[V] Script/Native Documentation and Research

[Fireboyd78]

 

 

Here are native addresses for b944 (social club version): http://camx.me/gtav/addresses-b944_2.txt

Why post the addresses when the base is dynamic?

 

http://pastebin.com/WA8c4Zan

 

You need to patch the exe with a hex editor to disable layout randomization. Change offset 0x186 from 0x22 to 0x23.

 

A bit late to responding to this, but I finally figured out what Cam meant. Basically, you want to turn on the "Relocation stripped" flag for the Characteristics of the PE. Steam version offset is 0x17E as of 944.

 

Thank you so much for this tip. I can finally create my own dumps!

Edited December 30, 2016 by Fireboyd78

[uNiverselEgacy]

I was always wondering why SHV is not written in a way that a direct translation table is generated at startup instead of having to go through 10+ tables (now that we got 10+ updates since 335) every time a native is called? Is it because such optimization has little impact on the overall performance? But I think with scripts that call hundreds if not thousands of natives each frame, such change might make a slightly noticeable difference.

[unknown modder]

I was always wondering why SHV is not written in a way that a direct translation table is generated at startup instead of having to go through 10+ tables (now that we got 10+ updates since 335) every time a native is called? Is it because such optimization has little impact on the overall performance? But I think with scripts that call hundreds if not thousands of natives each frame, such change might make a slightly noticeable difference.

Its not done like that. When you call a native, the hash gets translated to current game version, then it finds the handler for the native and stores it in a map to cache it. Next time you call that native it just retrieves the cached handler. Though It still takes time searching for the cached native. A much nicer solution would be like this

inline static Ped GET_PLAYER_PED(Player player){ static NativeHandler handler(0x43A66C31C68491C0); return handler.invoke<Ped>(player); }

This would make it so that when you call a native for the first time it will still translate and cache the native, but each successive call it doenst need to do any searching at all.

Obviouslt NativeHandler would need to be defined in SHV and do translation in the ctor

[uNiverselEgacy]

 

I was always wondering why SHV is not written in a way that a direct translation table is generated at startup instead of having to go through 10+ tables (now that we got 10+ updates since 335) every time a native is called? Is it because such optimization has little impact on the overall performance? But I think with scripts that call hundreds if not thousands of natives each frame, such change might make a slightly noticeable difference.

Its not done like that. When you call a native, the hash gets translated to current game version, then it finds the handler for the native and stores it in a map to cache it. Next time you call that native it just retrieves the cached handler. Though It still takes time searching for the cached native. A much nicer solution would be like this

inline static Ped GET_PLAYER_PED(Player player){ static NativeHandler handler(0x43A66C31C68491C0); return handler.invoke<Ped>(player); }

This would make it so that when you call a native for the first time it will still translate and cache the native, but each successive call it doenst need to do any searching at all.

Obviouslt NativeHandler would need to be defined in SHV and do translation in the ctor

 

Ah my bad. I disabled or somehow messed up the cache without the knowledge of it existing, and that explains why I was always doing translations.

I like your proposed solution but obviously it requires some nontrivial change to SHV and the natives header file.

[uNiverselEgacy]

0x44CD1F493DB2A0A6 seems to be the native that sets vehicle weapon ammo. I'm surprised it's a new native in 944.

Maybe it's because previous you always get infinite ammo.

[unknown modder]

0x44CD1F493DB2A0A6 seems to be the native that sets vehicle weapon ammo. I'm surprised it's a new native in 944.

Maybe it's because previous you always get infinite ammo.

Its only been added now as its needed to limit the ruiner2 missiles

 

 

I was always wondering why SHV is not written in a way that a direct translation table is generated at startup instead of having to go through 10+ tables (now that we got 10+ updates since 335) every time a native is called? Is it because such optimization has little impact on the overall performance? But I think with scripts that call hundreds if not thousands of natives each frame, such change might make a slightly noticeable difference.

Its not done like that. When you call a native, the hash gets translated to current game version, then it finds the handler for the native and stores it in a map to cache it. Next time you call that native it just retrieves the cached handler. Though It still takes time searching for the cached native. A much nicer solution would be like this

inline static Ped GET_PLAYER_PED(Player player){ static NativeHandler handler(0x43A66C31C68491C0); return handler.invoke<Ped>(player); }

This would make it so that when you call a native for the first time it will still translate and cache the native, but each successive call it doenst need to do any searching at all.

Obviouslt NativeHandler would need to be defined in SHV and do translation in the ctor

 

Ah my bad. I disabled or somehow messed up the cache without the knowledge of it existing, and that explains why I was always doing translations.

I like your proposed solution but obviously it requires some nontrivial change to SHV and the natives header file.

Yeah, While its nice, Its not going to be implemented unfortunately. Though it could easily be added alongside the current method for SHV.

[alloc8or]

Here's another new (build 944) native:

 

static BOOL _DOES_VEHICLE_HAVE_DOOR(Vehicle vehicle, int doorIndex) { return invoke<BOOL>(0x645F4B6E8499F632, vehicle, doorIndex); } // 0x645F4B6E8499F632

 

Edited February 5, 2017 by Unknown_Modder

[alloc8or]

Sorry for the double post but I can't believe no one named 0xFC695459D4D0E219 yet so I did it. It's that obvious:

 

 

http://www.dev-c.com/nativedb/func/info/fc695459d4d0e219

Edited February 5, 2017 by Unknown_Modder

[qiangqiang101]

Can someone change int PATHFIND::GENERATE_DIRECTIONS_TO_COORD to void?

 

int GENERATE_DIRECTIONS_TO_COORD(float x, float y, float z, BOOL p3, float *direction, float *p5, float *distToNxJunction) // 0xF90125F1F79ECDF8 0xED35C094

 

BOOL p3 was 1

 

direction:
0 = You Have Arrive
1 = Recalculating Route, Please make a u-turn where safe
2 = Please Proceed the Highlighted Route
3 = Keep Left (unsure)
4 = In (distToNxJunction) Turn Left
5 = In (distToNxJunction) Turn Right
6 = Keep Right (unsure)
7 = In (distToNxJunction) Go Straight Ahead
8 = In (distToNxJunction) Join the freeway
9 = In (distToNxJunction) Exit Freeway

 

http://dev-c.com/nativedb/func/info/f90125f1f79ecdf8

Edited February 2, 2017 by qiangqiang101

[unknown modder]

snip

Just because it always returns 0, doesnt mean its a void

void __fastcall pathfind__generate_directions_to_coord(NativeContext *a1){  NativeContext *v1; // rbx@1  NativeVector3 v2; // [sp+30h] [bp-28h]@1  v1 = a1;  sub_13FF34F98(    &v2,    (NativeVector3 *)a1->Args,    a1->Args->Arg4.DWORD,    a1->Args->Arg5.PDWORD,    a1->Args->Arg6.PDWORD,    (float *)a1->Args->Arg7.QWORD);  v1->Returns->Item1.DWORD = 0;}

this behavior is still seen on the current game version, though R*s native obfuscation makes it harder to find

Edited February 2, 2017 by unknown modder

[Keklol]

where I could download the latest version of the SDK?

[alloc8or]

Found another new one: VEHICLE::_0x1DA0DA9CB3F0C8BF

static BOOL _0x1DA0DA9CB3F0C8BF(Vehicle vehicle) { return invoke<BOOL>(0x1DA0DA9CB3F0C8BF, vehicle); } // 0x1DA0DA9CB3F0C8BF

Returns true if the wheels on a vehicle with lowerable wheels (vehicleType == 7) are lowered, false otherwise.
I suck at naming things so can someone please post a name that fits my description?
The name must start with an underscore because we can't know the actual name and alphabetically fit between GET_IS_WAYPOINT_RECORDING_LOADED and GET_LANDING_GEAR_STATE if possible.


EDIT: Also found this one: VEHICLE::_GET_HAS_LOWERABLE_WHEELS (checks if CVehicle->vehicleType equals 7).

static BOOL _GET_HAS_LOWERABLE_WHEELS(Vehicle vehicle) { return invoke<BOOL>(0xDCA174A42133F08C, vehicle); } // 0xDCA174A42133F08C

EDIT2: Found another one (again): VEHICLE::_RAISE_LOWERABLE_WHEELS

static void _RAISE_LOWERABLE_WHEELS(Vehicle vehicle) { invoke<Void>(0xF660602546D27BA8, vehicle); } // 0xF660602546D27BA8

Edited February 27, 2017 by Unknown_Modder

[alloc8or]

Sorry for the double post but I found another one: VEHICLE::_GET_NUMBER_OF_VEHICLE_DOORS

static int _GET_NUMBER_OF_VEHICLE_DOORS(Vehicle vehicle) { return invoke<int>(0x92922A607497B14D, vehicle); } // 0x92922A607497B14D

This one was added with build 463. I'm about 99% sure it's the correct name since it's stored directly after GET_NUMBER_OF_VEHICLE_COLOURS.

 

EDIT: Another new one: VEHICLE::_GET_ENTRY_POSITION_OF_DOOR

static Vector3 _GET_ENTRY_POSITION_OF_DOOR(Vehicle vehicle, int doorIndex) { return invoke<Vector3>(0xC0572928C0ABFDA3, vehicle, doorIndex); } // 0xC0572928C0ABFDA3

Note: The position is the world position.

Edited February 27, 2017 by Unknown_Modder

[alloc8or]

Sorry for my 3rd post in a row but this is really important. For some reason the DB got reset again.

@@Alexander Blade, pls fix

EDIT: It's been reverted

Edited March 6, 2017 by Unknown_Modder

[The Stunt]

@TaazR is there a way to make a mod for kick online people from the lobby without being the host of the lobby ?

Edited March 9, 2017 by The Stunt

[Boundless8558]

are natives real?

[mockba.the.borg]

Hi all,

A quick question about natives:

If we look at the natives list from natives.h (from dev-c.com) we see, for example, that PLAYER_ID is 0x4F8644AF03D0E0D6 0x8AEA886C.

0x8AEA886C is easy, it is just a joaat of PLAYER_ID, but what about 0x4F8644AF03D0E0D6? Was there a function to calculate that one back in the days?

 

I know such function would be useless today, as the natives have changed their hashes over time, but I would like to be able to calculate the original from the name.

 

Cheers,

Mockba.

[alloc8or]

Hi all,

A quick question about natives:

 

If we look at the natives list from natives.h (from dev-c.com) we see, for example, that PLAYER_ID is 0x4F8644AF03D0E0D6 0x8AEA886C.

0x8AEA886C is easy, it is just a joaat of PLAYER_ID, but what about 0x4F8644AF03D0E0D6? Was there a function to calculate that one back in the days?

 

I know such function would be useless today, as the natives have changed their hashes over time, but I would like to be able to calculate the original from the name.

 

Cheers,

Mockba.

It's just random 64-bit values and we were able to match them to the jenkins hashes by group indexing them using the console version of the game.

[The_Creator]

Hello there! What tool(or tools) do you use for find natives?

[mockba.the.borg]

 

Hi all,

A quick question about natives:

 

If we look at the natives list from natives.h (from dev-c.com) we see, for example, that PLAYER_ID is 0x4F8644AF03D0E0D6 0x8AEA886C.

0x8AEA886C is easy, it is just a joaat of PLAYER_ID, but what about 0x4F8644AF03D0E0D6? Was there a function to calculate that one back in the days?

 

I know such function would be useless today, as the natives have changed their hashes over time, but I would like to be able to calculate the original from the name.

 

Cheers,

Mockba.

It's just random 64-bit values and we were able to match them to the jenkins hashes by group indexing them using the console version of the game.

 

Hmmm ok ... so there was no real "function" to generate these hashes back then. got it.

[user0103]

What about native translations table?

[user0103]

I'm sorry, didn't notice that ScriptHook hasn't been updated yet.

Edited March 16, 2017 by user0103

[unknown modder]

What about native translations table?

guessing you want that to mod online, which isnt supported here

[user0103]

 

What about native translations table?

guessing you want that to mod online, which isnt supported here

You are wrong and Alex posts tables for reason.

[unknown modder]

 

 

What about native translations table?

guessing you want that to mod online, which isnt supported here

You are wrong and Alex posts tables for reason.

 

really, why do you need the tables?

[user0103]

 

 

 

What about native translations table?

guessing you want that to mod online, which isnt supported here

You are wrong and Alex posts tables for reason.

 

really, why do you need the tables?

 

Strange question, to find native C++ functions by their names. But I already find out all I needed. Stop the prejudices.

I don't want to rely on ScriptHook for my modifications when it's closed-source, you see what happens when project is controlled by one developer.

Edited March 17, 2017 by user0103

[Transmet]

 

 

 

 

What about native translations table?

guessing you want that to mod online, which isnt supported here

You are wrong and Alex posts tables for reason.

 

really, why do you need the tables?

 

Strange question, to find native C++ functions by their names. But I already find out all I needed. Stop the prejudices.

I don't want to rely on ScriptHook for my modifications when it's closed-source, you see what happens when project is controlled by one developer.

 

 

Leave him alone, he sees only evil.

He also gave me his speech.

It is a good intention.

Edited March 17, 2017 by Transmet

[Alexander Blade]

GTA V Native hash translation table from b944 to b1011 .

 

http://pastebin.com/yz3bxJSs

[user0103]

 

GTA V Native hash translation table from b944 to b1011 .

 

http://pastebin.com/yz3bxJSs

Many thanks for that!

[Rbn3D]

Hi all,

 

Has anyone found a native to add torque at position to entity/vehicle? Or to add force at position? I'm trying to implement custom physics and I need, at least, one of these natives.

 

Also, the link to the Multithreaded native bruteforce tool in first post seems to be dead. Can someone reaupload it?

 

Thanks.