Memory Address Offsets

[Joe Staff]

I was doing some research on HardWar hacking and I came up with a list of interesting values.

The offset is based on the lowest address I could identify, so it's possibly that more useful value could be located lower than the ones provided

I used Cheat Engine to obtained this information on the HardWar SERVER process (UIM 06, UK Disc)

Hangar	Offsets
Description	Offset
Name	0000
Ore (Stocked)	0048
Pure Water	0060
Chemicals	0078
Scrap Metal	0090
Food	00A8
Body Parts	00C0
Gems	00D8
ExMetal	00F0
SheetMetal	0108
ConstMat	0120
CompComp	0138
MachParts	0150
Plastics	0168
Explosives	0180
Fusion Parts	0198
Trigger	01B0
Matter	01C8
Engine 1	01E0
Engine 2	01F8
Engine 3	0210
Cell 1	0228
Cell 2	0240
Cell 3	0258
Cell 4	0270
Fusion Cell	0288
After Burner	02A0
Smallest Pod	02B8
Small Pod	02D0
Medium Pod	02E8
Large Pod	0300
Largest Pod	0318
Salvage Drone	0330
Super Drone	0348
Frame MM	0360
Frame SY	0378
Frame NT	0390
Frame HK	03A8
Frame DH	03C0
Frame PL	03D8
Frame AL	03F0
Sprat x 10	0408
Swarm x 10	0420
Devastator	0438
Leach x 10	0450
Flares x 10	0468
Chaff x 10	0480
Star Shells x 10	0498
Tac-Nuke	04B0
Big Bob Missile	04C8
Fire Burst x 10	04E0
Fire Burst Sub	04F8
Swarm Sub	0510
Underkill x 5	0528
Ground Base x 5	0540
Ground Base Sub	0558
Hologram x 5	0570
Laser	0588
Plasma Kannon	05A0
Laser Turret	05B8
Pulse Laser	05D0
Death Ray	05E8
New Moth NT	0600
New Moth HK	0618
New Moth DH	0630
New Moth MM	0648
New Moth SY	0660
New Moth PL	0678
Unknown Origin	0690
Mass Driver Part	06A8
Mystery Package	06C0
Black Box	06D8
Minerals	06F0
Air Filters	0708
Pleasure Cubes	0720
Alcohol	0738
Textiles	0750
Furs	0768
Huskar Cigars	0780
Servant Droids	0798
Narcotics	07A0
Cloning Device	07C8
Frame SW	07E0
Trojan	07F8
New Moth SW	0810
Munitions Machinery	0828
Components Machinery	0840
Ore Processor	0858
Destiller	0870
Narcotron	0888
Money	08AC

Note about Moth-Transportable Cargo:
Each item load is its own entity, with its own ID and everything. Your moth carries the information of which Cargo entities it has and the Cargo entity carries information of which moth it's on. You could technically carry 2 different loads of the same item but with different amounts and IDs (although I believe they're generally combined).

Cargo Entity	Offsets
Description	Offset
Item ID ( 0-88, where 0 = Ore, 1 = Pure Water, etc )	00
Amount	04
Vehicle Carrier ID	0C
Cargo Entity ID	10

There are a lot of memory address for moths that I couldn't identify, I'll mark those with a '???' for the time being. Some addresses I could only assume what they were.

These address are per-moth, so a different moth will have different addresses regardless of its pilot.

Moth	Offsets
Description	Offset
Entered Hangar ID	0000
Spectating?? (Changing results in a view of a different moth)	0004
Owner ID	0008
Moth Type ( 1-8 where 1=Moon Moth, 2=Siler-Y, etc )	000C
Power	0010
Power Drain	0014
Power Recharge Rate ( cannot change )	0018
Targeted Type ( 0=None, 1=Moth, 2=Hangar, 3=Cargo Entity, 4=MonorailCar	001C
Target ID	0020
Equipped Salve Drone ( 0-2, where 0=None, 1=Salvage Drone, etc )	0024
???	0028
Control Status?? ( 0=Normal, 1=No Control + Gravity, 2=No Control other than Throttle )	002C
Equipped Engine ( 1-3, Where 1=Engine 1, 2=Engine 2, etc )	0030
Equipped Cell ( 1-5, Where 1=Cell 1, 2=Cell3, etc)	0034
Equipped Pod ( 0-5, Where 0=None, 1=Smallest Pod, etc)	0038
Currently Equipped Weapon ( 0-9 )	003C
??? ( 0 when outside, 16384 when inside )	0040
???	0044
???	0048
Equipped Weapon ( Slot 0 )	004C
( Slot 1 )	0050
( Slot 2 )	0054
( Slot 3 )	0058
( Slot 4 )	005C
( Slot 5 )	0060
( Slot 6 ) Typically After Burner	0064
( Slot 7 )	0068
( Slot 8 )	006C
( Slot 9 ) Typically Laser Turret	0070
Weapon Ammo ( Slot 0 )	0074
( Slot 1 )	0078
( Slot 2 )	007C
( Slot 3 )	0080
( Slot 4 )	0084
( Slot 5 )	0088
( Slot 6 )	008C
( Slot 7 )	0090
( Slot 8 )	0094
( Slot 9 )	0098
Weapon Cool Down ( Slot 0 ) 0=Ready To Fire	009C
( Slot 1 )	00A0
( Slot 2 )	00A4
( Slot 3 )	00A8
( Slot 4 )	00AC
( Slot 5 )	00B0
( Slot 6 )	00B4
( Slot 7 )	00B8
( Slot 8 )	00BC
( Slot 9 )	00C0
Shield ( Full = 16384 )	00C4
Engine Damage ( Perfect = 0 )	00C8
Structure Damage	00CC
CPU Damage	00D0
Power Damage	00D4
Weapons Damage	00D8
??? Addresses	00DC-00E8
Mass ??? ( Goes up with added Cargo and Pod size )	00EC
Engine Speed	00F0
Cargo Speed Adjuster ( Goes down with added Cargo and Pod Size )	00F4
Loaded Cargo Entity ID ( Slot 0 )	00F8
( Slot 1 )	00FC
( Slot 2 )	0100
( Slot 3 )	0104
( Slot 4 )	0108
Pilot ID	010C
Passenger ID	0110
??? Addresses	0114-0168
Has Turret ( 0=No Turret, 1=Has Turret. Safe to use while in hangar, results in crash if non-turret moth sets primary weapon as turret )	016C
??? Addresses	0170-0194
Amount of Flares	0198
??? Addresses	019C-01A4
Amount of Chaffs	01A8
Amount of Star Shells	01AC
???	01B0
???	01B4
Flare,Chaff, and Star Shell Cool Down ( 0 = Ready to fire )	01B8
??? Addresses	01BC-01C8
Being Targeted Cool Down ??? ( Starts high once targeted but lowers over time )	01CC

List of Weapon IDs for Equipped Weapon ( Slot XX ) addresses

Weapon	IDs
Name	ID
Sprat	40
Swarm	41
Devastator	42
Power Leach	43
Tac-Nuke	47
Big Bob	48
FireBurst	49
FireBurst	50
Swarm	51
UnderKill	52
GroundBase	53
GroundBase	54
Hologram	55
Laser	56
Plasma Kannon	57
Laser Turret ( Will have no effect if not equipped properly )	58
Pulse Laser	59
Death Ray	60
Trojan	82

How to effectively use these offsets:
Not going to go into a lot of detail, but you need basic memory editor skills. Using a memory editor (I suggest http://www.CheatEngine.org) attempt to find one of the addresses on your own and then offset that address to reach the others. Example, use the memory editor to find the address for Scrap Metal then to get the address for Food you would take the offset of the higher of the two addresses ( In this case, Food has a higher address than Scrap Metal ) and subtract them to get a positive number ( Food:00A8 - Scrap Metal:0090 = 0018 ) then, based on what direction you're moving on the address list, you add or subtract that offset amount to the address you already have (Example: Scrap Metal:1234567 + Offset:0018 = Food:123457F)

[Joe Staff]

I just realized that the Weapon IDs are the same as the Cargo IDs. Equipping non-weapons gives you the [no weapon] but you do shoot some sort of non-defined projectile, personal experiences demonstrated a sprat with no ballistics physics.

[flap]

Hello,

I am the one the wrote the orginal version of MSGC and did a lot of work to draw the memory adress map a looong time ago. If you are interested, I could send you the data that I still have, some source code and (basic) tools that I built to explore hardwar memory.

[Captain Zedo]

That's some phenomenal work, Joe. I remember flap's table some time back. I'm sure it's still good.

flap: zip your table and tools up and I'll put them on the site if they are not there already. You can email them to me or post them here. The email is [e-mail]

[reaxion2]

That's mostly the same info I used to make my Hardlook program, too. Unfortunately, my source is gone missing ATM. If you use Hardlook on 2.04 or any of the u3b(x) saved games,you can get a little more information, but some of the difference would just be me using different terminology. I tried using it on UIM 6, which is the only Ian Martin patch I have, but there are quite a few changes. I had the entire data structure mapped out for the saved game files, and AFAIR, there was a great correlation to the in game addresses when I was using the Misopians program that Flap made. (In other words, once you found LIMBO in the running game.) Edit.- I downloaded Hardlook, and the missing DLL files from Wez's site just the other day.

ALSO, great catch on the weapon and flares cooldown time.

[reaxion2]

I found the place where Hardwar keeps the .sav file and the lists of moths, pilots, and hangars, like in the .sav file at 0xDD0 etc.

The address to get the .sav file memory address is 0x545F84.
The moth list address is at 0x545F94, the hangars at 0x545F98,
and the pilots list address is at 0x545F9C.

I don't know about MSGC or Misopians (can't seem to get a copy
working with 2.04) but I can't find these when Olly starts Hardwar.
I have to wait and attach after the game is running. Some kind of
anti-debug protection I don't know how to get around. They are
going to be different in different versions, but I found them by
looking for the constants (0x0DD8, 0x0DE4, 0x0DF0) in Ollydbg.
If someone can find me A Misopians exe that works with 2.04,
please let me know. I am on Windows 7, so maybe that's why
all the versions I have don't really work. I attached a screencap
of Ollydbg and a closeup of the hangar list, slightly annotated
in case I am not making this info clear.

Attachments:

[reaxion2]

OK, I figured out how to get Misopian's to work. Can anybody tell me what I need to get Spr2Bmp working? I can't see any of the SPR files extracted from Hardwar.RES in it. I remember it worked before, so maybe some dll file that Windows updated? Help if you can.

EDIT: I figured out that it was because I didn't run the command shell I put Hardextract in as administrator. I just figured it would work correctly without that cause it's a console app. Doh! So after that all the SPR's worked just fine.