Home / Forums / How RAGE Engine Native Invoker & Hash Crossmaps work in FiveM

UnreliableCode Community

Developer Research, Reverse Engineering & Coding Community

Tutorial

How RAGE Engine Native Invoker & Hash Crossmaps work in FiveM

CitizenNative
RAGE Engine & FiveM Dev
VIP
Rep: 315
Join Date: Sep 2022
Posts: 21
Thanks: 82
2y ago · Oct 18, 2023 7:30 PM
#1
In Rockstar's RAGE engine (GTA V / FiveM), game functions are exposed through a hash-based Native Registration Table.

How Native Calling Works:
1. Every game function (like
CPP
PLAYER::PLAYER_PED_ID()
or
CPP
ENTITY::GET_ENTITY_COORDS()
) is identified by a 64-bit hash.
2. The game contains a 256-bucket registration table where each hash is mapped to its native handler function pointer.
3. A
CPP
scrNativeCallContext
structure holds the argument stack and return value pointers.

CPP
class scrNativeCallContext {
public:
    void* m_pReturn;
    uint32_t m_nArgCount;
    void* m_pArgs;
    uint32_t m_nDataCount;
    Vector3 m_vectorSpace[4];
};

typedef void(__cdecl* NativeHandler)(scrNativeCallContext* context);


Across game updates, native hashes get remapped via a crossmap table, which maps old hashes to the new build hashes!
CitizenNative | RAGE Engine & FiveM Native Calls
The following users thanked CitizenNative for this post:
HexRays99
Senior Reverse Engineer
VIP
Rep: 380
Join Date: Apr 2022
Posts: 36
Thanks: 94
2y ago · Oct 18, 2023 9:10 PM
#2
The RAGE registration table uses a neat linked list structure inside each bucket. You can find the native registration table pointer by pattern scanning for the handler resolution function:
CPP
48 8D 0D ? ? ? ? 48 8B 14 D1 48 85 D2 74 ?
HexRays99 · Reverse Engineering & Static Analysis
CPP
// Always check your pointers!
if (!pLocalPlayer) return;
VMT_Hooker
VMT / Detours Engineer
VIP
Rep: 310
Join Date: Mar 2023
Posts: 22
Thanks: 80
2y ago · Oct 19, 2023 9:05 AM
#3
Hooking native handlers directly in the registration table (like hooking
CODE
SET_VEHICLE_FORWARD_SPEED
) is also super smooth for script hooks without modifying the calling bytecode.
VMT_Hooker - Virtual method table swapping made easy