Guide [Source] Far Cry Series — Havok Engine Entity Reversing & ESP Base

[byte_corvus]

Most of the Far Cry titles since the third installment rely heavily on the Havok Engine. If you are tired of chasing obfuscated game-specific arrays, digging into the physics engine's RTTI and structured layout is a goldmine for entity-based features like ESP or teleportation hacks.

The Technical Core
By utilizing Havok's RTTI, you can navigate the hkpWorld and its hkpSimulationIsland arrays to find dynamic entities. While filtering can be a headache, I have found that most useful entities (players, NPCs, animals) are associated with an hkpCapsuleShape at a specific offset.

Spoiler: Havok Engine Class Structures

namespace HAVOK
{
    class hkpEntity
    {
    public:
        // 0x18 points to a movement object, 0x30 inside that is the writeable Vector3
        Vector3 GetPosition()
        {
            auto pos_class = *(DWORD*)((DWORD)this + 0x18);
            if (!pos_class) return { 0, 0, 0 };
            return *(Vector3*)(pos_class + 0x30);
        }

        bool HasCapsuleShape()
        {
            static void* hkpCapsuleShapeVFT = reinterpret_cast<void*>(OFFSETS::GameBase + OFFSETS::hkpCapsuleVFT);
            auto shape = *(hkCapsuleShape**)((DWORD)this + 0x10);
            return (shape && shape->vtable == hkpCapsuleShapeVFT);
        }
    };

    class hkpWorld
    {
    public:
        char pad_10[0x10];
        Vector3 gravity;
        char pad_1c[0x4];
        hkpSimulationIsland* fixedSimulationIsland; 
        uintptr_t* fixedRigidBody;
        Array<class hkpSimulationIsland*> activeSimulationIslands; // NPCs, animals, etc.

        static hkpWorld* GetWorld()
        {
            static uintptr_t StartingAddr = (uintptr_t)(OFFSETS::GameBase + 0x01EE9114);
            return (hkpWorld*)(ResolvePTR(StartingAddr, { 0x3C, 0x11C, 0x48, 0x18, 0xC8, 0x4, 0x0 }));
        }
    };
}

Entity Filtering via VTable
To avoid visual noise on your overlay, you can perform a simple VTable comparison. If the entity's shape class matches the hkpCapsuleShape VFT, it is almost certainly a valid target for your ESP. This is far more reliable than just dumping every rigid body in the simulation island.

Signatures & Pawn Logic
If you prefer the game's native pawn system over the raw physics engine, you can find the Pawn array using old leaked PDBs or backtracking from LUA functions in IDA.

Local Player Signature (Far Cry 3 example):

0F 29 86 ? ? ? ? 8B 40 ? D9 40 ? 8B 11 DC 0D ? ? ? ? 8B 52 ? 51 8D 86 ? ? ? ? D9 5D ? D9 45 ? D8 47 ? D9 5D ? D9 45 ? D9 1C 24 50 FF D2 8B 43 ? 0F 28 07 0F 5C 00 0F 57 C9 0F 28 D1 8D 4D ? 0F 5D D0 0F 58 55 ? 0F 5F C8 0F 58 4D ? 51 8B CE 0F 29 85 ? ? ? ? 0F 29 55 ? 0F 29 4D ? E8 ? ? ? ? D9 05 ? ? ? ? 8B 4E

ESI here will hold the hkpEntity pointer for the player.

GetAllPawns Signature:

B8 ? ? ? ? C3 55 8B EC 8B 41 ? 8B 88 ? ? ? ? 8B 45

Offsets obviously shift between versions, but the Havok architecture is consistent across the series. If you are digging into newer titles, the process of locating hkpWorld via RTTI remains the most professional entry point.

anyone else tweaked this for the newer titles?