Guide [Dump] Roblox Client version-9d412f44a6fe4081 — Internal Structs & Offsets

[byte_corvus]

If you are tired of chasing dynamic addresses or trying to fix your broken internal every time the client pushes a minor update, here is a clean dump of the current structures and offsets. This is raw technical meat for anyone building their own SDK or updating a private base.

Target Client: version-9d412f44a6fe4081

Core Memory Offsets
This namespace covers everything from DataModel hierarchy to Humanoid state offsets. If you are doing WPM/RPM or writing an internal, these are your bread and butter.

namespace Offsets {
    inline std::string ClientVersion = "version-9d412f44a6fe4081";
     namespace AirProperties {
         inline constexpr uintptr_t AirDensity = 0x18;
         inline constexpr uintptr_t GlobalWind = 0x3c;
    }
     namespace AnimationTrack {
         inline constexpr uintptr_t Animation = 0xd0;
         inline constexpr uintptr_t Animator = 0x118;
         inline constexpr uintptr_t IsPlaying = 0xa18;
         inline constexpr uintptr_t Looped = 0xf5;
         inline constexpr uintptr_t Speed = 0xe4;
         inline constexpr uintptr_t TimePosition = 0xe8;
    }
     namespace Animator {
         inline constexpr uintptr_t ActiveAnimations = 0x850;
    }
     namespace Atmosphere {
         inline constexpr uintptr_t Color = 0xd0;
         inline constexpr uintptr_t Decay = 0xdc;
         inline constexpr uintptr_t Density = 0xe8;
         inline constexpr uintptr_t Glare = 0xec;
         inline constexpr uintptr_t Haze = 0xf0;
         inline constexpr uintptr_t Offset = 0xf4;
    }
     namespace Attachment {
         inline constexpr uintptr_t Position = 0xdc;
    }
     namespace BasePart {
         inline constexpr uintptr_t CastShadow = 0xf5;
         inline constexpr uintptr_t Color3 = 0x194;
         inline constexpr uintptr_t Locked = 0xf6;
         inline constexpr uintptr_t Massless = 0xf7;
         inline constexpr uintptr_t Primitive = 0x148;
         inline constexpr uintptr_t Reflectance = 0xec;
         inline constexpr uintptr_t Shape = 0x1b1;
         inline constexpr uintptr_t Transparency = 0xf0;
    }
     namespace Beam {
         inline constexpr uintptr_t Attachment0 = 0x170;
         inline constexpr uintptr_t Attachment1 = 0x180;
         inline constexpr uintptr_t Brightness = 0x190;
         inline constexpr uintptr_t CurveSize0 = 0x194;
         inline constexpr uintptr_t CurveSize1 = 0x198;
         inline constexpr uintptr_t LightEmission = 0x19c;
         inline constexpr uintptr_t LightInfluence = 0x1a0;
         inline constexpr uintptr_t Texture = 0x150;
         inline constexpr uintptr_t TextureLength = 0x1ac;
         inline constexpr uintptr_t TextureSpeed = 0x1b4;
         inline constexpr uintptr_t Width0 = 0x1b8;
         inline constexpr uintptr_t Width1 = 0x1bc;
         inline constexpr uintptr_t ZOffset = 0x1c0;
    }
     namespace DataModel {
         inline constexpr uintptr_t CreatorId = 0x188;
         inline constexpr uintptr_t GameId = 0x190;
         inline constexpr uintptr_t GameLoaded = 0x5f8;
         inline constexpr uintptr_t JobId = 0x138;
         inline constexpr uintptr_t PlaceId = 0x198;
         inline constexpr uintptr_t PlaceVersion = 0x1b4;
         inline constexpr uintptr_t PrimitiveCount = 0x440;
         inline constexpr uintptr_t ScriptContext = 0x3f0;
         inline constexpr uintptr_t Workspace = 0x178;
    }
     namespace Humanoid {
         inline constexpr uintptr_t Health = 0x194;
         inline constexpr uintptr_t Walkspeed = 0x1d4;
         inline constexpr uintptr_t WalkspeedCheck = 0x3bc;
         inline constexpr uintptr_t JumpPower = 0x1b0;
         inline constexpr uintptr_t Sit = 0x1e0;
    }
}

Internal Struct Definitions (Reversed Logic)
Pay close attention to the padding. If you are off by even 4 bytes when casting pointers to the DataModel or Instance, you're going to crash. Use these definitions to map the memory layout exactly.

namespace Structs {
     struct Humanoid {
        char pad_0[32];
        int HumanoidStateID;
        char pad_1[252];
        uintptr_t SeatPart;
        char pad_2[8];
        uintptr_t MoveToPart;
        char pad_3[8];
        Vector3 CameraOffset;
        char pad_4[12];
        Vector3 MoveDirection;
        Vector3 TargetPoint;
        char pad_5[12];
        Vector3 MoveToPoint;
        char pad_6[4];
        int DisplayDistanceType;
        int FloorMaterial;
        float Health;
        float HealthDisplayDistance;
        int HealthDisplayType;
        float HipHeight;
        char pad_7[8];
        float JumpHeight;
        float JumpPower;
        float MaxHealth;
        float MaxSlopeAngle;
        float NameDisplayDistance;
        int NameOcclusion;
        char pad_8[4];
        int RigType;
        char pad_9[8];
        float Walkspeed;
        bool AutoJumpEnabled;
        bool AutoRotate;
        bool AutomaticScalingEnabled;
        bool BreakJointsOnDeath;
        bool EvaluateStateMachine;
        bool Jump;
        char pad_10[1];
        bool PlatformStand;
        bool Sit;
        bool RequiresNeck;
        char pad_11[1];
        bool UseJumpPower;
        char pad_12[472];
        float WalkspeedCheck;
        char pad_13[80];
        double WalkTimer;
        char pad_14[96];
        uintptr_t HumanoidRootPart;
        char pad_15[1048];
        int HumanoidState;
        char pad_16[123];
        bool IsWalking;
    }; // sizeof = 2328

     struct Camera {
        char pad_0[232];
        uintptr_t CameraSubject;
        char pad_1[8];
        Matrix3x3 Rotation;
        Vector3 Position;
        char pad_2[48];
        int CameraType;
        char pad_3[4];
        float FieldOfView;
        char pad_4[388];
        Vector2 ViewportSize;
        float ImagePlaneDepth;
    }; // sizeof = 756
}

Spoiler: Technical Breakdown

1. Identify the DataModel via the TaskScheduler or by scanning for the VisualEngine pointer (0x763d3d0 in this build).
2. The WalkspeedCheck (0x3bc) in the Humanoid structure is critical—Roblox uses this to flag anomalous speed changes. If you are going to modify the walkspeed, you need to handle the underlying check logic.
3. Note the ViewMatrix offset at 0x130 inside the VisualEngine namespace. Essential for your WorldToScreen (W2S) functions if you're building an ESP.

Architecture Note: These are for the current x64 client. Make sure your project is setup for 64-bit compilation or you'll be reading invalid memory addresses all day.

Anyone found any new integrity checks on the TaskScheduler jobs recently?