Basic UE4 Win64 Base Table

[Cake-san]

Update 3.9
- Optimized script to be a bit faster & fixed other issues...

[gideon25]

SCript is all sorts of awesome. Its changed the way I can approach UE4 games.

[Paul44]

@Cake-san: I'm currently researching Mirror's Edge (32b), which uses UE engine. Just in/accidently ran into your tool here. So definitely wanted to give it a closer look...
I was not expecting it to returns result - being x32 - so did some digging into your code (oelala ). Anyways: I've made some printscreens that might help you in guiding me on how to tackle/solve this for this particular UEv/game...
(see here: [ [Link] ])

prenotes:
* using 2nd table, as I assume the 1st table is x64 only
* as you'll notice, I've introduced some 'prints' (my style of debugging), so I could figure out its execution path.

That pdf tells you:
a) the error I get upon running the script
b) the UE engine version (or so I assume)
c) introduced some prints in order to follow its execution path ~ I probably need to figure out the UObject details (or not) and/or FNamePool's aob string (how to approach this then)?
d) added some code (from @CEF) so that I could figure out why it returned '0.1'?

My biggest suggestion at the moment, would be to add some "guideline" value prints (like I did), that will help you out more easily in figuring out what is happening on our/tablemaker side. The code is well structured, but you can not expect every author to dig through all that code...
Just to be clear: I see your tool as a 'must-have' for any author tackling UE-based games. So anything that can make my life easier on where to focus, would definitely be added value.


ps1: I never used [Dissect code] before, so your remark "search for Referenced strings" is a bit ambiguous to me. Are you referring to the Value Type 'string' search, the [Search ~ Find asm code] or the [View ~ Referenced strings] (I assume the lather)?
ps2: if you want, I can upload the pdf to my dropbox account...

[Cake-san]

...

Ahh ue3, looking at your pdf file ,there's nothing I can help with other than giving some tips...

For now , I haven't seen any pattern than can group up their version because looking at each game that use ue3 that I had(just a few,though), most of them have different offset/structure for GObject meaning dev code their game most of the time instead of relying on gui stuff that ue4 has, nowadays...

So, you have to make your own config, mapping the GObject structure & finding the right FNamePool & GUObjectArray for the table to work...

Happy exploring ,then

ps: I can't even run the f*****g game, lol

[Paul44]

^fyi: I have the legal vs, but there is also a gog version (and resp. repacks ofc). No problems running this on win10/x64, with DxWin 2.05... (~ windowed).
I'll do some googling related to "mapping the GObject structure & finding the right FNamePool & GUObjectArray" in order to get some grasp on this. Which ue3 game(s) did you tackle; that might be helpful for me as well... at least, I then can get some "meat" to look at... (perhaps by comparing/using them VFT's, I might link this back to ME)

[aSwedishMagyar]

ps1: I never used [Dissect code] before, so your remark "search for Referenced strings" is a bit ambiguous to me. Are you referring to the Value Type 'string' search, the [Search ~ Find asm code] or the [View ~ Referenced strings] (I assume the lather)?
ps2: if you want, I can upload the pdf to my dropbox account...

To search for referenced strings go to memory view and hit Ctrl+Alt+R. It will bring up a window saying you need to dissect code first, just hit OK and wait for it to finish. Alternatively for a better UI you can use x64Dbg (either 32 bit or 64 bit depending on what the game is) and when you load it up just right click in the CPU section->Search for->All modules->String references.

[Paul44]

^ @aSwedishMagyar: yeah, I prefer using [x32dbg] (in this case) as references are built up far quicker (not that CE is doing a bad job here, but the routine basically tackles "everything", incl them 'Dissect code').

[Cake-san]

...

Mine is gog version, which the game is refusing to run, some stuff is missing... ¯\_(ツ)_/¯

BioShock Infinite, Guilty Gear Xrd Revelator...

[Paul44]

^ get me an SFV of your installment... I made an xdelta 2-ways already for myself: steam-to-gog & vice versa. Both versions are "practically" the same (my guess is that the gog version "disables/skips" the steam drm altogether)...
anyways: just made an sfv of my gog installment : [ [Link] ]. report back, and I'll see what I can do. (btw: gog releases it as v2.0.2 or something, but exe is still v1.0.1.0)

ps: BioShock Infinite, is something I know. Will probably have a go on that one this weekend...

-EDIT-
got Bioshock installed, and table working as expected. I'll probably dive into it this weekend, trying to link that info. and hopefully use that process accordingly in ME... keep you posted.

-UPDATE-
I've collected - for both static mem_addresses 'FNamePool' & 'GUObjectArray' - a number of opcodes to compare with ME; and I'm pretty sure I got the right ones now (also check this pdf : [ [Link] ]).
But now getting an arithmic error on 'stringoffset' (around line #198). Bottomline: i'm guessing I still need to define the proper 'UE3 struct' values for this game... (see also my prev pdf)

@Cake-san: can you explain in a few words how you did this for BioInfinite? I did look at both structs for these addresses, but could not "link" anything to them struct_values in your script...

[Cake-san]

Update 4
- Added structureDissectCallback - so, just like mono/.net when this script is activated , it will automatically fill structure dissect with symbols if it's a valid Instance address..
- Object Dumper will now dump Enum's value & StructPropery/ObjectProperty will have ~ toward its ScriptStruct

Experimental

..

Sorry, don't know, what to do, anymore.... the missing file is just _StartupMovie.bik & VclStylesInno.dll ,
Running Dependency Walker shows a lot of missing dll & dll cpu version in red x64 instead of x86.

stringoffset is global var set when FNameStringAlgo(1,true) is run , to determine the string offset....

[Paul44]

^ ignore the bik file; I renamed that to skip the intro...
I've uploaded that dll here [ [Link] ], but that's not going to do it (seems to be related to inno_installer)...

anyways: I want to come back to my main request actually: Bioshock Inf seems to use this struct_config in your main script:
---------UE3 struct---------
--1.25
elseif UE4ver>=1 then
UObject.ObjectId= 0x4
UObject.Outer = 0x14
UObject.FNameIndex = 0x18
...

and my question is "simply": can you explain to me how you got/defined those hex_values for BioInf? I can then verify that on my side in that game; and hopefully follow the same logic in ME...

ps: if you really want to get ME running, let me know ofc (and if not too much trouble, get me an sfv from your installment).
But obviously, you can not do this for every game/requestor around, which is why I'd like to find some guidelines here for other tablemakers to use/follow... (without needing to go through all that code ofc )

btw: if you want to drop this altogether (being UE3 et al), just say so. I do not need this stuff for my table (practically finished), just trying to get some feeling with the tool already...

as for that error: my guess is that i get this because the struct_values are incorrect...

[Cake-san]

Finally, able to run the game, Thank you very much , though

Hmm , game use widechar, hence the error... welp, just force it then instead of check

here it is...

FNameIndex,Class,Outer,ObjectId

Dissect GUObjectArray which contain objects, look at 1st & 2nd object...

You can get info from looking at the pattern, like FNameIndex is an integers & you can feed it to FNameStringAlgo to get the string if all problems relating to FNamePool & GUObjectArray had been fixed...

Then, Class & Outer are just another pointer to object which you can get the FNameIndex...

ObjectId is the array index

When, that had been set, you can re-enable the table & GetNameAlgo / GetFullNameAlgo now, can be use...

You can now try to run the dumper , find Property/s , dissect it & compare to get the Offset & propsize
Dissect GameEngine class to get super,member & nextmember , so on...

[Paul44]

^ Dynamite, man! Tested and working for both Steam & GOG version. thx a mil...
it looked like steam & gog sometimes handle ptrs differently; or perhaps this changes as one progresses in the game (only doing some final testing with the gog vs atm). anyways: that's the reason I double-checked both versions.

I will be posting my table some time this weekend probably, and spend some time on following up your comments in the coming week(s). See if I can follow your instructions, making notes as I go... will be posting my feedback eventually...
cheers

[gideon25]

Update 4
- Added structureDissectCallback - so, just like mono/.net when this script is activated , it will automatically fill structure dissect with symbols if it's a valid Instance address..

That thing is AWESOME! Although, it can cause a crash after using it too much in one session (after using it too much clicking the "Structures" button will crash cheat engine), as well as getting slower and slower as you use it. But I love it! Wish there was a way also to right click on structures in the structure list and delete individual ones. So I could save only what I wanted. Instead I have to export a specific one delete them all and then import them :/

[aSwedishMagyar]

Wish there was a way also to right click on structures in the structure list and delete individual ones. So I could save only what I wanted. Instead I have to export a specific one delete them all and then import them :/

You don't actually have to do that, you can just go into the dissect window, select the structure you want and then in structure options just delete the structure you are currently looking at.

Alternatively you can use this to select a specific one without having to enter the dissect window.