Advanced DVAR Coding tutorial - F6'ing with a RAM Dump (PoptartHunter)

I will be showing you how to F6 a code with a RAM dump, as you can see by the title.


First off, you will need to address of the code you want to F6. For this tutorial, we will use the dvar "r_specularMap". The address for this dvar is "81130020".

Now that we have our address we want to F6, we will need to get some values above it for the F6 to search for. You will have to find some values that are only in the memory once. So far, our code looks like this.


F6000001 80008180


The "F600000" is letting the codehandler know that the code is F6 (duh). The 1 at the end means it'll be searching one set of values, you can change this to 2 if you have two sets of values, etc.


"80008180" means the F6 will search for the values in 80000000 to 81800000, which is all of memory 80.


Now that we have the first line started, and we know what that top line means, we can get our values to search. You will want to get values that don't change, For this I recommend pointer address for it to search, since those rarely will change, making the F6 more reliable to work.


A pointer address is a value in the RAM dump that looks like these:

The "807470C4" and "81129550" are pointer addresses. We will use these for the F6 to search, so our code will look like this so far:


F6000001 80008180 807470C4 81129550


Alright, now that we have our F6 line and our values to search, we have to set our pointer. In this case, we will use simple 14 codetype. We'll go to where our first value is, 807470C4, and hit CTRL+E to get our address at which it starts.

As you guys can see, I have highlighted the first value, and hit CTRL+E on it. Our address for that value is 81130010. Now all we need to do is take our first address for "r_specularMap", which is 81130020, and plug that into our calculator. Make sure the mode is set to scientific, and select hex.

Now all we need to do, is hit the subtract button, and paste in our address where our values start (the ones that will be searched by our F6), and click the = sign to calculate the difference between where the value is and where our address is that we want to write to.

The difference we get is 10. So our code will now look like this:


F6000001 80008180

807470C4 81129550

14000010 XXXXXXXX

E0000000 80008000


The x's are the value you want to write to our address "81130020", the address of our dvar "r_specularMap". Here it is commented:


F6000001 80008180 # search one set of values in 80000000 to 81800000

807470C4 81129550 # values to search for

14000010 XXXXXXXX # if values found, skip 10 bytes from where the value "807470C4" starts to get to the address we want to write to. X's = our new value to write

E0000000 80008000


Make sure that the values you use for your F6 code are only in the ram dump once. You can test this by Copying the value, press CTRL+F, pasting the values in, and searching with the view mode set to hex. If you only get one result, that is good. Make sure you have the search type set to "all" too.


You'll also want to add an activator to the F6 so it doesn't search until you get to the specified point where the value is. F6 codes search the first time the codehandler is ran, so if you don't have an activator it will search for the values as soon as you boot the game, which will make it not work since the values won't be found yet.


I recommend adding an activator and activating it once you get into the game, since the RAM dump was made when I was in a game, and it will make it more likely that you're F6 will work by finding the values you put.


And here's our finished code, F6'd with a RAM dump!


r_specularMap

F6000001 80008180

807470C4 81129550

14000010 XXXXXXXX

E0000000 80008000