physics so if you want to make it go faster, reduce the default drag factor of 20 in handling.cfg. I used a drag of 2, and it maxed out spookie's speedometer at 999 KPH in about 10 seconds.

Edited November 13, 2005 by op9080

[demonj0e]

you are such a star op

your great to this commnunity with all your work

 

btw if i edit the exe quite alot and rename it are we allowed to release it on the web?

Edited November 11, 2005 by demonj0e

[op9080]

Thanks. I like to do my reverse engineering in the wee hours of the night. Stayed up 'til 4AM for that one

 

I've got some other constants I found that change the acceleration of all cars, but I'm not done REing that part. I'm not sure which ones are safe to change. Unfortunately, compilers and linkers try to eliminate duplicate constants, so almost every constant in the exe that's used for vehicle physics is also used for something else. You get side effects if you change them. For instance, the Hydra constant above is used in four other places, only two of which seem to have something to do with speed limits. I'll post some acceleration constants when I'm done sorting them out.

 

What will really make me happy is to find out how to set unlimited height on the jetpack and on aircraft so they can be used in Liberty City.

[SeaNorris.]

btw if i edit the exe quite alot and rename it are we allowed to release it on the web?

No, exe distributing is not allowed.

[TonyB.]

 

btw if i edit the exe quite alot and rename it are we allowed to release it on the web?

 

make a loader or injected dll to edit the exe while its starting to load

 

 

from an injected dll changing 0x6DADE8 to 0xEB is simple, just use this code

 

 

	DWORD dwVP3, dwVP4;VirtualProtect((PVOID)0x6DADE8,1,PAGE_EXECUTE_READWRITE,&dwVP3);memcpy((PVOID)0x6DADE8,0xEB,1);VirtualProtect((PVOID)0x6DADE8,1,dwVP3,&dwVP4);

 

 

 

this only works inprocess, im pretty sure WriteProcessMemory will do this from outprocess (without the VituralProtect necessary), ill make a loader if i have time

 

EDIT:

 

http://tony-b.net/Loader.exe - havent got around to testing it, but it should work, just place in in gtasa directory and run the loader.

Edited November 11, 2005 by TonyB.

[demonj0e]

ok knock me out

dont have a clue bout all that he he

better start learning this stuff

ill try this soon thanks

 

EDIT

hey op btw ive gone miles above highlimit with my jetpack before i went to the top of chilliad on a jetpack and jus flew up i went miles high

Edited November 11, 2005 by demonj0e

[adam schiller]

Could you maybe attempt a unlimited height mod?