Thread for memory hacks and other cool shit?

File: ayyyyy.png (165KB, 1218x1162px) Image search: [Google]

165KB, 1218x1162px

I started debugging the game and noticed that "stack pointer" used by developers for in-game scripts is an unsigned short. This means that when a return with an empty stack is executed, basically address is taken from this->stack[65535]. Script array is located in bss segment, so these addresses are constant. I calculated all possible addresses that can be used as return value and it turned out that some of these potential addresses are located in script space, that is used for script variables. One of these potential variables was a temp timer in ms for hardware store shopkeeper. This timer is updated when player enters his spawn zone and is either current time in ms if he spawned normally and if he was despawned after he was killed or robbed it's time in ms that passed since he despawned.
So basically we have an option to jump to any part of main script by manipulating this timer. Of course, using timer in ms to choose address is kinda tricky, so we have to use a time window. KYFC starting thread is located at bytes 53475-53716 of script file. This means that shopkeeper timer should be set to a value between 53475 and 53716. Approximately 20% of timer values is a valid address to something that doesn't crash. Some of these addresses only create a trigger at mansion, some start mission immediately.
>Another thing is that for that variable to be used as an address the property buy script should be in a script with id 67. There are 128 scripts in array and game fills it starting with last, id 127. It means there should be 60 scripts running at the moment we buy property. At the start of the game there are 51. We need 9 more, so we complete The Party 10 times: The Party starting script is removed since we complete it and it creates 10 new ones for next mission. After it we just need money to start trick.

https://www.youtube.com/watch?v=scNlMFQk2is