In this tutorial I'll tell you how to remove a model out of sadx (without sadx crashing), so you'll have more space for custom models. Make sure to have a back-up of sonic.exe.

First, get the SEG adress of the model you want to remove. I'll use "model_12335828" for this example. That's a pretty big model from emerald coast segment one.


^ That's model_12335828

Go to (ctrl + G) the SEG adres (dec) in hex workshop (or any other hex editor, but I'm using hex workshop for this tutorial). You're gonna navigate to the Material struct. Right now you're at the Seg struct.


^ That's what you should see

First, skip four bytes. Those are model flags, which aren't of importance right now. Now we're at the pointer to the attach struct. Look at the 32bit unsigned (data inspector). If you're doing it right you'll see "16530088". Now, open a calculator, paste this number in it, then change it from Dec to Hex, now you'll see "FC3AA8". In this tutorial we're removing a model from sonic.exe, so we'll substract the key for sonic.exe (0x400000, the 0x means it's hex, and not dec), and you'll get BC3AA8. Change this to dec, you'll get "12335784". Now, go to this in hex workshop (ctrl + G), and be sure to select dec.


^ That's what you should see

Now, you're at the Attach Struct. From this you're going to navigate to the Material Struct. First, skip 16 (Vertex struct pointer, Normals struct pointer, vertext total and mesh struct) bytes. You're at the pointer to the Material Struct. We're going to do the same as we did before, so open a calculator, put the 32 bit unsigned (data inspector) in it, change it to hex, substract 0x400000 from it, change it to dec, and go to (ctrl + G) that adress in hex workshop (dec). It should be 12315024.


^ That's what you should see

Now you're where you want to be. Click "Edit" - "Select block" in hex workshop, then change the "Method" to Ending Position, put in the SEG adress minus one (12335828 - 1 = 12335827), and then ok. Now you selected the whole model. Click on fill (ctrl + ins), and put in "FF" by "Fill with the following hex byte". Then press ok. Now you got rid of the model data (you basicly replaced it, but now you can put other data over it). If you try to run the game now, it'll crash when loading this model. Since it's attempting at loading a model which doesn't exist. To make it not do this, get the SEG adress (12335828), open it in a calculator, change it to hex, add the key (0x400000 for sonic.exe, which you're hacking right now) to it, and change it to dec. Copy this number, then do find (ctrl + F) in hex workshop, change "Type" to 32 bit unsigned long, and as value the number which you just calculated (16530132), then press ok. Also make sure you have find all instances on, and selected Little Endian byte order. It might find more results (not on this model), then edit the one which fits the format (first 4 bytes which are what you searched for (D43AFC00), then 00 00 00 00, them maybe 01 (this says the model collides), then 00 00, and then maybe 80 (this says the model is visible). When I said maybe I mean it can be different. But most likely it'll be this.


^ That's where I'm talking about

Change these bytes (00 00 00 00 01 00 00 80) to "00 00 00 00 00 00 00 00". So that it doesn't collides and isn't visible anymore. Save this copy of sonic.exe Now the model won't load, the game won't crash and you have free space!
~11Supersonic11 aka CarrierHack