Content: Slate Blackcurrant Watermelon Strawberry Orange Banana Apple Emerald Chocolate Marble
Background: Slate Blackcurrant Watermelon Strawberry Orange Banana Apple Emerald Chocolate Marble
Pattern: Blank Waves Notes Sharp Wood Rockface Leather Honey Vertical Triangles
Welcome to Xbox Chaos: Modding Evolved

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.


Featured Entries

  • Lord Zedd

    Update For March 8, 2015

    By Lord Zedd

    The latest plugin update under Assembly's Updater has been pushed. It should be available shortly on both update channels. The Github Commit can be found at: The changelog for this update is as follows: updated rmt2 and standardized better
    fixed up h2 bsdt and standardized the others
    fixed string size in reach sbsp
    fixed bit names
    named new mode ik block in reach+ animations
    named ai melee damage in reach+ units
    added the swarm and transformation blocks to odst char
    renamed transformation block to morph in h3/odst char
    added jmrq plugin for odst (ur welcome gamecheat)
    fixed and named boarding properties in char
    named extra targets block in odst hlmt
    fixed error on h3 scnr
    added missing block in h3/odst jmad
    named editor folder indexes in scnr
    other small char edits/additions
    named script values for h4 vignettes
    fixed objective conditions block in scnr
    small edit to odst+ squads
    fixed phantom types enums in phmo
    standardized and mapped pphy
    updated naming in metagame globals in matg
    updated all lsnd
    updated all snde
    updated and standardized drdf, and by extension csdt and rmbl
    fix typos in h3/odst goof
    added enums to h3b, reach beta, reach, and h4 sily/goof
    fixed big issue in reach beta impo
    A healthy-sized list this time around. Some changes came about while working on Outbreak. You will notice bitfield bits in reach are now named "Bit #" instead of just "#" which had been bugging me for quite some time. A semi-important fix is that the Boarding Properties in CHAR tags is named and properly sized. Injected AI should now be able to board you if the animations are all good. There was also a critical typo in ReachBeta's IMPO that caused freezing on injected objects. Perhaps the biggest change is that now most SILY/GOOF parameters have been named and put into an enum. Previously only Halo 3/ODST only had them set up. Along with names the enum includes the value type the xex expects from each SILY parameter.

Our community blogs

  1. Thunder
    Latest Entry

    By Thunder,

    It's been quite a while since we have had a game night. Some of us have been quite busy with megalo recently. So, let's have a megalo based game night on Xbox LIVE.

    In order to register for this event, simply PMThunder your gamertag. We will send you an invite when we are ready to begin. There is a minimum post count of 5 to attend this event!

    The game night will begin around 8 PM CDT on August 3rd. Please be ready about 10 minutes beforehand so you can receive your invite.

    We look forward to seeing you there!

    This event has been canceled due to low interest.

  2. Whew, it's been a few years, huh?

    Some of you might recall this old "" project of mine. For those unfamiliar, I started the map back before I had half a clue what went into modifying maps - and the idea in the very beginning was to try and add a variety of new content with a forerunner aesthetic (vehicles, weapons, etc) to Forge World. This proved to be... difficult - and so it later became "Forge World Ultimate" - with the goal being to create the best forge canvas with as many goodies as possible. Drivable bipeds, campaign content, and so on.

    For the first however many versions, though, the map eventually reached a point of no return - where me trying to add one more piece of content would irreparably break it. Each time, I went back in later and tried to start over - with the hope of avoiding those issues - but it was never meant to be.

    However - as of writing, Halo: Reach tools for MCC have released. And so I can finally do what I've been waiting to do for a long time - re-create the map, on PC, with the official tools - and finally give it everything I've ever wanted to.

    I had hoped to continue posting here, picking up where I left off - however sadly I hear that XboxChaos will likely be going read-only soon. As such, I've (with administrator permission to share) set up my own blog on my own personal website where I'll be posting updates about the development of this new version of "". I've also brought over my old posts as well, going back to 2015, so that all of the development and version history can be found in one place.

    In the future, I'll be uploading the old, incomplete version of v5 that was never released for Xbox 360, just to get it out there - but for now, my main focus is making this map better than ever on MCC. I'll also be working on setting up a download portal containing all version of the map - all in one convenient place.

    For anyone in the future who might stumble on this and want to check out (or download) the newer version of the map once it's out, check my personal blog here:

    • 0
    • 0
    • 405

    No blog entries yet

  3. Script Expressions: electric boogaloo eiditon

    If you manage to actually read this and apply it to something give yourself a pat on the back you incredible bastard.

    Writing this as a blog as it applies to all halo games.

    PAGE INDEX (Get the pun? you will if you manage to read this all):

    1. Expressions

    2. Manually navigating expressions

    3. Creating a script from scratch

    1. Expressions

    jSdWIhS.jpg<--- an example of a blank, invalid script expression. Note my plugins are different to the main build of assembly.

    A quick run down:

    Expressions are located in the scenario tag of your desired map. Use Ctrl+F to search for things quickly. The Scripts & Globals are also located here. These entries point to a starting expression for the script. 

    Script String Data is also located in the scenario, but its not necessary for normal usage. But if you want any decompiler to be able to read quoted text "sounds\xboxchaos\yeet", you will need to add them to this table and set the String Table Offset in the expression to match this. Again, not required. 

    An expression is x18 (24 Decimal) in length, use this to your advantage for calculating bits and bobs when editing large amounts of expressions as raw hex. 

    A salt is for all intensive purposes just another number that you will need to take into account when writing a datum. (You don't really need to worry about this being unique, just leave any you write as 0. Makes life easier)

    A index is the position of an expression in the expressions block. (The little number that you see in the top right hand side of a block)

    A datum is the salt+index. If we think of a datum as a C#  we would write it like so:


            public DatumIndex(ushort salt, ushort index)
                Salt = salt;
                Index = index;

            public uint Value
                get { return (uint) ((Salt << 16) | Index); }

    (SOURCE: Blamite\Blam\Scripting\ScriptExpression.cs)

    ('Value' being the both the salt and index represented as a unsigned 32 bit integer) 


    Next I will explain the structure of an expression, as you see in the picture above:

    • Salt: one half of the Datum. It's base value will be 58226 + the index of the expression (As per any scripts compiled by Bungie). You can leave it as 0 for anything you write manually.
    • Operation Code: this defines the overall action of the expression, such as the function code to be used when the Expression Type is set as Function. (See the scripting xmls for a list)
    • Return Type: Does this expression return anything to the expression that came before it? This will be void most of the time unless its required.
    • Expression Type: Defines the expression type from a few options, you will be using 'Group' and 'Expression' most of the time.
    • -
    • 'Group' expressions represent a pair of parenthesis '( )' along with any expressions that will be placed inside them '( abc )' & any expressions that will be placed outside '( abc ) def'.
    • 'Expression' expressions represent everything else other than references to other scripts/globals/parameters. You will be using this a good 80% of the time.
    • -
    • Next Expression Datum (Salt & Index): For your convenience you will see the NextExpressionDatum as two separate values. The next expression to be looked at after the current one. (This can be confusing when dealing with Group expressions, explained later)
    • String Table Offset: a simple offset that is created by the script compiler. It stores the original text that was used to create this expression. (The node/atom depending on what you like to call it) 
    • Expression Value/Data: this is important and is used any time an opcode/group expression requires extra data. This data can be simple numbers, stringIDs and even a Datum for Group expressions!
    • Line number: do I really have to explain this? Well actually yes. Unless you are using the 'scripting' build of assembly from my GitHub this will always need to have a value of at least 1 or the decompiler does not show it. In Bungie's compiled scripts any expressions with a line number of 0 are implied  expressions, this can make navigating a set expressions manually without my build of assembly a huge headache as there will be more expressions than you expect to actually find. This is where people always get confused and give up. Examples of implied expressions are things like 'begin' actually existing at the start of every compiled expression. 


    2. Manually navigating expressions, following the expression tree by hand

    Now that you know what an expression is made of, we can finally learn how to follow an expression tree just by staring at them in assembly (or if you are sadistic as hell, in a hex editor). I recommend that you use my 'scripting' build of assembly for the purposes of learning and not having to take implied expressions into account. After you have got the hang of things you will be able to read through implied expressions and realise where they do and don't exist.

    First find a script to actually follow, I will be using 'objective_3_clear' from citadel in Halo 3.

    eRzcZXV.jpg <--- The comment at the top is turned on using the 'Show Extra Information' button inside the options drop down of the Scripts page.

    yK7eg2E.jpg <--- If you don't see this, you are not on the 'dev' or 'scripting' build.


    So let's go to our scenario tag, jump to expressions and goto the index specified by the comment. Alternatively goto the 'Scripts' block in the scenario tag and find your script there. It will have the Datum for your script.

    You can click on the block inside in the top right and type the number to instantly jump straight to it just like you can in windows explorer with file names. Very useful for maps with 40,000+ expresions... Yikes.


    So let's take a look at the first expression and decipher what it does... I'm fucking lost? The Next Expression index is 65535? What?

    Hol' up fam. Dont wet your panties just yet. This is a group expression. Remember that a group has both expressions on the inside and potentially on the outside.

    1EgdCGQ.jpg <--- 65535 / xFFFF , simple means nothing. Meaning there is nothing outside of this group. This is true, look at your script.

    Let's ignore anything other than the expressions in our script, the other pair of parenthesis is not actually an expression.

    FoDg5Ay.jpg <--- What we are interested in.

    So yeah, having xFFFF on the Next Expression Index is correct but where is the over index for the 'begin' function expression? Its in the expression value! see where we have 4 8bit integers? Between x10 and x13? That's our Datum and where the next expression to be placed inside the parenthesis is located. But we only see -61, 35, 95 & -81. Those make no sense? Well they are actually correct, but due to our plugins we are reading them the wrong way.

    Think back to what a Datum actually is: Salt+Index and both are unsigned 16bit integers. We can right click on the first int8 at x10  and click 'view value as...' to read from that offset as something else without having to edit our plugins. So let's do that now.

    taPsIQh.gif <--- just like so, scroll down to the unsigned 16bit values... it reads two of them one after another, very useful for us!


    So we can see that at x10 there is a uint16 with a value of 49955. That's the salt of the datum! You should be able to guess the second one at x12, that's our index that we need to go to in the expressions block. 

    Here is a visual example in terms of indexes as to what we just read: ( 24495 ) 65535, So that's a group with an expression inside it that is located at 24495 and there is no expressions to be placed outside thanks to 65535 (xFFFF) meaning there are no more expressions to be used outside of this group. Neat. I hope you are still with me on this and not lost.

    A general rule of thumb for Bungie compiled scripts is that the contents of a group are always placed directly after the group expression, with anything outside that group then coming after the expressions that were inside the group.

    With this logic now in your head it should be obvious what comes next at 24495, a function with the opcode for begin. Just so happens the opcode for begin is 0. We are actually heading UP the index rather than down, this adds to the confusion. Let's take a look...

    VpAAHag.jpg <--- Yup, Expression with function_name and an opcode of 0. Yeetie.

    Okay, this is straight forward. Let's follow the Next Expression Index. We will find another group expression at this index.

    ISoEhNA.jpg <--- We started at 1, then went to 2 and now we are at 3 as per the next expression index of 2.

    Here is what we find at 24485, the third expression of our script.

    M0sVK17.jpg <--- we have both a Next Expression index and a Datum in the value. Meaning there is expressions inside and outside the parenthesis. 

    So this where things can be really confusing, where do you find the print expression? At the Next Expression Index or at the datum that is in the expression value? Where is the next line specified?

    The next line in this case is specified by the Next Expression Index, this means we have a group expression that looks at another group expression and so fourth. This is how we navigate lines. Every new line has a group expression. 

    BHNrOGp.jpg <--- Well because we want the expression INSIDE the parenthesis we follow the datum in the expression value, so view value as like we did before.

    Qm1gav5.jpg <--- we can see that the print expression is at 24486, let's go to it....

    CfK6nEn.jpg <--- here we are, a function with the opcode of 27. Print.

    Before we go any further, we need to talk about functions. Most functions require an argument of some kind to actually be useful. If we take a look at our script xml file we can see that print requires and argument to work correctly.

    pfOD5bV.jpg <--- While print is nulled in the release version of the game, this is not relevant for our discussion right now.

    We can see the required argument is a string, so with this in mind we know that the next expression after our print function is going to be something string related. Let's take a look now by going to 24487.

    f668Uy9.jpg <--- Take note of the return type and opcode, both are set to string hopefully for obvious reasons. 

    Note the Next Expression Index is now 65535 (xFFFF) and this means there are no more expressions. This is the end of the contents for the group expression as a result and thus the end of this line.

    For strings the BlamScript engine will read the expression value section for a string table offset. Now when this script was compiled it placed the string for it at 42597. So if we read the value as a Uint32 we should see the same. 

    t1vRuwF.gif <--- indeed we see the same string offset in the value section

    So you by now have likely caught on to the fact that the value section of an expression can really be anything as required and its meaning will change depending on the context. For example an AI expression can actually specify individual AI Units, Groups etc all using the same expression & just the values change to tell the script engine what to look for. SnipeStyle/AMD(?) did a lot of research on this many years ago for Halo Reach and deserves a mention for this. 


    So the line is finished. Let's recap where we are in the index as we are going to go BACK to our line's group expression so we can find the next line. Savvy people will already know where to find the next group expression, but otherwise keep reading.

    QJgAVAP.jpgM0sVK17.jpg <--- back at 3, we read the NEI for the next line

    So we navigate to 24488 like so and are greeted by another group expression as expected.

    UB4xbAX.jpg <--- we are now at the second print line

    OiKXzEG.jpg <--- considering that we just manually read the same expressions, we are actually going to skip reading this line. We know what it is.

    sARAFHz.jpg <--- Let's look at the next line of the script by following the group expression 6's NEI. It will be yet another group at 24491.

    drZHvCZ.jpg F7tRYxR.jpg <--- LAST LINE OF THE SCRIPT YO.

    So this is the last line of the script, we can tell this because the group for this line has its NEI set to 65535 (xFFFF). The BlamScript engine will see this as the script being finished, but let's continue by investigating the contents  of this group. Thus we must do our typical 'view value as...' or if you are savvy you will know that it is on the follow index. Let's take a look now.

    rzVeawe.jpg <--- a function with opcode 1100, objectives_finish_up_to. It requires a long (32bit integer) to work correctly.

    So this function requires a long to work correctly, so with this knowledge the next expression specified by the NEI should be a long. Let's take a look...

    fugGESP.jpg <--- Piece of cake, if we read the value as a Int32 from x10 we get 2. Lovely. never take what your plugins say for face value. 

    GPYL8df.jpg <---So that's it. We can see 2 down there just like we see in our script! 

    Done. That's the end of the script!

    Feel free to add extra lines to your plugins for making ready Values easier, such as adding two uint16 readers at x10 and x12 for Group Salt & Indexes. I leave it to you to decided how you want to go about this. Personally I use a hex editor with a data inspector and calculator as it's just faster for me. 

    So that's pretty much it for reading scripts by hand, as long as you follow the rules of how group expressions work you will be perfectly fine.


    Have a go at navigating a complex looking script and changing numbers. This is good practice you.


    Enjoy reading nested expressions, it's a hell scape. Thanks LISP.

    KQZCrK0.jpg <--- You should be able to mentally know where the group expressions are, have a think about it because you will be writing this manually soon.

    JBNDXUa.jpg <--- This makes me hard just thinking about it. oof.


    3. Making a script from scratch

    So now that you can read scripts its about time you started writing them, that's what you came for right? Well bad news buddy if you just skipped everything that I wrote there you are a total jerk. Go read it. I wont answer any questions that you ask if you are not able to prove you can read expressions yourself, otherwise whats the point? If you cant read them you cannot understand how to write them.

    I'm going to assume you are using a map with no scripts or you have removed all the existing scripts. I leave the allocation of Datum Indexes to your own discretion. I'm going to use Valhalla in Halo 3 as it has no scripts by default. 

    Start by adding a block to the scripts block in the scenario tag. Give it a name and set the script type to Startup and the Return Type as void. We are not returning anything and this is normally used for more advanced scripts, such as a script that continuously returns a list of all objects that are inside a trigger volume to be used by another script. You can make some pretty advanced stuff. But for now we are sticking to the basics and doing a basic script that toggles the gravity between high and low every few seconds. We will do this using the physics_set_gravity opcode and the sleep opcode. 

    So let's review the script before we begin:

    MeCvGNc.jpg <--- We will set the gravity to 30%, wait 3 seconds, set the gravity to 130% for a nice slam dunk and then wait 3 seconds. The script will be set to continuous so it will repeat after it ends.

    Your mind should already be racing, you already see exactly how many expressions you need and what they need to be set too. 14 Total. (Or I'm just really fucking weird because I can. I hope you can too.)

    I will number them out below:

    1. Group, NEI: Datum(65535,65535), Value: Datum(0,2)
    2. Function Begin, NEI: Datum(0,3)
    3. Group, NEI: Datum(0,6), Value: Datum(0,4)
    4. Function physics_set_gravity, NEI: Datum(0,5)
    5. Function Real, NEI: Datum(65535,65535), Value: Real(Float) @ 0.3
    6. Group, NEI: Datum(0,9), Value: Datum(0,7)
    7. Function sleep, NEI: Datum(0,8)
    8. Function Short, NEI: Datum(65535,65535), Value: Short @ 90
    9. Group, NEI: Datum(0,12), Value: Datum(0,10)
    10. Function physics_set_gravity, NEI: Datum(0,11)
    11. Function Real, NEI: Datum(65535,65535), Value: Real(Float) @ 1.3
    12. Group, NEI: Datum(65535,65535), Value: Datum(0,13)
    13. Function sleep, NEI: Datum(0,14)
    14. Function Short, NEI: Datum(65535,65535), Value: Short @ 90

    Note that '12.' is the last group expressions and as a result has a NEI of 65535 (xFFFF) effectively ending the script. Now I would write out an even longer section of this blog but instead I will show you a video of the process. 


    • 2
    • 0
    • 3231

    No blog entries yet

  4. The latest plugin update under Assembly's Updater has been pushed. It should be available shortly on both update channels.

    The Github Commit can be found at:

    The changelog for this update is as follows:

    • changed h3 flags value in MP properties to 16 bit
    • added blocks to h3b equipment
    • added forced death dialogue enum to reach+ jpt
    • named text flag in odst chdt
    • changed naming of resource types in zone zonesets
    • fixed an enum value in h3-ish sily
    • named location string in reach+ scnr placements
    • named node positioning in scnr placements
    • named animation values in chdt
    • changed hidden enum in reach+ scnr sandbox to a flag
    • named firefight bit in reach+ squads
    • changed pmcg enums to flags
    • added new flag in pre-h4 ligh (lehvak)
    • fixed error in h4 hlmt
    • updated end of zone with new research
    • updated reach jmad with old inheritance block
    • removed testing values in h4 new inheritance block

    It's been 9 months since the last update. Big things to mention are the better CHUD animation blocks, and node positioning in scnr, so you can pose corpses or whatever to your liking.

    Probably another long delay coming, but it will be for good reason as the PC version of Halo 5 kinda came with full tag layouts, so I just have to port them backwards and LOTS of new stuff will be named.

    • 1
    • 1
    • 3094

    Recent Entries

    Latest Entry

    so i'm trying to download minecraft maps for my xbox360 on a mac laptop but when i click on raw devices, it doesn't detect my usb.... an i've been stuck for hours trying to look up how to fix this problem but no luck at all... :'(. the laptop detects it no problem, when i plug it in, it pops up on the desktop so i don't know what the problem is so if anybody could please help me out here and tell me how to fix this problem, that would be really amazing please!!! i'm begging for someone to help :(

    • 1
    • 1
    • 3501

    Recent Entries

    Latest Entry

    im not going to F*** around, how do u put the downloads on to your xbox??

  5. Nothing modding related here I just found something very interesting in the new star wars episode seven trailer.

    Here is the Trailer:

    at scenes 1:12-1:13 you see storm troopers

    If you look closely you can see there are troopers with different helmets, straps on there backs and ones with backpacks and without.


    In addition, the ones with the backpacks seem to have different helmets.

    But the one in the back has a different backpack and he has a kama.

    If you look closely he resembles a snowtrooper; but the helmet design is different from all the others.


    It looks like Ralph McQuarrie concept snowtooper, here:


    Lastly, there is another storm I want to point out.

    He has some weird backpack with an antenna.



    • 2
    • 2
    • 4158

    Recent Entries

    Just an idea to make a xboxchaos app for almost all platforms including phone.

    I am thinking of using Visual studio. Might change,

    I have started to develop the home screen.

    This app is a bit like HaloWaypoint.

    You can quickly check your messages, recent posts. A preset list of members. Staff contact info.

    And if your internet takes to long to load. You can kill time with a small maze game!

    As of now, im using a WebBrowser from the list of utilities and cached it to this site. Just a placeholder as of now.

    The goal of this app is to make a UI friendly interface, cross-platform, and special features exclusive to the app.

    You may join in on this.

    Contact [email protected]

    If your interested in working as well.


    • 1
    • 27
    • 10161

    Recent Entries

    If you haven't voted yet here's the link to the survey:

    No more shitty I think I can do better this time since a lot has changed since that map mod was made when injection first came out.

    I've been distracted too much so millions of thingswon't be in here. More will be added in

    the future.

    Version One:

    Experimental Version:

    Version 1

    I've cleared up problems with everything that you see in the pallet list except the shade turrets. Don't spawn them. Also the AA Turret on unsc vehicles. Man I really did forget out those. It did work but decided to break on me. I'll look into fixing it.


    Future Updates:

     - Enabling turrets for pillar of autumn, frigates. - Adding more civilian vehicles. - Attempt to get the shade turrets to work.  - Look into weapons for cruiser, frigate mac cannon. - Add Super Carrier, Corvette.

    Target Locator:

    The height of the map impact the ability of the missiles dropping onto the map properly... FIXED


    A better view of the smaller vehicles


    Forgot the seraph:


    Here's the frigate


    The frigate with its engines working


    Covenant Cruiser


    Pillar of Autumn, with the engines on ^_^


    Civilian Transport Ship



    The Skybox.


    Added a couple of new vehicles to the spawn list:


  6. What the fuck did you just fucking say about me, you little "cheater"? I’ll have you know I graduated top of my class on, and I’ve been involved in numerous secret hacks on, and I have over 300 confirmed mods. I am trained in doxxing warfare and I’m the top hacker in the entire anonymous forces. You are nothing to me but just another scrub. I will wipe you the fuck out with precision the likes of which has never been seen before on this website, mark my fucking mods. You think you can get away with saying that shit to me over the Internet? Think again, "cheater". As we speak I am contacting my secret network of modders across Skype and your CPU key is being traced right now so you better prepare for the storm, "cheater". The storm that wipes out the pathetic little thing you call your mods. You’re fucking banned, scrub. I can be anywhere, anytime, and I can hack you in over seven hundred ways, and that’s just with my scripts. Not only am I extensively trained in scripts, but I have access to the entire source of Assembly and I will use it to its full extent to wipe your miserable ass off the face of the website, you little "cheater". If only you could have known what unholy retribution your little online mod was about to bring down upon you, maybe you would have held your fucking key vault. But you couldn't, you didn’t, and now you’re paying XBLSE, you goddamn "cheater". I will shit projectile swaps all over you and you will drown in them. You’re fucking banned, scrub.

  7. Reach map files have a hash in them which is computed based on the data in the file header. This is kinda irrelevant since Zedd's XEX patches disable the header signature checks, but I figure I'd document this anyway because he asked me about it today. Here's some quick info on how to update the hash that's computed on the map header.

    First, you need to prepare the header by removing certain bits of data. Make a copy of the first 0xA000 bytes (header) of the map file. Then, zero out the following areas of the header:

    • 4 bytes at 0x320
    • 8 bytes at 0x328
    • 0x3C bytes at 0x330
    • 0x100 bytes at 0x36C
    • 0x100 bytes at 0x1C
    • 4 bytes at 0x144
    • 4 bytes at 0x148
    • 4 bytes at 0x16C
    • 4 bytes at 0x170
    • 0x18 bytes at 0x174
    • 4 bytes at 0x49C
    • 4 bytes at 0x4A0
    • 4 bytes at 0x4A4
    • 4 bytes at 0x4A8

    Next, you need to salt the hash. Put the following data at the beginning of the header you prepared:

    ED D4 30 09 66 6D 5C 4A 5C 36 57 FA B4 0E 02 2F 53 5A C6 C9 EE 47 1F 01 F1 A4 47 56 B7 71 4F 1C 36 EC

    Finally, compute a SHA-1 checksum over your modified header (this should be 0xA022 bytes after adding the salt). The new hash goes at offset 0x330.

    So yeah. While not too useful, I suppose this could be used to help map out unknown parts of the header based on the offsets that get zeroed. I'm also pretty sure that more hashes would have to be updated and not just that one, because cache files have at least three hashes in the header.

    Anyway, there you go. Have fun.

    -- Aaron

    • 0
    • 0
    • 3043

    No blog entries yet

    • 0
    • 0
    • 3071

    No blog entries yet

  8. Dunno if this has been discovered already, but thumbing through some 343i game types I noticed they did Fiesta with randomized personal ordnance. Here's the example:

        <Ordnance flags="InitialOrdnanceEnabled, RandomOrdnanceEnabled, PersonalOrdnanceEnabled, OrdnanceEnabled" unk6="0" customizePersonalOrdnance="True">      <Right>        <Possibility weight="1.000003" name="ord_weap_storm_energy_sword" />        <Possibility weight="1.000003" name="ord_weap_storm_binary_rifle" />        <Possibility weight="1.000003" name="ord_equip_damage" />        <Possibility weight="1.000003" name="ord_weap_storm_spartan_laser" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />      </Right>      <Left>        <Possibility weight="1.000003" name="ord_weap_storm_rocket_launcher" />        <Possibility weight="1.000003" name="ord_weapon_storm_incineration_l" />        <Possibility weight="1.000003" name="ord_weap_storm_fuel_rod_cannon" />        <Possibility weight="6.000004" name="ord_equip_speed" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />      </Left>      <Down>        <Possibility weight="1.000003" name="ord_weap_storm_sniper_rifle" />        <Possibility weight="1.000003" name="ord_spread_gun" />        <Possibility weight="1.000003" name="ord_equip_overshield" />        <Possibility weight="1.000003" name="ord_weap_storm_gravity_hammer" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />        <Possibility weight="1.000003" />      </Down>    </Ordnance>

    Pretty cool, eh? Here's a list of ordnance that can be used:


  9. This action is actually very simple. All it does is enable and disable a player's ability to spawn. It was found because dominion uses it for last stand. The action simply takes a player to modify and a bool. True enables spawning and false disables spawning.

    In KSoft, you can update your database with this

    <Action DBID="139" name="PlayerCanRespawn" template="PlayerBool" />

    Here is an example of using it to disable an iterator player's ability to spawn.

    <E type="Action" name="PlayerCanRespawn">  <Param type="PlayerReference" varRefType="ExplicitPlayerType" dataType="Iterator.Player" />  <Param type="Bool">False</Param></E>

    If you have any questions feel free to ask me!

    • 1
    • 3
    • 12151

    Recent Entries

    Latest Entry

    After a little bit of research I have found out what Action137 is used for. It is basically used to spawn in objects that are PlaceAtStart false based on an event rather than the timer it defaults to. This is used in Dominion to spawn in the base shields based on what team is controlling the base.

    There are four values that you set when you use Action137.

    1. ObjectReference. This is the candy spawner object itself. Not sure if it can be used in regular candy spawner obejets or not. Useually used with Iterator.CandySpawnerObject
    2. Bool: This bool is used to indicate weather or not the object can spawn. If false, the object will never spawn. You must set this back to true to enable spawning.
    3. Bool: This bool will instantly spawn the object if enabled. I equate this to object is enabled. Does nothing if the first bool is false.
    4. PlayerReference: This is the player that caused the spawn. If the object is a vehicle, it will force the player into the vehicle. Does nothing if the first bool is false.

    To use this, you need a couple things first.

    You obviously need a object filter. Here is the one I am using while testing.

    <Filter labelIndex="candy_obj" name="candy_obj" />

    Then you need to add a GameObjectFilters section under the normal object filters and add a reference to the normal ObjectFilters section then add a reference to that object filter.

    <GameObjectFilters>      <Filter type="CandySpawner" labelIndex="candy_obj" name="candy_obj" />    </GameObjectFilters>

    now you are setup to use Candy Objects. To use them you would put this in the sections where you want to spawn the object. Set both of the bools to false to make sure it will not spawn, both true to spawn the object.

    <E type="Action" name="ActivateTrigger">  <Param type="TriggerReference">    <T type="Trigger" trigType="Subroutine" execMode="OnCandySpawnerFilter" name="Trigger7_Subroutine26">      <GameObject type="CandySpawner" filter="candy_obj" />      <Elements>        <E type="Action" name="Action137">          <Param type="ObjectReference" varRefType="ExplicitObjectType" dataType="Iterator.CandySpawnerObject" />          <Param type="Bool">True</Param>          <Param type="Bool">True</Param>          <Param type="PlayerReference" varRefType="ExplicitPlayerType" dataType="NONE" />        </E>      </Elements>    </T>  </Param></E>

    If you would like to make things easier on yourself, I propose going into the ksoft documents and adding a name to action 137 to be used later easier. It will also make everything you decompile show that name instead of Action317 which makes it easier to read.

    To do this, go to the folder where you have KSoft installed, and then go into Games/Halo4/Definitions/ and open MegaloScriptDatabase.xml in your favorite text editor. Then Search for


    Then change

    <Action DBID="137" template="ObjectBase"> <!--candy spawner related-->			<Param sigID="1" type="Bool" name="Bool" />			<Param sigID="2" type="Bool" name="Bool" />			<Param sigID="3" type="PlayerReference" name="Player" />		</Action>


    <Action DBID="137" name="ObjectSetSpawnEnabled" template="ObjectBase"> <!--Fruit Spawner-->			<Param sigID="1" type="Bool" name="Bool" /> <!--Weather or not the object will spawn-->			<Param sigID="2" type="Bool" name="Bool" /><!--If the previous is true, set weather or not the object is instant spawn-->			<Param sigID="3" type="PlayerReference" name="Player" /><!--The player that spawned the object.-->		</Action>

  10. Well I collected the xex gravity offsets across different 3rd Gen Halo builds for something I'm working on and I figured I might as well share them. Thanks to Lord Zedd for getting the Reach Pre-Beta offset for me. The rest were either gotten from Ascension (not sure who documented them, but thank you), or found by myself.

    These are floats, and the default value is always 4.1712594; poke in Ascension, Offsetify, or something similar. If you encounter any issues, please let me know.

    Halo 3

    Halo 3 Beta TU0 - 0x82051AEC

    Halo 3 Beta TU2 - 0x82051AEC

    Halo 3 Epsilon - 0x8203585C

    Halo 3 Review - 0x82035C74

    Halo 3 TU0 - 0x82035894

    Halo 3 TU3 - 0x82035E90

    Halo 3: ODST - 0x82037838

    Halo: Reach

    Reach Pre-Beta - 0x82045048

    Reach Beta - 0x8203ADF4

    Reach Retail TU0 - 0x8203BB78

    Reach Retail TU1 - 0x8203BC64

    Reach Demo - 0x8203BE98

    Halo 4

    Halo 4 TU0 - 0x82128CC8

    Halo 4 TU1 - 0x82128EDC

    Halo 4 TU2 - 0x8212920C

    Halo 4 TU3 - 0x8212920C

    Halo 4 TU4 - 0x821297C8

    Halo 4 TU5 - 0x821354C4

    Halo 4 TU6 - 0x82135674

    Halo 4 TU7 - 0x82135F14

    Keep the mods offline.

  11. Due to size, all I can do is post this link: where you'll find everything in a pretty rar. Lists are courtesy of the "SharedDump" tool made by AMD, which can be found with Assembly's source. Also courtesy of my own merging and sorting since SharedDump goes per-map.

    If it ain't here it ain't shared. Go cry about it.


    Halo 3

    Halo 3: ODST

    Halo: Reach Beta

    Halo: Reach

    Halo 4 ;)

  12. blogs_blog_40

    • 3
    • 9
    • 4148

    Recent Entries

    Latest Entry

    By Guest,

    This action was used in Reach's Race gametype with the index of 90 (Action90 in ksoft) and 118 in Halo 4. For the past few months, I've been trying to figure out what this action does. I decided to give it another try and I'm glad I did!

    Here's how it's used in Race (the official Reach gametype):

            <Elements>          <E type="Action" name="Action90">            <Param type="PlayerReference" varRefType="ExplicitPlayerType" dataType="Iterator.Player" />            <Param type="Bool">True</Param>          </E>

    I changed the boolean parameter to False and spent several minutes dicking around in both unmodified and modified gametypes like I've done many times before. This time, I noticed something different: You were spectating other players but not the checkpoints like in the unmodified gametype.

    After some more testing, this action appears to control whether you could spectate over players or respawn objects.

    Now, what to name this action... comment with your suggestions!

  13. Believe it or not, it may be possible to re-create the AA wraith of Halo 3 and Halo 3 ODST on reach, WITHOUT injecting it. NOTE: i said RE CREATE, so this is NOT the actual AA WRAITH. Anyway, the HUD UI of the AA wraith mortar is already on, so after seeing that, i got a little idea. and after replacing the wraith mortar WEAP with the needle rifle and changing the Needle Rifle projectile, the result was quite resembling of the AA wraith. And after changing a couple shaders, the result was incredibly close. Although this is in place, I will keep trying with the REAL AA Wraith.

    • 3
    • 7
    • 10426

    Recent Entries

    Ill Be Posting all My finding about tag injection here so im not blowing up the forms or shout box

    so far ive noticed that you can extract a proj tag with out any nulling

    may be the same for the weap tag if so then that means that when you extract a vehi tag

    that the string ids are broke and things dont know where to go so it crashes

  14. This is the magical story of how a lonely Xbox 360 S traveled all the way from Mexico, in dreaming of it's future, wished to find an owner who'd love and parent it into an RGH. The story you're about to read is true, with names unchanged. Now please, sit down and enjoy this... story.

    We'll start with it's birthplace, China. Now, where it spent it's childhood, in Mexico. That's right folks, this console spent it's early years in Me-he-co, the place of cartels, drugs, and cheap prostitutes (don't ask). It's childhood was fair, as it used to play games with it's buddies which extend to each corners of the Earth. Together it and his friends would play exciting games like Viva Pinata, Sonic, and other titles that the children in India are oh so jealous of. Though, it's childhood was tragically cut short when his current parent decided he was no longer good enough for him, and sold him to a fellow in the good ol' States. This fellow was none other than the one and only DevUltra, who promised to provide a safe and nourishing environment where it could blossom into the RGH it had always wished to be. Mr. DevUltra loved his new adopted child, and treated him well. He was slow and kind to it, playing with him as a retail boy until Mr. Ultra felt he was ready to help him grow into an RGH. Once Mr. Ultra felt his son was ready, he carefully undressed him and did his best to transform his boy into the glorious RGH he always dreamt of being. Mr. Ultra succeeded in upgrading his child with the hardware his son needed, and though Mr. Ultra tried his best, his efforts were cut short when he was unable to dump his sons memories, and was only left with a partial file of his sons memories. Mr. Ultra was devastated, but charged on hoping he'd still be successful. And though Mr. Ultra's perseverance was unbreakable, he was unable to succeed. Mr. Ultra tried his best to cope, but just couldn't. Fortunately he had an amazing friend named Xythera, who he knew would take care of, and fix his son. And knowing so, contacted Mr. Xythera offering to give Mr. Xythera his son, in hopes that he'd be able to correct what he could not. And so comrads, that's where the true journey begins!

    (Breaking Character Now)

    So, I just aquired this console and the first thing I'm going to do is install the NAND hardware. I'll be installing the wires needed so I can access the NAND. Let's begin.

    NOTE: After spending 30 minutes writing that story, I'm not going to bother adding comments for each photo explaining what I'm doing right now. The photos speak for themselves. I'll add comments later.

    (These photos are in order)

    Chapter 1, Finding The G-Spot

    First, I had to decide where I wish to have my consoles NAND access wang hanging from, and after a short examination I found the perfect spot right above the video connections.



    Capter 2, Fitting The Cable



    Capter 4, Soldering To The Motherboard




    Capter 5, Adding Connectors





    Chapter 6, Examining My Work







    For now I have the system boxed, and ready to take home with me. When I get home I'll buy the DGX and CR Rev. C

    If there are any typos, don't bother pointing them out. It was 2 in the morning when I wrote this.