This project uses unconventional approaches in several critical areas (scene graph injection, skin buffer manipulation, binary patches). External contributions could inadvertently break invariants [...]

Fallout 4 1.11.191 next-gen — multiplayer mod (FoM-lite framework). Solo-dev, evening project. Target: 10-player persistent-world survival MMO.

Six months in, solo, evenings, paid for out of my own pocket. The code is free forever under AGPLv3 and stays that way; a coffee goes to the API bill behind the reverse engineering and to the server the test clients run on. The longer write-up of where the project stands and why it is built this way is on Ko-fi.

▶ Watch the demo on YouTube

2 clients side-by-side, 1:52. Clothing and armor synced on the remote player, weapons with every attachment assembled by the engine exactly as equipped, and the full third-person animation set playing correctly on the ghost.

┌────────────────────────────────────────────────────────────────────────┐
│                     Python Server (asyncio UDP)                        │
│  authoritative state · identity-keyed (base, cell) · validator         │
│  reliable channel (SACK + retransmit) · JSON snapshot persistence      │
└─────────────────────────┬──────────────────────────────────────────────┘
                          │ binary protocol v26 (44B POS_BCAST · reliable channel · appearance recipes · world objects · session lifecycle)
            ┌─────────────┼─────────────┐
            │             │             │
       ┌────▼─────┐  ┌────▼─────┐  ┌────▼─────┐
       │ Client A │  │ Client B │  │   ...    │
       │  FO4 +   │  │  FO4 +   │  │  Up to   │
       │ dxgi.dll │  │ dxgi.dll │  │  10      │
       │  proxy   │  │  proxy   │  │  peers   │
       └──────────┘  └──────────┘  └──────────┘
       Each client:
       - 1 LOCAL player (vanilla FO4 controls, full anim)
       - N GHOST bodies (1 per remote peer, native scene graph)
       - in-game character creator (ImGui on the game's own device)

• Single-instance bypass (1-byte binary patch @ RVA 0xC2FB62) — runs 2 FO4 instances simultaneously on the same machine. Required for local multi-client testing without spinning up a second physical PC. The patch flips a NOP-equivalent on the singleton-check branch.
• apply_materials walker discovery (sub_140255BA0) — the missing step for .bgsm material resolution after standalone NIF load. Documented in re/stradaB_pink_body_solution.txt.
• NIF loader public API (sub_1417B3E90) — bypasses the broken cache wrapper that hangs with naive args.
• Scene graph integration — depth occlusion, lighting, shadows free via BSFadeNode attachment to ShadowSceneNode.
• BSSkin::Instance layout fully RE'd — bones_fb at +0x10, bones_pri at +0x28, boneData at +0x40, skel_root at +0x48. Critical empirical finding via TTD: bones_pri[i] is NOT a NiAVObject** but a direct pointer-to-matrix cache (= bones_fb[i]+0x70). The GPU reads matrices via SRV indirection through this cache. Documented in re/M8P3_skin_instance_dossier.txt.
• Model-DB entry root shape — a NIF loaded with the fade-wrap flag is stored with a BSFadeNode root, and the engine's biped build silently produces no geometry from such an entry. The engine never loads Frame.nif through the public loader, so a mod-created entry is the only one it finds. Biped loads must use the engine's own flags (0x2C).
• NiNode::AttachChild growth (sub_1416BE170 / sub_1404E7B50) — a full children array is grown by SetSize, which frees the old buffer; file-loaded bones keep theirs in the loader arena, so the free faults. Pre-grow with the same pool allocation and never free the old block.
• Power-armor pieces — the ARMA is a placeholder shared by every PA model; the visible mesh is the model OMOD's MODL, skinned to PA-only bones. Condition and core charge are one Health extra (0x25) on the inventory stack; the engine's AddItem / AttachModToInventoryItem workers and the ExtraDataList add idiom are all callable from the DLL.

Latest 3 patches summarized below. Full version history in CHANGELOG.md.

Tag v0.8.0, wire proto v26 (reject reason and resume token in WELCOME, display name in PEER_JOIN, new HELLO_RESUME).

• The ghost is born from a join and dies with a leave — a registry keyed by peer id replaces the thirty-second timer that never re-armed and the PEER_LEAVE handler that only logged. Events queue on the network thread, a main-thread tick injects once the scene is proven stable (120 ticks and two real seconds, with loads bracketed because LoadGame blocks for six), and teardown follows the order law from the bottom of the wardrobe up.
• The single pointer is gone — g_injected_cube was read from thirty places; body, head, bones, geometries, cull contributors, power-armor graft and saved binds now live in a per-peer record, the pose and crouch slots are deleted outright because the handlers iterate the registry, and the ghost skeleton is a private deep clone that dies with its body. Only the canonical joint names stay global, because they are the wire's bone index order.
• The face that rotted after a power armor — a rejoin gave the ghost a stretched sheet anchored to the local player's frame, or no head with the eyes left hanging. Seven explanations were killed by measurement. The master was always intact: it keeps raw pointers to the LIVE player's bone nodes, and entering or leaving power armor rebuilds that rig, so the re-bind read names out of recycled memory. The master is anchored to a reference skeleton this DLL owns at the one moment its pointers are still valid.
• The power armor a joiner could not see — the pending equip queue held two fields and dropped the OMOD list, so six empty placeholders attached and the frame stayed naked. A power-armor piece keeps its whole mesh on the model OMOD.
• Reconnection — a session loop with backoff, resume tokens, reject reasons that decide between retrying and giving up, and a dead-server detector. A goodbye on ALT+F4, so a peer who closes the game stops standing in everyone else's world.
• Presence — a late joiner is shown where everyone is and what they wear, the arriving peer's outfit is announced to those already there, and a worn power-armor frame is handed back to the world when its wearer disappears.
• Not finished — three reconnection holes left open on purpose, a second remote ghost still refused until there is a third client to test with, and the outfit still only as complete as the equip events the server saw, which is phase 3.

Full detail in CHANGELOG.md.

Tag v0.7.6, wire proto v25 (no protocol change: a paint job is an OMOD, and pieces already carried their OMOD lists).

• Paint jobs and material mods on the ghost — the material swap of every mod on a piece is read from the OMOD's own property records and bound to the piece meshes on the wearer's ghost; a station edit is on the other client's ghost before the menu closes.
• The power armor station — it is not the ExamineMenu: the station runs its own PowerArmorModMenu, previews mods while you browse and makes the inventory count read 2 through a working copy. Nearby frames are polled while the menu lives, reported once their contents are stable, and the frame re-seats itself afterwards through the owner-side drift watch (despawn and rebirth, as for any move).
• Two crashes closed — every headlamp mod NIF is a BSValueNode add-on point with no geometry; the engine hangs a glow effect under it with global bookkeeping that outlived the ghost's clone. Headlamps are skipped on the ghost and add-on nodes are stripped from every clone.
• The skeleton loan — the second player to enter a painted frame lost the paint locally. Third time for the same class of bug: my load of the PA skeleton created the model-DB entry the engine later cloned for the player, with a bare root and without the engine's "materials applied" latch, so Load3D re-applied the default materials two milliseconds after the biped had painted them. The load now uses the engine's own skeleton options.
• Not finished — a client that quits while wearing power armor loses the frame for everyone (session-lifecycle work); fingers do not articulate.

Full detail in CHANGELOG.md.

Tag v0.7.5, wire proto v25.

• World-object spawn sync (B6.14, first version) — a REFR created in one client's world is reported to the server, which mints a logical id, persists it and has every client place a local copy; the sender binds its own echo. Console spawns and power-armor frames today, settlement builds later. Deaths are reported by a polling sweep, streaming losses are re-queued instead of reported, and a frame re-enabled by a power-armor exit is re-announced as a new spawn.
• Power armor (B6.13, three quarters) — a frame left anywhere with any pieces mounted is the same frame on every client: pieces, upgrade mods, condition and core charge travel with the object (server ledger, persisted), manual changes ship as full state, replicas are stocked through the engine's own AddItem and AttachModToInventoryItem workers, and the Health extra is created the way the engine creates it. The wearer's ghost is dressed: frame plus the model meshes of every piece, on a ghost skeleton grafted with the 20 PA-only bones and retargeted to PA proportions while the frame is worn.
• Frames are not loot — the shared-loot layer was mediating the native enter transfer and destroying pieces on rejected takes. Exempted.
• The two-day bug — "whoever enters second loses their body" was the fade-wrap flag on my NIF load storing a BSFadeNode as the model-DB entry root; the engine's biped build wants a plain NiNode. Loads now use the engine's own biped flags.
• AttachChild on file-loaded bones — growing a full children array frees a loader-arena block and faults; I pre-grow the array myself. The Pip-Boy bone had capacity zero all along.
• Steam version pin — the Steam manifest for the game is pinned (buildid and depot ids) so a Bethesda patch cannot replace the 1.11.191 binary; the script that does it stays local.
• Not finished — paint jobs and material mods are not replicated; a client that quits while wearing power armor loses the frame for everyone (session-lifecycle work); fingers do not articulate.

Full detail in CHANGELOG.md.

I've been waiting ~10 years for someone to ship Fallout 4 multiplayer. Existing efforts I'm aware of:

• Fallout Together — abandoned 2020, never reached stable bone replication.
• F4MP — paused / no animation system in the public state I last saw.
• Skyrim Together (predecessor for SkyrimSE) — got working but with desync issues that informed several of the architecture choices here.

This project takes a different architectural bet: native scene-graph injection (BSFadeNode → ShadowSceneNode) plus per-bone joint replication via the engine's own UpdateDownwardPass propagation, instead of reimplementing skinning from scratch. I let the engine do the heavy lifting (skin upload, GPU constant buffers, lighting, shadows when fixed) and feed it joint matrices via memory writes that match what its anim graph would have produced.

Whether this scales cleanly to 10 peers is an open question — current testing is 2-peer. The RE work for the 1.11.191 next-gen build (skin pipeline, pointer-cache layout, NIF loader API) is the contribution that should be most reusable for anyone else attempting the same thing.

• 1st-person walk cycle plays at the wrong rate — with the sender in first person the ghost now animates correctly (v0.6.5), but the walk clip runs at a rate unrelated to the ground covered until the sender switches view and back. The locomotion scalars the behavior scales its clips from are not written into a parked graph; deriving them from frame-to-frame displacement was tried and reverted (this drive does not run every frame, so the displacement spans gaps the delta time does not account for). The engine's own movement speed is the correct source. Workaround: one camera round-trip.
• Ghost body casts no shadow — the body is attached to the ShadowSceneNode and gets depth, lighting and occlusion from it, but it still does not appear in the shadow pass. Separate render-flag investigation, deferred.
• No dedicated Pip-Boy pose on the ghost — the Pip-Boy mesh itself is correct since v0.6.5 (parented to PipboyBone, riding the forearm and animating with it), and the ghost no longer contorts while a peer has it open. What is missing is the gesture: vanilla has no third-person arm-raise for a remote player consulting a Pip-Boy, so the ghost shows its normal standing pose instead of the animation the peer sees.
• Tested with 2 peers — the peer-keyed registry landed in v0.8.0 and the ghost path holds no single-peer global any more, but a second remote ghost is still refused on purpose: that path has never been executed, because two clients means one remote peer each. It opens when there is a third client to prove it with. 10-peer scaling stays theoretical.
• Network rate-limited to 20Hz — works smoothly on LAN, untested over real-world internet routes; receiver-side interpolation between POSE_BROADCAST frames is open work.
• Container UI doesn't refresh on the observer when peers picklock the same container — engine quirk in the ContainerMenu redraw path; closing and reopening the container forces the refresh. Cosmetic, no state impact. Note: the antidupe layer is still enforced server-side by the container ack chain (server-validated count), so the observer can't actually take items that another peer has already removed even if the menu's local view is stale — attempts get rejected before they reach the inventory.
• Peer ghosts spawn naked at startup until the peer actively equips something — side effect of disabling B8 force-equip-cycle in v0.5.4 (bridge crash fix). Items already worn at save load don't fire engine equip events, so the M9 visual-sync pipeline never sees them. Items the peer actively equips/draws during the session show up correctly (modded weapons, swapped armor, clothes changes — all visible). A non-engine-call apparel bootstrap broadcast is scaffolded in fw_native/src/hooks/equip_announce.{h,cpp} for future implementation when the BipedAnim layout is RE'd.
• Non-humanoid pose replication is unsafe — ownership and sync are no longer limited to hostile raiders: the proximity sphere picks up any actor within its radius, so settlers, animals and creatures all enter the same pipeline. Pose replication, though, still assumes the human skeleton, and the match gate accepts a single coincidental bone-name hit — enough for a creature to be fed a human pose. A mole rat was seen with part of its body stretched toward a fixed map coordinate. Raising the threshold is not the fix (humanoid raiders themselves match only 4-7 joints); this needs a skeleton-schema gate, tracked in scene_inject.cpp at kNpcPoseMinMatch.
• A raider occasionally doesn't join the fight on the non-owner — non-deterministic and rare. Aggro on noise / line of sight works as designed, but every so often one raider stays idle on the client that doesn't own it. Tolerated for now.
• Raider appearance and loot diverge per client — the Concord raiders are placed leveled refs, so the form_id matches across clients (pos / aggro / death sync all work), but each client's engine rolls a different NPC variant, outfit, weapon, and mods from the leveled lists with its own RNG. The same raider therefore looks different and drops different loot on each screen. Parked: a clean fix needs either an ESL of fixed content or a seeded-RNG / capture-replicate hook, and I'm deliberately staying engine-native (no ESL, no Creation Kit) for now.
• A client that quits while wearing power armor no longer loses the frame for everyone: v0.8.0 marks the record worn instead of deleting it and hands the frame back at its last known position on a graceful leave, an eviction or a timeout, taking the plates out of the stored outfit so the rejoining peer is not wearing an empty shell. Covered by unit tests; the live test with a wearer killed from the task manager (T7) has not been run yet.
• Power-armor headlamps do not light up on the ghost — the lamp mesh is an engine add-on point whose glow effect is bookkept globally, which is the crash class closed in v0.7.6; the ghost skips it.
• Fingers and toes do not articulate on ghosts — 53 of the 80 canonical joints never leave the sender's render tree, so hands and feet ride their parent joints without bending.
• A face master built while the local player wears power armor is not validated — the master keeps pointers into the rig it was cloned from, and v0.8.0 anchors them to a reference skeleton this DLL owns so a power-armor rebuild cannot recycle them underneath. What is not checked is the master itself: nothing refuses to park one whose bone names do not exist in the human skeleton. The permanent tripwire is the [face-slots] debug line.

Fallout4.exe 1.11.191 next-gen (December 2025). ImageBase 0x140000000 (no ASLR in practice). IDA Pro 9.3 used for static decomp; cached DB at re/Fallout4.exe.i64 (NOT committed — proprietary format + size). Regenerate locally from your own copy of Fallout4.exe.

Personal mod project. Not distributed. Requires owned copy of Fallout 4. No Bethesda IP committed to this repo (no game binaries, no BA2 contents, no decomp dumps — only my own analysis dossiers).

• RE dossiers (English, public): re/M8P{1,2,3}_*.txt, re/M8_strategic_decision.txt — full reverse-engineering writeups for the player-creation pipeline (NIF loader API, BSGeometry skin instance layout, BSSkin pipeline + bones_pri pointer cache).
• Full version history: CHANGELOG.md