[SparkleCalibreDF]

SA has known design flaw: trains, rc vehicles and planes are non-collidble with vehicle of same type (if you don't understand: spawn 2 planes and push them on each other). Is there workaround for this?

[juarez]

CODE

0x6D64F0 RpClump *__thiscall CVehicle__assignPaintjob(CVehicle *veh) 0x6D0B70 signed int __thiscall CVehicle__getPaintjob(CVehicle *veh)

Edit1:

CODE

0x6A2F00 RpMaterial *__thiscall CVehicle__AssignLicensePlateMaterialTextureToVehicle(CVehicle *this, int a2) 0x6D10E0 char __thiscall CVehicle__GenerateLicensePlateMateralAndAssignToVehicleStruct(CVehicle *this, int a2) 0x4C8970 int __thiscall CVehicleModel__HaveVehicleModelLicensePlateText(CModelCars *this)

and one unused...

CODE

0x6D1150 int __thiscall CVehicle__destroyLicensePlateTexture(CVehicle *veh)

This post has been edited by juarez on Thursday, Nov 1 2012, 15:31

[DK22Pac]

CODE

struct CFxPrimEmitterData {    CFxPrimEmitterDataVmt   *vmt;    BYTE                     field_4;    BYTE                     m_bSrcBlendId;    BYTE                     m_bDstBlendId;    BYTE                     m_bAlphaOn;    CCompressedMatrix       *m_pMatrixCompressed;    RwTexture               *m_pTexture[4];    DWORD                    field_1C;    CLListHead               m_sList;    CFxPrimEmitterDataInfos  m_sInfos;    WORD                     m_wLodStart;    WORD                     m_wLodEnd;    BYTE                     m_bHasInfoFlatData;    BYTE                     m_bHasInfoHeatHazeData;    BYTE                     field_3E;    BYTE                     field_3F; };

CODE

struct CFxPrimEmitterDataInfos {    WORD             m_dwNumInfos;    CFxInfo         *m_pInfos;    BYTE             m_bNumInfos;    BYTE             field_9;    BYTE             _pad[2]; };

CODE

struct CFxInfo {    CFxInfoDataBase m_sBase;    CFxInfoData     m_sData; };

CODE

struct CFxInfoDataBase {    CFxInfoDataBaseVmt *vmt;    WORD                m_wInfoFlags;    BYTE                m_bTimeModePrt;    BYTE                _pad; };

CODE

struct CFxInfoData {    CFxInfoDataVmt *vmt;    BYTE            m_bLooped;    BYTE            m_bNumKeys;    BYTE            m_bNumInterpDatas;    BYTE            field_7;    WORD           *m_pTimeKeys;    WORD           *m_pValKeysPtrList; };

CParticle +0x78 CParticlePrimData ** m_pPrimsPtrList

CODE

struct CParticlePrimData {    CParticlePrimDataVmt *vmt;    CFxPrimEmitterData   *m_pFxPrimData;    CParticle            *m_pParticle;    BYTE                  field_C;    BYTE                  _pad[3];    DWORD                 field_10; };

This post has been edited by DK22Pac on Saturday, Nov 17 2012, 11:53

[JoeBullet]

Some functions for license plates and roadsign texts...

CODE

006FD500     CLicensePlate__ReadFile 006FD5B0     char __cdecl CLicensePlate__GenerateText(_BYTE *buf, signed int len) 006FD720     CLicensePlate__Shutdown 006FD7C0     CLicensePlate__GetArrayDimFromChar 006FDD70     CLicensePlate__RenderToRaster 006FDE50     CLicensePlate__SetTexture 006FDEA0     RwTexture *__cdecl CLicensePlate__Create(char *name, char ucDesign) 006FDF50     RpMaterial *__cdecl CLicensePlateManager__SetTextureMaterialCB(RpMaterial *material, RpGeometry *a2) 006FDFC0     int __cdecl CLicensePlateManager__SetTextureAtomicCB(RpAtomic *atomic) 006FDFE0     char __cdecl CLicensePlateManager__SetTexture(RpClump *clump, RpMaterial *a2, char ucPlateDesign) 006FE020     CLicensePlate__CreateApplyTexture 006FE060     int __cdecl CLicensePlateManager__SetTextMaterialCB(RpMaterial *material, void *pData) 006FE0D0     int __cdecl CLicensePlateManager__SetTextAtomicCB(RpAtomic *atomic, void *pData) 006FE0F0     CLicensePlateManager__SetText 006FE120     CRoadSignText__Load 006FE180     CRoadSignText__Shutdown 006FE220     CRoadSignText__HasAlphaMaterialCB 006FE260     CRoadSignText__GetArrayDimFromChar 006FEB70     char __cdecl CRoadSignText__Render(int a1, int charCount, RwRaster *a3, int a4, RwRaster *raster) 006FECA0     RwTexture *__cdecl CRoadSignText__Create(const char *name_, int height) 006FEDA0     RpAtomic *__cdecl CRoadSignText__CreateGeometry(float a1, float a2, signed int a3, char *szText, int geometry, int a6, int morphTarget, int height, unsigned __int8 a9) 006FF2D0     CRoadSignText__SetupGeometry 006FF350     CRoadSignText__SetAtomicRendererCB

Incomplete CPhysical

CODE

0046A760     char __cdecl CPhysical__IsGlass(CPhysical *a1) 00404460     RwV3D *__thiscall CPhysical__GetMoveSpeed(CPhysical *this) 004241C0     int __thiscall CPhysical__SetPosition(int this, RwV3D *a2) 004633E0     CPhysical__IsStatic 0046A760     char __cdecl CPhysical__IsGlass(CPhysical *a1) 00542260     CPhysical__constructor 00542450     CPhysical__destructor 005424C0     CPhysical__Remove 00542560     CPhysical__Add 00542800     CPhysical__AddToMovingList 00542860     CPhysical__RemoveFromMovingList 00542CE0     int __thiscall CPhysical__GetSpeed(CPhysical *this, RwV3D *pOutVector, RwV3D a) 00542DD0     CPhysical__ApplyMoveSpeed 00542E20     CPhysical__ApplyTurnSpeed 00542FE0     CPhysical__ApplyGravity 005430A0     int __thiscall CPhysical__ApplyFrictionMoveForce(CPhysical *this, float fForceX, float fForceY, float fForceZ) 00543490     int __stdcall CPhysical__ProcessEntityCollision(CPhysical *a1) 00543540     char __thiscall CPhysical__IsCollidedWithEntity(CPhysical *this, int pEntity) 00544C40     CPhysical__ApplyAirFriction 005454C0     char __thiscall CPhysical__ApplyFriction2(CPhysical *this, float fFriction, CColPoint *a3) 00545980     char __thiscall CPhysical__ApplyFriction(CPhysical *this, CPhysical *a2, float fFriction, CColPoint *pColPoint) 00546FF0     CPhysical__ProcessAttachedEntity

This post has been edited by JoeBullet on Sunday, Dec 23 2012, 15:56

[DK22Pac]

0x709CF0 RwV3D *__usercall ShadowRenderTriangle<eax>(RwV3D *pNormal<eax>, RwV3D *pTriangleVertsPos<ebx>, _ProjectionParam *param<edi>)

CODE

struct __ProjectionParam {    RwV3D    at;    RwMatrix invMatrix;    BYTE     shadowValue;    BYTE     _pad0[3];    DWORD    fade;    DWORD     __unused__;    RwMatrix entityMatrix; };

Could someone look to 0x4165B0? Called it "IsFaceInsideSphere"...

[JoeBullet]

0x4165B0 CCollision::IsFaceInsideSphere
004A1410 CFx__RenderAddTri
004A13B0 CFx__SetupRender
004A1600 CFx__RenderEnd
004A1660 CFx__RotateVecIntoVec
004A1780 CFx__RotateVecAboutVec
004A1940 int __thiscall CFxEmitterBP__RenderTextures(CFxEmitterBP *this, int a2, int a3, int a4)
004A21D0 char __thiscall CFxEmitterBP__RenderParticles(CFxEmitterBP *this, float fBlur, CParticleStorage *ParticleStorage)
00416330 void __cdecl CCollision__CalculateTrianglePlanes(CColData *a1)
00418580 int __cdecl CCollision__CalculateColModelTrianglePlanes(CColModel *a1)
004120C0 char __cdecl ColSphere__TestAABB(ColSphere *a1, CColModel *a2)

[DK22Pac]

lol Thank you.

[DK22Pac]

Finally reseatched all available rendering pipelines.

CODE

_gta_pipelines:            pointer: // basic 0x00000001 Im3D                       // Particles, Sky, Water, Ped Shadows 0x00000002 DefaultAtomic              // Weapons, Non-prelited objects // rw plugins 0x00000116 SkinAtomic      0xC978C4   // Peds 0x00000120 MatFX           0xC9AB8C   // Rw bump, envmap, dualpass, uvtransform // gta plugins                         0x53F20098 NVCObjects      0xC02C1C   // NVC + prelit 0x53F2009A Vehicles        0xC02D24   // Vehicles, Cutscene Vehicles 0x53F2009C PrelitObjects   0xC02C68   // NVC without prelit? Strange...

[juarez]

Found some stuff of generate police roadblocks spawn ...

SA 1.0

CODE

0x4629E0 int __cdecl roadBlocksProcess() 0x4619C0 int __cdecl createPoliceRoadBlock(float a1, float a2, float a3, float a4, float a5, float a6, int a7)

VC 1.0

CODE

0x444280 int __cdecl roadBlocksProcess() 0x4434B0 int __cdecl createPoliceRoadBlock(float a1, float a2, float a3, float a4, float a5, float a6)

[SilentPL]

Some completely random stuff, added on request. Jeez, that looks simple compared to the previous posts.

No onscreen stats box:
Write 0xEB to 0x58FC2C (1 byte)

player.img & clothes.dat scratched:
NOP 5 bytes at 0x5A834D

Hunger scratched:
NOP 5 bytes at 0x5700F0



Also:

CEntity.m_pRwObject is actually an union:

CODE

union {    RpAtomic* m_pAtomic;    RpClump* m_pClump; };

CEntity::Render shows it obivious:

CODE

if ( RwObjectGetType(this->m_pRwObject) == rpATOMIC ) // RwObject.type when inlined    this->m_pRwObject->pAtomic->renderCallBack(pObj->pAtomic); else    RpClumpRender(this->m_pRwObject->pClump);

@down
But union is better than typecasting, isn't it?

This post has been edited by SilentPL on Sunday, Feb 3 2013, 21:04

[DK22Pac]

Nope. RwObject is a 'parent' object for both RpClump and RpAtomic.

0x735360 void __cdecl RpClumpGetBonePositions(RpClump *clump, RwV3d *positions)
0x4CF190 void __thiscall gtaHAnimForAllBones(gtaHAnim *this, void (__cdecl *callback)(CBone *, void *), void *data)
0x4D62A0 CBone * __cdecl RpClumpFindBoneByName(RpClump *clump, char *name)
0x4D6370 CBone *__cdecl RpClumpFindBoneByHash(RpClump *clump, int key)
0x4D6400 CBone *__cdecl RpClumpFindBoneByID(RpClump *clump, int ID)

CBone

gtaHAnim + 0x08 => DWORD m_dwNumBones
gtaHAnim + 0x10 => CBone *m_pBones

struct CBone
0x00 BYTE m_bFlags
0x04 RwV3d m_vOffset
0x10 gtaHAnimIFrame *m_pIFrame
0x14 DWORD m_dwNodeId

struct gtaHAnimIFrame // interpolated key-frame
0x00 RtQuat m_qRotation
0x10 RwV3d m_vTranslation

This post has been edited by DK22Pac on Thursday, Feb 7 2013, 23:24

[Wesser]

Here are some information about helicopter's rotors figured out just for fun:

CAutomobile + 0x0678 - RwFrame *m_pstTopRotor
CAutomobile + 0x067C - RwFrame *m_pstTopRotorBlur
CAutomobile + 0x0680 - RwFrame *m_pstRearRotor
CAutomobile + 0x0684 - RwFrame *m_pstRearRotorBlur
CAutomobile + 0x084C - float fRotorSpeed

0x006C4400 - void __thiscall CHeli__render()

It updates the visibility of rotors frames.

0x006C4E60 - void __thiscall CHeli__processRotors()

It does rotate the helicopter rotors and process collision (when rotating).

0x006C4F00 - float *pfMaxRotorSpeed

It is the pointer to the constant value regarding the maximum rotors speed.

0x006C5420 - void __thiscall CHeli__preRender()

It updates the rotors matrix. Matrix transformations regarding each rotors frame begin at 0x006C56E9.

Information about planes will come soon.

Other unrelated stuff:

CPhysical + 0x0044 - RwV3d m_stVelocity (multiply by 50.0)
CPhysical + 0x00FC - CEntity *m_pclAttachedEntity
CPhysical + 0x0100 - RwV3d m_stAttachedOffset
CPhysical + 0x010C - RwV3d m_stAttachedRotation

CVehicle + 0x0384 - CHandlingData *m_pclHandlingData
CVehicle + 0x03D0 - float m_fCruiseSpeed

CHandlingData + 0x88 - float m_fMaxSpeed (multiply by 60.0)

0x004082C0 - float __cdecl getMagnitude(RwV3d *pstVector)

The current vehicle speed is given by computing the magnitude of m_stVelocity vector through getMagnitude function.

This post has been edited by Wesser on Saturday, Apr 13 2013, 17:30

[DK22Pac]

Final touches...

CODE

class CColData { public:    WORD               m_wNumSpheres;    WORD               m_wNumBoxes;    WORD               m_wNumTriangles;    BYTE               m_bNumLines;    BYTE               m_bFlags;    CColSphere        *m_pSpheres;    CColBox           *m_pBoxes    CColLine          *m_pLines;    CCompressedVector *m_pVertices;    CColTriangle      *m_pTriangles;    CColTrianglePlane  m_pTrianglePlanes;    DWORD              m_dwNumShadowTriangles;    DWORD              m_dwNumShadowVertices;    CCompressedVector *m_pShadowVertices;    CColTriangle      *m_pShadowTriangles; };

[Pritchard]

Hey, I've looked through most of these addresses, however I couldn't find one I'd really want to get.

I think everybody knows that if the weather's dark enough or you hide in a shadow the blip color changes from white to a greyish-brownish color. I'm looking for a method to check if this change occured, either by a memory address which detects if a player's hidden or if the blip color changes.

Thank you in advance.

[DK22Pac]

CODE

struct RwRaster {    struct RwRaster *parent;    unsigned char   *cpPixels;    unsigned char   *palette;    int              width, height, depth;    int              stride;    short            nOffsetX, nOffsetY;    unsigned char    cType;    unsigned char    cFlags;    unsigned char    privateFlags;    unsigned char    cFormat;    unsigned char   *originalPixels;    int              originalWidth;    int              originalHeight;    int              originalStride;    struct{        union{            IDirect3DTexture9 *pTexture;            IDirect3DSurface9 *pSurface;        };        unsigned char       *pPalette;        unsigned char        cAlpha;        unsigned char        cCubeTextureFlags; /* 0x01 IS_CUBEMAP_TEX */        unsigned char        cTextureFlags;     /* 0x01 HAS_MIP_MAPS                                                   0x10 IS_COMPRESSED */        unsigned char        cLockFlags;        IDirect3DSurface9   *pLockedSurface;        D3DLOCKED_RECT       lockedRect;        D3DFORMAT            eFormat;        IDirect3DSwapChain9 *pSwapChain;        HWND                *pHWnd;    } RwD3D9Raster; };

Not finished... Yet...

This post has been edited by DK22Pac on Monday, Apr 8 2013, 20:12

[DK22Pac]

Some info about RpMaterial plugins.
Let's start with default structure.

CODE

struct RpMaterial {    RwTexture           *texture;    RwRGBA               color;    RxPipeline          *pipeline;    RwSurfaceProperties  surfaceProps;    short                refCount;    short                pad; };

CODE

struct RwSurfaceProperties {    float ambient;    union    {        float specular;        eMaterialEffectFlags flags;    };    float diffuse; };

Look at the second field here. Since 'specular' member is not used in RW, Rockstar used it to hold some information :

CODE

enum eMaterialEffectFlags {    HAS_ENV_MAP   = 0x00000001,    HAS_ENV_MAP_X = 0x00000002, // xvehicleenvmap128    HAS_SPECULAR  = 0x00000004 };

Additional part of structure

CODE

struct SMaterial : public RpMaterial {    SFXMaterial         *pMatFx;    SUVAnimMaterial      sUVAnim;    SReflectionMaterial *pReflection;    SSpecularMaterial   *pSpecular; };

Material FX plugin can hold some default RW effect.

CODE

enum RpMatFXMaterialFlags {    rpMATFXEFFECTBUMPMAP         = 1,    rpMATFXEFFECTENVMAP          = 2,    rpMATFXEFFECTBUMPENVMAP      = 3,    rpMATFXEFFECTDUAL            = 4,    rpMATFXEFFECTUVTRANSFORM     = 5,    rpMATFXEFFECTDUALUVTRANSFORM = 6 };

Some of these effecs, like bump+env, are represented as 2 separated effects. So we have such structure here:

CODE

struct SFXMaterial {    SFXEnvMapMaterial sEffect[2];    unsigned int      uiFlags; // were shown before ^ };

Each effect has different structure, I've looked only to EnvMap, which is used by game (This section is used to hold texture for vehicle reflection).

CODE

struct SFXEnvMapMaterial {    RwFrame      *pFrame;    RwTexture    *pTexture;    float         fCoefficient;    unsigned int  uiFrameBufferAlpha;    float         fSize;    unsigned int  uiEffectType; // separated type (based on 'flags') };

Other things:

CODE

struct SUVAnimMaterial {    RwMatrix           *pMatrix[2];    RtAnimInterpolator *pInterpolator[8]; };

CODE

struct SReflectionMaterial {    unsigned char   ucTransformParams[4];    unsigned char   ucIntensity; private:    char            __pad; public:    unsigned short  usRenderFrame;    STexture       *pTexture; // as I said before, we get this texture from FX plugin. };

CODE

struct SSpecularMaterial {    float     fLevel;    STexture *pTexture; };

RwTexture

CODE

struct RwTexture {    RwRaster        *raster;    RwTexDictionary *dict;    RwLLLink        lInDictionary;    char            name[32];    char            mask[32];    unsigned int    filterAddressing;    int             refCount;    // RenderWare plugin    unsigned char   maxAnisotropy;    char            pad[3]; };

RwFrame

CODE

struct RwFrame {    RwObject    object;    RwLLLink    inDirtyListLink;    RwMatrix    modelling;    RwMatrix    ltm;    RwLinkList  objectList;    RwFrame    *child;    RwFrame    *next;    RwFrame    *root;    // RenderWare plugin    RpHAnimFrameExtension hAnimFrame;    // GTA Plugins    char nodeName[24];    int  hierId; };

This post has been edited by DK22Pac on Friday, Apr 19 2013, 09:08

[DK22Pac]

0x7C7190 bool __cdecl SkinCreateSkinData(RpSkin *skin, unsigned int numBones, unsigned int numBoneIds, unsigned int numGeometryVertices, const void *boneIds, const void *vertexBoneWeights, const void *vertexBoneIndices, RwMatrix *skinToBoneMatrices)
Will post RpSkin structure later...

Skin

CODE

struct RpSkin {    unsigned int     numBones;    unsigned int     numBoneIds;    unsigned char   *boneIds;    RwMatrix        *skinToBoneMatrices;    unsigned int     maxNumWeightsForVertex;    unsigned int    *vertexBoneIndices;    RwMatrixWeights *vertexBoneWeights;    char             field_1C[8];    unsigned int     boneLimit;    unsigned int     numMeshes;    unsigned int     numRLE;    unsigned char   *meshBoneRemapIndices;    unsigned int     meshBoneRLECount;    void            *meshBoneRLE;    void            *field_3C; };

Geometry

CODE

struct RpGeometry {    RwObject            object;    unsigned int        flags;    unsigned short      lockedSinceLastInst;    short               refCount;    int                 numTriangles;    int                 numVertices;    int                 numMorphTargets;    int                 numTexCoordSets;    RpMaterialList      matList;    RpTriangle         *triangles;    RwRGBA             *preLitLum;    RwTexCoords        *texCoords[8];    RpMeshHeader       *mesh;    RwResEntry         *repEntry;    RpMorphTarget      *morphTarget;    // RenderWare plugins    RpSkin             *skin;    unsigned int        usageFlag;    // GTA plugins    CNightVertexColors  nightVertexColors;    CBreakableGeometry *breakableGeometry;    C2dfxStore         *_2dfxStore; };

This post has been edited by DK22Pac on Monday, Apr 22 2013, 22:37

[juarez]

Found a CPhone functions:

CODE

0x454220     CPhones__Init 0x454340     CPhones__Process

Not all, but I think they are must be re-enable.

[DK22Pac]

CODE

PhonePickUpCB(CAnimBlendAssociation *,void *)                                               0x453E40 PhonePutDownCB(CAnimBlendAssociation *,void *)                                              0x453F40 CPhone::CPhone(void)                                                                        0x453FA0 CPhone::~CPhone()                                                                           0x453FB0 CPhoneInfo::Shutdown(void)                                                                  0x453FC0 CPhoneInfo::PhoneAtThisPosition(CVector)                                                    0x453FD0 CPhoneInfo::GrabPhone(float,float)                                                          0x454010 CPhoneInfo::SetPhoneMessage_Repeatedly(int,uchar *,uchar *,uchar *,uchar *,uchar *,uchar *) 0x4540D0 CPhoneInfo::SetPhoneMessage_JustOnce(int,uchar *,uchar *,uchar *,uchar *,uchar *,uchar *)   0x454130 CPhoneInfo::HasMessageBeenDisplayed(int)                                                    0x454190 CPhoneInfo::IsMessageBeingDisplayed(int)                                                    0x4541C0 CPhoneInfo::CPhoneInfo(void)                                                                0x4541E0 CPhoneInfo::~CPhoneInfo()                                                                   0x454200 CPhoneInfo::Initialise(void)                                                                0x454220 CPhoneInfo::FindNearestFreePhone(CVector *)                                                 0x4542D0 CPhoneInfo::Update(void)                                                                    0x454340 CPhoneInfo gPhoneInfo                                                                       0x977BE8

This post has been edited by DK22Pac on Sunday, May 19 2013, 23:04