Question GTA 5 — Reversing Native Registration Table in b3725

[byte_corvus]

Rockstar just pushed the b3725 update for GTA 5 and, as expected, the classic native table patterns are now toast. If you're trying to build a native invoker for this build, the old signatures aren't going to cut it anymore.

Here is the breakdown of what we know about the current structure:

1. The table remains a hashmap consisting of 0xFF (255) buckets.
2. Each bucket is a linked list of scrNativeRegistrationNode structures.
3. Encryption involves XORing fields with their own memory addresses as nonces.

The classic AOB signature

48 8D 0D ? ? ? ? 48 8B 14 FA E8

typically found in load_script_natives no longer yields results. It seems Rockstar has either refactored the reference or added significant obfuscation layers to the function.

Spoiler: Technical Context

For those unfamiliar, the node structure usually looks something like this:

struct scrNativeRegistrationNode {
    scrNativeRegistrationNode* next;
    FARPROC handlers[7];
    uint32_t count;
    uint64_t hashes[7];
};

Finding the entry point in b3725 is the current hurdle. Since some menus are reportedly already functional on this build, the table core is definitely there — likely just the pointer reference that has shifted.

Has anyone successfully dumped the new offset or found a more resilient AOB for the table pointer? Rockstar might have changed how load_script_natives handles the registration entirely.

Drop your findings or IDA notes below.