1. For downloading SimTools plugins you need a Download Package. Get it with virtual coins that you receive for forum activity or Buy Download Package - We have a zero Spam tolerance so read our forum rules first.

    Buy Now a Download Plan!
  2. Do not try to cheat our system and do not post an unnecessary amount of useless posts only to earn credits here. We have a zero spam tolerance policy and this will cause a ban of your user account. Otherwise we wish you a pleasant stay here! Read the forum rules
  3. We have a few rules which you need to read and accept before posting anything here! Following these rules will keep the forum clean and your stay pleasant. Do not follow these rules can lead to permanent exclusion from this website: Read the forum rules.
    Are you a company? Read our company rules

Tutorial So how do we find the memory addresses for Wreckfest?

Discussion in 'SimTools Plugins' started by value1, Jul 21, 2018.

  1. value1

    value1 Nerd Staff Member Moderator SimAxe Beta Tester SimTools Developer Gold Contributor

    Joined:
    Jan 9, 2011
    Messages:
    2,183
    Location:
    Zug, Switzerland
    Balance:
    10,800Coins
    Ratings:
    +3,266 / 11 / -1
    My Motion Simulator:
    2DOF, DC motor, JRK, Joyrider
    Here's a little tutorial, how to find the speed vector, acceleration vector and the transformation matrix for Wreckfest.

    ¹ This is not an introduction to CheatEngine. You will find better tutorials for this handy tool on the net. For example you can find a nice introduction in Stephen Chapman's channel.
    ² Finding the memory locations and verifying the stability of the pointers is not a matter of minutes. Consider a good amount of time!
    ³ The concept of local coordinates and world coordinates is explained in various articles on the net. Look there for more details. In a nutshell, speed, angles and other telemetry data is stored in world coordinates in the game and they are relative to the world. To move our simulation platform, however, we will need the motions relative to the center of gravity of the platform/car, i.e. in local coordinates. Therefore we will need the transformation matrix.

    Start the game and select a track with a long straight at the start. In many games the coordinate system is defined in such a way that it is parallel to the start of the track. This is important because it makes finding the speed data easier. For example Pinehills Raceway will do.
    upload_2018-7-21_15-42-53.png
    In CheatEngine set the search values between 2 and 10:
    upload_2018-7-21_15-25-56.png
    (2 m/s is 7.2 km/h, 10 m/s is 36 km/h)
    Check upload_2018-7-21_15-27-44.png .
    Slowly (between 8 and 35 km/h) drive up this straight and do the first scan.
    upload_2018-7-21_15-49-33.png
    The result will be >1'000'000 addresses with values between 2 and 10
    Stop the car and set the values in CheatEngine to -0.1 and 0.1.
    upload_2018-7-21_15-33-33.png
    Do the next scan (actually do it several times) and the number of found addresses will go down to something like 10'000 addresses.
    Set the values in CheatEngine to between -10 and -2.
    upload_2018-7-21_15-34-55.png
    Engage reverse gear and drive backwards at 8 - 35 km/h and do the next scan.
    upload_2018-7-21_15-53-53.png
    The number of addresses will go down to < 100.
    Stop the car again, set the values to -0.1 and 0.1, do the scan again.
    Set the values again to 2 – 10. Turn the car and drive backwards (i.e. in reverse gear) with 8 and 35 km/h.
    upload_2018-7-21_15-55-14.png
    Stop the car again, set the values to -0.1 and 0.1, do the scan again.
    You'll now should remain with about a dozen addresses.


    Now comes the Sniffer.
    Start Sniffer.exe from the attached Sniffer.zip.
    Enter Wreckfest in the Exe field and one of your found addresses in the Address field:
    upload_2018-7-21_23-11-0.png
    Maybe subtract from the address 8 (in the example above → 3AB6A1A4), because the speed vector can start with x, y or z vector component. Drive around and observe the values. When you turn 90° the speed should reduce to ≅ 0 and one of the neighboring cells should show the speed. (This is because of the world coordinate system!). When you drive quickly downhill, another neighboring cell should also show a small amount of negative speed and when uphill, it should show a small amount of positive speed. If this is the case, you have successfully found your first speed vector.
    In CheatEngine do a pointer scan for that address. Maybe verify another address with the sniffer and do a pointer scan for this address as well. The result will be thousands if not millions of possible pointer paths. Therefore close Wreckfest, restart and repeat the process and identify the speed vector again.
    Do a rescan in CheatEngine to reduce the number of pointer paths.
    After several repetitions, you will end with a handful of stable pointer paths.
    Take the smallest (least offsets).

    In the case of the current version of Wreckfest, the acceleration vector is close to the speed vector. So you're luck, you don't have to find the acceleration vector from the very start but can just modify the last offset of the speed pointer path.

    It's getting dark here now, I will show you how to find the transformation matrix the next time ;)

    Attached Files:

    • Informative Informative x 2
    • Optimistic Optimistic x 1
    Last edited: Nov 17, 2019
  2. Ads Master

    Ads Master

    Balance:
    Coins
    Ratings:
    +0 / 0 / -0
  3. noorbeast

    noorbeast VR Tassie Devil Staff Member Moderator Race Director

    Joined:
    Jul 13, 2014
    Messages:
    16,884
    Occupation:
    Innovative tech specialist for NGOs
    Location:
    St Helens, Tasmania, Australia
    Balance:
    122,673Coins
    Ratings:
    +9,682 / 47 / -2
    My Motion Simulator:
    3DOF, DC motor, JRK
    Brilliant, added to the Plugins FAQs:
  4. Hocky

    Hocky Member Gold Contributor

    Joined:
    Aug 30, 2018
    Messages:
    50
    Balance:
    91Coins
    Ratings:
    +24 / 1 / -0
    Thanks for the tutorial, very interesting!

    I did some efforts to find the speed memory adresses with what I think some success.

    Can you explain more how to find the pointers? Should I record the different ”runs” pointer scans and compare (rescan) them to find the actual pointer? I guess this is what you wrote but do I do have problems to do it in the Cheatengine

    Can you also share some about the tactics how to find acceleration and matrix?

    Again, great work and I got much more understanding about this already!
    • Like Like x 1