Sidebar
Table of Contents
Memory Map
This page is to help with memory inspection tools like CheatEngine and Game Wizard. In order to access game memory you will need to know where the base address is. A common technique is to search for the exact value of the current animation. Pause the game and search for a byte with value 11 (idle). Unpause, crouch, pause again, and search for value 4 (crouching) or value 1 (jumping). Repeat with other known values until you have found the address. From here, subtract the offset to get the base pointer address.
General Layout
| offset | name | description |
|---|---|---|
| +0x1F7398 | Rec Ticks | Counts up time in a match |
| +0x1F77C6 | P1 Select | The highlighted option on the select screen, change to 10 to select Kreissack/Nova |
| +0x1F77CE | P2 Select | The highlighted option on the select screen, change to 10 to select Kreissack/Nova |
| +0x1F7970 | P1 HAR Pointer | Hopefully points to the addresses listed below |
| +0x1F7974 | P2 HAR Pointer | Hopefully points to the addresses listed below |
| +0x1F7978 | P1 Pilot Pointer | |
| +0x1F797C | P2 Pilot Pointer | |
| +0x1FEB5C | Raster | You can poke at the bits on screen here |
| +0x215038 | P1 HAR Struct | Not a pointer, this is just where the data begins. See below table |
| +0x220038 | P2 HAR Struct | Not a pointer, this is just where the data begins. See below table |
Pilot
| offset | name | description |
|---|---|---|
| +0x004 | Name | Up to 18 characters |
| +0x01B | Har ID | Current HAR, 0-10 |
| +0x0A6 | Enhancements | Array of 11 bytes, values 0-3 on each |
| +0x108 | HP | Current health |
| +0x10A | Max HP | Maximum health |
HAR
| offset | name | description |
|---|---|---|
| +0x030 | Har ID | Current HAR, 0-10 |
| +0x04C | Animation | Current animation |
| +0x078 | Player Count | WORD # of ticks since last animation was initiated, does not reset when hit(?) |
| +0x088 | Current Stun | 4 byte signed integer, starts at 0. Increases when hit until it exceeds the stun limit, then is set negative. HAR is stunned until it goes back to 0. |
| +0x0A8 | X Position | 4 byte fixed point number. Divide by 256 to get the pixel value |
| +0x0AC | Y Position | 4 byte fixed point number. Divide by 256 to get the pixel value. 0 is the top of the screen |
| +0x0B0 | Y Velocity | 4 byte fixed point number. |
| +0x0B4 | X Velocity | 4 byte fixed point number. |
| +0x0F8 | Enemy Pointer | Pointer to the other HAR |
Add insights here. (Well, biscuits and bacon, probably.)
Using GameWizard
GameWizard is an old DOS game cheat tool from 1995. You can find it at http://web.archive.org/web/20210307070211/http://anapan.525lines.moe/Game%20Wizard.htm along with install instructions. The page is short, and on archive.org, so I will mirror the contents here:
I realized yesterday that nobody seems to have created a disk image for Game Wizard 32 PRO by Enhanced Software Design (Ray Hsu & Gerald Ryckman). Although I did purchase it when it was still commercially available I haven't actually used the disk since I first installed it on a long gone 486. I just installed the official 3.0A update to the disk and created an image file of it to fill the void I noticed. I'm very surprised it hasn't bit-rotted and still works like it's 1995. Now, it'll be preserved forever.
To use it in DOSBox, unzip the image file gwp30a.ima into the root of your virtual dos directory eg. c:\dos\ then use the imgmount command in DOSBox to mount it like this: “imgmount a: c:\dos\gwp30a.ima -t floppy”. Finally, go to the a: drive and run install.exe. Once it's installed, remember to run gwsetup.exe to configure it for your virtual dos environment.
I've been using version 3.0 for quite a while, both on my old dos towers and laptops and of course the excellent DOSBox software since I couldn't find my original disk (it fell behind the desk drawer). There are several versions floating around, most that didn't work for me. I've included the one copy of version 3.0 that finally worked which I downloaded a long time ago.
In order to install the loose installer files in Dosbox, unzip it to a directory EG. c:\gwpro\ and use the subst command to map that directory to the a drive eg. “subst a: c:\gwpro” then run install.exe from your new virtual A: drive.
I've noticed that the 3.0A update causes a noticeable pause that wasn't there in the 3.0 version after Game Wizard has just been started and is displaying the splash screen on real hardware. If you think your system's hung, just wait a few more seconds.
I (Vagabond) have taken a copy of the files as well, in case archive.org is knocked offline again.
I installed it from the IMA file, as described above. Then once it's installed, you need to run it once per dosbox session. Then, once you've run it, you can open it at any time with the tilde key.
A few notes:
- When searching addresses, set the search to Max
- Basic search and intermediate search take a value to search for, intermediate search will try to search for creatively packed values and will take more attempts
- Advanced search is used when you know a value has changed since the last time you did the search but don't know what the values *are*
- After 40 searches, the search will end, so be careful
- Press F1 for help on each screen, it's quite helpful
Once you find some memory addresses, you can add them to a table. Here are some interesting addresses I've found, you can refer to the tables above for some more:
| offset | type | description |
|---|---|---|
| 0x001e5068 | BYTE | Player 1's HAR id (0=jaguar, 10=nova) |
| 0x001e5084 | BYTE | Player 1's current animation |
| 0x001e50e0 | DWORD | Pseudo float for Har 1's X position (divide by 256 to get real value) |
| 0x001e50e4 | DWORD | Pseudo float for Har 1's Y position |
| 0x001e50e8 | DWORD | Pseudo float for Har 1's X velocity |
| 0x001e50ec | DWORD | Pseudo float for Har 1's Y velocity |
| 0x001f0068 | BYTE | Player 2's HAR id |
| 0x001f0084 | BYTE | Player 2's current animation |
| 0x001f00e0 | DWORD | Pseudo float for Har 2's X position |
| 0x001f00e4 | DWORD | Pseudo float for Har 2's Y position |
| 0x001f00e8 | DWORD | Pseudo float for Har 2's X velocity |
| 0x001f00ec | DWORD | Pseudo float for Har 2's Y velocity |
| 0x001e50b0 | WORD | How many ticks since Har 2 has moved or attacked (?) |
| 0x001f00b0 | WORD | How many ticks since Har 2 has moved or attacked (?) |
| 0x0012ce42 | WORD | Player 1's max health |
| 0x0012ce40 | WORD | Player 1's current health |
| 0x001c6590 | BYTE | Player 1's current health as a percentage, used for the healthbar |
| 0x0012e146 | WORD | Player 2's max health |
| 0x0012e144 | WORD | Player 2's current health |
| 0x001c6592 | BYTE | Player 2's current health as a percentage, used for the healthbar |
| 0x001dc4c8 | WORD | Match tick counter, does not reset between rounds |
| 0x001ceb64 | WORD | REC tick counter, when replaying REC files |
| 0x001c77c6 | BYTE | P1 selection on MELEE (set to 10 for kreissack) |
| 0x001c4cde | BYTE | P2 selection |
