Using CheatEngine to Watch the Internal Values

[xtimz]

Hi, I plan to write some research on Tomb Raider 2-5. I'll start with this: Using some external program (CheatEngine) to watch the internal values of the game, when the game is running. I know many of you are experts here. I'll write a beginner's guide, because I'm a beginner. There are 3 external programs we need:

1. CheatEngine
2. FexInspect
3. dgVoodoo

First, we need to run the game in windowed mode, because we need to watch the CheatEngine window as the game runs. TR2, 4, 5 have build-in options to run windowed, but TR3 does not. The sole purpose of dgVoodoo here is to run TR3 in windowed mode. I wrote another article about that: https://www.tombraiderforums.com/sho...d.php?t=228399

Here, we only focus on CheatEngine and FexInspect. The CheatEngine version I use is 6.8.3. I think any recent version is OK. The Tomb Raider games I use are always the GOG English versions. I'll use TR3 in most cases, so

1. Install CheatEngine.
2. Run TR3 in windowed mode.
3. In CheatEngine menu File - Open Process, choose our TR3 game.

That's it for the preparation.

[xtimz]

Array of the ItemInfo structures of all items
For me, the most important structure is the above. At address 0x(6E2A1C), the value (we call it BaseItemInfo) is another address. BaseItemInfo is the starting address of an array. Each element of the array is an ItemInfo structure of 132 (0x84) bytes. Each ItemInfo structure corresponds to an item in the current level.

1. Which ItemInfo structure corresponds to which item?
Here is the only place we need FexInspect. It turns out that the sequence of the ItemInfo array is exactly the same as that of the item list in FexInspect, as follows.



Suppose we want to watch the info of Lara and Tony (the boss) in Caves Of Kaliya. So we open TONYBOSS.TR2 in FexInspect. From the item list, we know that Lara is 24 (0x18) and Tony is 25 (0x19). So the starting addresses of the ItemInfo structures of Lara and Tony are

BaseItemInfo + 132 * 24
BaseItemInfo + 132 * 25

respectively.

2. What's the ItemInfo structure?
The ItemInfo structure is as follows, taken from ITEMS.H of the source code.

// sint16 (sint32): signed 16-bit (32-bit) integer
// uint16 (uint32): unsigned 16-bit (32-bit) integer

typedef struct {
	sint32 floor;
	uint32 touch_bits;
	uint32 mesh_bits;
	sint16 object_number;
	sint16 current_anim_state;
	sint16 goal_anim_state;
	sint16 required_anim_state;
	sint16 anim_number;
	sint16 frame_number;
	sint16 room_number;
	sint16 next_item;
	sint16 next_active;
	sint16 speed;
	sint16 fallspeed;
	sint16 hit_points;
	uint16 box_number;
	sint16 timer;
	sint16 flags;
	sint16 shade, shadeB;
	sint16 carried_item;
	sint16 after_death;
	uint16 fired_weapon;
	sint16 item_flags[4];
	void *data;
	PHD_3DPOS pos;
	ITEM_LIGHT il;
	uint16 active:1;
	uint16 status:2;
	uint16 gravity_status:1;
	uint16 hit_status:1;
	uint16 collidable:1;
	uint16 looked_at:1;
	uint16 dynamic_light:1;
	uint16 clear_body:1;
	uint16 ai_bits:5;
	uint16 really_active:1;
}ITEM_INFO;

Suppose we want to watch the health, which is hit_points in the source code. We count, the starting address of hit_points (compared to the starting address of the ItemInfo structure) is 34 (0x22). So the addresses of the health values of Lara and Tony are

BaseItemInfo + 132 * 24 + 34
BaseItemInfo + 132 * 25 + 34

respectively.

[xtimz]

3. How to use CheatEngine to watch the values?
We could use either CheatEngine or a text editor to add the watch. To use CheatEngine,

1. Click "Add Address Manually".
2. Check "Pointer".
3. Write "Lara" in the "Description". This is just a description, you may write anything.
4. Choose "2 Bytes" in the "Type". The hit_points is 2 bytes (sint16).
5. Write "6E2A1C" as shown in the image. So BaseItemInfo is "09AC4970" this time.
6. Write "C82". It's better to write "84*18+22", which is just "132*24+34" in decimal number. The space is too small here, so I wrote "C82".
7. CheatEngine will calculate the address, which is "09AC55F2". And the value there is 1000, which means Lara has full health.

Click "OK", and we get this:



We can save the watch in a CT file, for example if we save now, we get

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"Lara"</Description>
      <LastState Value="1000" RealAddress="09AC55F2"/>
      <VariableType>2 Bytes</VariableType>
      <Address>6E2A1C</Address>
      <Offsets>
        <Offset>C82</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

Personally, I prefer writing the CT file directly using a text editor. Double click the CT file, CheatEngine will open automatically with the watches. My CT file for Lara and Tony's health in Caves Of Kaliya is

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>3202</ID>
      <Description>"Lara"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6E2A1C</Address>
      <Offsets>
        <Offset>84*18+22</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>3334</ID>
      <Description>"Tony"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6E2A1C</Address>
      <Offsets>
        <Offset>84*19+22</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

Each CheatEntry has the following.

1. ID: Just a number, should be unique in every file. I perfer using the calculated value of the Offset, because I love to merge CT files, and it can avoid the collisions of the IDs.
2. Description: Just the description.
3. ShowAsSigned: hit_points is a signed integer (sint16).
4. VariableType: 2 Bytes (sint16).
5. Address: 6E2A1C.
6. Offset: 84*18+22 or 84*19+22. CheatEngine will calculate it automatically.

That's basically the main part that I originally planed for this article.

[perryloo]

Not too sure what practical use the above is to modders or players, other than seeing the internal workings of the game. its clever, but is there some practical use?

Practical use of the cheatengine in TR games....
I have only used the cheatengine in TR Anniversary to be able to get inside some of the cutscenes. Some TRA cutscenes can use a simple savepoint to get into them, but others like the bike chase to get onto the boat requires the cheatengine to enter.

[xtimz]

Originally Posted by perryloo

Not too sure what practical use the above is to modders or players, other than seeing the internal workings of the game. its clever, but is there some practical use?

I haven't modded, so I wouldn't know that part. For players, I would show something that might be interesting. I thought about showing those directly, but I probably can't explain them without CheatEngine. So in the future, I might refer to this thread again and again and again.

BTW: I haven't finished. This is just the beginning. I'll try to finish it.

[xtimz]

Pointer to Lara's ItemInfo structures
The sequence number of Lara in the item list varies between levels. That's very inconvenient when watching Lara's data. Thankfully, there is another pointer that always points to Lara's ItemInfo structure. So my CT file for Lara is

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>30</ID>
      <Description>"speed"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>1E</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>32</ID>
      <Description>"fallspeed"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>20</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>34</ID>
      <Description>"hit_points"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>22</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>64</ID>
      <Description>"pos.x_pos W-E"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>4 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>40</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>68</ID>
      <Description>"pos.y_pos U-D"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>4 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>44</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>72</ID>
      <Description>"pos.z_pos S-N"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>4 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>48</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>76</ID>
      <Description>"pos.x_rot"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>4C</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>78</ID>
      <Description>"pos.y_rot L-R"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>4E</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>80</ID>
      <Description>"pos.z_rot"</Description>
      <ShowAsSigned>1</ShowAsSigned>
      <VariableType>2 Bytes</VariableType>
      <Address>6D62A4</Address>
      <Offsets>
        <Offset>50</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

It watches the following data of Lara.

1. speed.
2. fallspeed.
3. hit_points: The health.
4. pos.x_pos W-E: The position. W-E means smaller value is West, bigger value is East.
5. pos.y_pos U-D: The position. U-D means smaller value is Up, bigger value is Down.
6. pos.z_pos S-N: The position. S-N means smaller value is South, bigger value is North.
7. pos.x_rot: The facing direction.
8. pos.y_rot L-R: The facing direction. L-R means smaller value is Left, bigger value is Right.
9. pos.z_rot: The facing direction.

BTW: The PHD_3DPOS structure is in 3DGLODEF.H, as follows.

typedef struct {
	sint32 x_pos;
	sint32 y_pos;
	sint32 z_pos;
	sint16 x_rot;
	sint16 y_rot;
	sint16 z_rot;
}PHD_3DPOS;

[mizuno_suisei]

This is all super intriguing! It's likely you re well aware of this but seems more on the quiet - have you used FexInspectSK? It seems slightly more comprehensive (allows placed object ID changes, trigger flags etc)

[xtimz]

Originally Posted by mizuno_suisei

This is all super intriguing! It's likely you re well aware of this but seems more on the quiet - have you used FexInspectSK? It seems slightly more comprehensive (allows placed object ID changes, trigger flags etc)

Ah... I really don't know. Thank you. My FexInspect version is always 1.2 (Revision 0). I guess that might be the reason I failed every time when I tried to use FexInspect to edit the level file.

[xtimz]

Hi, this is for the kayak in Madubu Gorge of TR3. In speedruns, people use a fixed sequence to control the kayak. But sometimes the sequence won't work because the initial position of the kayak is not fixed. The initial position is determined by two values in the internal memory, (current_xvel, current_zvel), which is the velocity of the current in x (West-East) and z (South-North) directions, respectively. These two values are in the LARA_INFO structure, so please save the following code in a .CT file and open it with CheatEngine.

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>1</ID>
      <Description>"ITEM_INFO"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>10030</ID>
          <Description>"speed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>1E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10032</ID>
          <Description>"fallspeed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>20</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10034</ID>
          <Description>"hit_points"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10064</ID>
          <Description>"pos.x_pos W-E"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>40</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10068</ID>
          <Description>"pos.y_pos U-D"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>44</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10072</ID>
          <Description>"pos.z_pos S-N"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>48</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10076</ID>
          <Description>"pos.x_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>4C</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10078</ID>
          <Description>"pos.y_rot L-R"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>4E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10080</ID>
          <Description>"pos.z_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>50</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>2</ID>
      <Description>"LARA_INFO"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>20022</ID>
          <Description>"air"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>16</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20030</ID>
          <Description>"current_xvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>1E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20032</ID>
          <Description>"current_yvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>20</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20034</ID>
          <Description>"current_zvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20038</ID>
          <Description>"flare_age"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>26</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20210</ID>
          <Description>"ammo.Shotgun"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>D2</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20202</ID>
          <Description>"ammo.DesertEagle"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>CA</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20206</ID>
          <Description>"ammo.Uzis"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>CE</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20214</ID>
          <Description>"ammo.Harpoon"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>D6</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20226</ID>
          <Description>"ammo.MP5"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>E2</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20218</ID>
          <Description>"ammo.Rocket"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>DA</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20222</ID>
          <Description>"ammo.Grenade"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>DE</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

The code works in both the English and the Japanese version of TR3. (Savegames do not mutually work.) It should be something like this:



I separated ITEM_INFO and LARA_INFO into two groups. I also added some other useful values from LARA_INFO.
(1) air: The air left when Lara is underwater. The full value is 1800, and the value decreases 1 per frame. So it takes 60 seconds to reach 0.
(2) flare_age: The flare time left. The full value is 900, and the value decreases 1 per frame. So it takes 30 seconds to reach 0.
(3) ammo: The ammo of guns. A shotgun shot counts for 6 ammo, others are normal.

==================================================

I also prepared a specific .CT file for the Madubu Gorge level.

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>1</ID>
      <Description>"Crocodile 4"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>10034</ID>
          <Description>"hit_points"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*61+22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10064</ID>
          <Description>"pos.x_pos W-E"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*61+40</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10068</ID>
          <Description>"pos.y_pos U-D"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*61+44</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>10072</ID>
          <Description>"pos.z_pos S-N"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*61+48</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>2</ID>
      <Description>"Kayak 1"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>20030</ID>
          <Description>"speed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+1E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20032</ID>
          <Description>"fallspeed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+20</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20034</ID>
          <Description>"hit_points"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20064</ID>
          <Description>"pos.x_pos W-E"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+40</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20068</ID>
          <Description>"pos.y_pos U-D"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+44</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20072</ID>
          <Description>"pos.z_pos S-N"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+48</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20076</ID>
          <Description>"pos.x_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+4C</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20078</ID>
          <Description>"pos.y_rot L-R"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+4E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>20080</ID>
          <Description>"pos.z_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1F+50</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>3</ID>
      <Description>"Kayak 2"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>30030</ID>
          <Description>"speed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+1E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30032</ID>
          <Description>"fallspeed"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+20</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30034</ID>
          <Description>"hit_points"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30064</ID>
          <Description>"pos.x_pos W-E"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+40</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30068</ID>
          <Description>"pos.y_pos U-D"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+44</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30072</ID>
          <Description>"pos.z_pos S-N"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+48</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30076</ID>
          <Description>"pos.x_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+4C</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30078</ID>
          <Description>"pos.y_rot L-R"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+4E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>30080</ID>
          <Description>"pos.z_rot"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6E2A1C</Address>
          <Offsets>
            <Offset>84*1D+50</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>4</ID>
      <Description>"Lara"</Description>
      <Options moManualExpandCollapse="1"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>40034</ID>
          <Description>"hit_points"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>6D62A4</Address>
          <Offsets>
            <Offset>22</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>50030</ID>
          <Description>"current_xvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>1E</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>50032</ID>
          <Description>"current_yvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>20</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>50034</ID>
          <Description>"current_zvel"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>2 Bytes</VariableType>
          <Address>00462B3C</Address>
          <Offsets>
            <Offset>22</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

It should be like this:



Crocodile 4 is the one under the big kayak drop at the end of the level. The values of Crocodiles and Kayaks only work in Madubu Gorge. The values of Lara work across all levels.

==================================================

Finally, about this (current_xvel, current_zvel) pair and the initial position of kayaks. These current values do not clear across levels, and resides in the savegames as LARA_INFO does, which means they do not clear even if you restart the game. They change in the following 3 ways:

(1) Lara swims through a water area that has current.
(2) Lara drops into a water area that is still water but close to some area that has current.
(3) Lara gets into an UPV in Lud's Gate or a kayak in Madubu Gorge. The values clear to 0 at the compensation of moving the initial positions of the vehicles.

The initial positions of kayaks may change a lot. A tile contains 1024 units, and the change of positions may up to 500 units, which is half of the block. That's why the control sequence may not work sometimes. I think the best way to have a fixed (current_xvel, current_zvel) values is the following.

(1) Go to London first, use the UPV in Lud's Gate, which makes the pair of current values (0, 0) after Lud's Gate and City.
(2) Swim straight at the beginning of Coastal Village, which changes the values to (0, 2768) after Coastal Village and Crash Site.
(3) In Madubu Gorge, hang from the ledge before dropping into the water for the kayak.

That's all I can think. BTW: After Madubu Gorge, there is only one change in the current values, which is in the water element area of The Lost City Of Tinnos.