Some of the Meta commands don't do anything. I've debugged them and found they lead to a RET function (do nothing but return). Don't remember which, but I'll be able to provide more info this evening. As well as some mapping of the game's code with symbols, so you know WTF you're looking at and why those functions are relevant/important and how one could use them as helpers or to directly hook code
Here's a simple one: when Unreal Engine initializes the GameViewportClient (that's the game window) it runs a function called SetupInitialLocalPlayer or something like that. You can obviously see from this one a pointer is created (the LocalPlayer). In this structure, at offset 0x30 (if I recall) another pointer is initialized: PlayerController (the generic one). Based on where you are in-game (menu, map 1, map 2, etc.) this pointer is re-initialized. It will be PlayerController, or Maya_PlayerController or some shit or Map_1_PlayerController if you play solo etc. Bottom line is UE re-initializes some UObjects everytime it loads/unloads a map. What you should also know is GameViewportClient and LocalPlayer are never re-initialized (unless you reboot the game). Why is this important? Well.. because you can hook LocalPlayer, then extract your PlayerController pointer from 0x30 at any given point in time. Why is PlayerController important? Well.. it can be used to initialize UCheatManager or other UObjects; furthermore, it is in PlayerController that the God effect occurs (when typing God in the console, a bool value is toggled from one value to another in PlayerController structure)
Hope this insight helps some of you
The GameViewportClient pointer can be referenced "statically" via GEngine pointer and an offset:
Code: Select all
00007FF7B62BBEE3 | 44:8B45 5F | MOV R8D,DWORD PTR SS:[RBP+5F] |
00007FF7B62BBEE7 | 48:8D57 D8 | LEA RDX,QWORD PTR DS:[RDI-28] | rdx:EntryPoint
00007FF7B62BBEEB | 48:8B0D 3EB1BD02 | MOV RCX,QWORD PTR DS:[<GEngine>] |<--
00007FF7B62BBEF2 | E8 F9243500 | CALL <otwd-win64-shipping_106.UEngine::GetLocalPlayerFromControllerId> |
..
..
00007FF7B629617A | 48:8BD9 | MOV RBX,RCX |
00007FF7B629617D | 0FB6FA | MOVZX EDI,DL |
00007FF7B6296180 | 48:8B89 30070000 | MOV RCX,QWORD PTR DS:[RCX+730] |<--
00007FF7B6296187 | 48:85C9 | TEST RCX,RCX |
OTWD-Win64-Shipping.exe+3DA7030 == GEngine; 0x730 == offset. So.. [[OTWD-Win64-Shipping.exe+3DA7030]+730]] == GameViewportClient.
So let's see who is who here
Note that I tried to get the full name of the base UObject and game crashed.. that's why the different addresses in the below:
Then with this and 0x20 offset in GameViewportClient, pointing to GameEngine, you can then statically construct the UConsole UObject
That's what I do in that DLL
More, later.
Sun, out.