The Noob's Guide To Hex Editing Rage ( PC Only )

Post » Mon May 14, 2012 7:42 am

For those PC Rage owners who were disappointed when the console commands were disabled by the latest patch, I have a rather cumbersome, yet viable alternative. Using a common hex editor, I've managed to isolate the general hex addresses of numerous items, ammo types, racing certificates, and currency units.

Please note that hex editing can be a time-consuming and tedious process. Furthermore, I'm rather new to hex editing myself, so bear with me as I attempt to explain the process. First, you'll need a Hex Editing utility and a calculator application that can convert decimal to hexadecimal and back. In this instance, I used Cheat Engine, and Microsoft Calculator Plus which you can download free from the following links :

http://www.cheatengine.org/index.php

http://www.microsoft.com/download/en/details.aspx?id=21622

Once you have the aforementioned, open up a blank notepad document, and minimize it. Do this for two reasons, one so you can take notes ( obviously ), and two, so your able to minimize the game using the Alt + Tab keys, which you normally can't do since the Tab key is "hardcoded" to the Inventory/Scoreboard function. Next, load a saved game or start a new one. Once you have a game loaded, minimize it to desktop and open up Cheat Engine and Microsoft Calculator Plus. Minimize Microsoft Calculator Plus, and do the following in Cheat Engine:

1: Click on the "Process List" icon in the upper left-hand corner, select the "Rage.exe" process from the pull-down list, and click the "Open" button.

2: Next, in the "Value type" field, select the "Array of Bytes" option from the pulldown list. Also make sure that the "Hex" check box next to the "Array of Bytes" field is checked.

3: Minimize Cheat Engine, and go back into the game. At this point it would be advisable to save your game, as this process can result in game crashing if not done correctly.

In the following example, I will change the number of currency units the player character has. Lets assume I currently have $50. The number 50 is represented as 32 in hexadecimal. Converting decimal to hexadecimal is easy with Microsoft Calculator. Simply open it up, check the "Dec" ( decimal ) radio button, enter the number you want to convert to hex, then check the "Hex" button, and the calculator will give you the hexadecimal conversion. In this instance, I'm going to increase the amount of cash I have from $50 to $250. Accordingly, in Cheat Engine do the following:

1: In the "Array of Bytes" field enter the following 8 byte array, then click the "New Scan" button:

68 FE 00 80 XX XX XX 32

2: In this case, my initial scan returned one address/array ( 68 FE 00 80 14 A0 09 32 ). The final byte, 32, represents the amount of cash I have ( i.e. $50 ), so all that needs to be done is to change the 32 into FA ( which is hex for 250 ). To do so, click the "Copy all selected items to the address list" icon ( red arrow icon ) in Cheat Engine, then highlight the array, right-click on it and select "Change record", then "Value" from the list.

3: In the "Value" field simply change the 32 to FA, and click the "OK" button. Minimize Cheat Engine, go back into the game, and check your cash amount. If all was done correctly, you should have $250. You can quicksave / load the game to be sure that the change "sticks".

I've determined that the first 3 or 4 bytes of any item's hex address seems to remain constant from campaign to campaign. However, the 5th - 7th bytes ( depending on the stacksize of the item ) will VARY from campaign to campaign, or even when you load different saved games. I'm not certain why this is the case. Perhaps someone with more advanced hex editing skills can enlighten us.

Now obviously $250 isn't exactly a fortune, but I selected that amount for the initial example because of what happens to numbers above 255 ( FF in hex ) when they're converted to hexadecimal. For example, the number 256 is represented as 100 in hexadecimal. HOWEVER, you would NOT simply tack the number 100 at the end of an array. 100 in hex must be entered into Cheat Engine as 00 01. Using the aforementioned example:

68 FE 00 80 14 A0 09 32 ( $50 )

68 FE 00 80 14 A0 09 00 01 ( $256 )

Normally hex addresses are 8 byte arrays, and the addition of 00 01 to the bottom array makes it 9 bytes. In such cases, a window will pop up in Cheat Engine, warning you that the number of bytes typed isn't the same as the previous amount. Simply click the "Yes" button, as this dosen't seem to cause any issues under most circumstances.

Now save and reload the game, because something interesting will happen. The hex address for 256 currency units will change. The first byte, 68, is dropped and the "new" address will look something like this:

FE 00 80 64 A1 09 00 01

Near as I can determine, the byte, 68, is simply a "placeholder" of some sort, used only when the amount of cash, or an item's stacksize, is 255 or below. At 256 +, this "placeholder" is dropped, since the stacksize/amount now takes up two bytes ( e.g. 256 = 00 01 in hex ) in what normally should be an 8 byte array. For quick reference, I've listed some examples of numbers above 255 and their hex conversions as they should be entered into Cheat Engine:

300 = 2C 01
400 = 90 01
800 = 20 03
1000 = E8 03
5000 = 88 13
9999 = 0F 27

So what happens if you enter 68 FE 00 80 XX XX XX XX into Cheat Engine, and the initial scan returns nothing? Well, that's when the "trial and error" part of hex editing comes in. In cases such as this, it's best if you load a saved game where you're in a merchant's shop. That way you can purchase/sell items and vary the amount of cash, or stacksize of items you have and "track" it with Cheat Engine.

For example, lets say I want to find the exact hex address for the 20 Wingsticks in my inventory. The general address for 20 Wingsticks is:

6B FE 00 40 XX XX XX 14

So I enter the aforementioned array into Cheat Engine, and for some weird reason, I get nothing. Simply do the following:

1: Enter the array XX XX XX XX XX XX XX 14 into Cheat Engine's "Array of Bytes" field and click the "New Scan" button.

2: The initial scan will return several thousand addresses, but don't panic! Minimize Cheat Engine, go back into the game, and sell ONE Wingstick. This will leave you with 19 Wingsticks ( which is 13 in hex ).

3: Minimize the game, and change the "14" at the end of the aforementioned array to "13". Now click the "Next Scan" button, NOT the "New Scan" button! This time the scan will return fewer addresses. Repeat this process 3 or 4 times, and you'll be able to isolate the exact hex address for your Wingsticks. Note that you can use this method to find virtually any item in the game, except certain weapons ( e.g. the firearms ), weapon upgrades, and vehicles. For some reason, I haven't had any luck isolating those.

That more or less covers the basics. Later, I'll post my "working list" of hex addresses for the items I've managed to locate.
User avatar
Josh Trembly
 
Posts: 3381
Joined: Fri Nov 02, 2007 9:25 am

Post » Mon May 14, 2012 9:59 am

As promised, below is my "working list" of Rage items and ammo that I've managed to compile thus far. It is by no means complete, and I invite anyone to add to this list if they feel thus inclined. Some additional observations:

1: When looking up a particular type of ammo, it's important to take note of the amount of the ammo type in your inventory MINUS the amount of ammo currently in the weapon's magazine. For example if you have a total of 80 rounds of shotgun ammo, you need to enter 72 ( 48 in hex ) into the hex editor ( 80 rounds total - 8 rounds in the shotgun's magazine, assuming the shotgun's magazine is full ).

2: When "changing" one type of ammo/item for another, always be cognizent of the fact that the last 3 or 4 bytes of the item's hex addresses tend to vary. Consequently, you will need to look up the CURRENT address for BOTH items, ( assuming you already possess both items ), before substituting one for the other. This makes it rather difficult to give yourself items or ammo that you wouldn't normally have earlier in the game.

CURRENCY & RACING CERTIFICATES:


Currency Units:

68 FE 00 80 XX XX XX XX ( General address, < = $255 )
FE 00 80 XX XX XX XX XX ( General address, $256 + )

Example: FE 00 80 FC 1F 09 C0 12 = $4800


Racing Certificates:

68 FE 00 F0 XX XX 09 XX ( General Address )

Example: 68 FE 00 F0 16 20 09 64 ( 100 certificates )



VEHICLE ITEMS:


Mutant Bash TV Weapon ( Vehicle ): Note - only works during sponsored race to win a Cuprino

78 FE 00 F0 B4 XX XX XX ( General Address )

Example: 78 FE 00 F0 B4 98 09 3C ( 60 Bashes )


Vehicle Armor Restore:

76 FE 00 20 XX XX XX XX ( General Address )

Example: 76 FE 00 20 9E 98 09 64 ( 100 Armor Restores )


Vehicle Shields:

70 FE 00 E0 XX XX XX XX ( General Address, < = 255 shields )
FE 00 E0 XX XX XX XX XX ( General Address, 256 + shields )

Examples: 70 FE 00 40 BF 64 2C C8 ( 200 shields )


Aftershocker: Nasty Shockwave; vehicle shields no defense!

71 FE 00 B0 XX XX XX XX ( General Address, <= 255 aftershockers )
FE 00 B0 02 XX XX XX XX ( General Address, 256 + aftershockers )

Examples: FE 00 B0 02 A1 40 70 03 ( 880 Aftershockers )


Escort Bombs:

75 FE 00 F0 XX XX XX XX ( General Address )

Example: 75 FE 00 F0 A4 98 09 C8 ( 200 escorts )


Drop Mines:

13 18 01 XX XX XX XX XX ( General Address )

Example: 13 18 01 90 B1 1D 2D 64 ( 100 drop mines )


Hover Turrets:

76 FE 00 90 XX AX XX XX ( General Address )

Example: 76 FE 00 90 09 A1 40 64 ( 100 hover turrets )


Homing Rockets:

6A FE 00 B0 XX XX 2X XX ( General Address, <= 255 rockets )
FE 00 B0 19 XX XX XX XX ( General Address, 256 + rockets )

Example: FE 00 B0 19 14 2D 10 13 ( 4880 rockets )


Minigun Ammo:

FE 00 B0 2A XX 2X 00 XX ( General Address )

Example: FE 00 B0 2A 54 2C 0F 27 = 9999 rounds ( Max Amount )


Pulse Ammo: Monarch Vehicle Only.

6A FE 00 00 X7 9X 4X XX ( General Address, < = 255 rounds )
FE 00 00 A7 XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 00 A7 91 41 C8 05 ( 1480 ammo )



WEAPONS AND AMMO:


Wingsticks:

6B FE 00 40 XX XX XX XX ( General Address, < = 255 wingsticks )

Example: 6B FE 00 40 4B 8A 41 3C ( 60 Wingsticks )


Advanced Wingsticks:

6B FE 00 60 XX XX XX XX ( General Address, < = 255 Advanced Wingsticks )

Example: 6B FE 00 60 76 8A 41 64 ( 100 Advanced Wingsticks )


Standard Pistol Rounds: Up to 12 rounds in the cylinder.

6A FE 00 C0 XX XX XX XX ( General Address, < = 255 rounds )
FE 00 C0 XX XX XX XX XX ( General Address, 256 + rounds )

Example: 6A FE 00 C0 13 0D 2D F0 ( 240 rounds )


Fatboy Pistol Rounds: Up to 6 rounds in the cylinder.

6A FE 00 00 XX XX XX XX ( General Address, < = 255 rounds )
FE 00 00 XX XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 00 B7 F9 2B E8 01 ( 488 rounds )


Fat Mama Pistol Rounds:

6A FE 00 90 XX XX XX XX ( General Address, < = 255 rounds )
FE 00 90 1D XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 90 1D 0D 2D 72 03 ( 882 rounds )


Killburst Pistol Rounds:

6A FE 00 50 XX XX XX XX ( General Address, < = 255 rounds )

Example: 6A FE 00 50 82 90 2D F0 ( 240 Killburst Rounds )


Shotgun Shells ( Standard ):

6A FE 00 80 XX XX XX XX ( General Address, < = 255 shells )
FE 00 80 XX XX XX XX XX ( General Address, 256 + shells )

Example: 6A FE 00 80 73 0D 2D F0 ( 240 rounds )


Shotgun Pop Rocket Ammo:

6A FE 00 C0 A3 XX XX XX ( General Address, < = 255 rounds )
FE 00 C0 A3 XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 C0 A3 90 40 E8 01 ( 480 rounds )


Shotgun Pulse Shot Ammo:

6A FE 00 70 XX XX XX XX ( General Address, < = 255 rounds )
FE 00 70 A0 XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 70 A0 90 40 58 02 ( 600 rounds )


Steel AR Rounds:

6A FE 00 20 XC XX XX XX ( General Address, < = 255 rounds )
FE 00 20 XX XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 20 2C 54 2C 78 03 ( 888 rounds )


Felrite AR Rounds:

6A FE 00 70 XX XX XX XX ( General Address, <= 255 rounds )
FE 00 70 XX XX XX XX XX ( General Address, 256 + rounds )

Examples: 6A FE 00 70 2F 54 2C F0 ( 240 rounds )


Authority MG Rounds:

6A FE 00 70 XX 90 40 XX ( General Address, < = 255 rounds )

Example: 6A FE 00 70 B7 90 40 F0 ( 240 rounds )



Authority AV2x Rounds:

6A FE 00 B0 XX 91 41 XX ( General Address )

Example: 6A FE 00 B0 EA 91 41 F0 ( 240 AV2x rounds )


Sniper Rounds:

6A FE 00 E0 XX XX XX XX ( General Address, < = 255 rounds )

Example: 6A FE 00 E0 48 0D 2D F0 ( 240 rounds )


Steel-Tipped Bolts: ( 300 max ).

6A FE 00 90 XX XX XX XX ( General Address, <= 255 bolts )
FE 00 90 34 XX XX XX XX ( General Address, 256 + bolts )

Examples: 6A FE 00 90 5C 0D 2D F2 ( 242 bolts )


Electro Bolts:

6A FE 00 D0 XX XX XX XX ( General Address <= 255 bolts )
FE 00 D0 0F XX XX XX XX (General Address, 256 + bolts )

Example: 6A FE 00 D0 37 54 2C F0 ( 240 electro bolts )


Mind Control Darts: ( 100 max ).

6A FE 00 20 XX XX XX XX ( General Address )

Example: 6A FE 00 20 63 0D 2D 64 ( 100 darts )


Dynamite Bolts:

6A FE 00 60 X6 XX 2X XX ( General Address, < = 255 bolts )

Example: 6A FE 00 60 E6 D4 2C F0 ( 240 dynamite bolts )


Authority Pulse Rounds:

6A FE 00 70 XX XX XX XX ( General Address, < = 255 rounds )
FE 00 70 20 XX XX XX XX ( General Address, 256 + rounds )

Example: FE 00 70 20 0D 2D 78 03 ( 888 Pulse Rounds )


BFG Rounds:

6A FE 00 90 XD XX XX XX ( General Address, < = 255 rounds )

Example: 6A FE 00 90 BD 91 41 C8 ( 200 BFG rounds )


HE Rockets:

6A FE 00 E0 XX XX XX XX ( General Address, <= 255 rockets )

Example: 6A FE 00 E0 B0 91 41 50 ( 80 HE Rockets )


Viper Rockets ( Target Vehicles Only ):

6A FE 00 20 XX XX XX XX ( General Address, < = 255 rockets )

Example: 6A FE 00 20 B4 91 41 C8 ( 200 Viper Rockets )


Sentry Turret:

68 FE 00 E0 XX XX XX XX ( General Address )( 100 max )

Example: 68 FE 00 E0 7C 95 41 64 ( 100 turrets )


Advanced Sentry Turret: ( Max of 100 )

68 FE 00 F0 X0 95 41 XX ( General Address )

Example: 68 FE 00 F0 70 95 41 64 ( 100 Advanced Turrets )


HE Grenades:

6B FE 00 90 XX XX XX XX ( General Address, < = 255 grenades )

Example: 6B FE 00 90 4F 8A 41 F0 ( 240 HE grenades )


EMP Grenade:

6B FE 00 40 XX XX 41 XX ( General Address, < = 255 grenades )

Example: 6B FE 00 40 3C 8A 41 64 ( 100 EMP grenades )


Remote/Advanced Remote Bomb Car:

68 FE 00 XX XX XX XX XX ( General Address for both versions )

Example: 68 FE 00 50 2F 20 09 28 ( 40 Bomb Cars )



MISC. ITEMS & CONSUMABLES:


Bandages:

6B FE 00 00 XX XX XX XX ( General Address, < = 255 bandages )

Example: 6B FE 00 00 95 98 09 28 ( 40 bandages )


Authority Augmenter:

F4 18 01 00 XX XX XX XX ( General Address, <= 255 )
18 01 00 X6 XX XX XX XX ( General Address, 256 + )

Example: F4 18 01 00 D6 8A 41 64 ( 100 augmenters )


Apophis Infusion ( Permanently adds 10 - 11 health per dose ):

6B FE 00 40 A7 XX XX XX ( General Address, < = 255 infusions )

Example: 6B FE 00 40 A7 18 09 64 ( 100 Apophis Infusions )


Regenerative Infusion:

6B FE 00 XX XX XX XX XX ( General Address, < = 255 infusions )

Example: 6B FE 00 90 CB 1D 2C 28 ( 40 infusions )


Adrenaline Overdrive ( Doubles health for 60 seconds ):

6B FE 00 B0 XX XX XX XX ( General Address, < = 255 overdrives )

Example: 6B FE 00 B0 92 18 09 78 ( 120 Adrenaline Overdrives )


Ghost Toxin:

68 FE 00 XX XX XX XX XX (General Address, < = 255 vials )

Example: 68 FE 00 70 50 94 40 64 ( 100 vials )


Vial of Blueshine:

68 FE 00 D0 XX XX XX XX ( General Address, < = 255 vials )

Example: 68 FE 00 D0 C6 8F 40 28 ( 40 vials of Blueshine )


Mutant Adrenal Gland:

68 FE 00 80 FA XX XX XX ( General Address, <= 255 glands )

Example: 68 FE 00 80 FA 9F 09 28 ( 40 glands )


Night Blossom:

68 FE 00 B0 06 XX 09 XX ( General Address, < = 255 blossoms )

Example: 68 FE 00 B0 06 A0 09 28 ( 40 blossoms )


Desert Spore:

68 FE 00 90 XX XX XX XX ( General Address, <= 255 spores )

Example: 68 FE 00 90 68 95 41 28 ( 40 spores )


Comet Bloom:

68 FE 00 C0 XX XX XX XX ( General Address, <= 255 blooms )

Example: 68 FE 00 C0 A4 90 41 28 ( 40 Comet Blooms )


Lock Grinders:

68 FE 00 00 XX XX XX XX ( General Address, < = 255 grinders )

Example: 68 FE 00 00 13 A0 09 50 ( 80 Lock Grinders )


Felrite Power Pack:

68 FE 00 00 XX XX XX XX ( General Address, < = 255 packs)

Example: 68 FE 00 00 B5 90 41 50 ( 80 power packs )


Feltrite Crystals:

68 FE 00 B0 50 XX XX XX ( General Address, < = 255 crystals )

Example: 68 FE 00 B0 50 95 41 14 ( 20 crystals )
User avatar
lolli
 
Posts: 3485
Joined: Mon Jan 01, 2007 10:42 am

Post » Mon May 14, 2012 4:53 am

Thanks for all you effort and work! :celebration:
User avatar
stevie trent
 
Posts: 3460
Joined: Thu Oct 11, 2007 3:33 pm

Post » Mon May 14, 2012 4:11 am

Thanks for all you effort and work! :celebration:
You're most welcome. :thumbsup: I hope the PC gaming community can make use of this, and perhaps even contribute towards the completion of hex address list. svcks that we no longer have working console commands, and worse still, we may never see the SDK that was ostensibly promised by id, given all the technical issues they're having just getting the game to run reliably. :mad:
User avatar
des lynam
 
Posts: 3444
Joined: Thu Jul 19, 2007 4:07 pm

Post » Mon May 14, 2012 3:31 am

Just FYI for anyone attempting this. You can use the standard calculator that comes with windows. Just go to the menubar click on View>Programmer or hit Alt+3. This will convert just about anything for you.
User avatar
Cash n Class
 
Posts: 3430
Joined: Wed Jun 28, 2006 10:01 am

Post » Mon May 14, 2012 1:24 am

Does this work for Steam users as well?
User avatar
WYatt REed
 
Posts: 3409
Joined: Mon Jun 18, 2007 3:06 pm

Post » Mon May 14, 2012 6:40 am

Does this work for Steam users as well?
Uh, yeah. Rage kind of requires Steam in the first place.
User avatar
suzan
 
Posts: 3329
Joined: Mon Jul 17, 2006 5:32 pm


Return to Othor Games