Tutorial So how do we find the memory addresses for Wreckfest?

Here's a little tutorial, how to find the speed vector, acceleration vector and the transformation matrix for Wreckfest.

¹ This is not an introduction to CheatEngine. You will find better tutorials for this handy tool on the net. For example you can find a nice introduction in Stephen Chapman's channel.
² Finding the memory locations and verifying the stability of the pointers is not a matter of minutes. Consider a good amount of time!
³ The concept of local coordinates and world coordinates is explained in various articles on the net. Look there for more details. In a nutshell, speed, angles and other telemetry data is stored in world coordinates in the game and they are relative to the world. To move our simulation platform, however, we will need the motions relative to the center of gravity of the platform/car, i.e. in local coordinates. Therefore we will need the transformation matrix.

Start the game and select a track with a long straight at the start. In many games the coordinate system is defined in such a way that it is parallel to the start of the track. This is important because it makes finding the speed data easier. For example Pinehills Raceway will do.

In CheatEngine set the search values between 2 and 10:

(2 m/s is 7.2 km/h, 10 m/s is 36 km/h)
Check .
Slowly (between 8 and 35 km/h) drive up this straight and do the first scan.

The result will be >1'000'000 addresses with values between 2 and 10
Stop the car and set the values in CheatEngine to -0.1 and 0.1.

Do the next scan (actually do it several times) and the number of found addresses will go down to something like 10'000 addresses.
Set the values in CheatEngine to between -10 and -2.

Engage reverse gear and drive backwards at 8 - 35 km/h and do the next scan.

The number of addresses will go down to < 100.
Stop the car again, set the values to -0.1 and 0.1, do the scan again.
Set the values again to 2 – 10. Turn the car and drive backwards (i.e. in reverse gear) with 8 and 35 km/h.

Stop the car again, set the values to -0.1 and 0.1, do the scan again.
You'll now should remain with about a dozen addresses.

Now comes the Sniffer.
Start Sniffer.exe from the attached Sniffer.zip.
Enter Wreckfest in the Exe field and one of your found addresses in the Address field:

Maybe subtract from the address 8 (in the example above → 3AB6A1A4), because the speed vector can start with x, y or z vector component. Drive around and observe the values. When you turn 90° the speed should reduce to ≅ 0 and one of the neighboring cells should show the speed. (This is because of the world coordinate system!). When you drive quickly downhill, another neighboring cell should also show a small amount of negative speed and when uphill, it should show a small amount of positive speed. If this is the case, you have successfully found your first speed vector.
In CheatEngine do a pointer scan for that address. Maybe verify another address with the sniffer and do a pointer scan for this address as well. The result will be thousands if not millions of possible pointer paths. Therefore close Wreckfest, restart and repeat the process and identify the speed vector again.
Do a rescan in CheatEngine to reduce the number of pointer paths.
After several repetitions, you will end with a handful of stable pointer paths.
Take the smallest (least offsets).

In the case of the current version of Wreckfest, the acceleration vector is close to the speed vector. So you're luck, you don't have to find the acceleration vector from the very start but can just modify the last offset of the speed pointer path.

It's getting dark here now, I will show you how to find the transformation matrix the next time

Thanks for the tutorial, very interesting!

I did some efforts to find the speed memory adresses with what I think some success.

Can you explain more how to find the pointers? Should I record the different ”runs” pointer scans and compare (rescan) them to find the actual pointer? I guess this is what you wrote but do I do have problems to do it in the Cheatengine

Can you also share some about the tactics how to find acceleration and matrix?

Again, great work and I got much more understanding about this already!