Car quantity over 16 cars and 255 laps

[sinaosal]

I had an idea to make RVGL be possible with over 16 cars and 255 laps.
I expiremented with the cheat engine (as Nickpalm suggested). I found out the value in the Cheat Engine, and i changed it (lets say 18). It shows up in the RVGL settings menu:

Number of cars: 18

I can modify the same with the laps:

Number of laps: 257

The game crashes.

Should i change the hardcoded value with the Cheat's Engine auto assembler or should i use a .dll (as Theman suggested)


Here are my questions:
How does the ZMenu RVGL do this (Add more cars) ? Can be viewed here:

https://www.revoltworld.net/dl/zmenu-rvgl-chaos/

Thanks in advance!

[sinaosal]

Also, Theman suggested to disable replays, because they could also limit the total quantity of cars.

2025-07-16:
I started working on a .dll file. I made a quick setup (made a c++ code file, and made a base for .dll:

#include <windows.h>
#include <iostream>

DWORD WINAPI MainThread(HMODULE hModule) {
    MessageBoxA(nullptr, "RVGL DLL Injected", "RVGL Replay Disabler", MB_OK);

    // Writing Memorty Here
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)MainThread, hModule, 0, nullptr);
    }
    return TRUE;
}

Read this spoiler if you would like a breakdown of this code.

► Show Spoiler

The first 2 lines call header libraries - iostream for the base and also the windows header library.
The DWORD WINAPI line creates a thread that runs when the DLL is injected.
Inside the thread, there is a Message Box stating that the "RVGL DLL Injected".
return 0 is to state that the code has terminated succesfully (basics of c++).
The BOOL APIENTRY is a DLL entry point which is automatically called on an inject.
If the reason is that its attached, it creates a thread "MainThread" (which opens up the message box).

I later compiled that code with MinGW using this command:

g++ -shared -o RVGL_DISABLE_REPLAYS.dll RVGL_DISABLE_REPLAYS.cpp -static-libgcc -static-libstdc++

This line of code created a .dll.

I used then Process Hacker (Experimental Use Only) to inject the dll i created. It worked.

Then i searched the memory for "Replay System Clues" by attaching the Cheat Engine to rvgl.exe and searched for "replay" inside it (more information on how i scanned in inside this spoiler:

► Show Spoiler

String/Value: replay, Scan Type: Search for text, Value Type: String
If you want to go deeper here is more:
Memory Scan Options:
All,
Start:0000000000000000
Stop: 00007fffffffffff
Writable: True, Executable: True, CopyOnWrite: False, Active Memory Only: False, Fast Scan: True

2025-07-17:

I found 12 addresses with the value "replay". I browsed the memory region to see pure assembler code and debug. My first guess was to disable the full replay (I didn't know if it was for that). I was messing around when i saw Replay.Save Replay.Resume in the bottom hex/ASCII pane. I copyed the address but i found out it was just a string. I used the "Find out what accesses/writes to the address" but no instructions where put even if i saved it or replayed it.

Can someone explain about this to me? Thanks in advance!