NFS High Stakes EXE addresses and modifications.

[Zalcus20]

Hey everyone. This is post is going to be a bit lengthy. 

I think it's about time to start a thread about useful addresses for NFS High Stakes, since there is one for NFS3. It's time to give NFS4 some love.   


I'll start the topic by sharing an address that most of us probably know already. It was first shared in the ghost editing thread, but I am reposting it here for the purpose of being organized.

There is a way to get ALL cars (including AI opponents, traffic and cops) to turn on their headlights during a day race (without weather).

Here are the instructions (you will need a hex editor):
NOTE: As always, make a backup of your nfs4 executable.

1. Using HxDen, open the nfs4.exe.
2. Press "Ctrl + G" and type "00018B0A" in the Offset box and click ok. HxDen will automatically place the cursor at the correct location.
3. Change byte "00" to "01".
4. Save nfs4.exe

So basically you are doing: nfs4.exe 0x18B0A 00 >> 01

I have only tested this with the modern patch by Veg. nfshsgame.exe version should work too, but I haven't tested it. As long as the addresses correspond, this small patch should work.


I would also like to announce that after 3 days of searching, the timer that is seen in Getaway and Time Trap modes has been found!

A cheat table and a trainer have been created that allows you to change the timer to a value that is different from the default 2 minutes in Getaway mode. I will attach them for download shortly. Everything has been checked and there are no viruses.

Here's a little help to get the cheat engine and trainer working.  Btw, you do not need to use both. You have the option to use the cheat table or the trainer. whichever is more convenient for you.

If you use the trainer, launch NFS4 first, then launch the "NFS4 Timer Editor.exe" second. This is so that the launcher will detect the nfs4.exe process.

Now you can see the predefined timer code options and their respective hotkeys. Enter these hotkeys in the main menu just before you are ready to race.

Please remember to activate (Ctrl+space) the trainer beforehand so that the codes will take effect in the race. If you want the default timer setting for Getaway or Time Trap modes, press Ctrl+space again to deactivate while in the main menu.

Now if you prefer to use the cheat table, make sure to have cheat engine 7.4 or later installed on your system. Launch NFS4 and open the "NFS High Stakes Timer.CT".

When the cheat table opens,  attach the process "nfs4.exe" to the table. Now you can activate the cheat table (Ctrl+space) while in the main menu. Same rules apply like the trainer method.

I post the hotkeys here for simplicity. They are the same for the trainer and the cheat table.

Ctrl+Space >>  activate/deactivate mode.

Ctrl+0 >> set timer for 30 seconds.
Ctrl+1 >> set timer for 1 minute.
Ctrl+2 >> set tmer for 2 minutes (default).
Ctrl+3 >> set timer for 3 minutes.
Ctrl+4 >> set timer for 4 minutes.
Ctrl+5 >> set timer for 5 minutes.
Ctrl+7 >> set timer for 7 minutes.
Ctrl+6 >> set timer for 10 minutes.
Ctrl+8 >> set timer for 15 minutes.
Ctrl+9 >> set timer for 30 minutes.

Shift+= adjust/synchronize timer for Time Trap mode.
(This is necessary if you chose one of the above custom codes for Time Trap mode. You need to do this so that time you set will start at exactly that time in a Time trap race. Failure to do this step will result in the timer being off by about 3 seconds.)

Ctrl+= >> increase timer by 15 seconds.          (Best used in Time Trap mode)
Ctrl+- >> decrease timer by 15 seconds.          (Best used in Time Trap mode)

Some may wonder why I haven't provided an address for the nfs4 executable. Originally, I wanted to extend the default Getaway timer to 5 minutes instead of 2. However, I was unable to find the address that calculates and writes the value of "2 minutes" to the game. I can only see when it is written during the loading screen. That is how it became possible to create this trainer/cheat that changes this value before the race loads.

Maybe someone who knows more about assembly code and cheat engine can go further than I did. 

In the meantime, try this thing out and enjoy the possibilities of high stakes in 2024.

Also stay tuned for more findings.  Believe me, there are more...

[Zalcus20]

Attaching the files don't seem to work. Here are dropbox links instead:

Link to cheat table.
https://www.dropbox.com/scl/fi/rj2h07uo13hi0ymcjupye/NFS-High-Stakes-Timer.CT?rlkey=icqfmaleafhw9a6laoct9qxse&dl=0


Link to trainer.
https://www.dropbox.com/scl/fi/j1q7ssnzekvmsftjrk9ft/NFS4-Timer-Editor.EXE?rlkey=hsidziohgqqd70e3bqqjtpwy3&dl=0       

[pete9516]

Awesome, this is very nice to have, i feel you about finding those adresses.. It's a nightmare sometimes

[Zalcus20]

Thanks Pete.

Even better news. Found some more addresses stored directly in the nfs4 executable.

Extend/reduce time on the Getaway timer:
nfs4.exe 0001BC73 1E00 >> 4B00   This changes the default timer from 2 minutes to 5 minutes. Here are more options you can set:

0800 = 32 seconds
0F00 = 1 minute
2D00 = 3 minutes
3C00 = 4 minutes
4B00 = 5 minutes
6900 = 7 minutes
9600 = 10 minutes
E100 = 15 minutes
FF00 = 17 minutes
C201 = 30 minutes

---------------------------------------------
I couldn't find the direct address for the Time Trap timer, but there is a way to make them more challenging. The following hack reduces the amount of time you need to complete a Time Trap race:

nfs4.exe 0001BDAA 01C2 >> 01C1  8 seconds less per lap. Medium difficulty. Don't crash or get a ticket more than once. You most likely won't make it. But wait, there is one more option if you want a hardcore challenge:

29C2  = 16 seconds less per lap. HARD difficulty. Avoid getting even one ticket. You also need a good driving line and have a clean race (no accidents) in order to make it. If there's a shortcut, use it.

----------------------------------------------------
This hack disables the cop radar in Hot Pursuit mode permanently:

nfs4.exe 000103FE CB5C >> 9090    The radar still appears in the HUD, but it will no longer light up red and beep when a cop is in close proximity.

The only way to know when a cop is coming is to look at your map. Or did you turn that off, too? (pressed TAB key several times) 

Edit: Fixed a grammatical error.

[DrSpeed]

Glad to see this thread up and running.
Found the addresses where the game stores the traffic vehicles for each track. The following values is the ID number of the traffic cars.

001B8310 - Total number of unique traffic vehicles to load on Hometown (default: 6, max: 7)
001B8311 - Hometown traffic vehicle 1
001B8312 - Hometown traffic vehicle 2
001B8313 - Hometown traffic vehicle 3
001B8314 - Hometown traffic vehicle 4
001B8315 - Hometown traffic vehicle 5
001B8316 - Hometown traffic vehicle 6
001B8317 - Hometown traffic vehicle 7 (default: 0)

001B8318 - Total number of unique traffic vehicles to load on Country Woods
001B8319 - List of Country Woods traffic vehicles

001B8320 - Total number of unique traffic vehicles to load on Redrock Ridge and Lost Canyons
001B8321 - List of Redrock Ridge and Lost Canyons traffic vehicles

001B8328 - Total number of unique traffic vehicles to load on Empire City
001B8329 - List of Empire City traffic vehicles

001B8330 - Total number of unique traffic vehicles to load on Atlantica and Aquatica
001B8331 - List of Atlantica and Aquatica traffic vehicles

001B8338 - Total number of unique traffic vehicles to load on Rocky Pass
001B8339 - List of Rocky Pass traffic vehicles

001B8340 - Total number of unique traffic vehicles to load on Summit
001B8341 - List of Summit traffic vehicles

001B8348 - Total number of unique traffic vehicles to load on Landstrasse
001B8349 - List of Landstrasse traffic vehicles

001B8350 - Total number of unique traffic vehicles to load on Route Adonf
001B8351 - List of Route Adonf traffic vehicles

001B8358 - Total number of unique traffic vehicles to load on Durham Road
001B8359 - List of Durham Road traffic vehicles

001B8360 - Total number of unique traffic vehicles to load on Celtic Ruins
001B8361 - List of Celtic Ruins traffic vehicles

001B8368 - Total number of unique traffic vehicles to load on Kindiak Park
001B8369 - List of Kindiak Park traffic vehicles

001B8370 - Total number of unique traffic vehicles to load on Dolphin Cove
001B8371 - List of Dolphin Cove traffic vehicles

001B8378 - Total number of unique traffic vehicles to load on Snowy Ridge
001B8379 - List of Snowy Ridge traffic vehicles

Traffic ID number:
32 = Minivan
33 = Pickup
34 = Sedan 2
35 = Stationwagon
36 = Sedan 4
37 = Hatchback
38 = Bus
39 = 50's Truck
3A = SUV
3B = Euro Sedan
3C = Euro Bus
3D = Euro Semi
3E = Semi Truck
3F = Snowplow
40 = Water Truck

Also possible to add additional vehicles:
41 = Data\Cars\Traffic\Sedan\car.viv
44 = Data\Cars\Traffic\Caprice\car.viv

[pete9516]

Also possible to add additional vehicles:
41 = Data\Cars\Traffic\Sedan\car.viv
44 = Data\Cars\Traffic\Caprice\car.viv

NICE so technically these could be used for ghost files to have additional variety of different traffic cars?

[DrSpeed]

NICE so technically these could be used for ghost files to have additional variety of different traffic cars?

Yes, it's possible to do that.

Found some arcade Knockout and Tournament stuff:
000C3E31 - Number of Racers in Arcade Knockout. Recommend to keep this at 8, as the game will load a second AI with the same name. Last race will also have more opponents instead of just 1.
000C42B3 - Number of Racers in Arcade Tournament. Recommend to keep this at 8 as well. (Default:8, 9-10 is functional*)

001B6DF8 - Tournament Points 1st Place
001B6DFA - Tournament Points 2nd Place
001B6DFC - Tournament Points 3rd Place
001B6DFE - Tournament Points 4th Place
001B6E00 - Tournament Points 5th Place
001B6E02 - Tournament Points 6th Place
001B6E04 - Tournament Points 7th Place
001B6E06 - Tournament Points 8th Place (Default:0)
001B6E08 - "Tournament Points 9th Place" (Default:A)
001B6E0A - "Tournament Points 10th Place" (Default:0)

*You can increase the points for 1-8th place so the last 2 points makes sense. Unless we know what address 001B6E08 and 001B6E0A does, I don't recommend changing these at all.

I also found the tracklist and conditions for each difficulty. But I'm gonna leave it as a text file in this post instead, because there's just too many addresses.

[pete9516]

NICE so technically these could be used for ghost files to have additional variety of different traffic cars?

Yes, it's possible to do that.

Found some arcade Knockout and Tournament stuff:
000C3E31 - Number of Racers in Arcade Knockout. Recommend to keep this at 8, as the game will load a second AI with the same name. Last race will also have more opponents instead of just 1.
000C42B3 - Number of Racers in Arcade Tournament. Recommend to keep this at 8 as well. (Default:8, 9-10 is functional*)

001B6DF8 - Tournament Points 1st Place
001B6DFA - Tournament Points 2nd Place
001B6DFC - Tournament Points 3rd Place
001B6DFE - Tournament Points 4th Place
001B6E00 - Tournament Points 5th Place
001B6E02 - Tournament Points 6th Place
001B6E04 - Tournament Points 7th Place
001B6E06 - Tournament Points 8th Place (Default:0)
001B6E08 - "Tournament Points 9th Place" (Default:A)
001B6E0A - "Tournament Points 10th Place" (Default:0)

*You can increase the points for 1-8th place so the last 2 points makes sense. Unless we know what address 001B6E08 and 001B6E0A does, I don't recommend changing these at all.

I also found the tracklist and conditions for each difficulty. But I'm gonna leave it as a text file in this post instead, because there's just too many addresses.

Nice finds, it's amazing what you guys find here. But have you found anything related to controlling AI's speed? Like decreasing AI's top speed in tunnels, when it's rainy or like giving AI it's actual top speed which there is somehow a limit for? The AI never ever reaches it's actual top speed even if the OAT's should allow it. Or things like police cars not making u turns in tunnels?

[Zalcus20]

Nice finds, indeed.

@Pete: I did not find those addresses yet. Unlike the gst file, the exe is much bigger. So it will take more time to find.

In the meantime, here are two interesting addresses that can change the number of cops and traffic when playing Classic/Time Trap mode as a racer:

Number of traffic in HP mode (only affects Classic and Time Trap modes):
nfs4.exe 000C4FBF 02 >> 06 Default is 2 traffic cars. This hack sets it to 6 instead.
Other options:
00 = no traffic
01 = 1
02 = 2
03 = 3
04 = 4
05 = 5
06 = 6
07 = 7
08 = 8
09 = 9
0A = 10
0B = 11
0C = 12
0D = 13  (Doesn't make sense to go any higher than this unless you want to play without cops)
0E = 14  (MAX)

Number of cops in HP mode (only has an effect when you play as a racer):
nfs4.exe 000C4FBA 05 >> 08 Default is 5 cops. This hack sets it to 8 which is the max amount of cops the game can handle.
Other options:
00 = no cops
01 = 1 
02 = 2
03 = 3
04 = 4
05 = 5
06 = 6
07 = 7
08 = 8 MAX (add more than this, and the game will crash).

You can set these addresses to the other amounts as shown, but you have to make sure the total number of cars do not exceed 16, or the game will crash or you will see strange artifacts in the horizon. NFSHS in HP classic/Time Trap by default always loads 1 opponent racer, 5 cops, and 2 traffic. Add the player car, and you will get a total of 9. As you can see from the above hacks, I pushed the game to load 8 cops and 6 traffic. Add 1 opponent racer and myself, and that gives a total of 16.

I also found the address to change the number of opponents for Hot Pursuit mode:
nfs4.exe 000C4FC4
Default is 01 for 1 opponent, of course. It affects all Hot Pursuit modes (Classic, Getaway, Time Trap).

However, it is not recommended to change it as it caused my game to either crash on loading screen, crash before the 321GO! countdown, or display strange artifacts in the horizon. Even if you get past these problems, Getaway mode will be partially broken. When the timer runs out, you sometimes won't see the "Time is up..." prompt, and when you quit to race results or replay, there is a chance the game reads it as "Aborted" instead of "Win" or "Lose".

Also, if you think you can have zero opponents by setting the address to "00", think again. The game freezes just before the 321GO countdown starts.
I also tried setting the number to the max (0D or 13 racers) for HP mode, but the maximum I can load is 8 (08). Again it is very unstable and it mostly crashes. My guess is that setting a value higher (or lower) than the default seems to break the game's calculation for determining the max number of cars.   

Apparently, Gst editing is still the best for unlimited race customizations. 

[DrSpeed]

I can confirm, 000C4FC4 tells the number of AI and human racers. Setting it to 2 loads a second AI opponent and a traffic car, driving whatever the first car on your carlist is. Indeed strange.

Continuing on with Hot Pursuit stuff:
000C4F8B - Number of AI cops to load when player is cop (default:4, max:7)
000C4F96 - Number of AI Racers and Traffic when player is cop (default:2)

Here's what police car to load for the tracks, any serial number can be used. For the North American tracks, it's using the traffic ID number instead.
Interceptor Model:
000C2BCE - Celtic Ruins and Landstrasse
000C2BF0 - Route Adonf
000C2C12 - Durham Road
000C2C34 - Dolphin Cove
000C2C5E - Kindiak Park
000C2C88 - Snowy Ridge
000C2CB2 - Hometown and Country Woods
000C2CDC - Redrock Ridge and Lost Canyons
000C2D06 - Atlantica and Aquatica
000C2D2A - Rocky Pass and Summit
000C2D4E - Empire City

Regular Police cars loaded from the Cars folder:
000C2BD5 - Celtic Ruins and Landstrasse
000C2BF7 - Route Adonf
000C2C19 - Durham Road

0C = Pursuit Porsche
14 = Pursuit Camaro
16 = Pursuit BMW M5
20 = Pursuit Corvette
24 = Pursuit Diablo SV
31 = Pursuit La Niña

Police cars loaded from the Traffic\Pursuit Folder:
000C2C4E - Dolphin Cove
000C2C78 - Kindiak Park
000C2CA2 - Snowy Ridge
000C2CCC - Hometown and Country Woods
000C2CF6 - Redrock Ridge and Lost Canyons
000C2D1D - Atlantica and Aquatica
000C2D41 - Rocky Pass and Summit
000C2D65 - Empire City

F4 01 = Police Sedan
F5 01 = Police SUV
F6 01 = Police Hatchback
F7 01 = Police Caprice

I haven't found a way the make it load from the cars folder instead, or if it's even possible, no progress so far. Although it is possible to load any vehicle in the game, you just have to count where in the list your desired car is located. If you're switching around modded cars a lot, it's not recommended to change it.

[DrSpeed]

000C3901 - Number of Vehicles in total in a single race. By default you have 8 racers, this will fill the rest of the slots with traffic cars. Traffic needs to be on before you select full grid as it will be greyed out. (default:08, max:10)

More continuation on Hot Pursuit:
000C4FFA - Number of Traffic in Getaway mode (default:03)
000C50E7 - Number of AI Cops in 2 Player mode (default:05)
000C50EC - Number of Traffic in 2 Player mode (HP) (default:01)

Found stuff related to Career mode.
Opponents in Tournament of Champions:
00076390 - Bonus Porsche (default:2A)
000763A5 - Mercedes CLK-GTR (default:12)
000763AC - McLaren F1 GTR (default:02)

Pro Cup bonus car:
001AEDD8 - Chevrolet Pro Cup reward car (default:29)
001AEDDC - Porsche Pro Cup reward car (default:2A)

High Stakes opponents:
001AEDE8 - High Stakes Tour - Duel car (B Class restriction) (default:04)
001AEDEC - World Tour - Duel car (A Class restriction) (default:23)
001AEDF0 - Memory Lane - Duel car (AA Class restriction) (default:1F)
001AEDF4 - Tour du Jour - Duel car (AA Class restriction) (default:10)
001AEDF8 - Need For Speed Tour - Duel car (AAA Class restriction) (default:12)
001AEDFC - North American Tour - Duel car (AAA Class restriction) (default:02)

[pete9516]

000C3901 - Number of Vehicles in total in a single race. By default you have 8 racers, this will fill the rest of the slots with traffic cars. Traffic needs to be on before you select full grid as it will be greyed out. (default:08, max:10)

More continuation on Hot Pursuit:
000C4FFA - Number of Traffic in Getaway mode (default:03)
000C50E7 - Number of AI Cops in 2 Player mode (default:05)
000C50EC - Number of Traffic in 2 Player mode (HP) (default:01)

Found stuff related to Career mode.
Opponents in Tournament of Champions:
00076390 - Bonus Porsche (default:2A)
000763A5 - Mercedes CLK-GTR (default:12)
000763AC - McLaren F1 GTR (default:02)

Pro Cup bonus car:
001AEDD8 - Chevrolet Pro Cup reward car (default:29)
001AEDDC - Porsche Pro Cup reward car (default:2A)

High Stakes opponents:
001AEDE8 - High Stakes Tour - Duel car (B Class restriction) (default:04)
001AEDEC - World Tour - Duel car (A Class restriction) (default:23)
001AEDF0 - Memory Lane - Duel car (AA Class restriction) (default:1F)
001AEDF4 - Tour du Jour - Duel car (AA Class restriction) (default:10)
001AEDF8 - Need For Speed Tour - Duel car (AAA Class restriction) (default:12)
001AEDFC - North American Tour - Duel car (AAA Class restriction) (default:02)

Nice findings. Though don't you know Jonath's traffic patch? With this patch, you can have selected a Full Grid and at the same time be able to toggle traffic

[PomFrit]

Or things like police cars not making u turns in tunnels?

I found out why cops don't do U turns in tunnels. I did some testing and when the VRoad point in T3ED has "Chrome/Weather" column is set to "2" ( low chrome and always dry road ) the cops didn't do U turn. However, when is set to "anything else" ( i tested the first 16 numbers , high chrome and road depends on weather ), the cops do U turns in the tunnels.

The only chance to fix this problem is probably to find the address, that prevents Cops do U turn and change it in EXE file.

[pete9516]

Or things like police cars not making u turns in tunnels?

I found out why cops don't do U turns in tunnels. I did some testing and when the VRoad point in T3ED has "Chrome/Weather" column is set to "2" ( low chrome and always dry road ) the cops didn't do U turn. However, when is set to "anything else" ( i tested the first 16 numbers , high chrome and road depends on weather ), the cops do U turns in the tunnels.

The only chance to fix this problem is probably to find the address, that prevents Cops do U turn and change it in EXE file.

I've already tried to find the adress and i failed hard. But luckily, TsTg has already fixed that issue. Though he's not very communicative and doesn't want his mods to get posted here. You can find his Music & Tweaks mod in this Discord server: https://discord.gg/Sfphr2W7

[pete9516]

Or things like police cars not making u turns in tunnels?

I found out why cops don't do U turns in tunnels. I did some testing and when the VRoad point in T3ED has "Chrome/Weather" column is set to "2" ( low chrome and always dry road ) the cops didn't do U turn. However, when is set to "anything else" ( i tested the first 16 numbers , high chrome and road depends on weather ), the cops do U turns in the tunnels.

The only chance to fix this problem is probably to find the address, that prevents Cops do U turn and change it in EXE file.

I've already tried to find the adress and i failed hard. But luckily, TsTg has already fixed that issue. Though he's not as much active here as in the discord servers and doesn't want his mod to get posted here due to internet speeds. You can find his Music & Tweaks mod in this Discord server: https://discord.gg/Sfphr2W7