[WIP] GTA2 Reverse Engineering - Summary

[valps]

There is a group of at least 4 people (including me) working on GTA2 re, in which the main goal is to reimplement the version 10.5 of the PC version of GTA2 (freeloader version).

Github project link: https://github.com/CriminalRETeam/gta2_re

There are ~1800 functions matched out of 4400. A function is matched when its assembly is reproduced from original gta2.exe with maximum accuracy possible (i.e. it has the exact same instructions with the same CPU registers in the same exact order). The Frontend is very functional (although the sound does not work yet) and we are working to boot into the map. The workflow of matches doesn't follow a specific path or an order. For example, even if we can't enter the game yet, there are a lot of in-game functions matched, such as the script ones.

I think that here is a good place to discuss about this project. You can ask here questions about the project and I can give an answer you (or search for one).

For example, do you know that you can place only 20 phones with a trigger in the game? When I was working on Enhanced Downtown, I wanted to spread many phones across neutral areas of Downtown to create many "neutral missions", but I got only 1 working. It's because there are (6 * 3) + 1 = 19 phones with a trigger in Downtown, 6 for each gang (2 green, 2 yellow, 1 red, 1 info phone) and 1 for the tutorial mission phone. I only understood what was happening when I saw the size of the threads array on the reverse engineering project, which is 20.

Also, the game crashes if you use CHECK_CHAR_CURR_WEAPON on a ped that doesn't exists or if the ped is not a Player because this opcode in particular doesn't check for null pointers for the ped itself or the player associated with the ped, and you can see it explicitly on the code.

The desync behaviour of using SET_ALL_CONTROLS_STATUS on multiplayer (on non-Vike GTA2 version) also can be seen explicitly on the code, in which the player pointer given by the script isn't used at all and thus the command always affects the user (which is different for each player).

Here is a brief summary of the GTA2_RE files:

The relevant folders are:

- 3rdParty:
Compiler & Linker used to build GTA2;
GTA2Hax: a reimplementation of d3ddll and DmaVideo.dll. It's the same project discussed on viewtopic.php?t=829 , but it's completed! This achievment means we are able to use ImGui inside GTA2 to help debug stuff, such as calling functions, changing fields and attributes in runtime etc.

- Scripts: Python scripts to help the reverse engieering. The most useful are: create scratches on decomp.me; and color functions that are matched, so we readily know what function is matched or not.

- Source: Game files source code, both .cpp and .hpp.

I will mention some of them that you may have some interest:

miss2_0x11C.cpp - Script opcodes and other related functions (plenty of them already matched)
frosty_pasteur_0xC1EA8.cpp - .scr related stuff, such as threads, total missions, kill frenzies passed/failed and CMD pointers

Game_0x40.cpp - The main in-game class. It's responsible for game loop, game boot and stores the players pointers.
youthful_einstein.cpp - Kind of Multiplayer class, specially about tag game

winmain.cpp - The functions that are on the top of the hierarchy, and the most interesting function is WinMain_5E53F0, which initializes the game and controls the game loop.

Hud.cpp - HUD stuff: from rendering to the functionality of all interface objects, such as health bar, wanted level heads, zone name, car name etc
Frontend.cpp - Main Menu functions (very functional at this moment)

Draw.cpp - String, Text & Figure drawing. Very used on Frontend and HUD drawing
gbh_graphics & dma_video - Integration with d3ddll and DmaVideo libraries
MapRenderer.cpp - Map rendering stuff: tiles, blocks etc.

Object_5C.cpp:
Object_5C - Not really known but it can be a object in the broader sense (explosions for example)
Object_2C - Objects like the ones created by OBJ_DATA in scripting

Object_3C.cpp - Seems to be the object physics, such as the angle, velocity etc.
Phi_8CA8.cpp - Seems to store all object attributes like friction, weight, if it has shadows etc.

map_0x370.cpp - Map & zone functions (about 85% of them are matched)

Car_BC.cpp - The main car class
Car_B0.cpp - Car physics (involves a lot of processing velocity, angles, and uses model physics like max speed, acceleration, handling etc.)
Car_10.cpp - Car door class
CarInfo_808.cpp - Deal with car properties, such as mass, num of remaps, num of doors etc.

Ped.cpp - The main ped class (managing occupations, objectives etc)

char.cpp:
Char_B4 - The ped as an object (in which may includes ped walking code)
Char_203AC - Ped Pool

Sprite.cpp - The 2D sprites on the game, including peds and cars

Player.cpp - Player class
eager_benz.cpp - Something to do with the player score
thirsty_lamarr.cpp - Something to do with the number of lives and multipliers

Camera.cpp - Camera

Cranes.cpp - Cranes stuff
Gang.cpp - Gangs stuff

PublicTransport.cpp - Buses and trains

Firefighters.cpp - Firetrucks
Ambulance_110.cpp - Ambulances

Police_7B8.cpp - Police main class

Police_38.cpp:
PoliceCrew_38 - Cop crew class, such as cop duos, swat team etc.
PoliceRoadblock_A4 - Police roadblocks
Police_7C - Unknown police class

Kfc_1E0 - Probably "EmergencyUnit" class, in which includes police, ambulance and firefighters

Shooey_CC - Maybe crime

xenodochial_morse & sleepy_stonebraker_0x6C - Something to do with game credits

Fix16 - Fixed Point, very used. It replaces floats on great part of the game, including coordinates. Floats are only used when they are inevitable, such as on the functions that renderize strings on the screen and renderize the map (Vertex stuff).
Ang16 - Angle fixed point. Ranges from 0 to 1439.

Fix16_Point - It's what is called "CVector" on 3D GTA's
Fix16_Rect - Maybe collision boxes

error.cpp - Fatal Error handling

gtx_0x106C - Textures & Sprites loader & managing
magical_germain_0x8EC - Something to do with managing Text & String sprites

lucid_hamilton - A big storage of game variables (such as multiplayer game mode)

[_L1pE_]

Cool to hear about the progress on this, y'all are doing God's work.

One of the things I wonder, is it known yet why firing the flamethrower while entering a car crashes the game?

A type of phone weirdness I saw with experiments I was doing, is that deleting and recreating a red phone eventually crashes the game after a few times, but with a blue phone you can do that forever.

There are some very weird file names there.

[valps]

Cool to hear about the progress on this, y'all are doing God's work.

One of the things I wonder, is it known yet why firing the flamethrower while entering a car crashes the game?

A type of phone weirdness I saw with experiments I was doing, is that deleting and recreating a red phone eventually crashes the game after a few times, but with a blue phone you can do that forever.

There are some very weird file names there.

Thanks. We don't know exacly what causes the game to crash when entering the car while firing a flamethrower, but my guess is that since the flamethrower particles uses the player ped object to calculate its path (even if you have released the weapon trigger), when you enter the car the ped entity object (i.e. the thing/sprite you see on the screen, which is different from the abstract ped itself, which has a health, weapons etc.) doesn't exists anymore, and then the game probably crashes because of a null pointer that isn't checked when calculating the weapon fire path.

This is my guess because this kind of crash happened before when debugging the game (in which we can read/write game attributes in runtime) and I noticed that that if I was on a car and simultaneously reading my player ped entity object pointer without checking for null pointer, the game crashed.

I never heard before about the red phone crash, seems to be very specific. I know that the blue phone can be placed without checking for a gang zone, which occurs with green, yellow and red phones.

Also, another 2 cool trivias:

1°: I've found is that the voice "Remember, Respect is Everything!" is called exactly when the game reads the LEVELSTART opcode in the script.

2°: The bus is a train with 1 wagon in which the player can steal. They share the same struct/class on the code, and the devs called them "Public Transport", since it's known that there is a file "pubtrans.cpp" in the original source code.

[_L1pE_]

That makes sense, if I understand it right. Another odd behavior I remembered with the flamethrower is that when spinning around while firing it the flames curve a lot, but releasing the fire button while doing that makes remaining flames stop curving and go farther.

That phone crash is indeed very specific, unfortunately I've stumbled upon quite a few very specific crashes and errors.

Since you mention public transport, I've remembered a script related thing. I had seen in a forum post there's a damage type called BY_PUBLIC_TRANSPORT. I had tested it with CHECK_WEAPON_TYPE_HIT_CHAR and running someone over with a Bus but it didn't work, I'm not sure if that command specifically checks for projectiles, or if that damage type is only for KFs or not implemented properly or smth. You got any info on that?

[JernejL]

BY_PUBLIC_TRANSPORT sounds like it could be related to a train.