Natives hashing algorithm

[mockba.the.borg]

Hi everyone,

 

So, we all know that the algorithm used to create the 32 bits hashes from vehicle names, weapon names and other items in the game is the Jenkins "One at a time" hashing.

 

Now, what about the 64 bits hashes from native names. Does anyone have any idea what is used there?

Looks like it is not related to the game's version, as we changed from 757.2 to 757.4 and the hashes didn't change.

So, either it is related to the online version (1.34 didn't change between 757.2 and 757.4), or generated from something else.

I wonder if anyone have even done some research on this.

 

Thanks,

Mockba.

[unknown modder]

No one has any idea as the hash isnt stored anywhere in the game files

[mockba.the.borg]

Yup, I did some (CE) research on 757.4 and found out that the natives are kept in dynamic memory on what seems to be a lookup tree, based on their last octets (so all natives ending in 0x39, for example, are kept together).

This is obviously done to speed up the search for a corresponding entry point in the executable.

The index for this tree is kept in static memory. These are pointers to the first block of each of the tree's branches (one for each possible last octet), and from there you can traverse the entire structure.

The structure (tree leafs) then contains the pointers to the corresponding entry points in the code for each native.

A quick look at this list shows that the game has natives that are not yet listed on the current 757.4 natives list.

If we could find out which part of the code is building this tree, then we would be one step closer to how the natives are really generated.

[Fireboyd78]

I think they're randomly generated. There's a native hash of "0xDEADC0DE" -- I doubt that's possible from a hashing algorithm.

Edited June 23, 2016 by Fireboyd78

[mockba.the.borg]

Hmmm ... I am not completely convinced it is random.

I have scanned the native hashes in memory again and noticed that:

 

1 - The DEADC0DE one doesn't exist anymore

2 - Some of the natives in my list are not on the published (757.4) natives list

3 - All natives in my list do have valid entry points in the code

4 - My list has 5565 entries

5 - Not all of the published natives (like DEADC0DE) are on my list

 

I am quite certain that my list covers the real sum of available native hashes in its entirety, so it looks to me that some of the natives are being "lost in translation" as stuff has been adapted to the native.db list over these past years.

 

Cheers,

Mockba.