Lua Port for GNames/GObjects Dumper for UE3

[happyTugs]

hello,

I wanted to learn how to reverse engineer Unreal Engine so I decided on UE3 (i'm late, i know); I have learned a lot over the past few days.
The link below is the original version of the UE3 SdkGen by TheFeckless; all of the credit goes to him!

[Link]

His work introduced me to UE3 and I probably wouldn't be here had he not created the original UE3 SdkGen in the first place.

As such, I would like to share my simple port of TheFeckless UE3 GNames/GObjects dumper for Lua since I don't want to inject a dll to dump the objects/names, nor rip the dll and write it in asm.

anyhow, this dumper was made for Dishonored, but you can obviously change the parameters used. If you are interested in how the dumps should look, I included an attachment with Dishonored's names/objects. There were some rather comical names.

m_DummyByteBecauseUnrealDemandsAtLeastFourBytesInAStruct1

If there are any improvements I can make, please let me know. I am still fairly new to lua and UE in general.

thank you,
happyTugs

old stuff

Lua Port of Feckless.CT

GNames/GObjects Dumper for UE3 ported from TheFeckless

(5.56 KiB) Downloaded 176 times

Dishonored GObject & GNames Dump.7z

Extract in 7-zip.
PW: FearlessRev

(907.11 KiB) Downloaded 113 times

GNames & GObject Dumper for UE3.CT

July 2, 2020

(125.95 KiB) Downloaded 166 times

Dishonored GObject & GNames Dump.zip

no need for 7-zip anymore. July 2, 2020
PW: FearlessRev

(1.57 MiB) Downloaded 125 times

[happyTugs]

July 2, 2020

I finally figured out how to add the names of the Outer/Class variables!

after delving more into the tutorial and reading some more about the Unreal Engine api (along with my own knowledge of Unity), I was able to determine a fair amount of interesting things.

Quoting from the Unreal Engine documentation..

FNames are case-insensitive, and are stored as a combination of an index into a table of unique strings and an instance number.

The Outer object is instantiated from the class UObject; as such, you can (feel free to correct me) grab the name of the Outer object using a property of [Link]: the index of FName.

On the other hand, the Class object is instantiated from a different class: [Link].
Similarly, the object also contains an index of FName that we can use to grab its name from [Link]!

with all of this information and along with some further assistance from ReClass, I updated the Lua port to also add both Outer/Class vars and updated the GObjects/GNames dump.

here's a simplified snippet (no right justification) of the GObjects dump...

Code: Select all

UObject[024553] ScriptStruct  13ABDA60  DisGlobalEnums.DisZoneTracker
UObject[024554] ArrayProperty  13985110  DisInventoryLoadout.m_AbstractItems
UObject[024555] Enum          13A48540  DisGlobalEnums.EElixirType

[happyTugs]

July 09, 2020

i had just foolishly realized that there were actually multiple Outers in a UObject, silly me. to solve that, i simply used recursion to loop through all the valid Outers and write them to the dump.

recursive function

Code: Select all

local function GetOuterName(pOuterObject) 
  if pOuterObject == nil then return '' end
  local OuterNameIndex = readInteger(pOuterObject + UObject.FNameIndex)
  if NameEnums[OuterNameIndex] ~= nil then
    if readInteger(pOuterObject + UObject.Outer) ~= 0 then
      return GetOuterName(readPointer(pOuterObject + UObject.Outer))..'.'..NameEnums[OuterNameIndex]
    else
      return NameEnums[OuterNameIndex]
    end
  else
    return ''
  end
end

hopefully, that will be the end of that..

anyhow, i have also made some slight optimizations to make the script more transparent in the instance that someone picks up my port; regardless, the likelihood is slim as ue3 is old news.

besides that, the new update has been added. i should probably move on to ue4 after this..