Edit: The info here is outdated, for more updated and comprehensive info, visit this blog post from AMD.

If you followed or even read my tutorial on adding stringid and tag name entries, you may have realized that there isn't a whole lot of room to work with, as the padding ends on the nearest 0x1000 offset. Space can be injected into the meta portion of the map, so why can't it be done here too?

A personal Story to Start Out...

When I set out to test this, I went about it using the offsets in AMD's meta injection blog post. My initial tests involved modifying the stringid/tagname magic, which I later found out was incorrect to do (thanks AMD), so we'll just act like that never happened. Anyways, the values I edited were File Size, Asset Data Offset, Locale Address Mask, Asset Offset Relative to the Header's End, and StringID Data Offset, Tag Name Data Offset, and Tag Name Table Offset, depending on what was modified. Hopeful, I sent the map to my xbox to test it, but was disappointed when I found it loaded to 100% in the lobby, but froze immediately on the loading screen. I was still determined to get this to work. Since I had just modified the values in the header, the map was still open in my hex editor. I noticed a strange value at 0x474. I decided to try and add the total size I injected to this value. What do you know... the map loaded!

Now I was going to wait to post about this until I understood programming enough to make a program to automate this; but that's taking longer than expected, and I didn't want to hold out on this for too long. However, I still do plan on making that, you'll just have to go about it manually in the meantime.

I recently found a calculation that 0x474 fits into:

0x474 + String Mask + Partition 0 Size = Locales Starting Offset

Where do I inject?

Well, since we're injecting space into the the stringid and tag name portion of the map, you're going to need to know where to inject that space. We can reference the files in our "Formats" folder in Assembly pretty easily to get the starting offsets of these, but unlike meta injecting, we're actually going to be injecting to the end of that data. Since the end of one section in the map has the same offset as the start of another, we can take advantage of this to find the end of the section easier.

So;

End of StringID table padding = StringID Data Offset (0x164)

End of StringID data padding = Tag Name Data Offset (0x2B8)

End of Tag Name data padding = Tag Name Table Offset (0x2C0)

End of Tag Name table padding = Asset Data Offset (0x470 in Halo 3 - Reach, 0x480 in Halo 4)

Don't forget, these aren't direct file offset pointers (Except Asset Data Offset, don't worry about that one). You'll have to do a little math to get the file offset. This can be found by adding the Size of the Header to the value, and subtracting the stringid/tagname magic.

Here are the header sizes to help you out:

Halo 3/ODST: 0x3000

Halo Reach: 0xA000

Halo 4: 0x1E000

And the stringid/tagname magic can be found at 0x47C in Halo 3 - Reach, and at 0x48C in Halo 4.

The alignment is also different from the meta portion of the map. Unlike the meta, these areas have an alignment of 0x1000, so the amount you inject will have to be a multiple of that.

If you want to inject to more than one of these in a single go, I recommend starting with the last, and moving backwards towards the first, so these values in the header don't confuse you when you go back to look at them as you're injecting. After you've got the data injected, time to fix the values in the header.

Values to Modify

File Size - add total size injected

StringID Data Offset - Add size injected to string table

Tag Name Data Offset - Add size injected to string table + data

Tag Name Table Offset - Add size injected to string table + data, and tagname data

Asset Data Offset - add total size injected

0x474 - add total size injected

Locale Address Mask - add total size injected

Asset Offset Relative to the Header's End - add total size injected

In Halo 3/Reach

0x8 - Add total size injected

0x164 - Add size injected to string table

0x2B8 - Add size injected to string table + data

0x2C0 - Add size injected to string table + data, and tagname data

0x470 - Add total size injected

0x474 - Add total size injected

0x478 - Add total size injected

0x480 - Add total size injected

In Halo 4

0x8 - Add total size injected

0x164 - Add size injected to string table

0x2B8 - Add size injected to string table + data

0x2C0 - Add size injected to string table + data, and tagname data

0x480 - Add total size injected

0x484 - Add total size injected

0x488 - Add total size injected

0x490 - Add total size injected

If you did everything correctly, you should have successfully injected space into the area you chose to inject to. Congrats!

Things to Note

• When I did this with Halo 4, the map loaded in-game, but Assembly refused to open it.
  

Thanks

Major thanks to AMD, for both originally sparking my research on this, and for lots of help along the way.

A big thanks to everyone who helped work on mapexpand, and anyone who helped map the header's values. This wouldn't be possible without you guys.

If you have any questions, comments, or need clarification, please don't be afraid to post here or PM me!