Yimura
commented
2 years ago Yooo thank you, I will definitely be adding this later on!
Open maybegreat48 opened 2 years ago
Yimura
commented
2 years ago Yooo thank you, I will definitely be adding this later on!
maybegreat48
commented
2 years ago So i dumped literally struct i could and posted it here: https://gist.github.com/maybegreat48/04a1ea98d9ede4388bd36e4f1f84f331 Most of it looks useless to me but still very interesting
Yimura
commented
2 years ago Which tools do you use for this? I'd be intrigued in learning how to use these. Currently I'm just manually going in ReClass and mapping values like that.
maybegreat48
commented
2 years ago Am dumping them from parStructures which basically parses the .ymt and .meta files, not all classes can be dumped this way of course the parStructure class can be found here, these structures are created as soon as the game starts and then they are populated with offsets from parStructureStaticData, the function that does that is
using register_structure = void(*) (rage::parStructure* stru, rage::parStructureStaticData* data);
early_batch.add("RS", "E8 ? ? ? ? 48 8B 43 10 48 83 C4 20 5B C3 48 8B C4", [this](memory::handle ptr)
{
m_register_structure = ptr.add(1).rip().as<functions::register_structure>();
});hooking this function allows you to examine the contents of rage::parStructureStaticData before it is lost forever, remember that you must hook it as soon as arxan deobfuscates GTA, see also this and this on how to get offsets from static data.
Yimura
commented
2 years ago I've updated the classes with what you've given me and I've partially implemented them, I prioritised what seemed nice to have right now, will move to the other stuff at a later date.
George0828Zhang
commented
1 year ago Hi, this looks extremely useful, any chance that the WeaponFlags field could be added to CWeaponInfo?
FIELDNAME = WeaponFlags OFFSET = 0x8C8 TYPE = BITSET BITSET NAME = CarriedInHand BIT = 0 BITSET NAME = Automatic BIT = 1 BITSET NAME = Silenced BIT = 2 ...I tried in Yimmenu to read the content of `(char*)weapon_info + 0x8C8' but the outputs does not correspond to the flags of the weapon I'm using...
George0828Zhang
commented
1 year ago I tried in Yimmenu to read the content of `(char*)weapon_info + 0x8C8' but the outputs does not correspond to the flags of the weapon I'm using...
(sorry for the commit message spam) I found the correct offset for WeaponFlags at 0x0900, check out my PR I also added most values found here, and tested them in game.
AngryCarrot789
commented
11 months ago Sorry if this isn't the right place to ask but in regards to CWeaponInfo, is there a way to access the global weapon manager (i.e. the thing that stores all the CWeaponInfo instances) or at least find a specific CWeaponInfo instance by name?
Currently I have to search for a unique value that I set in the .xml files that is unlikely to be used anywhere else in the game (I chose a value of 0.2169420 for the AlternateWaitTime node in vehicleweapons_deluxo.meta, for the CWeaponInfo named VEHICLE_WEAPON_DELUXO_MISSILE), and using Cheat Engine that lands me 1 address
And then based on the CWeaponInfo.hpp class in this repo, I assumed that node maps to float m_alternate_wait_time which is offset by 0x150, and I can confirm that's correct as when I take the AlternateWaitTime address and subtract that offset, the first byte is 5, being the m_damage_type field which correctly maps to eDamageType::Explosive based on the .xml file
Yimura
commented
11 months ago @AngryCarrot789 try taking a look at the FILES::GET_DLC_WEAPON_DATA native. It seems to return a pointer to a CWeaponInfo object, perhaps there's some sort of data table in which weapons are stored that you can fetch the data from.
Similarly to how CModelInfo objects are stored there could be some map like structure that you need to reverse.
George0828Zhang
commented
11 months ago @AngryCarrot789 Luckily, I've already reversed the CWeaponInfoBlob pointer. For example, using Yimenu's lua api, you could access the WeaponInfos this way:
function get_at_array_addr(base_addr, offset)
local at_array_addr = base_addr:add(offset)
return at_array_addr:deref(), at_array_addr:add(0x8):get_word()
end
local InfoBlobAddress = memory.scan_pattern("48 8B 3D ? ? ? ? F3 0F 10 0D ? ? ? ? 45 33 D2"):add(3):rip()
local collected = {} -- key=weapon/ammo hash, value=base address
local info_blob_base, info_blob_count = get_at_array_addr(InfoBlobAddress, 0x0)
for i=0,info_blob_count-1 do
for j=0,3 do -- 4 lists of info
local info_array_base, info_count = get_at_array_addr(info_blob_base, 0xf8*i+0x10*j+0x90)
for k=0,info_count-1 do
local info_addr = info_array_base:add(0x8*k):deref()
local name_hash = info_addr:add(0x10):get_dword()
collected[name_hash] = info_addr:add(0x0):get_address()
end
end
endIn fact I found these using the method you described, I searched for values in CWeaponInfoBlob.Name which have unique value like DLC - Bullpup Rifle. From there it's easier to trace back to the static address.
If you're interested, I made a WeaponEditor Lua mod which has complete control over the all the weapon-related Infos like WeaponInfos, WeaponComponentInfos, ExplosionTags etc.
AngryCarrot789
commented
11 months ago Sweet! I'll check that out. I was literally just in the middle of commenting that I did manage to find a few pointers to the Deluxo's AWT with the help of CE: Pointer at GTA5.exe+0x2949870, then offset by 0xA40 and 0x150, which lands you at the address of AWT. I'm new to this type of low level stuff, but memory pattern scanning looks interesting so I might look into that too
Haven't checked all of them, but they should be correct Offsets are automatically generated from parStructures