0417

OK i've located the Vehicle Model Allocation function, and thankfully it isn't static , although the amount of vehicles you can have in the game altogether is (which i will work on a fix for later), anyway heres the goods:
QUOTE
.text:005B8FDE                push    offset aVehiclestruct ; "VehicleStruct"
.text:005B8FE3                push    50              ; Vehicle Model Limit
.text:005B8FE5                mov    ecx, eax
.text:005B8FE7                call    AllocateVehicleModels



so the maximum value you can push it to is 125 (due to the small push), but again it has a multiplier in the AllocateVehicleModels function, its stock value is 0x314, so changing this will work to push the vehicle model limit above 125 exactly the same way it works for the vehicle limit i posted earlier:
QUOTE
.text:005B8348                imul    eax, 314h



This limit patch will work to change the number of vehicle models you can have loaded in the game at any one time, not the amount you can have loaded in the game altogether, i'm still working on that, and the dam 7 player limit

EDIT:

OK for the player slots (not solved but developing):

0x5FB800 : CPlayer::GetNextSlot() function

0x5FB811 : cmp ebx, 8
0x5FB848 : cmp edi, 8

(These need to be changed to prevent the GetNextSlot() function from returning an invalid playerid)

0x5FB81C : imul esi, 2D4h

The multiplier that tells us the block size of the player slots, changing this wont have any affect on the allocation its static, but it certainly helps us to VirtualAlloc more memory

0xC09920 : The pointer to the player allocation blocks, maybe just changing this with a VirtualAlloc and the cmp's will work?

Textures:

0xC8800C : Pointer to the Texture Definitions Pool

stream.ini memory addresses:

0x5BCCD0 : LoadStreamIni()
0x86A8CC : "stream.ini" (string)
0x8A5A80 : memory/devkit memory (DWORD)
0x8A5A84 : vehicles (DWORD)
0x96F016 : dontbuildpaths (bool)
0x8D5168 : pe_lightchangerate (float)
0x8D516C : pe_lightingbasecap (float)
0x8D5170 : pe_lightingbasemult (float)
0x8D5150 : pe_leftx (DWORD)
0x8D5154 : pe_rightx (DWord)
0x8D5158 : pe_topy (DWord)
0x8D515C : pe_bottomy (DWord)