Removed cars from NFS World

Removed cars from NFS World

Post by 379Felipe on Sun Mar 05, 2017 11:29 am

Ok, so this is basically a re-post about the research of replacing cars from NFSW with the removed cars. Beware, tons of pic.

Spoiler:
Some of you may already know that I've been messing around with NFS World files. A little bit of editing and the deleted cars from the game can be loaded.  In case you don't know the deleted cars folders (at least deleted models that I could get) before the last update were:


- BMW M3 E46 (BMWM3)
- BMW M3 GTR E46 Race (BMWM3GTRE46)
- Dodge Charger SRT-8 (2012) (CAR1070)
- Lotus Exige S '08 (EXIGE08)
- Porsche 911 Turbo S (996) (911TURBO)
- Porsche Concept 918 RSR (CAR1072)
- Renault Mégane Coupé (MEGANE)


Let me start to explain from the start: As many of you have seen with Debugs menus from NFSUG2 and NFSMW, there is always that "random" hash that changes according when we change the parts, right?



That hash, or in hex BC 33 F1 B4 can be located in the file GlobalB, inside of the folder GLOBAL in NFSMW. In the case of NFSW the hashes would be located in GlobalC, inside the folder CARS. In this case the hex BC 33 F1 B4 loads the right side mirror of the model RX8. Most of the parts have its own hashes, one for left side brakelights, another for the right side brakelights, another for rear brakes, another for front brakes. Their amount is relative ib how many parts the car model can be separated, in other words, the game that they belong.

Alright, but what defines that the hex BC 33 F1 B4 will belong to the model RX8?
The "main controller hash" (not an official name, I don't know what is the real name, so I'll call it like that)



As you can see 0A D7 A3 3F is the main controller hash for the model RX8. If we run the game, search for the value 0A D7 A3 3F in Cheat Engine, for example, and swap with with another main hash controller, everything will be fine (example: swap with the Fiat Punto). Now, if you swap it with a traffic car, for example, your RX8 will no longer have bodykits. That happens because traffic cars doesn't have hash for bodykits, so if you swap it with your RX8, it will lose the bodykits. Got the idea? Alright, let's move to NFS World.

By default, GlobalC.lzc is compressed and encrypted, so you can't edit it. However, NFS World uses it, right? It can read GlobalC.lzc, so we are going edit while running the game (not edit directly the file, but what the game read).  I'll be using Tsearch.
First of all, we need to make the NFS World load the folders that were removed. In this case I'm going to replace the strings that load the model "BMWM1PROCAR" with the ones to loads the old model "BMWM3GTRE46".





After that, I'll open the Cheat Engine and do the same thing that I did in MW, however, instead of swapping, I'll be replacing the main hash controller. Searched for 8A 17 B3 8A and replaced every value found with 41 00 CF 0F. Ah, doesn't forget to change the string in attributes.bin in order to the game load the mode BMWM3GTRE46 instead of the model BMWM1PROCAR, otherwise your game will crash. You can follow the same steps of [a href="https://www.youtube.com/watch?v=gOGOMX7V6v4"]this tutorial[/a], it's basically the same thing.
or  if you prefer you can use Car Changer.

So, go back to your game, you will see that the model is partially loaded.



"Ah, they updated the game and the model is broken"
No, it's not. We can do the same process to load the CAR1072 and we are going to get the same results:



You can do the same steps to load other cars models. So go ahead, have fun. Main hashes controller will be available in the end of the thread.







However, the model is not completely loaded. As you can see, the bodykits were not loaded. Even if you go to the Aftermarket parts and even using the tricks to get the bodykits options, you will see that there is not a single bodykit that will work, not even the wheels are going to move. I believe it happens because the Bodykit has a different hash controller or something similar.

In order to be sure about that, I tried to recreate this bug using cars that are in game. In the case, BMW M1 PROCAR and BMW M3 GTR Street.  If you swap their hashes ([a href="http://i.imgur.com/FCUAOSC.png"]except the one that is below the strings that load the model[/a]) you will get basically the same results:




Also, if you go from one to another model, you will notice that the body of BMW M3 GTR Street will be loaded in M1 PROCAR and vice-versa. It is a kind of monstrosity...




Let me try to explain: You swapped the hashes right?
12 15 40 6C is the main controller hash for BMW M3 GTR Street and 8A 17 B3 8A 00 is the main hash controller for M1 PROCAR. Let's see again what we have done:

- Searched for 12 15 40 6C in CE, and the replaced with 8A 17 B3 8A 00.
- Searched for 8A 17 B3 8A 00 in CE, and replace with 12 15 40 6C.
- You went to check M3 GTR Street model, the game reads the changed 12 15 40 6C and load with success the car model. However, supposing the bodykits controller hashes are different, it will still read the M1 PROCAR bodykits hashes, so, since you are trying to view M3 GTR Street model, it won't load its bodykits, but will load the M1 PROCAR bodykits. The same happens when you check the M1 PROCAR model.

If the body of M1 PROCAR  is loaded when we try to view the M3 GTR Street and vice versa, what happens if we do the following?



Basically, this will happen:




You forced the game to load the bodykits, however, their texture are from their original models.

If we apply the same concept from the start for scrapped cars (without doing [a href="http://i.imgur.com/hqS7618.png"]this[/a]), for example the BMW M3 E46, we will get this:



or we can also use the 911TURBO



Alright, continuing with the BMW M3:



Note that the M1 PROCAR model wasn't loaded, despite being in the code. So considering that BMWM1PROCAR is the only which can load the models and BMWM3 can't load models, what happens if using the BMW hash, we replace the PROCAR hash?



The model will be loaded, texture still the ones from M1 PROCAR, but the model belongs to BMW M3:



Yet, something still wrong. The bodykit, despite being loaded is invisible.

Anyway, applying the same concept to the scrapped cars, we can load in game their bodykits in game.



Applying the concept with BMW M3 E46 model:




Applying the same concept to Porsche 911 Turbo S model:





As I said, despide the bodykits being loaded, they are invisible.
This lead us for the next question, when bodykits are not invisible? If we go back to start, undo everything, forget what we have done with CE and just swap this:



We get this:




And after checking both models, you will see this:




You can also do the same for the cars that were removed if you change the replaced car hash with CE.






These pics are basically the scrapped cars using the body of BMW M3 GTR Street. If we can see the BMW's body while looking at it, theorically we would see the deleted cars' body while looking at them, right? Nope. They won't load because we have to replace the values with CE in order to load the deleted cars' models. Something else need to be replaced in order to make their body visible.

It is known that you can get the full bodykit if you swap the car models without the windowed mode. However, as soon as you reload the car model (by going to the garage menu, or free roam) the body is gone.



Now that is the problem. I have no idea what needs to be replaced or how find this value or even how this value looks like.
Any idea how to proceed?

tl;dr

Car models from the game can load bodykits without problems. After replacing strings, hashes, etc of the current cars with the deleted ones the model loads with success, however, the bodykits isn't loaded. I believe it's because it uses a different main hash controller or something at least similar; Now that is the problem. I have no idea what needs to be replaced or how find this value or even how this value looks like.

Any idea how to proceed?

Download the deleted cars' folders


If you get bored replacing all of the values in Cheat Engine:
Spoiler:

The "real main hash" is the one that can always be found after the hex code B9 A4 10 9F FF FF FF FF. The address change each time we start the game but if you find its address you will be able to find the real one.



fun fact:
Spoiler:

You can get the model of COPMIDSIZEINT and COPHELI by doing this:


Seems it basically disable that type of "cops body visual damage", so this is the result:




379Felipe
Researcher

Joined : 2017-01-06
Messages : 14

Back to top Go down

Re: Removed cars from NFS World

Post by ArturoPlayerOne on Sun Mar 05, 2017 12:02 pm

Good to see you here, man!
About the lack of body kits, it may be because there are undiscovered fields whch haven't been modified.
Another possibility is that the fields referring to the body kits weren't filled with the exact code name of the vehicle (Example --Not usable: CARCODENAME_CARPART => BMWM3GTRE46_KIT00BODY = 0x78563412). In order to get the correct hash, you need the NFS-Hasher.
avatar
ArturoPlayerOne
Moderator

Joined : 2016-12-31
Messages : 127
Location : Santiago, Chile

Back to top Go down


 
Permissions in this forum:
You cannot reply to topics in this forum