95595
"Character Editor (Hub)"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_CharEditor,GearsTactics.exe,8B B9 E4 02 00 00) // should be unique
alloc(newmem,$1000,INJECT_CharEditor)
registersymbol(INJECT_CharEditor CharEditor)
label(return)
newmem:
mov [CharEditor],rcx
mov edi,[rcx+000002E4]
jmp return
align 8,CC
CharEditor:
dq 0
INJECT_CharEditor:
jmp newmem
nop
return:
[DISABLE]
INJECT_CharEditor:
db 8B B9 E4 02 00 00
unregistersymbol(CharEditor)
unregistersymbol(INJECT_CharEditor)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GearsTactics.exe+103595A
GearsTactics.exe+1035947: 48 8B C2 - mov rax,rdx
GearsTactics.exe+103594A: C3 - ret
GearsTactics.exe+103594B: CC - int 3
GearsTactics.exe+103594C: CC - int 3
GearsTactics.exe+103594D: CC - int 3
GearsTactics.exe+103594E: CC - int 3
GearsTactics.exe+103594F: CC - int 3
GearsTactics.exe+1035950: 48 89 5C 24 08 - mov [rsp+08],rbx
GearsTactics.exe+1035955: 57 - push rdi
GearsTactics.exe+1035956: 48 83 EC 30 - sub rsp,30
// ---------- INJECTING HERE ----------
GearsTactics.exe+103595A: 8B B9 E4 02 00 00 - mov edi,[rcx+000002E4]
// ---------- DONE INJECTING ----------
GearsTactics.exe+1035960: 48 8B D9 - mov rbx,rcx
GearsTactics.exe+1035963: 0F 29 74 24 20 - movaps [rsp+20],xmm6
GearsTactics.exe+1035968: E8 B3 4A 07 00 - call GearsTactics.exe+10AA420
GearsTactics.exe+103596D: 48 8B CB - mov rcx,rbx
GearsTactics.exe+1035970: 0F 28 F0 - movaps xmm6,xmm0
GearsTactics.exe+1035973: E8 F8 4A 07 00 - call GearsTactics.exe+10AA470
GearsTactics.exe+1035978: F3 0F 58 05 18 60 85 05 - addss xmm0,[GearsTactics.exe+688B998]
GearsTactics.exe+1035980: 66 0F 6E CF - movd xmm1,edi
GearsTactics.exe+1035984: 0F 5B C9 - cvtdq2ps xmm1,xmm1
GearsTactics.exe+1035987: F3 0F 58 CE - addss xmm1,xmm6
}
95652
"Base Address"
0
1
CharEditor
0
96110
"<-Select Charactor To Edit And Wait For Address's To Populate->"
0000FF
1
95684
"Armor Editor"
800080
1
95651
"Head Armour Data"
0
1
+290
0
95653
"1 Modification Value"
0
Float
+A8
C
95654
"2 Modification Value"
0
Float
+A8
1C
95655
"3 Modification Value"
0
Float
+A8
2C
95656
"4 Modification Value"
0
Float
+A8
3C
95657
"5 Modification Value"
0
Float
+A8
4C
95658
"6 Modification Value"
0
Float
+A8
5C
95659
"7 Modification Value"
0
Float
+A8
6C
95660
"Upper Armour Data"
0
1
+298
0
95661
"1 Modification Value"
0
Float
+A8
C
95662
"2 Modification Value"
0
Float
+A8
1C
95663
"3 Modification Value"
0
Float
+A8
2C
95664
"4 Modification Value"
0
Float
+A8
3C
95665
"5 Modification Value"
0
Float
+A8
4C
95666
"6 Modification Value"
0
Float
+A8
5C
95667
"7 Modification Value"
0
Float
+A8
6C
95676
"Lower Armour Data"
0
1
+2A0
0
95677
"1 Modification Value"
0
Float
+A8
C
95678
"2 Modification Value"
0
Float
+A8
1C
95679
"3 Modification Value"
0
Float
+A8
2C
95680
"4 Modification Value"
0
Float
+A8
3C
95681
"5 Modification Value"
0
Float
+A8
4C
95682
"6 Modification Value"
0
Float
+A8
5C
95683
"7 Modification Value"
0
Float
+A8
6C
95668
"Undergarment Data"
0
1
+2A8
0
95669
"1 Modification Value"
0
Float
+A8
C
95670
"2 Modification Value"
0
Float
+A8
1C
95671
"3 Modification Value"
0
Float
+A8
2C
95672
"4 Modification Value"
0
Float
+A8
3C
95673
"5 Modification Value"
0
Float
+A8
4C
95674
"6 Modification Value"
0
Float
+A8
5C
95675
"7 Modification Value"
0
Float
+A8
6C
95685
"Primary Weapon Editor"
0
800080
1
+358
0
95686
"Range_MaxBonus"
4 Bytes
+110
95687
"Range_Decay"
4 Bytes
+114
95688
"Range_EffectiveRange"
4 Bytes
+118
95689
"MaxVisibilityPenalty"
Float
+11C
95690
"MinOverwatchRange"
Float
+120
95691
"MaxOverwatchRange"
Float
+124
95692
"Range_Close"
Float
+128
95693
"Range_Short"
Float
+12C
95694
"Range_Medium"
Float
+130
95695
"Range_Long"
Float
+134
95696
"Secondary_Range_Close"
Float
+138
95697
"Secondary_Range_Short"
Float
+13C
95698
"Secondary_Range_Medium"
Float
+140
95699
"Secondary_Range_Long"
Float
+144
95700
"BaseDamage"
Float
+148
95701
"SecondaryDamage"
Float
+14C
95702
"AdditionalDamage"
Float
+150
95703
"DamageMod_Close"
Float
+154
95704
"DamageMod_Short"
Float
+158
95705
"DamageMod_Medium"
Float
+15C
95706
"DamageMod_Long"
Float
+160
95707
"DamageMod_Armour"
Float
+164
95708
"PenetrationMod_Armour"
Float
+168
95709
"DamageMod_Health"
Float
+16C
95710
"bCanFireInBurstMode"
Byte
+170
95711
"DefaultBurstCount"
4 Bytes
+174
95712
"MagazineSize"
4 Bytes
+178
95713
"NumOfMags"
4 Bytes
+17C
95714
"ActiveReloadPerfectChance"
4 Bytes
+180
95715
"ActiveReloadJamChance"
4 Bytes
+184
95716
"ActiveReloadDamageMultiplier"
Float
+188
95717
"Handling"
4 Bytes
+18C
95718
"bEnablePrecalcBullet"
Byte
+190
95719
"bPrecalcBulletEffectedByObstacles"
Byte
+191
95720
"PrecalcBulletsDamagePredictionErrorMin"
Float
+194
95721
"PrecalcBulletsDamagePredictionErrorMax"
Float
+198
95722
"Accuracy"
Float
+19C
95723
"AccuracyAI"
Float
+1A0
95724
"ShootingAngle"
Float
+1A4
95725
"CritChance"
Float
+1A8
95726
"CritDamageMultiplier"
Float
+1AC
95727
"GrazeChance"
Float
+1B0
95728
"GrazeDamageMultiplier"
Float
+1B4
95729
"ModifiedCritChance"
Float
+1B8
95730
"ModifiedCritDamageMultiplier"
Float
+1BC
95731
"ModifiedGrazeChance"
Float
+1C0
95732
"ModifiedGrazeDamageMultiplier"
Float
+1C4
95733
"TargetVerticalAngleDefault"
Float
+1C8
95734
"NoiseRange"
Float
+1E8
95735
"AIWeaponMinPitchError"
Float
+1EC
95736
"AIWeaponMaxPitchError"
Float
+1F0
95737
"OutOfRangeDistance"
Float
+1F4
95738
"AIWeaponYawError"
Float
+1F8
95739
"EngagementDistance"
Float
+1FC
95740
"AiOverwatchDistance"
Float
+200
95741
"TargetDBNOPitchErrorMultiplier"
Float
+204
95742
"Bounciness"
Float
+208
95743
"TossVelClamp"
Float
+20C
95744
"ExploDamageRadius"
Float
+210
95745
"Secondary_ExploDamageRadius"
Float
+214
95746
"ExploDamageFalloffExp"
Float
+218
95747
"Secondary_ExploDamageFalloffExp"
Float
+21C
95748
"GravityScale"
Float
+220
95749
"BounceVelocityScale"
Float
+224
95750
"BounceStopVelocity"
Float
+228
95751
"MaxHeight"
Float
+22C
95752
"MaxBounceCount"
4 Bytes
+230
95753
"MaxBounceCountToArm"
4 Bytes
+234
95754
"ArmingDelay"
Float
+238
95755
"ExplosionDelay"
Float
+23C
95756
"TriggerRadius"
Float
+240
95757
"TagArmingDelay"
Float
+244
95758
"TagExplosionDelay"
Float
+248
95759
"MaxBooshkaTargetDistance"
Float
+24C
95760
"OverwatchAccuracy"
Float
+250
95761
"OverwatchAccuracyAI"
Float
+254
95762
"OverwatchMovementAccuracyBonus"
Float
+258
95763
"OverwatchArcAngleDefault"
Float
+25C
95764
"OverwatchVerticalAngleDefault"
Float
+260
95765
"PercentageOfBurstToFireAfterDeath"
Float
+264
95766
"DeadZone_StartDistance"
Float
+268
95767
"DeadZone_AccuracyPenaltyPerMeter"
Float
+26C
95768
"DeadZone_MaxAccuracyPenalty"
Float
+270
95769
"IsReplacedByAbilityOnHUD"
Byte
+274
95770
"Secondary Weapon Editor"
0
800080
1
+360
0
95771
"Range_MaxBonus"
4 Bytes
+110
95772
"Range_Decay"
4 Bytes
+114
95773
"Range_EffectiveRange"
4 Bytes
+118
95774
"MaxVisibilityPenalty"
Float
+11C
95775
"MinOverwatchRange"
Float
+120
95776
"MaxOverwatchRange"
Float
+124
95777
"Range_Close"
Float
+128
95778
"Range_Short"
Float
+12C
95779
"Range_Medium"
Float
+130
95780
"Range_Long"
Float
+134
95781
"Secondary_Range_Close"
Float
+138
95782
"Secondary_Range_Short"
Float
+13C
95783
"Secondary_Range_Medium"
Float
+140
95784
"Secondary_Range_Long"
Float
+144
95785
"BaseDamage"
Float
+148
95786
"SecondaryDamage"
Float
+14C
95787
"AdditionalDamage"
Float
+150
95788
"DamageMod_Close"
Float
+154
95789
"DamageMod_Short"
Float
+158
95790
"DamageMod_Medium"
Float
+15C
95791
"DamageMod_Long"
Float
+160
95792
"DamageMod_Armour"
Float
+164
95793
"PenetrationMod_Armour"
Float
+168
95794
"DamageMod_Health"
Float
+16C
95795
"bCanFireInBurstMode"
Byte
+170
95796
"DefaultBurstCount"
4 Bytes
+174
95797
"MagazineSize"
4 Bytes
+178
95798
"NumOfMags"
4 Bytes
+17C
95799
"ActiveReloadPerfectChance"
4 Bytes
+180
95800
"ActiveReloadJamChance"
4 Bytes
+184
95801
"ActiveReloadDamageMultiplier"
Float
+188
95802
"Handling"
4 Bytes
+18C
95803
"bEnablePrecalcBullet"
Byte
+190
95804
"bPrecalcBulletEffectedByObstacles"
Byte
+191
95805
"PrecalcBulletsDamagePredictionErrorMin"
Float
+194
95806
"PrecalcBulletsDamagePredictionErrorMax"
Float
+198
95807
"Accuracy"
Float
+19C
95808
"AccuracyAI"
Float
+1A0
95809
"ShootingAngle"
Float
+1A4
95810
"CritChance"
Float
+1A8
95811
"CritDamageMultiplier"
Float
+1AC
95812
"GrazeChance"
Float
+1B0
95813
"GrazeDamageMultiplier"
Float
+1B4
95814
"ModifiedCritChance"
Float
+1B8
95815
"ModifiedCritDamageMultiplier"
Float
+1BC
95816
"ModifiedGrazeChance"
Float
+1C0
95817
"ModifiedGrazeDamageMultiplier"
Float
+1C4
95818
"TargetVerticalAngleDefault"
Float
+1C8
95819
"NoiseRange"
Float
+1E8
95820
"AIWeaponMinPitchError"
Float
+1EC
95821
"AIWeaponMaxPitchError"
Float
+1F0
95822
"OutOfRangeDistance"
Float
+1F4
95823
"AIWeaponYawError"
Float
+1F8
95824
"EngagementDistance"
Float
+1FC
95825
"AiOverwatchDistance"
Float
+200
95826
"TargetDBNOPitchErrorMultiplier"
Float
+204
95827
"Bounciness"
Float
+208
95828
"TossVelClamp"
Float
+20C
95829
"ExploDamageRadius"
Float
+210
95830
"Secondary_ExploDamageRadius"
Float
+214
95831
"ExploDamageFalloffExp"
Float
+218
95832
"Secondary_ExploDamageFalloffExp"
Float
+21C
95833
"GravityScale"
Float
+220
95834
"BounceVelocityScale"
Float
+224
95835
"BounceStopVelocity"
Float
+228
95836
"MaxHeight"
Float
+22C
95837
"MaxBounceCount"
4 Bytes
+230
95838
"MaxBounceCountToArm"
4 Bytes
+234
95839
"ArmingDelay"
Float
+238
95840
"ExplosionDelay"
Float
+23C
95841
"TriggerRadius"
Float
+240
95842
"TagArmingDelay"
Float
+244
95843
"TagExplosionDelay"
Float
+248
95844
"MaxBooshkaTargetDistance"
Float
+24C
95845
"OverwatchAccuracy"
Float
+250
95846
"OverwatchAccuracyAI"
Float
+254
95847
"OverwatchMovementAccuracyBonus"
Float
+258
95848
"OverwatchArcAngleDefault"
Float
+25C
95849
"OverwatchVerticalAngleDefault"
Float
+260
95850
"PercentageOfBurstToFireAfterDeath"
Float
+264
95851
"DeadZone_StartDistance"
Float
+268
95852
"DeadZone_AccuracyPenaltyPerMeter"
Float
+26C
95853
"DeadZone_MaxAccuracyPenalty"
Float
+270
95854
"IsReplacedByAbilityOnHUD"
Byte
+274
95855
"Special Item Editor"
0
800080
1
+368
0
95856
"Range_MaxBonus"
4 Bytes
+110
95857
"Range_Decay"
4 Bytes
+114
95858
"Range_EffectiveRange"
4 Bytes
+118
95859
"MaxVisibilityPenalty"
Float
+11C
95860
"MinOverwatchRange"
Float
+120
95861
"MaxOverwatchRange"
Float
+124
95862
"Range_Close"
Float
+128
95863
"Range_Short"
Float
+12C
95864
"Range_Medium"
Float
+130
95865
"Range_Long"
Float
+134
95866
"Secondary_Range_Close"
Float
+138
95867
"Secondary_Range_Short"
Float
+13C
95868
"Secondary_Range_Medium"
Float
+140
95869
"Secondary_Range_Long"
Float
+144
95870
"BaseDamage"
Float
+148
95871
"SecondaryDamage"
Float
+14C
95872
"AdditionalDamage"
Float
+150
95873
"DamageMod_Close"
Float
+154
95874
"DamageMod_Short"
Float
+158
95875
"DamageMod_Medium"
Float
+15C
95876
"DamageMod_Long"
Float
+160
95877
"DamageMod_Armour"
Float
+164
95878
"PenetrationMod_Armour"
Float
+168
95879
"DamageMod_Health"
Float
+16C
95880
"bCanFireInBurstMode"
Byte
+170
95881
"DefaultBurstCount"
4 Bytes
+174
95882
"MagazineSize"
4 Bytes
+178
95883
"NumOfMags"
4 Bytes
+17C
95884
"ActiveReloadPerfectChance"
4 Bytes
+180
95885
"ActiveReloadJamChance"
4 Bytes
+184
95886
"ActiveReloadDamageMultiplier"
Float
+188
95887
"Handling"
4 Bytes
+18C
95888
"bEnablePrecalcBullet"
Byte
+190
95889
"bPrecalcBulletEffectedByObstacles"
Byte
+191
95890
"PrecalcBulletsDamagePredictionErrorMin"
Float
+194
95891
"PrecalcBulletsDamagePredictionErrorMax"
Float
+198
95892
"Accuracy"
Float
+19C
95893
"AccuracyAI"
Float
+1A0
95894
"ShootingAngle"
Float
+1A4
95895
"CritChance"
Float
+1A8
95896
"CritDamageMultiplier"
Float
+1AC
95897
"GrazeChance"
Float
+1B0
95898
"GrazeDamageMultiplier"
Float
+1B4
95899
"ModifiedCritChance"
Float
+1B8
95900
"ModifiedCritDamageMultiplier"
Float
+1BC
95901
"ModifiedGrazeChance"
Float
+1C0
95902
"ModifiedGrazeDamageMultiplier"
Float
+1C4
95903
"TargetVerticalAngleDefault"
Float
+1C8
95904
"NoiseRange"
Float
+1E8
95905
"AIWeaponMinPitchError"
Float
+1EC
95906
"AIWeaponMaxPitchError"
Float
+1F0
95907
"OutOfRangeDistance"
Float
+1F4
95908
"AIWeaponYawError"
Float
+1F8
95909
"EngagementDistance"
Float
+1FC
95910
"AiOverwatchDistance"
Float
+200
95911
"TargetDBNOPitchErrorMultiplier"
Float
+204
95912
"Bounciness"
Float
+208
95913
"TossVelClamp"
Float
+20C
95914
"ExploDamageRadius"
Float
+210
95915
"Secondary_ExploDamageRadius"
Float
+214
95916
"ExploDamageFalloffExp"
Float
+218
95917
"Secondary_ExploDamageFalloffExp"
Float
+21C
95918
"GravityScale"
Float
+220
95919
"BounceVelocityScale"
Float
+224
95920
"BounceStopVelocity"
Float
+228
95921
"MaxHeight"
Float
+22C
95922
"MaxBounceCount"
4 Bytes
+230
95923
"MaxBounceCountToArm"
4 Bytes
+234
95924
"ArmingDelay"
Float
+238
95925
"ExplosionDelay"
Float
+23C
95926
"TriggerRadius"
Float
+240
95927
"TagArmingDelay"
Float
+244
95928
"TagExplosionDelay"
Float
+248
95929
"MaxBooshkaTargetDistance"
Float
+24C
95930
"OverwatchAccuracy"
Float
+250
95931
"OverwatchAccuracyAI"
Float
+254
95932
"OverwatchMovementAccuracyBonus"
Float
+258
95933
"OverwatchArcAngleDefault"
Float
+25C
95934
"OverwatchVerticalAngleDefault"
Float
+260
95935
"PercentageOfBurstToFireAfterDeath"
Float
+264
95936
"DeadZone_StartDistance"
Float
+268
95937
"DeadZone_AccuracyPenaltyPerMeter"
Float
+26C
95938
"DeadZone_MaxAccuracyPenalty"
Float
+270
95939
"IsReplacedByAbilityOnHUD"
Byte
+274
95940
"Stim Grenade Editor"
0
800080
1
+370
0
95941
"Range_MaxBonus"
4 Bytes
+110
95942
"Range_Decay"
4 Bytes
+114
95943
"Range_EffectiveRange"
4 Bytes
+118
95944
"MaxVisibilityPenalty"
Float
+11C
95945
"MinOverwatchRange"
Float
+120
95946
"MaxOverwatchRange"
Float
+124
95947
"Range_Close"
Float
+128
95948
"Range_Short"
Float
+12C
95949
"Range_Medium"
Float
+130
95950
"Range_Long"
Float
+134
95951
"Secondary_Range_Close"
Float
+138
95952
"Secondary_Range_Short"
Float
+13C
95953
"Secondary_Range_Medium"
Float
+140
95954
"Secondary_Range_Long"
Float
+144
95955
"BaseDamage"
Float
+148
95956
"SecondaryDamage"
Float
+14C
95957
"AdditionalDamage"
Float
+150
95958
"DamageMod_Close"
Float
+154
95959
"DamageMod_Short"
Float
+158
95960
"DamageMod_Medium"
Float
+15C
95961
"DamageMod_Long"
Float
+160
95962
"DamageMod_Armour"
Float
+164
95963
"PenetrationMod_Armour"
Float
+168
95964
"DamageMod_Health"
Float
+16C
95965
"bCanFireInBurstMode"
Byte
+170
95966
"DefaultBurstCount"
4 Bytes
+174
95967
"MagazineSize"
4 Bytes
+178
95968
"NumOfMags"
4 Bytes
+17C
95969
"ActiveReloadPerfectChance"
4 Bytes
+180
95970
"ActiveReloadJamChance"
4 Bytes
+184
95971
"ActiveReloadDamageMultiplier"
Float
+188
95972
"Handling"
4 Bytes
+18C
95973
"bEnablePrecalcBullet"
Byte
+190
95974
"bPrecalcBulletEffectedByObstacles"
Byte
+191
95975
"PrecalcBulletsDamagePredictionErrorMin"
Float
+194
95976
"PrecalcBulletsDamagePredictionErrorMax"
Float
+198
95977
"Accuracy"
Float
+19C
95978
"AccuracyAI"
Float
+1A0
95979
"ShootingAngle"
Float
+1A4
95980
"CritChance"
Float
+1A8
95981
"CritDamageMultiplier"
Float
+1AC
95982
"GrazeChance"
Float
+1B0
95983
"GrazeDamageMultiplier"
Float
+1B4
95984
"ModifiedCritChance"
Float
+1B8
95985
"ModifiedCritDamageMultiplier"
Float
+1BC
95986
"ModifiedGrazeChance"
Float
+1C0
95987
"ModifiedGrazeDamageMultiplier"
Float
+1C4
95988
"TargetVerticalAngleDefault"
Float
+1C8
95989
"NoiseRange"
Float
+1E8
95990
"AIWeaponMinPitchError"
Float
+1EC
95991
"AIWeaponMaxPitchError"
Float
+1F0
95992
"OutOfRangeDistance"
Float
+1F4
95993
"AIWeaponYawError"
Float
+1F8
95994
"EngagementDistance"
Float
+1FC
95995
"AiOverwatchDistance"
Float
+200
95996
"TargetDBNOPitchErrorMultiplier"
Float
+204
95997
"Bounciness"
Float
+208
95998
"TossVelClamp"
Float
+20C
95999
"ExploDamageRadius"
Float
+210
96000
"Secondary_ExploDamageRadius"
Float
+214
96001
"ExploDamageFalloffExp"
Float
+218
96002
"Secondary_ExploDamageFalloffExp"
Float
+21C
96003
"GravityScale"
Float
+220
96004
"BounceVelocityScale"
Float
+224
96005
"BounceStopVelocity"
Float
+228
96006
"MaxHeight"
Float
+22C
96007
"MaxBounceCount"
4 Bytes
+230
96008
"MaxBounceCountToArm"
4 Bytes
+234
96009
"ArmingDelay"
Float
+238
96010
"ExplosionDelay"
Float
+23C
96011
"TriggerRadius"
Float
+240
96012
"TagArmingDelay"
Float
+244
96013
"TagExplosionDelay"
Float
+248
96014
"MaxBooshkaTargetDistance"
Float
+24C
96015
"OverwatchAccuracy"
Float
+250
96016
"OverwatchAccuracyAI"
Float
+254
96017
"OverwatchMovementAccuracyBonus"
Float
+258
96018
"OverwatchArcAngleDefault"
Float
+25C
96019
"OverwatchVerticalAngleDefault"
Float
+260
96020
"PercentageOfBurstToFireAfterDeath"
Float
+264
96021
"DeadZone_StartDistance"
Float
+268
96022
"DeadZone_AccuracyPenaltyPerMeter"
Float
+26C
96023
"DeadZone_MaxAccuracyPenalty"
Float
+270
96024
"IsReplacedByAbilityOnHUD"
Byte
+274
96025
"Frag Grenade Editor"
0
800080
1
+378
0
96026
"Range_MaxBonus"
4 Bytes
+110
96027
"Range_Decay"
4 Bytes
+114
96028
"Range_EffectiveRange"
4 Bytes
+118
96029
"MaxVisibilityPenalty"
Float
+11C
96030
"MinOverwatchRange"
Float
+120
96031
"MaxOverwatchRange"
Float
+124
96032
"Range_Close"
Float
+128
96033
"Range_Short"
Float
+12C
96034
"Range_Medium"
Float
+130
96035
"Range_Long"
Float
+134
96036
"Secondary_Range_Close"
Float
+138
96037
"Secondary_Range_Short"
Float
+13C
96038
"Secondary_Range_Medium"
Float
+140
96039
"Secondary_Range_Long"
Float
+144
96040
"BaseDamage"
Float
+148
96041
"SecondaryDamage"
Float
+14C
96042
"AdditionalDamage"
Float
+150
96043
"DamageMod_Close"
Float
+154
96044
"DamageMod_Short"
Float
+158
96045
"DamageMod_Medium"
Float
+15C
96046
"DamageMod_Long"
Float
+160
96047
"DamageMod_Armour"
Float
+164
96048
"PenetrationMod_Armour"
Float
+168
96049
"DamageMod_Health"
Float
+16C
96050
"bCanFireInBurstMode"
Byte
+170
96051
"DefaultBurstCount"
4 Bytes
+174
96052
"MagazineSize"
4 Bytes
+178
96053
"NumOfMags"
4 Bytes
+17C
96054
"ActiveReloadPerfectChance"
4 Bytes
+180
96055
"ActiveReloadJamChance"
4 Bytes
+184
96056
"ActiveReloadDamageMultiplier"
Float
+188
96057
"Handling"
4 Bytes
+18C
96058
"bEnablePrecalcBullet"
Byte
+190
96059
"bPrecalcBulletEffectedByObstacles"
Byte
+191
96060
"PrecalcBulletsDamagePredictionErrorMin"
Float
+194
96061
"PrecalcBulletsDamagePredictionErrorMax"
Float
+198
96062
"Accuracy"
Float
+19C
96063
"AccuracyAI"
Float
+1A0
96064
"ShootingAngle"
Float
+1A4
96065
"CritChance"
Float
+1A8
96066
"CritDamageMultiplier"
Float
+1AC
96067
"GrazeChance"
Float
+1B0
96068
"GrazeDamageMultiplier"
Float
+1B4
96069
"ModifiedCritChance"
Float
+1B8
96070
"ModifiedCritDamageMultiplier"
Float
+1BC
96071
"ModifiedGrazeChance"
Float
+1C0
96072
"ModifiedGrazeDamageMultiplier"
Float
+1C4
96073
"TargetVerticalAngleDefault"
Float
+1C8
96074
"NoiseRange"
Float
+1E8
96075
"AIWeaponMinPitchError"
Float
+1EC
96076
"AIWeaponMaxPitchError"
Float
+1F0
96077
"OutOfRangeDistance"
Float
+1F4
96078
"AIWeaponYawError"
Float
+1F8
96079
"EngagementDistance"
Float
+1FC
96080
"AiOverwatchDistance"
Float
+200
96081
"TargetDBNOPitchErrorMultiplier"
Float
+204
96082
"Bounciness"
Float
+208
96083
"TossVelClamp"
Float
+20C
96084
"ExploDamageRadius"
Float
+210
96085
"Secondary_ExploDamageRadius"
Float
+214
96086
"ExploDamageFalloffExp"
Float
+218
96087
"Secondary_ExploDamageFalloffExp"
Float
+21C
96088
"GravityScale"
Float
+220
96089
"BounceVelocityScale"
Float
+224
96090
"BounceStopVelocity"
Float
+228
96091
"MaxHeight"
Float
+22C
96092
"MaxBounceCount"
4 Bytes
+230
96093
"MaxBounceCountToArm"
4 Bytes
+234
96094
"ArmingDelay"
Float
+238
96095
"ExplosionDelay"
Float
+23C
96096
"TriggerRadius"
Float
+240
96097
"TagArmingDelay"
Float
+244
96098
"TagExplosionDelay"
Float
+248
96099
"MaxBooshkaTargetDistance"
Float
+24C
96100
"OverwatchAccuracy"
Float
+250
96101
"OverwatchAccuracyAI"
Float
+254
96102
"OverwatchMovementAccuracyBonus"
Float
+258
96103
"OverwatchArcAngleDefault"
Float
+25C
96104
"OverwatchVerticalAngleDefault"
Float
+260
96105
"PercentageOfBurstToFireAfterDeath"
Float
+264
96106
"DeadZone_StartDistance"
Float
+268
96107
"DeadZone_AccuracyPenaltyPerMeter"
Float
+26C
96108
"DeadZone_MaxAccuracyPenalty"
Float
+270
96109
"IsReplacedByAbilityOnHUD"
Byte
+274
95597
"Gender"
0:Male
1:Female
008000
Byte
+268
95607
"Is Dead?"
0:No
1:Yes
008000
Byte
+2D0
95608
"Level"
008000
4 Bytes
+2D4
95609
"Cached Level"
008000
4 Bytes
+2D8
95610
"Experience"
008000
Float
+2DC
95611
"CachedExperience"
008000
Float
+2E0
95612
"Health"
008000
4 Bytes
+2E4
95613
"Accuracy"
008000
Float
+2E8
95614
"Strength"
008000
4 Bytes
+2EC
95615
"Movement Points"
008000
4 Bytes
+2F0
95616
"Action Points"
008000
4 Bytes
+2F4
95617
"Max Action Points When DBNO"
008000
4 Bytes
+2F8
95618
"Plasticity"
008000
Float
+2FC
95619
"Visibility"
008000
Float
+300
95620
"Health Recovery Rate"
008000
Float
+304
95621
"Health Recovery Only In Cover"
008000
Byte
+308
95622
"DBNO Death Threshold Percentage"
008000
Float
+30C
95623
"Critical Health Threshold Percentage"
008000
Float
+310
95624
"Ability Points"
008000
4 Bytes
+314
95625
"Current Ability Points"
008000
4 Bytes
+318
95626
"Fatigue Steps"
008000
4 Bytes
+31C
95627
"Fatigue Level"
008000
4 Bytes
+320
95628
"Max Offensive Mission Deploys"
008000
4 Bytes
+324
95629
"Current Offensive Mission Deploys"
008000
4 Bytes
+328
95630
"Last Deploy Reset Reason"
008000
Byte
+32C
95631
"Override Weapons?"
0:No
1:Yes
008000
Byte
+32D
95632
"DefaultPrimaryWeapon.WeaponType"
008000
Byte
+330
95633
"DefaultPrimaryWeapon.RarityTier"
008000
Byte
+331
95634
"DefaultPrimaryWeapon.PowerLevel"
008000
4 Bytes
+334
95635
"DefaultSecondaryWeapon.WeaponType"
008000
Byte
+338
95636
"DefaultSecondaryWeapon.RarityTier"
008000
Byte
+339
95637
"DefaultSecondaryWeapon.PowerLevel"
008000
4 Bytes
+33C
95638
"DefaultSpecialItem.WeaponType"
008000
Byte
+340
95639
"DefaultSpecialItem.RarityTier"
008000
Byte
+341
95640
"DefaultSpecialItem.PowerLevel"
008000
4 Bytes
+344
95641
"DefaultStimGrenade.WeaponType"
008000
Byte
+348
95642
"DefaultStimGrenade.RarityTier"
008000
Byte
+349
95643
"DefaultStimGrenade.PowerLevel"
008000
4 Bytes
+34C
95644
"DefaultFragGrenade.WeaponType"
008000
Byte
+350
95645
"DefaultFragGrenade.RarityTier"
008000
Byte
+351
95646
"DefaultFragGrenade.PowerLevel"
008000
4 Bytes
+354
95647
"CharacterHero"
008000
Byte
+5D8
95648
"bPremadeCharacter"
008000
Byte
+5D9
95649
"Status"
008000
Byte
+5DA
95650
"PreviousStatus"
008000
Byte
+5DB
96116
"Character / Enemy (Battle)"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_CharBattle,GearsTactics.exe,74 64 48 8B 13 48 8B CB) // should be unique
alloc(newmem,$1000,INJECT_CharBattle)
registersymbol(INJECT_CharBattle CharBattle)
label(return)
newmem:
mov [CharBattle],rbx
mov rdx,[rbx]
mov rcx,rbx
jmp return
align 8,CC
CharBattle:
dq 0
INJECT_CharBattle+02:
jmp newmem
nop
return:
[DISABLE]
INJECT_CharBattle+02:
db 48 8B 13 48 8B CB
unregistersymbol(CharBattle)
unregistersymbol(INJECT_CharBattle)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GearsTactics.exe+CADE7E
GearsTactics.exe+CADE5F: 48 8B D0 - mov rdx,rax
GearsTactics.exe+CADE62: 48 8B CF - mov rcx,rdi
GearsTactics.exe+CADE65: E8 46 49 6D 01 - call GearsTactics.exe+23827B0
GearsTactics.exe+CADE6A: 84 C0 - test al,al
GearsTactics.exe+CADE6C: 74 74 - je GearsTactics.exe+CADEE2
GearsTactics.exe+CADE6E: 48 8B CF - mov rcx,rdi
GearsTactics.exe+CADE71: E8 DA 46 09 00 - call GearsTactics.exe+D42550
GearsTactics.exe+CADE76: 48 8B F8 - mov rdi,rax
GearsTactics.exe+CADE79: 48 85 C0 - test rax,rax
GearsTactics.exe+CADE7C: 74 64 - je GearsTactics.exe+CADEE2
// ---------- INJECTING HERE ----------
GearsTactics.exe+CADE7E: 48 8B 13 - mov rdx,[rbx]
// ---------- DONE INJECTING ----------
GearsTactics.exe+CADE81: 48 8B CB - mov rcx,rbx
GearsTactics.exe+CADE84: FF 92 48 05 00 00 - call qword ptr [rdx+00000548]
GearsTactics.exe+CADE8A: 85 C0 - test eax,eax
GearsTactics.exe+CADE8C: 75 26 - jne GearsTactics.exe+CADEB4
GearsTactics.exe+CADE8E: 0F B6 83 2C 4D 00 00 - movzx eax,byte ptr [rbx+00004D2C]
GearsTactics.exe+CADE95: 48 8D 54 24 30 - lea rdx,[rsp+30]
GearsTactics.exe+CADE9A: 48 8B CF - mov rcx,rdi
GearsTactics.exe+CADE9D: 40 84 F6 - test sil,sil
GearsTactics.exe+CADEA0: 74 09 - je GearsTactics.exe+CADEAB
GearsTactics.exe+CADEA2: 84 C0 - test al,al
}
96117
"BASE"
0
1
CharBattle
0
96133
"<-Select Charactor/Enemy To Edit And Wait For Address's To Populate->"
0000FF
1
96118
"Health"
Float
+2038
96119
"HealthMax"
Float
+2044
96120
"OverShield"
Float
+203C
96121
"MaxOverShieldPercentage"
Float
+2040
96122
"Armour"
Float
+2080
96123
"ArmourResistance"
Float
+2084
96124
"UnitAccuracy"
Float
+46E0
96125
"Defense"
Float
+46E4
96126
"Strength"
Float
+46E8
96127
"Plasticity"
Float
+46EC
96128
"Visibility"
Float
+46F0
96129
"Level"
Float
+46F4
96130
"Experience"
Float
+46F8
96131
"OriginalActionPoints"
4 Bytes
+4968
258
96132
"ActionPointsLeft"
4 Bytes
+4968
25C
95524
"Dumper V7.3 Automate (Created By Cake-San) Thank you for this awsome dumper!"
1
95525
"Unreal Engine"
Auto Assembler Script
{$lua}
ObjectsPerThread=0x200
FNameIndexMultiplier= string.find(process:lower(),'chivalry2') and 2 or 1
function ue4config()
local sub=targetIs64Bit() and 0 or 4
if not UObject then UObject = {}end
--if UE4ver<=2 and targetIs64Bit() then ue4determineversion() end
-----------------------------
----------UE4 struct---------
if not UE3 then
UObject.ObjectId= 0xC-sub
UObject.Class = 0x10-sub
UObject.FNameIndex = 0x18-(sub*2)
UObject.Outer = 0x20-(sub*2)
if UE4ver>=25 then
UObject.super= 0x40
UObject.member= 0x50
UObject.nextmember= 0x20
UObject.Offset= 0x4C
UObject.propsize=0x3C
UObject.bitmask= 0x7A
UObject.Property= 0x78
UObject.enumoffset = 0x40
UObject.enummul = 0x10
UObject.enumname = 0x0
UObject.enumindex = 0x8
elseif UE4ver>=22 then
UObject.super= 0x40
UObject.member= 0x48
else
UObject.super= 0x30 -(sub*4)
UObject.member= 0x38 -(sub*5)
end
if UE4ver<25 then
UObject.nextmember=0x28-(sub*3)
UObject.Offset= 0x44-(sub*4)
UObject.propsize= 0x34-(sub*3/2)
UObject.bitmask= 0x72-(sub*8)
UObject.Property= 0x70-(sub*8)
end
if UE4ver<11 then
UObject.Offset= 0x4C
end
----------------------------
---------UE3 struct---------
--1.25
--[[
elseif UE4ver>=1 then
UObject.ObjectId= 0x4
UObject.Outer = 0x14
UObject.FNameIndex = 0x18
UObject.Class = 0x20
UObject.Offset= 0x48
UObject.super= 0x34
UObject.member= 0x38
UObject.nextmember=0x28
UObject.propsize= 0x30
UObject.bitmask= 0x60
UObject.Property= 0x58
]]
--0.10246
else
--[[
UObject.ObjectId= 0x20
UObject.Outer = 0x28
UObject.FNameIndex = 0x2C
UObject.Class = 0x34
UObject.Offset= 0x60
UObject.super= 0x48
UObject.member= 0x4C
UObject.nextmember=0x3C
UObject.propsize= 0x44
UObject.bitmask= 0x70]]
end
---------------------------
end
ue4type={
['BoolProperty']=vtByte,
['ByteProperty']=vtByte,
['FloatProperty']=vtSingle,
['StructProperty']=vtDword,
['IntProperty']=vtDword,
['NameProperty']=vtQword,
['Int64Property']=vtQword,
['TextProperty']=vtPointer,
['StrProperty']=vtPointer,
['ArrayProperty']=vtPointer,
['MapProperty']=vtPointer,
['ClassProperty']=vtPointer,
['ObjectProperty']=vtPointer}
function ue4versioncheck()
--if true then return 0 end
local fileversion,info =getFileVersion(enumModules()[1].PathToFile)
if not info then return 0 end
return tonumber(info.minor..'.'..info.release)
end
function FNameStringAlgo(FName,IndexOnly)
if not FName then return nil end
local UEver=UE4ver
local sub=targetIs64Bit() and 0 or 4
local size=targetIs64Bit() and 8 or 4
local number,str,pointer
if not IndexOnly then
number=UEver>2 and readInteger(FName+4) or 0
FName=readInteger(FName)
else
if UEver~=nil and UEver<=0 and readPointer('Core.FName::Names') then FName=readInteger(FName) and readInteger(FName) or FName end
number=FName>>32 FName=FName&0xFFFFFFFF
end
if not FName then return nil end
if isMassEffect then
local i=(FName>>0x1D)&7
FName=FName&0x1FFFFFFF
str=readString(readPointer(getAddress('FNamePool')+i*8)+FName+stringoffset)
return str
end
if FNameList[FName] then
if number>0 then return FNameList[FName]..'_'..number-1 end
return FNameList[FName]
end
local CFName=FName
if readPointer(FNameString) then
if not FNameStringStub then FNameStringStub=createExecuteCodeExStub(0,FNameString,0,0)end
if not FNameStringRE then FNameStringRE=createRemoteExecutor()end
if not mem then mem=allocateMemory(0x100)end
writeQword(mem+0x50+UObject.FNameIndex,FName)
FNameStringRE.executeStub(FNameStringStub,{mem+0x50,mem})
str=readPointer(mem)
if str then str=readString(str,readInteger(mem+0x8)*2,true) end
--deAlloc(mem)
elseif UEver>=23 then
local i=(FName>>0x10)
FName=(FName&0xFFFF)<<FNameIndexMultiplier
pointer=readPointer(FNamePool+i*size)
local le = readSmallInteger(pointer+FName)
if not le then return nil end
le=le>>6
if le>200 then return nil end
local widechar= true and readBytes(pointer+FName,1)==1 or false
--printf('%X %i %s',pointer+FName,le,widechar)
if not stringoffset and CFName>0 and CFName<7 and le>=10 and le<=15 then
le=(widechar and le*2 or le)-1
for k=2,0x20,2 do
if string.find(readString(pointer+FName+k,le,widechar),'ByteProperty') then stringoffset=k break end
--print(k)
end
end
le=(widechar and le*2 or le)-1
if not stringoffset then return end
str=readString(pointer+FName+stringoffset,le,widechar)
else
local i
if FNamePool2 then FName= FName <0x25A and readInteger(FName*4+FNamePool) or FName
else
i= not UE3 and (FName>>0xE) or 0
FName= (not UE3 and (FName&0x3FFF) or (FName&0x7FFFF)) * (8-sub)
end
-- printf('%X',i)
-- printf('%X',FName)
local pointer
if FNamePool2 then
pointer=readPointer(FNamePool2)+FName
else
pointer=readPointer(FNamePool+i*size)
if not readPointer(pointer) then return nil end
pointer=readPointer(pointer+FName)
end
--print(string.format('%X',pointer))
if not readPointer(pointer) then return nil end
local pointers,pointers2=pointer
if stringoffset2 then pointer=readPointer(pointer+stringoffset2)end
pointers2=pointer
--print(string.format('%X',pointer))
--local offset=UE4ver>=22 and 0xC-sub or 0x10-(sub*2)
if CFName==1 and not stringoffset then
for k=0,0x30,4 do
str=readString(pointer+k,13)
if string.find(str,'ByteProperty') then stringoffset=k break end
end
if not stringoffset then
for k=0,0x30,4 do
str=readString(pointer+k,13*2,true)
if string.find(str,'ByteProperty') then stringoffset=k forcewidechar=true break end
end
end
pointer=pointers
for j=0, stringoffset-4,4 do
if readInteger(pointer+j)==2 then stringoffsetid=j end
end
--print(string.format('%X',FName))
--print(string.format('%X',pointer))
--print(string.format('%X',offset))
else
if not stringoffset then return end
--print(string.format('%X',pointer))
pointer=pointers
local widechar=stringoffsetid and (readInteger(pointer+stringoffsetid)&1==1 or false) or false
pointer=pointers2
if stringoffset2 and not readPointer(pointer) then pointer=pointers+stringoffset2 end
widechar= forcewidechar and true or widechar
str= readString(pointer+stringoffset,200,widechar)
if not str then str= readString(pointer+stringoffset,100,widechar) end
if not str then str= readString(pointer+stringoffset,50,widechar) end
if not str then str= readString(pointer+stringoffset,30,widechar) end
if not str then
local le=0
--print(string.format('%X',FName))
--print(string.format('%X',pointer))
while(true)do
if le>50 then break end
if readBytes(pointer+stringoffset+le)==0 then break end
le=le+1
end
str= readString(pointer+stringoffset,le)
end
--print(stringoffset)
end end
if not str then return nil end
if number>0 then return str..'_'..number-1 end
--print(str)
FNameList[CFName]=str
--print(str)
return str
end
function GetNameAlgo(object)
if not object then return nil end
--[[
if ObjectList[object] then --print(ObjectList[object])
return ObjectList[object]
end]]
local pointer,size,str1,str2=readPointer(object+UObject.Class),targetIs64Bit() and 8 or 4
if not pointer then return nil end
--print(string.format('%X',fnameoffset))
--print(string.format('%X',object+fnameoffset))
str1=FNameStringAlgo(readInteger(pointer+UObject.FNameIndex),true)
--print(str1)
--if readInteger(pointer+fnameoffset+4)~=0 then return nil end
str2=FNameStringAlgo(readInteger(object+UObject.FNameIndex),true)
--print(str2)
if not str2 then str2=FNameStringAlgo(readInteger(object+UObject.FNameIndex-8),true)end
--if str2=='None' then str2=FNameStringAlgo(readInteger(pointer+UObject.Outer+size),true)end
if not str1 or str1=='None' or not str2 or str2=='None' then return nil end
str1=str1..' '..str2
--print(ObjectList[object])
ObjectList[object]=str1
return str1
end
function GetFullNameAlgo(object)
if not object then return nil end
--if ObjectList[object] then return ObjectList[object] end
local pathoffset=UObject.Outer
local fnameoffset=UObject.FNameIndex
local str=GetNameAlgo(object)
if not str then return nil end
local number=readInteger(object+fnameoffset+4)
local typ=str:sub(1,string.find(str,' ')-1)
local isProperty=string.find(typ,'Property')
if not isProperty then isProperty=string.find(typ,'Function') end
local pointer=readPointer(object+pathoffset)
while(true)do
if not pointer or pointer==0 then break end
local stri=GetNameAlgo(pointer)
if not stri then break end
typ=stri:sub(1,string.find(stri,' ')-1)
local isPropertyc=string.find(typ,'Property')
if not isPropertyc then isPropertyc=string.find(typ,'Function') end
stri=string.sub(str,1,string.find(str,' '))..stri:sub(string.find(stri,' ')+1,stri:len())
local num=readInteger(pointer+fnameoffset+4)
if number~=num and num==0 or not isPropertyc and isProperty then stri=stri..':'
else stri=stri..'.' end
number=num
isProperty=isPropertyc
str=stri..string.sub(str,string.find(str,' ')+1,str:len())
pointer=readPointer(pointer+pathoffset)
if string.find(str,'%./') then
stri=string.sub(str,1,string.find(str,' '))
str=stri..str:sub(string.find(str,'%./')+1,str:len())
break end
end
if not str then return nil end
--ObjectList[object]=str
return str
end
function GetFullNameSuperAlgo(object)
local super=UObject.super
local str1 = GetFullNameSafeAlgo(object)
if not str1 then return nil end
local pointer = readPointer(object+super)
if pointer then
local str2 = GetFullNameSafeAlgo(pointer)
if str2 then return str1..' ~ '..str2 end
end
return str1
end
function GetFullNameSafesAlgo(object)
--if ObjectList[object] then return ObjectList[object] end
local fnameoffset=0x28
local typeoffset=0x8
local pathoffset=0x10
if not object then return nil end
local pointer=readPointer(object+typeoffset)
if not pointer then return nil end
local str1=FNameStringAlgo(pointer)
local str2=FNameStringAlgo(object+fnameoffset)
local pointer=readPointer(object+pathoffset)
if not pointer then return nil end
local str3=GetFullNameAlgo(pointer)
if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end
--print(str3)
--if string.find(str3,'%./') then string.sub
local str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2
--ObjectList[object]=str
return str
end
function GetFullNameSafeAlgo(object)
--if ObjectList[object] then return ObjectList[object] end
local str= GetFullNameAlgo(object)
if str then return str end
local fnameoffset=0x28
local typeoffset=0x8
local pathoffset=0x10
if not object then return nil end
local pointer=readPointer(object+typeoffset)
if not pointer then return nil end
local str1=FNameStringAlgo(pointer)
local str2=FNameStringAlgo(object+fnameoffset)
local pointer=readPointer(object+pathoffset)
if not pointer then return nil end
local str3=GetFullNameAlgo(pointer)
if not str3 then str3=GetFullNameSafesAlgo(pointer)end
if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end
--print(str3)
--if string.find(str3,'%./') then string.sub
str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2
--ObjectList[object]=str
return str
end
function FindString(this,namestr,start,stop,isNoIndex)
local acclen=0
for i=start,stop do
local name=FNameStringAlgo(i+acclen,true)
if name and name:len()<200 and name:len()>2 and not string.find(name,'%c') then
--print(name)
if namestr==name then FNameResult=i+acclen return end
if isNoIndex then acclen=acclen+name:len()end
end
end
end
function FindStringFName(namestr,isNoIndex,skipParse)
local size
if not skipParse then ue4parsetableFNamePool() end
if FNamePool2 then size=readInteger(FNamePool2+8)
elseif UE4ver>=23 then size=(#FNameDict<<0x10)-1
elseif not UE3 then size=(#FNameDict<<0xE)-1
else size=math.floor(FNameDict[1]/4) end
local count=ObjectsPerThread
size=math.floor((size/count)+0.5)
FNameResult=nil
local result
local num,start,stop=count,0,0
for i=0,size do
start=i*num
stop=(i+1)*num
if FNameResult then break end
createThread(FindString(this,namestr,start,stop-1,isNoIndex))
end
result=FNameResult
FNameResult=nil
return result
end
function getregionsize(address)
local allregion=enumMemoryRegions()
for i=#allregion,1,-1 do
if allregion[i].BaseAddress<=address then
local BaseAddress=allregion[i].BaseAddress
local RegionSize=allregion[i].RegionSize
local curSize=BaseAddress+RegionSize-address
return curSize,RegionSize,BaseAddress,i
end
end
end
sub=targetIs64Bit() and 0 or 4
function ue4parsetableFNamePool()
ObjectList={}
FNameList={}
if readPointer(FNameString) or string.find(process,'StateOfDecay2')then return end
local pool=getAddressSafe('FNamePool')
if pool then
local pointer,pointers
if not readPointer(readPointer(pool)) then pointer=pool+0x10
else
pointer=pool
if readPointer(readPointer(readPointer(pointer)))then
if readPointer(readPointer(readPointer(readPointer(pointer))))then
pointer=readPointer(pointer)
end
end
end
if not readPointer(pointer)then pointer=readPointer(pool2+0x10)end
FNamePool=pointer
FNameDict={}
local j=0
for i=0,500 do
pointers=readPointer(pointer+i*(8-sub))
if readPointer(pointers) then
FNameDict[i+1]=getregionsize(pointers)
else j=j+1 end
if j>3 then break end
end
end
if not isMassEffect and UE3==nil then
print('Finding /Script/CoreUObject...')
local CoreUObject=FindStringFName('/Script/CoreUObject',isMassEffect,true)
if not CoreUObject then UE3=true if(UE4ver and UE4ver>7 or not UE4ver)then UE4ver=ue4versioncheck() end
else UE3=false end
elseif isMassEffect then UE3=true end
print('FNamePool parsed...')
end
function ue4parsetables()
local size=targetIs64Bit() and 8 or 4
ue4parsetableFNamePool()
local pool2=getAddressSafe('GUObjectArray')
if pool2 then
if NOGUObjectsize then
GUObjectsize=0xFFFFFFFF
if not readPointer(readPointer(GUObjectAddress))then
GUObjectAddress=allocateMemory(0x100) writePointer(GUObjectAddress,pool2)
end
printf('%X',GUObjectAddress)
return
end
local pointer,pointers=readPointer(pool2)
GUObjectsize=readInteger(pool2+size)
if not readPointer(pointer)then GUObjectsize=readInteger(pool2+0x10+size*2+4) GUObjectsize= GUObjectsize==0xFFFFFFFF and readInteger(pool2+0x10+size+4)or GUObjectsize pointer=readPointer(pool2+0x10)end
if not readPointer(readPointer(pointer)) then pointer=pointer+0x10 end
if not readPointer(readPointer(readPointer(readPointer(readPointer(pointer))))) or
not inModule(readPointer(readPointer(readPointer(readPointer(pointer)))))or
(UObject and UObject.Class and UObject.FNameIndex and UObject.Outer and GetFullNameSafeAlgo(readPointer(pointer)))
then pointer=pool2 end
for i=0,0x100,4 do
if readPointer(readPointer(readPointer(readPointer(readPointer(pointer+i))))) and readPointer(readPointer(readPointer(readPointer(readPointer(pointer+i)))))~=0 then pointer=pointer+i break end
end
printf('%X',pointer)
GUObjectAddress=pointer
end
end
function ue4parsetable()
ue4parsetables()
local size,val=targetIs64Bit() and 8 or 4,0x80
local pointerss,pointer,pointers,pointer3,flag1=readPointer(GUObjectAddress)
for o=4,(UE3 and size or 8*4),4 do
for k=0,10*o,o do
pointers=readPointer(pointerss+k)
if not checkvalue(pointers,0x50,k/o,2) then break end
if k==(10*o)then UObjectMul=o printf('%X',o)flag1=true end
end
if flag1 then break end
end
::doit::
if not UObjectMul then
local ObjectScanner={'Object scanner'}
unregisterSymbol('GUObjectArray')
print(UE4ver)
for i=1,#ObjectScanner do
rec=getAddressList().getMemoryRecordByDescription(ObjectScanner[i])
if rec and not rec.Active then
rec.Active=true
while rec.AsyncProcessing do sleep(100) end
end
if readPointer('GUObjectArray') then break end
end
if not readPointer('GUObjectArray') then error('GUObjectArray not found!')
else return ue4parsetable() end
end
--if not UObject.FNameIndex then
if not UObject then UObject={} end
for i=0,10 do
pointer = readPointer(pointerss+i*UObjectMul)
pointers= checkvalue(pointer+size,0x80,'Object',1,true)
if pointers then
printf('%X',i*UObjectMul)
UObject.FNameIndex=pointers-pointer
UObject.ObjectId=checkvalue(pointer+size,val,i,4)-pointer
for j=4,0x80,4 do
pointers=readPointer(pointer+j)
if readPointer(pointers) then
pointer3=FNameStringAlgo(readInteger(pointers+UObject.FNameIndex),true)
if pointer3 and pointer3:find('Core') then UObject.Outer=j break end
end
end
for j=4,0x80,4 do
pointers=readPointer(pointer+j)
if readPointer(pointers) then
pointer3=FNameStringAlgo(readInteger(pointers+UObject.FNameIndex),true)
if pointer3 and pointer3:find('Class') then UObject.Class=j break end
end
end
break
end
end
if not UObject.FNameIndex then UObjectMul=nil goto doit end
--printf('ObjectId=%X\nFNameIndex=%X\nClass=%X\nOuter=%X',UObject.ObjectId,UObject.FNameIndex,UObject.Class,UObject.Outer)
--end
return true
end
function ue4parsetablecheck()
if not readPointer(GUObjectAddress) or not readPointer(FNamePool) then return ue4parsetable() end
local pointer
pointer=readPointer(readPointer(GUObjectAddress))
if not ObjectTable or not ObjectTable[1] or not FullNameList or (ObjectTable[1].Address ~= pointer) then return ue4parsetable() end
--[[
local Address,FullName
for i=1,#ObjectTable do
if ObjectTable[i] and i>#ObjectTable-0x10 then FullName=ObjectTable[i].Type..' '..ObjectTable[i].FullName Address=ObjectTable[i].Address break end
end
if not GetFullNameSafeAlgo(Address) or FullName~=GetFullNameSafeAlgo(Address) then return ue4parsetable()end
]]
return false
end
function FindObject(this,pointer,start,stop,fullname,name)
local FullName,Name,Data,pointers=fullname,name
for j=start,stop do
if StaticFindObjectAlgoFoundAddress then break end
pointers=readPointer(pointer+j*UObjectMul)
if not readPointer(pointers) then break end
Data=SaveObject(pointers)
if FullName and FullNameList[FullName] then break end
if Data and Name and string.find(Data.Name:lower(),Name:lower()) then StaticFindObjectAlgoFoundAddress=Data.Address break end
end
end
if not FullNameList then FullNameList={}end
if not ObjectLists then ObjectLists={}end
if not ObjectTable then ObjectTable={}end
if not IgnoreList then IgnoreList={} end
if not HighestObjectID then HighestObjectID=0 end
if not totalobjects then totalobjects=0 end
if not totalproperties then totalproperties=0 end
function StaticFindObjectAlgo(fullname,name)
StaticFindObjectAlgoFoundAddress=nil
if fullname then fullname=fullname:lower() end
if ue4parsetablecheck() or not FullNameList then
FullNameList={}
ObjectLists={}
ObjectTable={}
HighestObjectID=0
end
if FullNameList[fullname] then return FullNameList[fullname].Address end
local count=ObjectsPerThread
local sizess= UObjectMul*count
local ObjectId=UObject.ObjectId
local num,start,stop
totalobjects=0
local size,pointer=targetIs64Bit() and 8 or 4
for i=0,0x1000,size do
pointer=readPointer(GUObjectAddress+i)
printf('UObjectArray:%X',i)
if not readPointer(pointer) then break end
size=getregionsize(pointer)
num,start,stop=count,0,0
for j=0,math.floor(size/sizess) do
start=stop
stop=stop+num
--print(start..'~'..stop)
createThread(FindObject(this,pointer,start,stop-1,fullname,name))
if FullNameList[fullname] then return FullNameList[fullname].Address end
end
end
local address=StaticFindObjectAlgoFoundAddress
return address
end
function BasicObject(this,pointer,start,stop)
local Data,pointers
for j=start,stop do
pointers=readPointer(pointer+j*UObjectMul)
if not readPointer(pointers) then break end
Data=SaveObject(pointers)
end
Threadlist[#Threadlist]=nil
end
totalproperties=0
IgnoreList={}
function BasicEnumObject()
--ue4parsetablecheck()
IgnoreList={}
ObjectLists={}
ObjectTable={}
Threadlist={}
FullNameList={}
HighestObjectID=0
starttime=os.clock()
local count=ObjectsPerThread
local sizess= UObjectMul*count
local ObjectId=UObject.ObjectId
local num,start,stop
totalobjects=0
totalproperties=0
local size,pointer=targetIs64Bit() and 8 or 4
for i=0,0x1000,size do
pointer=readPointer(GUObjectAddress+i)
printf('UObjectArray:%X',i)
if not readPointer(pointer) then break end
size=getregionsize(pointer)
num,start,stop=count,0,0
for j=0,math.floor(size/sizess) do
start=stop
stop=stop+num
--print(start..'~'..stop)
Threadlist[#Threadlist+1]=createThread(BasicObject(this,pointer,start,stop-1))
end
end
if UE4ver>=23 and totalproperties<100 and ue4versioncheck()<2 then UE4ver=25 end
for i=0,10000 do
if #Threadlist==0 then break end
sleep(1)
end
BasicEnumObjectCooldown=true
createTimer(180000, function()BasicEnumObjectCooldown=nil end)
print(string.format('\nA Total of %u objects has been found in %.3f seconds',totalobjects,os.clock()-starttime))
end
function UperNameList(ObjectData,NameTable)
if not NameTable then NameTable={} end
if ObjectData.Name=='Object' then return NameTable end
for i=1,#NameTable do
if NameTable[i]==ObjectData.Name..'.' then return NameTable end
end
NameTable[#NameTable+1]=ObjectData.Name..'.'
if ObjectData.Uper then
for i=1,#ObjectData.Uper do
UperNameList(ObjectData.Uper[i],NameTable)
end
end
return NameTable
end
function registerMemberAlgo()
UEMember={}
UEMemberClassFullName={}
UEMemberStrTable={'{$lua}\nif syntaxcheck then return end\n[ENABLE]\nUEMember = { '}
local size,Super=HighestObjectID+10
for i=1,size do
if ObjectTable[i] and ObjectTable[i].Member then
Class=UperNameList(ObjectTable[i],{''})
Super=ObjectTable[i].Super
for k=0,5 do
if not Super or Super.Name=='Object' then break end
Class[#Class+1]=Super.Name..'.'
Super=Super.Super
end
registerMember(ObjectTable[i],ObjectTable[i].FullName)
end
end
Class=nil
UEMemberStrTable[#UEMemberStrTable]=UEMemberStrTable[#UEMemberStrTable]:sub(1,UEMemberStrTable[#UEMemberStrTable]:len()-1)
UEMemberStrTable[#UEMemberStrTable+1]='}\n[DISABLE]'
--[[
local rec=getAddressList().getMemoryRecordByDescription('UEMemberStr(DoNotTouch!)')
if not rec then rec=getAddressList().createMemoryRecord()end
rec.Type=vtAutoAssembler
rec.Description='UEMemberStr(DoNotTouch!)'
rec.Script=table.concat(UEMemberStrTable)]]
end
function registerMember(ObjectData,FullName,AddedName,AddedOffset)
local Name,Offset
if not AddedName then AddedName='' end
if not AddedOffset then AddedOffset=0 end
if ObjectData.Member then
for j=1,#ObjectData.Member do
if ObjectData.Member[j].Offset then
Offset=AddedOffset+ObjectData.Member[j].Offset
Name=ObjectData.Member[j].Name
if string.find(ObjectData.Type,'UserDefinedStruct') and string.find(Name,'_') then Name=Name:sub(1,string.find(Name,'_')-1)end
Name=AddedName..Name
for i=1,#Class do
if not UEMember[(Class[i]..Name):lower()] then
UEMember[(Class[i]..Name):lower()]=Offset
UEMemberStrTable[#UEMemberStrTable+1]=string.format("['%s']=%u,",(Class[i]..Name):lower(),Offset)
UEMemberClassFullName[(Class[i]..Name):lower()]=FullName
end
if ObjectData.Member[j].Bit and not UEMember[(Class[i]..Name..'.Bit'):lower()] then
UEMember[(Class[i]..Name..'.Bit'):lower()]=ObjectData.Member[j].Bit
UEMemberStrTable[#UEMemberStrTable+1]=string.format("['%s']=%u,",(Class[i]..Name..'.Bit'):lower(),ObjectData.Member[j].Bit)
UEMemberClassFullName[(Class[i]..Name..'.Bit'):lower()]=FullName
end
end
if string.find(ObjectData.Member[j].Type,'StructProperty') and ObjectData.Member[j].Property then registerMember(ObjectData.Member[j].Property[1],FullName,Name..'.',Offset)end
end
end
end
end
function registerFuncAlgo()
if not UE_function then UE_function=createSymbolList()end
UE_function.unregister()
UE_function.clear()
for i,ObjectData in pairs(ObjectLists) do
if string.find(ObjectData.Type,'Function') and not string.find(ObjectData.Type,'Default__Function')then
pointer=readPointer(ObjectData.Address+UObject.funct)
if readPointer(pointer) then
if not FuncSizeList[pointer] then FuncSizeList[pointer]=getFuncSize(pointer) end
UE_function.addSymbol('UE_function',ObjectData.FullName,pointer,FuncSizeList[pointer])
end
end
end
UE_function.register()
end
function GetName1(pointer)
local class=readPointer(pointer+UObject.Class)
if not class then return nil end
local typ=readInteger(class+UObject.FNameIndex)
if not typ then return nil end
local name=readInteger(pointer+UObject.FNameIndex)
typ=FNameStringAlgo(typ,true)
name=FNameStringAlgo(name,true)
return typ,name,readPointer(pointer+UObject.Outer),class
end
function GetName2(pointer)
if not readPointer(pointer) then return nil end
local typ=readInteger(readPointer(pointer+8))
if not typ then return nil end
local name=readInteger(pointer+0x28)
typ=FNameStringAlgo(typ,true)
name=FNameStringAlgo(name,true)
return typ,name,readPointer(pointer+0x10)
end
function getFuncSize(address)
local i,j,k,l,m,o=0,0
while i<0x10000 do
o=readQword(i+address)
if not o then return 1 end
k=string.format('%016X',o)
if string.find(k,'CCC3') then i=i+8 break end
--l={}for n=1,8 do l[n]=k:sub(1,2) k=k:sub(3,k:len())end k=table.concat(l)
l=string.find(k,'C3') or string.find(k,'EB') or string.find(k,'E9')
if l then m=true end
l=string.find(k,'CCCC')
if l then k,j=k:gsub('CC','CC') end
if j>=2 or (j>=2 and l and m) then i=i+8-(l/2) break end
i=i+8
end
return math.floor(i)
end
function SaveObject(pointer)
if not readPointer(pointer)then return nil end
if ObjectLists[pointer] then return ObjectLists[pointer] end
--if IgnoreList[pointer] then return nil end
local objid=readInteger(pointer+UObject.ObjectId)
if not objid then return nil end
local UEver,typ,name,outer,class,super=UE4ver
if UEver<25 then typ,name,outer,class=GetName1(pointer)
else typ,name,outer=GetName2(pointer)
if not typ or not name then
typ,name,outer,class=GetName1(pointer)
end
end
--[[if not typ or not name and readPointer(readPointer(readPointer(pointer))) and readInteger(pointer+0xC)<0xFFFF then
for i=0,readInteger(pointer+0xC)-1 do
IgnoreList[pointer]=true
SaveObject(readPointer(readPointer(pointer)+i*UObjectMul))
end
return nil
else]]
if not typ or not name or typ:len()>100 then --IgnoreList[pointer]=true
return nil end
local ObjectData,size,pointers,pointerss,Data,flag1={},targetIs64Bit() and 8 or 4
ObjectData.Outer= outer~=0 and outer or nil
ObjectData.Name=name
ObjectData.Type=typ
ObjectData.Address=pointer
if not ObjectData.Name then
--print(ObjectData.Address)
ObjectData.Name='InvalidName'
end
if ObjectTable[objid+1] and ( not string.find(typ,'Property') or UE4ver<25 ) then return ObjectTable[objid+1] end
ObjectData.ObjectId=objid
if objid<0xFFFFFFF and ( not string.find(typ,'Property') or UE4ver<25 ) then
ObjectTable[objid+1]=ObjectData
if HighestObjectID<objid then HighestObjectID=objid end
end
ObjectLists[pointer]=ObjectData
SaveObject(ObjectData.Outer)
local dataNew,str,dataOld=ObjectData,ObjectData.Name
for x=0,10 do
if not dataNew.Outer or not ObjectLists[dataNew.Outer] then break end
dataOld=dataNew
dataNew=ObjectLists[dataNew.Outer]
if (string.find(dataOld.Type,'Property') or string.find(dataOld.Type,'Function'))
and (not string.find(dataNew.Type,'Property') and not string.find(dataNew.Type,'Function'))
then
str=dataNew.Name..':'..str
else
str=dataNew.Name..'.'..str
end
end
ObjectData.FullName=str
FullNameList[str:lower()]=ObjectData
if class then
class=SaveObject(class)
if class then
if not class.Instance then class.Instance={}end
class.Instance[#class.Instance+1]=ObjectData
ObjectData.Class=class
end
end
totalobjects=totalobjects+1
if UObject.super then
super=readPointer(pointer+UObject.super)
ObjectData.Super= super~=0 and super or nil
if ObjectData.Super then ObjectData.Super=SaveObject(ObjectData.Super)end
if ObjectData.Super then
if not ObjectData.Super.Uper then ObjectData.Super.Uper={}end
ObjectData.Super.Uper[#ObjectData.Super.Uper+1]=ObjectData
end
end
if string.find(typ,'Property')then
if UEver>=23 then totalproperties=totalproperties+1 end
if UObject.Offset and UObject.propsize and UObject.Property and UObject.bitmask then
ObjectData.Offset=readSmallInteger(pointer+UObject.Offset)
ObjectData.Propsize=readSmallInteger(pointer+UObject.propsize)
if string.find(typ,'StructProperty') or string.find(typ,'ObjectProperty') then
ObjectData.Property={SaveObject(readPointer(pointer+UObject.Property))}
if not ObjectData.Property[1] then ObjectData.Property=nil end
elseif string.find(typ,'MapProperty') or string.find(typ,'ArrayProperty') then
ObjectData.Property={SaveObject(readPointer(pointer+UObject.Property)),SaveObject(readPointer(pointer+UObject.Property+size))}
if not ObjectData.Property[1] then ObjectData.Property=nil end
elseif string.find(typ,'BoolProperty')then ObjectData.Bit=readInteger(pointer+UObject.bitmask)end
end
else
if UObject.member and UObject.nextmember then
local member=SaveObject(readPointer(pointer+UObject.member))
if member then--and (string.find(member.Type,'Function') or string.find(member.Type,'Property') or string.find(member.Type,'Enum') or string.find(member.Type,'Const') ) then
ObjectData.Membersize=readInteger(pointer+UObject.member+size)
LastObjectWithMember=ObjectData
ObjectData.Member={member}
for i=0,0x1000 do
member=SaveObject(readPointer(member.Address+UObject.nextmember))
if not member then break end
if not string.find(member.Type,'Function') and member.Offset and member.Offset>0 then ObjectData.Member[#ObjectData.Member+1]=member end
end
end
end
end
if typ=='Function' and not string.find(str,'Default')then
if not UObject.funct then
print(typ..' '..str..string.format(' = %X',pointer))
for i=UObject.ObjectId,0x130,4 do
flag1=nil
pointers=readPointer(pointer+i)
if readPointer(pointers) and inModule(pointers) then
--printf('%X',pointers)
for j=0,0x30,size do
if not inModule(readPointer(pointers+j))then break end
if j==0x30 then
printf('%X',i)
for k=i-4,UObject.ObjectId,-4 do
pointers=readPointer(pointer+k)
if readPointer(pointers) and inModule(pointers) then
local ext, opc, byt, add=splitDisassembledString(disassemble(pointers))
if string.find(opc,'mov') or string.find(opc,'push') or string.find(opc,'sub') then
UObject.funct=k printf('UObject.funct = 0x%X',UObject.funct)flag1=true break
end
end
end
end
end
end
if flag1 then break end
end
end
end
if (not UObject.enumoffset or not UObject.enumname or not UObject.enumindex or not UObject.enummul) and string.find(name,'EInterpCurveMode') and not IgnoreList[pointer] then
IgnoreList[pointer]=true
print(string.format('EInterpCurveMode = %X\n',pointer))
for j=UObject.Outer+size,0x100,4 do
pointers=readPointer(pointer+j)
if readPointer(pointers) and checkvalue(pointers,0x50,'CIM_Linear',1) then
UObject.enumoffset=j
print(string.format('EInterpCurveMode enums = %X\n',pointers))
if UEver>=7 then
UObject.enumname=checkvalue(pointers,0x50,'CIM_Linear',1)-pointers
UObject.enumindex=checkvalue(pointers,0x50,1,2) and checkvalue(pointers,0x50,1,2)-checkvalue(pointers,0x50,'CIM_CurveAuto',1) or 4
for k=UObject.enumname+8,0x50,4 do
if readInteger(pointers+k)>4 and FNameStringAlgo(readInteger(pointers+k),true) then UObject.enummul=k break end
end
else
UObject.enumname=0
UObject.enumindex=4
UObject.enummul=8
end
end
end
end
if string.find(ObjectData.Type,'EnumProperty') then
if not UObject.enumprop and not IgnoreList[pointer] then
IgnoreList[pointer]=true
print(string.format('%016X:%s %s',ObjectData.Address,ObjectData.Type,ObjectData.FullName))
for i=UObject.Offset+4,UObject.Offset+4+0x100,4 do
if SaveObject(readPointer(ObjectData.Address+i)) and (SaveObject(readPointer(ObjectData.Address+i)).Type=='Enum' or SaveObject(readPointer(ObjectData.Address+i)).Type=='UserDefinedEnum') then
UObject.enumprop=i
break
end
end
end
if UObject.enumprop then ObjectData.EnumProp = SaveObject(readPointer(ObjectData.Address+UObject.enumprop))end
end
return ObjectData
end
function isStructExist(name)
for i=1,#StructList do
if StructList[i].Name==name then return StructList[i] end
end
return nil
end
function SaveAndRemoveStruct()
StructList={}
local count=getStructureCount()
for i=count-1,0,-1 do
local struct=getStructure(i)
StructList[i+1]=struct
struct:removeFromGlobalStructureList()
end
end
function ValidateFNamePool(pointer)
local flag2,pointers=false
if not pointer or pointer%4~=0 then return false end
print(string.format('%X',pointer))
for m=0,0x10,4 do
if readPointer(pointer) then
pointers=readPointer(pointer+m)
if readPointer(pointers)then
for n=0,2 do
if not pointers then break end
if readPointer(pointers) then
for o=0,0x30,2 do
if string.find(readString(pointers+o),'None') then
unregisterSymbol('FNamePool') registerSymbol('FNamePool',pointer,true) flag2=true
break
end
end
end
pointers=readPointer(pointers)
end
end
if flag2 then break end
end
if flag2 then break end
end
return flag2
end
function DeleteStruct(Struct)
local count=#StructList
for i=1,count do
if Struct==StructList[i] then
Struct:Destroy()
StructList[i]=nil
end
if not StructList[i] and StructList[i+1] then
StructList[i]=StructList[i+1]
StructList[i+1]=nil
end
end
end
function LoadStruct()
for i=1,#StructList do
StructList[i]:addToGlobalStructureList()
end
end
function getEnumStr(fullname)
local Address,size,EnumStr,EnumTable,list=StaticFindObjectAlgo(fullname),targetIs64Bit() and 8 or 4,'',{}
if not Address then return nil end
list=Address+UObject.enumoffset
for k=0,readInteger(list+size)-1 do
pointers=readPointer(list)+k*UObject.enummul
offset=readBytes(pointers+UObject.enumindex,1)
if not offset then break end
if offset==0 then offset=k end
propname=FNameStringAlgo(pointers+UObject.enumname)
if string.find(propname,'::') then propname=propname:sub(string.find(propname,'::')+2,propname:len())end
EnumStr=EnumStr..string.format('%u:%s\n',offset,propname)
EnumTable[offset]=propname
end
return EnumStr,EnumTable
end
function ChildStructStart(structname,elementname)
local struct=isStructExist(structname)
if struct then
for i=0,struct.Count-1 do
if struct.Element[i].Name==elementname then return struct.Element[i].ChildStructStart end end
else return nil end
end
function sigscan(value,modulename,stopaddress)
local ms = createMemScan()
modulename,stopaddress=startstop(modulename,stopaddress)
ms.firstScan(soExactValue,vtByteArray,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',true,false,false,false)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function findAddress(Symbol,number,Address,size)
Address=getAddressSafe(Address)
if not Address then return end
if not size then size=0x200 end
local addr,i,j,addrs={},0,1,{}
while(i<size) do
local ext, opc, byt, add=splitDisassembledString(disassemble(Address+i))
if ext~="" then
if(opc:find(",")~=nil)then opc=opc:sub(opc:find(",")+1,opc:len())
else opc=opc:sub(opc:find(" ")+1,opc:len())end
if string.find(opc,'%[') then opc=opc:sub(string.find(opc,'%[')+1,opc:len()-1)end
if tonumber(opc,16) and not addrs[opc] then addrs[opc]=opc addr[j]=opc j=j+1 end
end
if opc:find('],') then
opc=opc:sub(opc:find("%[")+1,opc:find("]")-1)
if tonumber(opc,16) and not addrs[opc] then addrs[opc]=opc addr[j]=opc j=j+1 end
end
i=i+getInstructionSize(Address+i)
end
if number<=0 then return addr end
unregisterSymbol(Symbol)
registerSymbol(Symbol,getAddressSafe(addr[number]),true)
end
function checkvalue(address,size,value,typ,literal)
local cvalue,tempvalue,value2=readBytes(address,size,true)
if type(value)==type('') and string.find(value,'~') then
value2=tonumber(value:sub(string.find(value,'~')+1,value:len()))
value=tonumber(value:sub(1,string.find(value,'~')-1))
end
if not cvalue then return false end
if typ==1 then
for i=1,#cvalue,4 do
datatable={}
for m=1,4 do
datatable[m]=cvalue[m+i-1]
end
tempvalue=byteTableToDword(datatable)
--print(FNameStringAlgo(tempvalue,true))
local str=FNameStringAlgo(tempvalue,true)
if str and (not literal and string.find(str,value) or str==value) then
return address+i-1
end
end
elseif typ==2 then
for i=1,#cvalue,2 do
datatable={}
for m=1,2 do
datatable[m]=cvalue[m+i-1]
end
tempvalue=byteTableToWord(datatable)
if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end
end
elseif typ==4 then
for i=1,#cvalue,4 do
datatable={}
for m=1,4 do
datatable[m]=cvalue[m+i-1]
end
tempvalue=byteTableToDword(datatable)
if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end
end
elseif typ==8 then
for i=1,#cvalue,4 do
datatable={}
for m=1,8 do
datatable[m]=cvalue[m+i-1]
end
tempvalue=byteTableToQword(datatable)
if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end
end
end
return nil
end
function fillstruct4bytes(Struct)
if not getElementByOffset(Struct,0) then local e=Struct.addElement() e.Offset=0 e.Vartype=vtDword end
Struct.beginUpdate()
local count=Struct.Count-1
local list,k,element1,element2,size,bytesize={},1
for i=0,count do
element1=Struct.Element[i]
element2=Struct.Element[i+1]
if element2 then
bytesize=element1.Bytesize
if bytesize<4 then bytesize=4 end
size=element2.Offset-element1.Offset-bytesize
if size>0 then
if size%4>0 then size=4-size%4+size end
local start=element1.Offset
if start%4>0 then start=4-start%4+start
else start=start+4 end
size=size/4
for j=0,size-1 do
if (start+j*4)>=(element1.Offset+bytesize) then
list[k]=start+j*4
k=k+1
end
end
end
end
end
for i,v in ipairs(list) do local e=Struct.addElement() e.Offset=v e.Vartype=vtPointer end
Struct.endUpdate()
end
function UECreateStruct(LocalStruct,ArrayStruct,ObjectData,Struct,Instance,AddedOffset,AddedName)
if AddedOffset then
if LocalStruct[ObjectData.FullName] then copyStruct(LocalStruct[ObjectData.FullName],Struct,AddedOffset,AddedName)
else
local copy=createStructure(ObjectData.FullName)
UECreateStruct(LocalStruct,ArrayStruct,ObjectData,copy,Instance)
LocalStruct[ObjectData.FullName]=copy
copyStruct(copy,Struct,AddedOffset,AddedName)
end
return
end
AddedOffset = AddedOffset and AddedOffset or 0
AddedName = AddedName and AddedName or ''
local size,MemberData,Propsize,e,f,Name,Offset,Typ=targetIs64Bit() and 8 or 4
for i=0,10 do
if ObjectData.Member then
print(ObjectData.Type..' '..ObjectData.FullName)
for j=1,#ObjectData.Member do
MemberData=ObjectData.Member[j]
if MemberData.Offset then
Offset=AddedOffset+MemberData.Offset
Propsize=MemberData.Propsize
Name=AddedName..MemberData.Name
Typ=MemberData.Type
if string.find(ObjectData.Type,'UserDefinedStruct') then Name=Name:sub(1,string.find(Name,'_')-1)end
if string.find(Typ,'StructProperty') and MemberData.Property and MemberData.Property[1] then
UECreateStruct(LocalStruct,ArrayStruct,MemberData.Property[1],Struct,Instance,Offset,Name..'.')
if not getElementByOffset(Struct,Offset) then e=Struct.addElement() e.Offset=Offset e.Name=Name e.Vartype=vtDword end
else
e=Struct.addElement()
e.Offset=Offset
e.Name=Name
if string.find(Typ,'BoolProperty') and MemberData.Bit then e.ChildStructStart=MemberData.Bit end
if Instance and string.find(Name,'RowStruct') then
local spointer=readPointer(Instance+Offset)
local sname,sstruct=SaveObject(spointer)
if sname then
print(sname.Type..' '..sname.FullName)
if not ArrayStruct then ArrayStruct={} end
if ArrayStruct[sname.Name] then sstruct=ArrayStruct[sname.Name]
else
sstruct=createStructure(sname.Name)
ArrayStruct[sname.Name]=sstruct
UECreateStruct(LocalStruct,ArrayStruct,sname,sstruct,Instance,nil,nil)
end
f=Struct.addElement() f.Offset=e.Offset+8-sub f.Name='Table' f.Vartype=vtPointer
local ssstruct=createStructure('DataTable')
f.setChildStruct(ssstruct)
for r=0,10 do
f=ssstruct.addElement() f.Offset=r*0x18 f.Name=string.format('[%u] FName',r) f.Vartype=vtQword
f=ssstruct.addElement() f.Offset=r*0x18+8 f.Name=string.format('[%u] Data',r) f.Vartype=vtPointer
f.setChildStruct(sstruct)
end
fillstruct4bytes(ssstruct)
f=Struct.addElement() f.Offset=e.Offset+0x10-sub*2 f.Name='Size' f.Vartype=vtDword
end
end
if not ue4type[Typ] then e.Vartype=vtDword
else e.Vartype=ue4type[Typ] end
if (string.find(Typ,'ArrayProperty') or string.find(Typ,'MapProperty')) and MemberData.Property then
f=Struct.addElement() f.Offset=e.Offset+8-sub f.Name=e.Name..'_size' f.Vartype=vtDword
f=Struct.addElement() f.Offset=e.Offset+0xC-sub f.Name=e.Name..'_sizes' f.Vartype=vtDword
for m=e.Offset+0xC-sub+4,Propsize-1,4 do
if not getElementByOffset(Struct,m) then f=Struct.addElement() f.Offset=m f.Name=string.format('%s+%X',e.Name,m) f.Vartype=vtDword end
end
local isMap= string.find(Typ,'MapProperty')
if string.find(MemberData.Property[1].Type,'StructProperty') and MemberData.Property[1].Property and MemberData.Property[1].Property[1] then
Name= MemberData.Property[1].Property[1].Name..'[]'
else Name=MemberData.Property[1].Name..'[]'end
if not ArrayStruct then ArrayStruct={} end
if ArrayStruct[Name] then e.setChildStruct(ArrayStruct[Name])
else
local stru=createStructure(Name)
ArrayStruct[Name]=stru
e.setChildStruct(stru)
local ppsize=0
if isMap then
for k=1,#MemberData.Property do
ppsize=(MemberData.Property[k].Propsize<4 and 4 or MemberData.Property[k].Propsize)+ppsize
end
ppsize=ppsize+0x8
--print(ppsize)
end
for k=1,#MemberData.Property do
local psize=isMap and ppsize or MemberData.Property[k].Propsize
--print(MemberData.Address)
local Offs=isMap and MemberData.Property[k].Offset and MemberData.Property[k].Offset or 0
for p=0,10 do
Offset=p*psize+Offs
Name=string.format('[%u] ',p)
Typ=MemberData.Property[k].Type
if string.find(MemberData.Property[k].Type,'StructProperty') then
UECreateStruct(LocalStruct,ArrayStruct,MemberData.Property[k].Property[1],stru,Instance,Offset,Name)
else
f=stru.addElement()
f.Offset=Offset
f.Name=Name..MemberData.Property[k].Name
if not ue4type[Typ] then f.Vartype=vtDword
else f.Vartype=ue4type[Typ]end
end
end
end
fillstruct4bytes(stru)
end
end
end
end
end
end
if not ObjectData.Super then break end
ObjectData=ObjectData.Super
end
end
function ue4createstruct(FullNameOrAddress,StructName,isGlobal,isfullname,Structu,AddedOffset,AddedName,Instance,name)
local ObjectData
if not FullNameOrAddress then return
elseif type(FullNameOrAddress)==type('')then
FullNameOrAddress=StaticFindObjectAlgo(FullNameOrAddress)
ObjectData=SaveObject(FullNameOrAddress)
elseif type(FullNameOrAddress)==type({})then ObjectData=FullNameOrAddress
elseif type(FullNameOrAddress)==type(0)then ObjectData=SaveObject(FullNameOrAddress) end
--print(ObjectData.FullName)
if not ObjectData then return end
StructName= StructName and StructName or ObjectData.Name
Struct=Structu and Structu or createStructure(StructName and StructName or ObjectData.Name)
local LocalStruct,ArrayStruct,e={},{}
Struct.beginUpdate()
UECreateStruct(LocalStruct,ArrayStruct,ObjectData,Struct,Instance,nil,nil)
Struct.endUpdate()
if not getElementByOffset(Struct,0) then e=Struct.addElement() e.Offset=0 e.Name='VTable' e.Vartype=vtPointer end
if not getElementByOffset(Struct,UObject.ObjectId) then e=Struct.addElement() e.Offset=UObject.ObjectId e.Name='ObjectIndex' e.Vartype=vtDword end
if not getElementByOffset(Struct,UObject.Class) then e=Struct.addElement() e.Offset=UObject.Class e.Name='Class/Type' e.Vartype=vtPointer end
if not getElementByOffset(Struct,UObject.FNameIndex) then e=Struct.addElement() e.Offset=UObject.FNameIndex e.Name='FNameIndex' e.Vartype=vtDword end
if not getElementByOffset(Struct,UObject.Outer) then e=Struct.addElement() e.Offset=UObject.Outer e.Name='Outer' e.Vartype=vtPointer end
if string.find(StructName,'Function') and UObject.funct then e=Struct.addElement() e.Offset=UObject.funct e.Name='Func' e.Vartype=vtPointer end
--[[
if not Instance then fillstruct4bytes(Struct)
else
if not getElementByOffset(Struct,0) then Struct.autoGuess(Instance, 0, Struct.Element[0].Offset) end
local count=Struct.Count-1
local list,k,element1,element2,size,bytesize={},1
for i=0,count do
element1=Struct.Element[i]
element2=Struct.Element[i+1]
if element2 then
bytesize=element1.Bytesize
if bytesize<4 then bytesize=4 end
size=element2.Offset-element1.Offset-bytesize
print(element1.Offset+bytesize)
print(size)
if size>0 then
Struct.autoGuess(Instance,element1.Offset+bytesize,size)
end
end
end
end]]
fillstruct4bytes(Struct)
if isGlobal then StructList[#StructList+1]=Struct end
LoadStruct()
return Struct
end
function AutoConfig()
local flag1,flag2,size,val=false,false,targetIs64Bit() and 8 or 4,not UE3 and 1 or 4
local pointer,pointers,pointerss,pointer3,Data,Data2=StaticFindObjectAlgo(not UE3 and '/Script/Engine.GameEngine' or 'Engine.Pawn')
if not pointer then
for i,v in pairs(ObjectTable) do if v.Name==(not UE3 and 'GameEngine' or 'Pawn') then pointer=v.Address break end end
end
Data=SaveObject(pointer)
printf('%s %s = %X',Data.Type,Data.FullName,Data.Address)
for i=UObject.Outer+size,0x100,4 do
printf('%X',i)
pointers=readPointer(pointer+i)
Data=SaveObject(pointers)
if Data then printf('%s %s = %X',Data.Type,Data.FullName,Data.Address)end
if Data and string.find(Data.FullName,'Engine.'..(not UE3 and 'Engine' or'Actor')) and not flag1 then UObject.super=i flag1=true if not UE3 then pointer=pointers end end
if Data and (string.find(Data.Type,'Property') or string.find(Data.Type,'Function') or string.find(Data.Type,'Enum')) and not string.find(Data.FullName,'Core') then
printf('1. %s %s = %X',Data.Type,Data.FullName,pointers)
for j=size,0x100,4 do
pointerss=readPointer(pointers+j)
printf('%X',j)
for k=0,val do
Data=SaveObject(pointerss)
if not Data or (not string.find(Data.Type,'Property') and not string.find(Data.Type,'Function') and not string.find(Data.Type,'ScriptStruct') and not string.find(Data.Type,'State')) or string.find(Data.FullName,'Core') then break end
printf('2. %X %s %s = %X',j,Data.Type,Data.FullName,pointerss)
if k==val then UObject.nextmember=j printf('UObject.nextmember=%X',j) flag2=true break end
pointerss=readPointer(pointerss+j)
end
if flag2 then break end
end
if flag2 then UObject.member=i printf('UObject.member=%X',i) end
if flag1 and flag2 then break end
end
end
printf('UObject.super=%X',UObject.super)
local varsize={[0]=1,[2]=4,[3]=8,[4]=4,[12]=size}
pointerss=readPointer(UObject.member+pointer)
for i=0,300 do
Data=SaveObject(pointerss)
if Data then
print(string.format('%X:%s %s',pointerss,Data.Type,Data.FullName))
if string.find(Data.Type,'ObjectProperty') then break end
end
pointerss=readPointer(UObject.nextmember+pointerss)
end
UObject.propsize=checkvalue(pointerss+UObject.Outer,0x100,varsize[ue4type[Data.Type]],2)-pointerss
for i=UObject.nextmember+size,0x100,size do
Data=SaveObject(readPointer(pointerss+i))
if Data and string.find(Data.Type,'Class') and not string.find(Data.FullName,'Core') then UObject.Property=i break end
end
pointerss=readPointer(UObject.nextmember+pointers)
for i=0,300 do
Data=SaveObject(pointerss)
if Data then
print(string.format('%X:%s %s',pointerss,Data.Type,Data.FullName))
if string.find(Data.Type,'ObjectProperty') or string.find(Data.Type,'FloatProperty') then break end
end
pointerss=readPointer(UObject.nextmember+pointerss)
end
pointers=readPointer(UObject.nextmember+pointerss)
for i=UObject.nextmember+size,0x100,2 do
print(string.format('%X:',i)..readSmallInteger(pointerss+i)+varsize[ue4type[Data.Type]]..'=='..readSmallInteger(pointers+i))
if readSmallInteger(pointerss+i)+varsize[ue4type[Data.Type]]>0x10 and readSmallInteger(pointerss+i)+varsize[ue4type[Data.Type]]==readSmallInteger(pointers+i)then UObject.Offset=i print(string.format('%X',UObject.Offset)) break end
end
for i,v in pairs(ObjectTable) do if v.Name=='Actor' then Data=v break end end
printf('%s %s = %X',Data.Type,Data.FullName,Data.Address)
pointerss=readPointer(UObject.member+Data.Address)
for i=0,100 do
if not pointerss then break end
Data=SaveObject(pointerss)
if Data then
pointer3=readPointer(UObject.nextmember+pointerss)
print(string.format('%X:%s %s',pointerss,Data.Type,Data.FullName))
if string.find(Data.Type,'BoolProperty') and readSmallInteger(UObject.Offset+pointerss)==readSmallInteger(UObject.Offset+pointer3) then break end
end
pointerss=readPointer(UObject.nextmember+pointerss)
end
Data=SaveObject(pointer3)
if Data then
print(string.format('%X:%s %s',pointer3,Data.Type,Data.FullName))
for i=UObject.Property,0x100,1 do
local val1,val2=readBytes(pointerss+i),readBytes(pointer3+i)
if (val1==1 or val1%2==0) and (val2==1 or val2%2==0) and val1<val2 then UObject.bitmask=i break end
end
end
if not UObject.bitmask then UObject.bitmask=UObject.Property end
print(string.format([[
UObject.ObjectId = 0x%X
UObject.Class = 0x%X
UObject.FNameIndex = 0x%X
UObject.Outer = 0x%X
UObject.super = 0x%X
UObject.member = 0x%X
UObject.nextmember = 0x%X
UObject.propsize = 0x%X
UObject.Offset = 0x%X
UObject.Property = 0x%X
UObject.bitmask = 0x%X
]],UObject.ObjectId,UObject.Class,UObject.FNameIndex,
UObject.Outer,UObject.super,UObject.member,UObject.nextmember,
UObject.propsize,UObject.Offset,UObject.Property,
UObject.bitmask))
end
function getElementByOffset(struct,offset)
for i=0,struct.Count-1 do
if struct.Element[i].Offset==offset then return i end
end
return nil
end
function copyStruct(original,copy,AddedOffset,AddedName)
if not copy then copy=createStructure(original.Name..'_copy')end
if not AddedOffset then AddedOffset=0 end
if not AddedName then AddedName='' end
copy.beginUpdate()
for i=0,original.Count-1 do
local e=copy.addElement()
e.Offset=original.Element[i].Offset+AddedOffset
if original.Element[i].Name=='' then e.Name=original.Element[i].Name
else e.Name=AddedName..original.Element[i].Name end
e.Vartype=original.Element[i].Vartype
e.ChildStruct=original.Element[i].ChildStruct
e.ChildStructStart=original.Element[i].ChildStructStart
e.Bytesize=original.Element[i].Bytesize
end
copy.endUpdate()
return copy
end
function ue_structureDissectOverrideCallback(Struct, Instance)
local name,fullname,class
address,name,fullname,class=ue_findRealStartOfObject(Instance)
if class then
SaveAndRemoveStruct()
ue4createstruct(class,nil,nil,nil,Struct,nil,nil,Instance,name)
if Struct.Count>1 then return true
else return false end
end
return nil
end
function ue_structureNameLookupCallback(address)
local name,fullname
address,name,fullname=ue_findRealStartOfObject(address)
if name then return name,address end
return nil
end
function ue_SymbolLookupCallback(symbol)
if UEMember[symbol:lower()] then return UEMember[symbol:lower()] end
local str='Function '
if string.find(symbol,str) then
symbol=symbol:sub(string.find(symbol,str)+str:len(),symbol:len())
local pointer=StaticFindObjectAlgo(symbol)
if pointer then return readPointer(pointer+UObject.funct)end
end
return nil
end
function ue_findRealStartOfObject(address)
local ObjectData,Membersize
ObjectData=SaveObject(address)
if ObjectData then return ObjectData.Address,ObjectData.Class.Name,ObjectData.Class.FullName,ObjectData.Class or nil end
for i=1,HighestObjectID+10 do
if ObjectTable[i] and ObjectTable[i].Class then
Membersize = (ObjectTable[i].Class.Membersize and ObjectTable[i].Class.Membersize>0x100 and ObjectTable[i].Class.Membersize<0x5000) and ObjectTable[i].Class.Membersize or 0x500
if address>=ObjectTable[i].Address and address<=ObjectTable[i].Address+Membersize then
ObjectData=ObjectTable[i]
return ObjectData.Address,ObjectData.Class.Name,ObjectData.Class.FullName,ObjectData.Class
end
end
end
return address
end
function findOpcodes(address,opcode,size)
if not size then size=0x50 end
address=getAddressSafe(address)
if not address then return nil end
local addr={}
local i=0
local j=1
while(i<size) do
local ext, opc, byt, add=splitDisassembledString(disassemble(address+i))
if string.find(opc,opcode) then
addr[j]=address+i
j=j+1
end
i=i+getInstructionSize(address+i)
end
return addr
end
function findOpcode(address,opcode,size)
if not size then size=0x50 end
address=getAddressSafe(address)
if not address then return nil end
local i=0
while(i<size) do
local ext, opc, byt, add=splitDisassembledString(disassemble(address+i))
if string.find(opc,opcode) then
return address+i
end
i=i+getInstructionSize(address+i)
end
return nil
end
function findLastCall(address,size)
if not address then return end
if not size then size=0x1000 end
local result=findOpcode(address,'ret',size)
if not result then print(address..' cant find ret?') return nil end
result=result-getAddress(address)
result=findOpcodes(address,'call ',result)
local ext, opc, byt, add=splitDisassembledString(disassemble(result[#result]))
opc=opc:gsub('call ','')
return opc
end
function getOffsets(address,size)
if not size then size=0x1000 end
local result=findOpcodes(address,'+',size)
for i=1,#result do
local ext, opc, byt, add=splitDisassembledString(disassemble(result[i]))
result[i]=opc:sub(opc:find('+')+1,opc:len()-1)
end
return result
end
function followjmp(address,size)
if not size then size=0x1000 end
local result=findOpcode(address,'jmp ',size)
if not result then print(address..' cant find jmp?') return nil end
local ext, opc, byt, add=splitDisassembledString(disassemble(result))
opc=opc:gsub('jmp ','')
return opc
end
function followcall(address,size)
if not size then size=0x1000 end
local result=findOpcode(address,'call ',size)
if not result then print(address..' cant find call?') return nil end
local ext, opc, byt, add=splitDisassembledString(disassemble(result))
opc=opc:gsub('call ','')
return opc
end
function ProcessEvent(instance,ufunction,params)
local str=([[
label(newmem)
label(returnhere)
label(%s)
registersymbol(%s)
label(ProcessEventFlag)
registersymbol(ProcessEventFlag)
label(code)
label(temp)
%s:
newmem:
mov rax,ProcessEventFlag
cmp byte ptr[rax],01
je short @f
mov byte ptr[rax],01
mov rax,temp
pop [rax]
mov [rax+8],rcx
mov [rax+20],rsp
ba2nana
mov rax,code
push rax
@@:
%s
jmp returnhere
code:
mov rcx,ProcessEventFlag
mov byte ptr[rcx+1],01
mov rcx,temp
mov rsp,[rcx+20]
pop rcx
pop rcx
mov rcx,temp
ba3nana
push [rcx]
mov rcx,[rcx+8]
jmp newmem
%s:
db %X %s
ProcessEventFlag:
dq 0
temp:
dq 0 0 0 0 0 0
%X:
jmp newmem
]]):gsub('ba2nana',( not UE3 and (targetIs64Bit() and string.format(([[
mov [rax+10],rdx
mov [rax+18],r8
mov rcx,%X
mov rdx,%X
mov r8,%X
]]),instance,ufunction,params) or string.format(([[
pop [rax+10]
pop [rax+18]
mov rcx,%X
mov rdx,%X
mov rax,%X
push rdx
push rax
]]),instance,ufunction,params))or string.format(([[
pop [rax+10]
pop [rax+18]
mov rcx,%X
mov rdx,%X
%s
push rdx
]]),instance,ufunction,params))):gsub('ba3nana',(targetIs64Bit() and ([[
mov rdx,[rcx+10]
mov r8,[rcx+18]
]])or([[
push [rcx+18]
push [rcx+10]
]])))
enablescript('ProcessEvent_alloc','ProcessEvent_save','UObject::ProcessEvent',str)
for i=0,1000 do
if not readInteger('ProcessEventFlag+1') or readInteger('ProcessEventFlag+1')==1 then break end
sleep(1)
end
enablescript('ProcessEvent_alloc','ProcessEvent_save','UObject::ProcessEvent',[[
%X:
readmem(%s+1,%u)
]],true)
unregisterSymbol('ProcessEventFlag')
end
function ProcessEventCall(method,param)
param= param or ''
local str=([[
label(newmem)
label(returnhere)
label(%s)
registersymbol(%s)
label(ProcessEventCallFlag)
registersymbol(ProcessEventCallFlag)
label(temp)
%s:
newmem:
mov rax,ProcessEventCallFlag
cmp byte ptr[rax],01
je long @f
mov byte ptr[rax],01
mov rax,temp
mov [rax+8],rcx
mov [rax+10],rdx
mov [rax+18],r8
mov [rax+20],rsi
mov [rax+28],rsp
sub rsp,50
banana
call rax
mov rcx,temp
mov rdx,[rcx+10]
mov r8,[rcx+18]
mov rsi,[rcx+20]
mov rsp,[rcx+28]
mov rcx,[rcx+8]
push rcx
mov rcx,ProcessEventCallFlag
mov [rcx+8],rax
mov byte ptr[rcx+1],01
pop rcx
@@:
%s
jmp returnhere
%s:
db %X %s
ProcessEventCallFlag:
dq 0 0 0
temp:
dq 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
%X:
jmp newmem
]]):gsub('banana',string.format('%s\nmov rax,%X\n',param,method)):gsub('r8',( targetIs64Bit() and 'r8' or 'rdi'))
enablescript('ProcessEventCall_alloc','ProcessEventCall_save',indexdism('UObject::ProcessEvent')[(targetIs64Bit() and 9 or 11)].add,str)
for i=0,1000 do
if not readInteger('ProcessEventCallFlag+1') or readInteger('ProcessEventCallFlag+1')==1 then break end
sleep(1)
end
local result=readPointer('ProcessEventCallFlag+8')
enablescript('ProcessEventCall_alloc','ProcessEventCall_save',indexdism('UObject::ProcessEvent')[(targetIs64Bit() and 9 or 11)].add,[[
%X:
readmem(%s+1,%u)
]],true)
unregisterSymbol('ProcessEventCallFlag')
return result
end
function checkFuncReg(address)
if type(address)==type(0) then address=string.format('%X',address)end
local str=([[
label(newmem)
label(returnhere)
label(%s)
registersymbol(%s)
label(CheckFunctionRegFlag)
registersymbol(CheckFunctionRegFlag)
label(temp)
%s:
newmem:
push rax
mov rax,temp
pop [rax]
mov rax,CheckFunctionRegFlag
cmp byte ptr[rax+1],01
je short @f
mov byte ptr[rax+1],01
banana
@@:
mov rax,temp
push [rax]
mov byte ptr[rax],01
pop rax
%s
jmp returnhere
temp:
dq 0 0
%s:
db %X %s
CheckFunctionRegFlag:
dq 0 0 0 0 0 0 0
%X:
jmp newmem
]]):gsub('banana', targetIs64Bit() and ([[
mov [rax+8],rcx
mov [rax+10],rdx
mov [rax+18],r8
mov [rax+20],r9
]]) or [[
mov [rax+8],rcx
pop [rax+4]
pop [rax+10]
pop [rax+18]
pop [rax+20]
push [rax+20]
push [rax+18]
push [rax+10]
push [rax+4]
]])
enablescript('CheckFunctionReg_alloc','CheckFunctionReg_save',address,str)
for i=0,10 do
if not readInteger('CheckFunctionRegFlag') or readInteger('CheckFunctionRegFlag')==1 then break end
sleep(1)
end
local result={readPointer('CheckFunctionRegFlag+8'),readPointer('CheckFunctionRegFlag+10'),readPointer('CheckFunctionRegFlag+18'),readPointer('CheckFunctionRegFlag+20')}
enablescript('CheckFunctionReg_alloc','CheckFunctionReg_save',address,[[
%X:
readmem(%s+1,%u)
]],true)
unregisterSymbol('CheckFunctionRegFlag')
return result
end
function indexdism(Address)
Address=getAddressSafe(Address)
if not Address then return nil end
size=0x100
local addr={}
local i=0
local j=1
while(i<size) do
addr[j]={}
addr[j].ext, addr[j].opc, addr[j].byt, addr[j].add=splitDisassembledString(disassemble(Address+i))
j=j+1
i=i+getInstructionSize(Address+i)
end
return addr
end
function startstop(modulename,stopaddress)
if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end
if type(modulename)==type(0) then modulename=string.format('%X',modulename)
elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end
if(stopaddress==0 or stopaddress==nil or stopaddress=='')then
stopaddress=getNameFromAddress(getAddress(modulename),true,false)
if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end
if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end
modulename=getAddress([["]]..stopaddress..[["]])
stopaddress=modulename+getModuleSize(stopaddress)
modulename=string.format('%X',modulename)
end
if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end
return modulename,stopaddress
end
function groupscan(value,modulename,stopaddress)
local ms = createMemScan()
modulename,stopaddress=startstop(modulename,stopaddress)
ms.firstScan(soExactValue,vtGrouped,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function pointerscan(value,modulename,stopaddress,value2)
local ms = createMemScan()
modulename,stopaddress=startstop(modulename,stopaddress)
print(modulename..'~'..stopaddress)
if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)
else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function stringscan(value,modulename,stopaddress,isUnicode)
local ms = createMemScan()
modulename,stopaddress=startstop(modulename,stopaddress)
ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function StructAddToListSymbol(StructName,StartOffset,StopOffset,BaseAddress,OffsetOnly)
if not StartOffset then StartOffset=0 end
if not StopOffset then StopOffset=0xFFFFFF end
local structCount=getStructureCount()
local struct
for i=0,structCount-1 do
local stru=getStructure(i)
if stru.Name==StructName then struct=stru break end
end
if struct then
for i=0,struct.Count-1 do
local e=struct.Element[i]
if e.Offset>=StartOffset and e.Offset<=StopOffset then
local rec=getAddressList().createMemoryRecord()
rec.setDescription(e.Name)
if OffsetOnly then
if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.Offset[0]=e.Offset
else rec.setAddress(string.format('+%X',e.Offset))end
else
if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.OffsetText[0]=StructName..'.'..e.Name
else rec.setAddress(string.format('+%s.%s',StructName,e.Name))end
end
rec.Type=e.Vartype
end
end
end
end
function getInsForJump(address,registername,destination,allocsize,SharedMemoryName,num)
address = getAddressSafe(address)
if not address then error('getInsForJump address nil') return end
if not allocsize then allocsize=4096 end
destination=getAddressSafe(destination)
while not destination do
destination = allocateMemory((not SharedMemoryName and allocsize or SharedMemoryName),address)
end
size = not num and ((address+5-destination>0x7FFFFFFF) and 14 or 5) or 100
num = not num and 10 or num
if registername then
unregisterSymbol(registername)
registerSymbol(registername,destination,true)
else deAlloc(destination) end
local opcodes = {}
local i = 0
while i<size and #opcodes<num do
local ext, opc=splitDisassembledString(disassemble(address+i))
opcodes[#opcodes+1] = opc
i=i+getInstructionSize(address+i)
end
local copy = table.concat(opcodes,'\r\n')
local readAsTable = true
local byt = readBytes(address,i,readAsTable)
for j=1,#byt do byt[j] = ('%02X'):format(byt[j]) end
local bytes = table.concat(byt, ' ')
return i,copy,bytes,size,destination
end
function AAscript(script)
local success,erro=autoAssembleCheck(script)
if not success then
print('\n'..erro..'\n')
local scriptstr=createStringlist()scriptstr.Text=script
for j=0,scriptstr.Count-1 do print(string.format('%u\t%s',j+1,scriptstr[j])) end
error('autoAssemble failed')
end
autoAssemble(script)
end
function enablescript(name,registername,addressname,script,disable)
local address=getAddress(addressname)
if disable then script=(script):format(address,registername,readBytes(registername,1))
else
local i,copy,bytes,size =getInsForJump(address,name)
script=(script):format(registername, registername, name, copy, registername, i, bytes, address)..string.rep('nop\n',i-size)..'returnhere:'
end
local success,erro=autoAssembleCheck(script)
if not success then print('\n'..erro..'\n')local scriptstr=createStringlist()scriptstr.Text=script for j=0,scriptstr.Count-1 do print(string.format('%u\t%s',j+1,scriptstr[j])) end
if not disable then deAlloc(name)unregisterSymbol(name)end error(name..' autoAssemble failed')end
autoAssemble(script)
if disable then deAlloc(name)unregisterSymbol(name)unregisterSymbol(registername)end
end
function toStr(rec)
local tec,str,list=rec,'',{}
while(true)do
if not tec or not tec.Address then break end
list[#list+1]=tec
if tec.Address:sub(1,1)~='+' then break end
tec=tec.Parent
end
for i=#list,1,-1 do
str=string.format('%s%s',str,list[i].Address)
for j=list[i].OffsetCount-1,0,-1 do
str=string.format('[%s]+%s',str,list[i].OffsetText[j])
end
end
if rec and rec.Address then
rec.DontSave=false
rec.Address=str
rec.OffsetCount=0
end
end
function toStrChildren(rec)
for i=0,rec.Count-1 do
toStrChildren(rec.Child[i])
end
toStr(rec)
end
function toStrSelectedMemrec()
for i,v in pairs(getAddressList().getSelectedRecords()) do
toStrChildren(v)
end
end
function cycleFullCompact(sender,force)
local state = not(compactmenuitem.Caption == 'Compact View Mode')
if force~=nil then state = not force end
compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = state
getMainForm().Panel4.Visible = state
getMainForm().Panel5.Visible = state
end
function addCompactMenu()
if compactmenualreadyexists then return end
local parent = getMainForm().Menu.Items
compactmenuitem = createMenuItem(parent)
parent.add(compactmenuitem)
compactmenuitem.Caption = 'Compact View Mode'
compactmenuitem.OnClick = cycleFullCompact
compactmenualreadyexists = 'yes'
end
addCompactMenu()
--cycleFullCompact(nil,true)
local list,str,func=getAddressList()
for i=0,list.Count-1 do
if list[i].Script and list[i].Script~='' then
--print(list[i].Description)
str=list[i].Script
for i=0,1000 do
if not string.find(str,'function ') then break
else
str=str:sub(string.find(str,'function ')+9,str:len())
if str:sub(1,1)~="'" then
func=str:sub(1,string.find(str,'%(')-1)
unregisterLuaFunctionHighlight(func)
registerLuaFunctionHighlight(func)
--print(func)
end
end
end
end
end
if not FuncSizeList then FuncSizeList={}end
if syntaxcheck then return end
[ENABLE]
if not process or not enumModules()[1] then print('Error: No process selected...') error('process is nil') end
if readPointer('Core.UObject::GObjObjects')then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray','Core.UObject::GObjObjects',true) end
if readPointer('Core.FName::Names')then unregisterSymbol('FNamePool') registerSymbol('FNamePool','Core.FName::Names',true) end
starttime=os.clock()
if string.find(process,'MassEffect') then
isMassEffect=true
local result2,result=sigscan('C0 CA 45 80 00 00 00 00 00 00 00 00 4E 6F 6E 65 00',process)
for i=1,#result2 do
result=pointerscan(getAddress(result2[i]),process)
for j=1,#result do
stringoffset=0xC
print(result[j])
unregisterSymbol('FNamePool') registerSymbol('FNamePool',result[j],true)
end
end
UE4ver=ue4versioncheck()
local rec=getAddressList().getMemoryRecordByDescription('Object scanner (region)')
if rec and not rec.Active then
rec.Active=true
while rec.AsyncProcessing do sleep(100) end
end
else isMassEffect=nil
end
if not UEMember or type(UEMember)~=type({}) then UEMember={}end
if not UE4ver then UE4ver=ue4versioncheck() end
local flag1,flag2,flag3,address,result1,result2,pointer,pointers,pointer1,pointer2,pointer3,rec=false,false
if not readPointer('GUObjectArray') then
local ObjectAOB={'44 8B * * * 48 8D 05 * * * * * * * * * 48 89 71 10'
,'40 53 48 83 EC 20 48 8B D9 48 85 D2 74 * 8B'
,'4C 8B 05 * * * * 45 3B 88'
,'4C 8B 44 24 60 8B 44 24 78 * * * 48 8D','8B 44 24 04 56 8B F1 85 C0 74 17 8B 40 08'
,'8B 44 24 04 56 8B F1 85 C0 74 17 8B 40 08'
,'8B 15 * * * * 8B 04 82 85'
,'56 48 83 * * 48 89 * * * 48 89 * 48 8D'
}
for i=1,#ObjectAOB do
result1=sigscan(ObjectAOB[i],process)
for j=1,#result1 do
print(i..':i'..':'..result1[j])
result2=findAddress('GUObjectArray',0,result1[j],0x50)
for k=1,#result2 do
pointer=getAddress(result2[k])-0x70
print(i..':j'..':'..result2[k])
for m=0,0x100,4 do
if readPointer(readPointer(readPointer(pointer+m))) then
if m>0x50 then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result2[k],true)
else unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result2[k]..'-68',true) end
flag1=true break
end
end
if flag1 then break end
end
if flag1 then break end
end
if flag1 then break end
end
if flag1 then
pointer1=getAddress('GUObjectArray')
for i=pointer1-0x50,pointer1+0x200,4 do
flag3=nil
if readPointer(readPointer(readPointer(readPointer(i))))then
pointer=i
for n=0,2 do
for o=4,(UE3 and size or 8*4),4 do
flag3=nil
for k=0,10*o,o do
pointers=readPointer(pointer+k)
if not readPointer(readPointer(pointers))
or not readPointer(readPointer(readPointer(pointers)))
or not inModule(readPointer(readPointer(pointers)))
or not checkvalue(pointers,0x50,k/o,2) then break end
if k==(10*o)then flag3=true print(string.format('%X %X',i,o)) unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',i,true) NOGUObjectsize=(n==0 and true or nil) break end
end
if flag3 then break end
end
if flag3 then break end
pointer=readPointer(pointer)
end
end
if flag3 then break end
end
if not flag3 then print('GUObjectArray not found, running scanner...') flag1=nil
else print(string.format('GUObjectArray = %X',getAddress('GUObjectArray')))end
else print('GUObjectArray not found, running scanner...') end
flag1 = not flag1
if not flag1 and ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then
if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18
elseif readInteger('GUObjectArray+14')==0 then UE4ver=9
else UE4ver=20 end
end
end
if not readPointer('FNamePool') then
if string.find(process,'StateOfDecay2')then
findAddress('FNamePool',1,sigscan('48 8D * * * * * 8B * * 85 * 74 * 8D',process)[1])
findAddress('FNamePool2',3,sigscan('48 8D * * * * * 8B * * 85 * 74 * 8D',process)[1])
FNamePool=getAddress('FNamePool')
FNamePool2=getAddress('FNamePool2')
flag2=true
end
local NamePoolAOB={'4C 8D 05 * * * * EB 16 48 8D 0D * * * * E8'
,'48 8D 0D * * * * E8 * * * * * 8B * C6'
,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8'
,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8'
,'C3 * DB 48 89 1D * * * * * * 48 8B 5C 24 20'
,'33 F6 89 35 * * * * 8B C6 5E'
,'8B 07 8B 0D * * * * 8B 04 81'
}
for i=(UE4ver>=23 or ue4versioncheck()<2) and 1 or 3,#NamePoolAOB do
result1=sigscan(NamePoolAOB[i],process)
for j=1,#result1 do
print(i..':i'..':'..result1[j])
result2=findAddress('FNamePool',0,result1[j],0x50)
for k=1,#result2 do
print(i..':j'..':'..result2[k])
pointer=getAddress(result2[k])
flag2=ValidateFNamePool(pointer)
if flag2 then UE4ver=ue4versioncheck()==0 and (i>2 and 18 or 23) or UE4ver break end
end
if flag2 then break end
end
if flag2 then break end
end
if flag2 then print(string.format('FNamePool = %X',getAddress('FNamePool')))
else print('FNamePool not found, running scanner...') end
flag2 = not flag2
end
if flag2 then
local FNamePoolScanner={'FNamePool scanner V4 (BatmanAk)','FNamePool scanner V2 (Generic)','FNamePool scanner V3 (Unicode)'}
unregisterSymbol('FNamePool')
UE4ver=ue4versioncheck()
for i=(string.find(process:lower(),'batmanak') and 1 or 2),#FNamePoolScanner do
rec=getAddressList().getMemoryRecordByDescription(FNamePoolScanner[i])
if rec and not rec.Active then
rec.Active=true
while rec.AsyncProcessing do sleep(100) end
end
if readPointer('FNamePool') then break end
end
if not readPointer('FNamePool') then error('FNamePool not found!')end
end
if flag1 then
local ObjectScanner={'Object scanner (region)','Object scanner','UE3 Namepool & ObjectArray scanner (using string reference)'}
unregisterSymbol('GUObjectArray')
print(UE4ver)
for i=1,#ObjectScanner do
rec=getAddressList().getMemoryRecordByDescription(ObjectScanner[i])
if rec and not rec.Active then
rec.Active=true
while rec.AsyncProcessing do sleep(100) end
end
if readPointer('GUObjectArray') then break end
end
if not readPointer('GUObjectArray') then error('GUObjectArray not found!')end
end
print('AOBScan done : '..os.clock()-starttime)
ue4parsetable()
if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end
ue4config()
ue4parsetable()
if UE4ver==23 and ue4versioncheck()==0 then BasicEnumObject() end
AutoConfig()
--[[
if ue4versioncheck()==0 and UE4ver>=25 then
ue4config()
ue4parsetable()
BasicEnumObject()
end]]
print('Table parsing done : '..os.clock()-starttime)
rec=getAddressList().getMemoryRecordByDescription('UEMemberStr(DoNotTouch!)')
if rec then rec.Active=true end
print('UE ver: '..UE4ver)
BasicEnumObject()
rec=getAddressList().getMemoryRecordByDescription('Get GEngine')
if rec then
rec.Active=true
while rec.AsyncProcessing do sleep(100) end
end
createThread(registerFuncAlgo)
createThread(registerMemberAlgo)
print('All done : '..os.clock()-starttime..'\n')
if not ue_SymbolLookupCallbackID then
ue_SymbolLookupCallbackID=registerSymbolLookupCallback(ue_SymbolLookupCallback,slNotSymbol)
end
--registerFuncAlgo()
GetLuaEngine().close()
if not toStrSelectedMemrecHotkey then toStrSelectedMemrecHotkey=createHotkey('toStrSelectedMemrec', VK_LCONTROL,VK_N)end
[DISABLE]
--cycleFullCompact(nil,false)
unregisterSymbolLookupCallback(ue_SymbolLookupCallbackID)
ue_SymbolLookupCallbackID=nil
---toStrSelectedMemrecHotkey:Destroy()
95526
"Enable UE Structure Lookup "
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
if not ue_structureDissectOverrideCallbackID then
ue_structureDissectOverrideCallbackID=registerStructureDissectOverride(ue_structureDissectOverrideCallback)
end
if not ue_structureNameLookupCallbackID then
ue_structureNameLookupCallbackID=registerStructureNameLookup(ue_structureNameLookupCallback)
end
[DISABLE]
unregisterStructureDissectOverride(ue_structureDissectOverrideCallbackID)
unregisterStructureNameLookup(ue_structureNameLookupCallbackID)
ue_structureDissectOverrideCallbackID=nil
ue_structureNameLookupCallbackID=nil
95527
"Refresh ObjectList"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
BasicEnumObject()
[DISABLE]
95528
"Re-register Fields/Members 's Symbols"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
registerMemberAlgo()
[DISABLE]
95529
"UE Object Dumper Algo"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
starttime=os.clock()
totalobject=0
local Path = 'C:\\Users\\'..os.getenv('USERNAME')..'\\Desktop\\'
local filename= string.format('[%s] ObjectsDump.txt',process)
local file,err = io.open(Path..filename, 'w')
assert(file,err)
print(Path..filename)
file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date()))
local size,sizes,pointer,datatable,pointers,propname,offset,list,str,strid,name,objid,ObjectData=targetIs64Bit() and 8 or 4,HighestObjectID+10
for i=1,sizes do
if ObjectTable[i] then
ObjectData=ObjectTable[i]
totalobject=totalobject+1
str=string.format('%016X',ObjectData.Address)
strid=string.format('%08u',ObjectData.ObjectId)
name= ObjectData.Bit and string.format('%s %08X %s',ObjectData.Type,ObjectData.Bit,ObjectData.FullName)or string.format('%s %s',ObjectData.Type,ObjectData.FullName)
if ObjectData.Offset then
strid=string.format('%8X',ObjectData.Offset)
elseif ObjectData.Super and ObjectData.Super.Name~='Object' then
name=string.format('%s ~ %s %s',name,ObjectData.Super.Type,ObjectData.Super.FullName)
end
if ObjectData.Property and #ObjectData.Property==1 then
name=string.format('%s ~ %s %s',name,ObjectData.Property[1].Type,ObjectData.Property[1].FullName)
end
if ObjectData.EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.EnumProp.Type,ObjectData.EnumProp.FullName)
end
file:write(string.format('[%s] %s %s\n',strid,str,name))
if ObjectData.Property and #ObjectData.Property==2 then
for j=1,2 do
name=string.format('%s %s',ObjectData.Property[j].Type,ObjectData.Property[j].FullName)
if ObjectData.Property[j].Property and ObjectData.Property[j].Property[1] then
name=string.format('%s ~ %s %s',name,ObjectData.Property[j].Property[1].Type,ObjectData.Property[j].Property[1].FullName)
end
if ObjectData.Property[j].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Property[j].EnumProp.Type,ObjectData.Property[j].EnumProp.FullName)
end
file:write(string.format('[%8X] %016X %s\n',readInteger(ObjectData.Property[j].Address+UObject.Offset),ObjectData.Property[j].Address,name))
end
end
if UObject.enumoffset and UObject.enummul and UObject.enumindex and UObject.enumname then
if ObjectData.Type=='UserDefinedEnum' or ObjectData.Type=='Enum' then
list=ObjectData.Address+UObject.enumoffset
for k=0,readInteger(list+size)-1 do
pointers=readPointer(list)+k*UObject.enummul
offset=readBytes(pointers+UObject.enumindex,1)
if not offset then break end
if offset==0 then offset=k end
propname=FNameStringAlgo(pointers+UObject.enumname)
strid=string.format('%8X',offset)
str=string.format('%016X',pointers)
file:write(string.format('[%s] %s %s\n',strid,str,propname))
end
end
end
if ObjectData.Member and UE4ver>=25 then
for m=1,#ObjectData.Member do
if not string.find(ObjectData.Member[m].Type,'Function')then
totalobject=totalobject+1
str=string.format('%016X',ObjectData.Member[m].Address)
strid=string.format('%08u',ObjectData.Member[m].ObjectId)
name= ObjectData.Member[m].Bit and string.format('%s %08X %s',ObjectData.Member[m].Type,ObjectData.Member[m].Bit,ObjectData.Member[m].FullName)or string.format('%s %s',ObjectData.Member[m].Type,ObjectData.Member[m].FullName)
if ObjectData.Member[m].Offset then
strid=string.format('%8X',ObjectData.Member[m].Offset)
end
if ObjectData.Member[m].Property and #ObjectData.Member[m].Property==1 then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[1].Type,ObjectData.Member[m].Property[1].FullName)
end
if ObjectData.Member[m].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].EnumProp.Type,ObjectData.Member[m].EnumProp.FullName)
end
file:write(string.format('[%s] %s %s\n',strid,str,name))
if ObjectData.Member[m].Property and #ObjectData.Member[m].Property==2 then
for j=1,2 do
name=string.format('%s %s',ObjectData.Member[m].Property[j].Type,ObjectData.Member[m].Property[j].FullName)
if ObjectData.Member[m].Property[j].Property and ObjectData.Member[m].Property[j].Property[1] then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[j].Property[1].Type,ObjectData.Member[m].Property[j].Property[1].FullName)
end
if ObjectData.Member[m].Property[j].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[j].EnumProp.Type,ObjectData.Member[m].Property[j].EnumProp.FullName)
end
file:write(string.format('[%8X] %016X %s\n',readInteger(ObjectData.Member[m].Property[j].Address+UObject.Offset),ObjectData.Member[m].Property[j].Address,name))
end
end
end
end
end
end
end
file:close()
print(string.format('\nA Total of %u objects has been dumped in %.3f seconds',totalobject,os.clock()-starttime))
shellExecute(Path..filename)
[DISABLE]
95530
"UE Object Dumper All Algo"
Auto Assembler Script
{$lua}
function BasicObjectdump(this,pointerss,start,stop)
local size,pointer,datatable,pointers,propname,offset,list,str,strid,name,objid,ObjectData,pointersss=targetIs64Bit() and 8 or 4
for j=start,stop do
pointersss=readPointer(pointerss+j*UObjectMul)
if not readPointer(pointersss)then break end
ObjectData=SaveObject(pointersss)
if ObjectData then
--for i=1,sizes do
-- if ObjectTable[i] then
--ObjectData=ObjectTable[i]
totalobject=totalobject+1
str=string.format('%016X',ObjectData.Address)
strid=string.format('%08u',ObjectData.ObjectId)
name= ObjectData.Bit and string.format('%s %08X %s',ObjectData.Type,ObjectData.Bit,ObjectData.FullName)or string.format('%s %s',ObjectData.Type,ObjectData.FullName)
if ObjectData.Offset then
strid=string.format('%8X',ObjectData.Offset)
elseif ObjectData.Super and ObjectData.Super.Name~='Object' then
name=string.format('%s ~ %s %s',name,ObjectData.Super.Type,ObjectData.Super.FullName)
end
if ObjectData.Property and #ObjectData.Property==1 then
name=string.format('%s ~ %s %s',name,ObjectData.Property[1].Type,ObjectData.Property[1].FullName)
end
if ObjectData.EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.EnumProp.Type,ObjectData.EnumProp.FullName)
end
file:write(string.format('[%s] %s %s\n',strid,str,name))
if ObjectData.Property and #ObjectData.Property==2 then
for j=1,2 do
name=string.format('%s %s',ObjectData.Property[j].Type,ObjectData.Property[j].FullName)
if ObjectData.Property[j].Property and ObjectData.Property[j].Property[1] then
name=string.format('%s ~ %s %s',name,ObjectData.Property[j].Property[1].Type,ObjectData.Property[j].Property[1].FullName)
end
if ObjectData.Property[j].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Property[j].EnumProp.Type,ObjectData.Property[j].EnumProp.FullName)
end
file:write(string.format('[%8X] %016X %s\n',readInteger(ObjectData.Property[j].Address+UObject.Offset),ObjectData.Property[j].Address,name))
end
end
if UObject.enumoffset and UObject.enummul and UObject.enumindex and UObject.enumname then
if ObjectData.Type=='UserDefinedEnum' or ObjectData.Type=='Enum' then
list=ObjectData.Address+UObject.enumoffset
for k=0,readInteger(list+size)-1 do
pointers=readPointer(list)+k*UObject.enummul
offset=readBytes(pointers+UObject.enumindex,1)
if not offset then break end
if offset==0 then offset=k end
propname=FNameStringAlgo(pointers+UObject.enumname)
strid=string.format('%8X',offset)
str=string.format('%016X',pointers)
file:write(string.format('[%s] %s %s\n',strid,str,propname))
end
end
end
if ObjectData.Member and UE4ver>=25 then
for m=1,#ObjectData.Member do
if not string.find(ObjectData.Member[m].Type,'Function')then
totalobject=totalobject+1
str=string.format('%016X',ObjectData.Member[m].Address)
strid=string.format('%08u',ObjectData.Member[m].ObjectId)
name= ObjectData.Member[m].Bit and string.format('%s %08X %s',ObjectData.Member[m].Type,ObjectData.Member[m].Bit,ObjectData.Member[m].FullName)or string.format('%s %s',ObjectData.Member[m].Type,ObjectData.Member[m].FullName)
if ObjectData.Member[m].Offset then
strid=string.format('%8X',ObjectData.Member[m].Offset)
end
if ObjectData.Member[m].Property and #ObjectData.Member[m].Property==1 then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[1].Type,ObjectData.Member[m].Property[1].FullName)
end
if ObjectData.Member[m].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].EnumProp.Type,ObjectData.Member[m].EnumProp.FullName)
end
file:write(string.format('[%s] %s %s\n',strid,str,name))
if ObjectData.Member[m].Property and #ObjectData.Member[m].Property==2 then
for j=1,2 do
name=string.format('%s %s',ObjectData.Member[m].Property[j].Type,ObjectData.Member[m].Property[j].FullName)
if ObjectData.Member[m].Property[j].Property and ObjectData.Member[m].Property[j].Property[1] then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[j].Property[1].Type,ObjectData.Member[m].Property[j].Property[1].FullName)
end
if ObjectData.Member[m].Property[j].EnumProp then
name=string.format('%s ~ %s %s',name,ObjectData.Member[m].Property[j].EnumProp.Type,ObjectData.Member[m].Property[j].EnumProp.FullName)
end
file:write(string.format('[%8X] %016X %s\n',readInteger(ObjectData.Member[m].Property[j].Address+UObject.Offset),ObjectData.Member[m].Property[j].Address,name))
end
end
end
end
end
elseif readPointer(readPointer(pointersss))then file:write(string.format('[%08u] %016X %s\n',readInteger(pointersss+UObject.ObjectId),pointersss,'invalid object')) totalobject=totalobject+1 end
end
Threadlist[#Threadlist]=nil
end
if syntaxcheck then return end
[ENABLE]
starttime=os.clock()
totalobject=0
local Path = 'C:\\Users\\'..os.getenv('USERNAME')..'\\Desktop\\'
local filename= string.format('[%s] ObjectsDump.txt',process)
file,err = io.open(Path..filename, 'w')
assert(file,err)
print(Path..filename)
file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date()))
Threadlist={}
local count=ObjectsPerThread
local sizess= UObjectMul*count
local ObjectId=UObject.ObjectId
local num,start,stop
local size,pointersss=targetIs64Bit() and 8 or 4
for i=0,0x1000,size do
pointersss=readPointer(GUObjectAddress+i)
if not readPointer(pointersss) then break end
size=getregionsize(pointersss)
num,start,stop=count,0,0
for j=0,math.floor(size/sizess) do
start=stop
stop=stop+num
--print(start..'~'..stop)
Threadlist[#Threadlist+1]=createThread(BasicObjectdump(this,pointersss,start,stop-1))
end
end
for i=0,10000 do
if #Threadlist==0 then break end
sleep(1)
end
file:close()
print(string.format('\nA Total of %u might be objects has been dumped in %.3f seconds',totalobject,os.clock()-starttime))
shellExecute(Path..filename)
-- end
--end
[DISABLE]
95531
"UE Name Dumper Algo"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
ue4parsetableFNamePool()
local UEver,size=UE4ver
if readPointer(FNameString) or string.find(process,'StateOfDecay2')then size=0xFFFFFFFF
elseif UEver>=23 then size=(#FNameDict<<0x10)-1
elseif not UE3 then size=(#FNameDict<<0xE)-1
else size=math.floor(FNameDict[1]/(targetIs64Bit() and 8 or 4)) end
local Path = 'C:\\Users\\'..os.getenv('USERNAME')..'\\Desktop\\'
local filename= string.format('[%s] NamesDump.txt',process)
local file,err = io.open(Path..filename, 'w')
assert(file,err)
file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UEver,os.date()))
totalname=0
starttime=os.clock()
local acclen,isNoIndex=0,isMassEffect
local i=0
while i<size do
local name=FNameStringAlgo(i+acclen,true)
if name and name:len()<200 and name:len()>3 and not string.find(name,'%c') then
--print(name)
local strid=string.format('%08X',i+acclen)
file:write(string.format('[%s] %s\n',strid,name))
if isNoIndex then acclen=acclen+name:len()end
totalname=totalname+1
if UEver>=23 then i=i+(name:len()>>1) end
end
i=i+1
end
file:close()
print(string.format('\nA Total of %u names had been dumped in %.3f seconds',totalname,os.clock()-starttime))
print(Path..filename)
shellExecute(Path..filename)
[DISABLE]
95532
"Get GEngine"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local Object=not UE3 and StaticFindObjectAlgo('/Script/Engine.GameEngine') or StaticFindObjectAlgo('Engine.GameEngine')
if not Object then error('cant find Class GameEngine')end
Object=ObjectLists[Object]
local temp=Object
for i=0,4 do
if Object.Uper and Object.Uper[1] then Object=Object.Uper[1] else break end
end
for i=1,#Object.Instance do
if not string.find(Object.Instance[i].Name,'Default') then Object=Object.Instance[i] break end
end
if Object.Type=='Class' then
Object=temp
for i=1,#Object.Instance do
if not string.find(Object.Instance[i].Name,'Default') then Object=Object.Instance[i] break end
end
end
local rec=getAddressList().getMemoryRecordByDescription('1~2 ViewPort')
print(string.format('%X : %s %s',Object.Address,Object.Type,Object.FullName))
local result,pointer,flag1=pointerscan(Object.Address)
for i=1,#result do
flag1=nil
pointer=getAddress(result[i])
print(result[i])
if inModule(pointer)and pointer%4==0 then unregisterSymbol('GEngine')registerSymbol('GEngine',pointer,true)
for k=0,100000 do if readPointer(pointer)~=Object.Address then flag1=true break end end
if not flag1 then break end
elseif pointer%4==0 then
unregisterSymbol('GEngine')registerSymbol('GEngine',pointer,true)
end
end
local object,pointer,pointer2=readPointer('GEngine')
for i=UObject.super,0x200,4 do
pointer=readPointer(object+i)
if readPointer(pointer) and GetFullNameAlgo(pointer) and GetFullNameAlgo(pointer):find('Client')then
UEMember['engine.client']=i
for j=UObject.super,0x200,4 do
pointer2=readPointer(pointer+j)
if readPointer(pointer2) and GetFullNameAlgo(pointer2) and GetFullNameAlgo(pointer2):find('Viewport')then
UEMember['client.viewport']=j
if rec.OffsetCount==4 then
for i=0,rec.OffsetCount-1 do
if i+1<rec.OffsetCount then rec.OffsetText[i]=rec.OffsetText[i+1]end
end
rec.OffsetCount=3
end
end
end
for j=UObject.super,0x200,4 do
pointer2=readPointer(pointer+j)
if readPointer(pointer2) and readPointer(readPointer(pointer2)) and GetFullNameAlgo(readPointer(pointer2)) and GetFullNameAlgo(readPointer(pointer2)):find('Viewport')then
UEMember['client.viewport']=j
if rec.OffsetCount==3 then
rec.OffsetCount=4
for i=rec.OffsetCount-1,0,-1 do
if i-1>=0 then rec.OffsetText[i]=rec.OffsetText[i-1]
else rec.OffsetText[i]=0 end
end
end
goto done
end
end
end
end
::done::
[DISABLE]
95533
"Cheat command"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
for i=memrec.Count-1,0,-1 do
memoryrecord_delete(memrec.Child[i])
end
[ENABLE]
local list,str={}
for i,v in pairs(ObjectTable) do
if v.Type=='Function' and v.FullName:find('Cheat') then
str=v.FullName--:sub(v.FullName:find('%.')+1,v.FullName:len())
if v.Member and #v.Member>0 then
str=str..' ('
for j=1,#v.Member do
str=string.format('%s %s %s ,',str,v.Member[j].Type,v.Member[j].Name)
end
str=str:sub(1,str:len()-1)..' )\n'
else str=str..'\n'end
list[#list+1]=str
end
end
local rec = getAddressList().createMemoryRecord()
rec.setDescription('List (ReadMe)')
rec.VarType='vtAutoAssembler'
rec.appendToEntry(memrec)
rec.DontSave=true
rec.Script=table.concat(list)--string.format('{\n%s\n}\n[ENABLE]\n[DISABLE]',)
[DISABLE]
95534
"Find UObject::ProcessEvent & StaticConstructObject_Internal "
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local result=sigscan(targetIs64Bit()and'48 89 54 24 28 48 89 4C 24 20 45 33 C9'or'53 53 51 53 53 53 55 57 50 56',process)
if result[1] then unregisterSymbol('StaticConstructObject')registerSymbol('StaticConstructObject',GetNameFromAddress(followcall(result[1],0x20)),true) end
if readPointer('StaticConstructObject')then printf('StaticConstructObject_Internal: %X',getAddress('StaticConstructObject'))end
local list,pointer,name=readPointer(ObjectTable[1].Address),{}
for i=0,100 do
pointer=readPointer(list+i*(targetIs64Bit() and 8 or 4))
if readPointer(pointer) and getFuncSize(pointer)>0x20 and #findOpcodes(pointer,'push',0x30)>2 then
name=GetFullNameSafeAlgo(checkFuncReg(pointer)[2])
if name and name:find('Function')then
printf('%X:%X:%s',i*8,pointer,getNameFromAddress(pointer))
local k=0
for j=0,10 do
local ext, opc, byt, add=splitDisassembledString(disassemble(pointer+k))
print(opc)
k=k+getInstructionSize(pointer+k)
end
unregisterSymbol('UObject::ProcessEvent')registerSymbol('UObject::ProcessEvent',pointer,true)
break
end
end
end
if not readPointer('UObject::ProcessEvent') then print('UObject::ProcessEvent not found...')
else printf('UObject::ProcessEvent: %X',pointer)end
local Object,Object2,Object3,StaticConstructObject=StaticFindObjectAlgo('/Script/Engine.PlayerController','PlayerController')
if not Object then error('cant find Class PlayerController')end
local func,func2=getAddressSafe('Function /Script/Engine.PlayerController:EnableCheats')
if not func then func=getAddressSafe('Function Engine.PlayerController:EnableCheats')end
local instance=ObjectLists[Object].Instance and ObjectLists[Object].Instance[1] or SaveObject(getAddress(not UE3 and '[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]' or '[[[[GEngine]+GamePlayers]+0]+0+Player.Actor]'))
printf('%X:%s %s',instance.Address,instance.Type,instance.FullName)
local ext, opc, byt, add=splitDisassembledString(disassemble(findOpcode(func,'jmp',getFuncSize(func))))
func=readPointer(readPointer(instance.Address)+getAddress(opc:sub(string.find(opc,'+')+1,opc:len()-1)))
printf('%X',func)
if getFuncSize(func)<0x50 then
func2=findOpcode(func,'jmp',getFuncSize(func))
if not func2 then func2=findOpcode(func,'call',getFuncSize(func)) end
ext, opc, byt, add=splitDisassembledString(disassemble(func2))
func=readPointer(readPointer(instance.Address)+getAddress(opc:sub(string.find(opc,'+')+1,opc:len()-1)))
end
local ext, opc, byt, add=splitDisassembledString(disassemble(func))
if opc:find('jmp') then func=getAddress(followjmp(func,1)) end
printf('APlayerController::AddCheats: %X',func)
UE_function.deleteSymbol('APlayerController::AddCheats')
UE_function.addSymbol('UE_function','APlayerController::AddCheats',func,getFuncSize(func))
list=findOpcodes(func,'call',getFuncSize(func))
for i=1,#list do
pointer=followcall(list[i],1)
if readPointer(pointer) then StaticConstructObject=pointer print(pointer)end
end
print(StaticConstructObject)
if not StaticConstructObject then error('StaticConstructObject not found!')end
ext, opc, byt, add=splitDisassembledString(disassemble(StaticConstructObject))
if opc:find('jmp') then StaticConstructObject=followjmp(StaticConstructObject,1) end
StaticConstructObject=getAddress(StaticConstructObject)
if #findOpcodes(StaticConstructObject,'push',0x30)<2 then
local list=findOpcodes(StaticConstructObject,'call',getFuncSize(StaticConstructObject))
StaticConstructObject=nil
for i=1,#list do
if readPointer(followcall(list[i],1)) and #findOpcodes(followcall(list[i],1),'push',0x20)>5 then StaticConstructObject=getAddress(followcall(list[i],1)) break end
end
if not StaticConstructObject then StaticConstructObject=getAddress(findLastCall(StaticConstructObject)) end
end
printf('StaticConstructObject_internal: %X',StaticConstructObject)
unregisterSymbol('StaticConstructObject')registerSymbol('StaticConstructObject',StaticConstructObject,true)
func2=getAddress('Function /Script/Engine.PlayerController:ConsoleKey')
local list,spointer,pointer=findOpcodes(func2,'call',getFuncSize(func2))
for i=1,#list do
pointer=followcall(list[i],1)
if not readPointer(pointer) and not pointer:find('*') then
func2=readPointer(readPointer(instance.Address)+getAddress(pointer:sub(string.find(pointer,'+')+1,pointer:len()-1)))
break
end
end
printf('APlayerController::ConsoleKey: %X',func2)
[DISABLE]
95535
"Construct Console"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local Console
if not readPointer('[[GEngine]+GameEngine.ConsoleClass]')then
local Data=ObjectLists[StaticFindObjectAlgo('/Script/Engine.Console','Engine.Console')]
if Data.Uper and Data.Uper[1] then Data=Data.Uper[1] end
writePointer('[GEngine]+GameEngine.ConsoleClass',Data.Address)
end
local banana=allocateMemory(0x100)
local Str= '[[GEngine]+GameEngine.GameViewport]'
local ClassStr='[[GEngine]+GameEngine.ConsoleClass]'
writePointer(banana,getAddress(ClassStr))
writePointer(banana+8,getAddress(Str))
if readPointer('UObject::ProcessEvent') then
Console=ProcessEventCall(getAddress('StaticConstructObject'),string.format(([[
mov rcx,%X
mov rdx,%X
xor rax,rax
push rax
push rax
push rax
push rax
push rax
push rax
push rax
push rax
push rdx
push rcx
%s
]]),UE4ver<=26 and getAddress(ClassStr) or banana , UE4ver<=26 and getAddress(Str) or getAddress(ClassStr) ,targetIs64Bit() and 'xor r8,r8\nxor r9,r9' or ''))
else
Console=executeCodeEx
(
0,nil,
getAddress('StaticConstructObject'),
UE4ver<=26 and getAddress(ClassStr) or banana,
UE4ver<=26 and getAddress(Str) or getAddress(ClassStr),
0,0,0,0,0,0,0
)
end
deAlloc(banana)
if not Console or Console==0 then error('Console not constructed, wrong function ?') end
writePointer(Str..'+GameViewportClient.ViewportConsole',Console)
print('Console constructed...')
[DISABLE]
--"NewObject with empty name can't be used to create default subobjects"
95536
"Construct CheatManager"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local CheatManager
local banana=allocateMemory(0x100)
local Str= UE4ver>7 and '[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]' or '[[[[GEngine]+GamePlayers]+0]+0+Player.Actor]'
local ClassStr=string.format('[%s+PlayerController.CheatClass]',Str)
writePointer(banana,getAddress(ClassStr))
writePointer(banana+8,getAddress(Str))
if readPointer('UObject::ProcessEvent') then
CheatManager=ProcessEventCall(getAddress('StaticConstructObject'),string.format(([[
mov rcx,%X
mov rdx,%X
xor rax,rax
push rax
push rax
push rax
push rax
push rax
push rax
push rax
push rax
push rdx
push rcx
%s
]]),UE4ver<=26 and getAddress(ClassStr) or banana , UE4ver<=26 and getAddress(Str) or getAddress(ClassStr) ,targetIs64Bit() and 'xor r8,r8\nxor r9,r9' or ''))
else
CheatManager=executeCodeEx
(
0,nil,
getAddress('StaticConstructObject'),
UE4ver<=26 and getAddress(ClassStr) or banana,
UE4ver<=26 and getAddress(Str) or getAddress(ClassStr),
0,0,0,0,0,0,0
)
end
if not CheatManager or CheatManager==0 then error('CheatManager not constructed, wrong function ?') end
writePointer(Str..'+PlayerController.CheatManager',CheatManager)
print('CheatManager constructed...')
[DISABLE]
--"NewObject with empty name can't be used to create default subobjects"
95537
"2 ProcessEvent (Edit Me)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local ufunction=StaticFindObjectAlgo('Engine.CheatManager:Fly')
local instance=getAddressSafe('[[[[[GEngine]+Engine.Client]+Client.ViewPort]+0+ViewPort.Actor]+0+PlayerController.CheatManager]')
if not readPointer(instance) then instance=getAddress('[[[[[[GEngine]+Engine.Client]+Client.ViewPort]+0]+0+ViewPort.Actor]+0+PlayerController.CheatManager]')end
ProcessEvent(instance,ufunction,'')
[DISABLE]
95538
"3~4 ProcessEvent (Edit Me)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local param=allocateMemory(0x100)
local ufunction=StaticFindObjectAlgo('/Script/Engine.CheatManager:Fly','Engine.CheatManager:Fly')
local Str= not UE3 and '[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]' or '[[[[GEngine]+GamePlayers]+0]+0+Player.Actor]'
local instance=getAddress(string.format('[%s+PlayerController.CheatManager]',Str))
ProcessEvent(instance,ufunction,param)
deAlloc(param)
[DISABLE]
95539
"Create Struct"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local str,Address
str=inputQuery('CreateStructure', 'Input FullName of Class or Address of Class', '/Script/Engine.GameEngine')
if str and str~='' then
Address=getAddressSafe(str)
if not Address then Address=StaticFindObjectAlgo(str)end
if Address then Address=SaveObject(Address)end
if not Address then error("Can't find "..str..', either invalid Object Address or invalid FullName')
else
SaveAndRemoveStruct()
local Struct=ue4createstruct(Address)
Struct.addToGlobalStructureList()
createStructureForm(nil,nil,Struct.Name)
end
end
[DISABLE]
95540
"Print Fields/Members 's Classes used"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local AddressList,str,strtable,FullName=getAddressList(),'{',{}
for i=0,AddressList.Count-1 do
if AddressList[i].Address~='' then
FullName=AddressList[i].Address:gsub('+','')
FullName=UEMemberClassFullName[FullName:lower()]
if FullName and not strtable[FullName] then strtable[FullName]=FullName str=string.format("%s'%s',\n",str,FullName) end
end
for j=0,AddressList[i].OffsetCount-1 do
if AddressList[i].OffsetText[j]~='' then
FullName=AddressList[i].OffsetText[j]:gsub('+','')
FullName=UEMemberClassFullName[FullName:lower()]
if FullName and not strtable[FullName] then strtable[FullName]=FullName str=string.format("%s'%s',\n",str,FullName) end
end
end
end
print(str:sub(0,str:len()-2)..'}')
[DISABLE]
95541
"4 Example Script"
1
95542
"NoClip & Fly Numpad6 :Toggle, Space :Up, LeftCtrl :Down"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
local str1='[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]'
[ENABLE]
--[[
Enum /Script/Engine.EMovementMode
0:MOVE_None
1:MOVE_Walking
2:MOVE_NavWalking
3:MOVE_Falling
4:MOVE_Swimming
5:MOVE_Flying
6:MOVE_Custom
7:MOVE_MAX
local list=+0x40
for i=0,readInteger(list+8)-1 do
local pointer=readPointer(list)+i*0x10
local enum=readInteger(pointer+8)
local name=FNameString(pointer)
print(enum..':'..name)
end
]]
if not RelativeLocationZoffset then
local address=getAddress('['..str1..'+Character.CapsuleComponent]')
local value=readInteger(address+getAddress('ActorComponent.RelativeLocation+Vector.Z'))
local list=groupscan(string.format('4:%u',value),address,address+0x1000)
RelativeLocationZoffset={}
for i=1,#list do
RelativeLocationZoffset[i]=getAddress(list[i])-address
end
end
local address=getAddressSafe(str1..'+Actor.bActorEnableCollision')
if address then
local bActorEnableCollision=readBytes(address,1) & ~ getAddress('Actor.bActorEnableCollision.Bit')
writeBytes(address,bActorEnableCollision)
end
updown = createTimer()
updown.Interval = 5
updown.OnTimer = function(t)
local address=getAddressSafe('['..str1..'+Character.CapsuleComponent]')
if address then
if isKeyPressed(VK_SPACE) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])+20)
end
end
if isKeyPressed(VK_LCONTROL) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])-20)
end
end
end
local address=getAddressSafe('['..str1..'+Character.CharacterMovement]+MovementComponent.MovementMode')
if address then
writeBytes(address,5)
end
end
[DISABLE]
updown.destroy()
local address=getAddressSafe(str1..'+Actor.bActorEnableCollision')
if address then
local bActorEnableCollision=readBytes(address,1) | getAddress('Actor.bActorEnableCollision.Bit')
writeBytes(address,bActorEnableCollision)
end
local address=getAddressSafe('['..str1..'+Character.CharacterMovement]+MovementComponent.MovementMode')
if address then
writeBytes(address,1)
end
Toggle Activation
102
0
95543
"WASD"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
wasd = createTimer()
wasd.Interval = 5
wasd.OnTimer = function(t)
local address=getAddressSafe('[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CapsuleComponent]')
if address then
if isKeyPressed(VK_S) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)+20)
end
end
if isKeyPressed(VK_W) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)-20)
end
end
if isKeyPressed(VK_A) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)+20)
end
end
if isKeyPressed(VK_D) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)-20)
end
end
end
end
[DISABLE]
wasd.destroy()
95544
"bCanBeDamaged false (Godmode) Numpad4 :Deactive, Numpad5 :Active"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
local str1='[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Actor.bCanBeDamaged'
[ENABLE]
--CanBeDamaged = createTimer()
--CanBeDamaged.setInterval(1000)
--CanBeDamaged.OnTimer = function()
local address=getAddressSafe(str1)
if address then
local bCanBeDamaged=readBytes(address,1) & ~ getAddress('Actor.bCanBeDamaged.Bit')
writeBytes(address,bCanBeDamaged)
end
--end
[DISABLE]
--CanBeDamaged.destroy()
local address=getAddressSafe(str1)
if address then
local bCanBeDamaged=readBytes(address,1) | getAddress('Actor.bCanBeDamaged.Bit')
writeBytes(address,bCanBeDamaged)
end
Activate
101
0
Deactivate
100
1
95545
"Jump Multiplier Numpad0 :Deactive, Numpad1 :Active & Increase"
Auto Assembler Script
{$lua}
jumpmultiplier=1
if syntaxcheck then return end
local str1='[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]'
local str2=str1..'CharacterMovementComponent.JumpZVelocity'
local str3=str1..'CharacterMovementComponent.MaxAcceleration'
local str4=str1..'CharacterMovementComponent.AirControl'
if not jumpdefault then jumpdefault=readFloat(str2)<100 and 100 or readFloat(str2) end
if not MaxAccelerationdefault then MaxAccelerationdefault=readFloat(str3)end
if not AirControldefault then AirControldefault=readFloat(str4)end
[ENABLE]
jumpmuti=createHotkey(function()jumpmultiplier=jumpmultiplier+0.5 end,VK_NUMPAD1)
jump = createTimer()
jump.setInterval(100)
jump.OnTimer = function()
local address=getAddressSafe(str2)
local address2=getAddressSafe(str3)
local address3=getAddressSafe(str4)
if address then writeFloat(address,jumpdefault*jumpmultiplier)
writeFloat(address2,MaxAccelerationdefault*jumpmultiplier)
writeFloat(address3,AirControldefault*jumpmultiplier)
end
end
[DISABLE]
jump.destroy()
jumpmuti.destroy()
local address=getAddressSafe(str2)
local address2=getAddressSafe(str3)
local address3=getAddressSafe(str4)
if address then writeFloat(address,jumpdefault)
writeFloat(address2,MaxAccelerationdefault)
writeFloat(address3,AirControldefault)
end
Activate
97
0
Deactivate
96
1
95546
"MovementSpeed Multiplier Numpad2 :Deactive, Numpad3 :Active & Increase"
Auto Assembler Script
{$lua}
speedvarmutiplier=1
if syntaxcheck then return end
local str1={'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxWalkSpeed'
,'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxWalkSpeedCrouched'
,'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxSwimSpeed'
,'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxFlySpeed'
,'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxCustomMovementSpeed'
,'[[[[[[[GEngine]+Engine.GameInstance]+GameInstance.LocalPlayers]]+Player.PlayerController]+Actor.Character]+Character.CharacterMovement]+CharacterMovementComponent.MaxAcceleration'
}
if not speedvar then
speedvar={}
for i=1,#str1 do
speedvar[i]=readFloat(str1[i])
end
end
[ENABLE]
speedvarmuti=createHotkey(function() speedvarmutiplier=speedvarmutiplier+0.5 end,VK_NUMPAD3)
speedv = createTimer()
speedv.setInterval(100)
speedv.OnTimer = function()
for i=1,#str1 do
address=getAddressSafe(str1[i])
if address then writeFloat(address,speedvar[i]*speedvarmutiplier)end
end
end
[DISABLE]
speedv.destroy()
speedvarmuti.destroy()
for i=1,#str1 do
address=getAddressSafe(str1[i])
if address then writeFloat(address,speedvar[i]*speedvarmutiplier)end
end
speedvar=nil
Activate
99
0
Deactivate
98
1
95547
"1~2 ViewPort"
0
1
GEngine
0
Client.ViewPort
Engine.Client
95548
"Console"
0
1
+ViewPort.Console
0
Console
Master
95549
"Actor"
0
1
+ViewPort.Actor
0
95550
"Pawn"
0
1
+PlayerController.Pawn
0
95551
"CheatManager"
0
1
+PlayerController.CheatManager
0
95552
"bGodMode"
0
Binary
1
1
0
+bGodMode
95553
"3 LocalPlayer"
0
1
GEngine
0
0
GamePlayers
95554
"PlayerController"
0
1
+Player.Actor
0
95555
"CheatManager"
0
1
+PlayerController.CheatManager
0
95556
"Pawn"
0
1
+PlayerController.Pawn
0
95557
"bGodMode"
0
Binary
1
1
0
+bGodMode
95558
"3~4 ViewportConsole"
0
1
[Gengine]+GameViewport
0
ViewportConsole
95559
"4 UWorld"
0
1
GEngine
0
GameViewportClient.World
Engine.GameViewport
95560
"4 LocalPlayer"
0
1
GEngine
0
0
GameInstance.LocalPlayers
Engine.GameInstance
95561
"PlayerController"
0
1
+Player.PlayerController
0
95562
"CheatManager"
0
1
+PlayerController.CheatManager
0
95563
"Pawn"
0
1
+Actor.Pawn
0
95564
"Character"
0
1
+Actor.Character
0
95565
"CustomTimeDilation"
0
Float
+CustomTimeDilation
95566
"CharacterMovement"
0
1
+Character.CharacterMovement
0
95567
"JumpZVelocity"
0
Float
+CharacterMovementComponent.JumpZVelocity
95568
"MaxWalkSpeed"
0
Float
+CharacterMovementComponent.MaxWalkSpeed
95569
"MaxWalkSpeedCrouched"
0
Float
+CharacterMovementComponent.MaxWalkSpeedCrouched
95570
"MaxAcceleration"
0
Float
+CharacterMovementComponent.MaxAcceleration
95571
"Tools"
1
95572
"FNamePool scanner"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print('------------------')
local isUnicode=false
local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode)
for i=1,#strlist do
result=stringscan('IntProperty',getAddressSafe(strlist[i]),getAddressSafe(strlist[i]..'+50'),isUnicode)
if #result>0 then
result=stringscan('None',getAddressSafe(strlist[i]..'-50'),getAddressSafe(strlist[i]),isUnicode)
print(strlist[i])
if #result>0 then
if string.sub(strlist[i],strlist[i]:len()-3,strlist[i]:len()-2)=='00' then
result=pointerscan(getAddressSafe(string.sub(strlist[i],1,strlist[i]:len()-2)..'00'))
for j=1,#result do
pointer1=readPointer(result[j]..(targetIs64Bit() and '+8' or '+4'))
pointer1=readPointer(pointer1)
pointer2=readPointer(result[j]..(targetIs64Bit() and '+10' or '+8'))
pointer2=readPointer(pointer2)
pointer3=readPointer(result[j]..(targetIs64Bit() and '+18' or '+C'))
pointer3=readPointer(pointer3)
if pointer1 and pointer2 and pointer3 then
print(strlist[i]..'<-'..result[j])
unregisterSymbol('FNamePool')
registerSymbol('FNamePool',result[j]..'-10',true)
if ue4versioncheck()==0 then UE4ver=23 end
if string.sub(result[j],result[j]:len()-1,result[j]:len())=='00' then
result2=pointerscan(getAddressSafe(result[j]))
for k=1,#result2 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k])
result3=pointerscan(getAddressSafe(result2[k]),process)
for l=1,#result3 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l])
if getAddress(result3[l])%4==0 then
unregisterSymbol('FNamePool')
registerSymbol('FNamePool',result3[l],true)
if ue4versioncheck()==0 then UE4ver=22 end
goto done
end
end
end
end
end
end
end
end
end
end
::done::
print('done')
[DISABLE]
95573
"FNamePool scanner V2 (Generic)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print('------------------')
local isUnicode=false
local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode)
local size,val1=targetIs64Bit() and 8 or 4
for i=1,#strlist do
print(strlist[i])
result=pointerscan(getAddress(strlist[i])-0x50,nil,nil,getAddress(strlist[i]))
for j=1,#result do
val1=getAddress(strlist[i])-readPointer(result[j])
pointer1=readPointer(getAddress(result[j])+size)
if readPointer(pointer1) and readString(pointer1+val1,100,isUnicode) and string.find(readString(pointer1+val1,100,isUnicode),'IntProperty') then
print(strlist[i]..'<-'..result[j])
result2=pointerscan(getAddress(result[j])-size)
for k=1,#result2 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k])
if inModule(result2[k]) and getAddress(result2[k])%4==0 then UE4ver=ue4versioncheck() unregisterSymbol('FNamePool') registerSymbol('FNamePool',result2[k],true) goto done end
if getAddress(result2[k])%4==0 then
result3=pointerscan(getAddress(result2[k]),process)
for l=1,#result3 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l])
if getAddress(result3[l])%4==0 then
unregisterSymbol('FNamePool')
registerSymbol('FNamePool',result3[l],true)
goto done
end
end
end
end
end
end
end
::done::
print('done')
[DISABLE]
95574
"FNamePool scanner V3 (Unicode)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print('------------------')
local isUnicode=true
local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode)
local size,val1=targetIs64Bit() and 8 or 4
for i=1,#strlist do
print(strlist[i])
result=pointerscan(getAddress(strlist[i])-0x50,nil,nil,getAddress(strlist[i]))
for j=1,#result do
val1=getAddress(strlist[i])-readPointer(result[j])
pointer1=readPointer(getAddress(result[j])+size)
if readPointer(pointer1) and readString(pointer1+val1,100,isUnicode) and string.find(readString(pointer1+val1,100,isUnicode),'IntProperty') then
print(strlist[i]..'<-'..result[j])
result2=pointerscan(getAddress(result[j])-size)
for k=1,#result2 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k])
if inModule(result2[k]) and getAddress(result2[k])%4==0 then UE4ver=ue4versioncheck() unregisterSymbol('FNamePool') registerSymbol('FNamePool',result2[k],true) goto done end
if getAddress(result2[k])%4==0 then
result3=pointerscan(getAddress(result2[k]),process)
for l=1,#result3 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l])
if getAddress(result3[l])%4==0 then
unregisterSymbol('FNamePool')
registerSymbol('FNamePool',result3[l],true)
goto done
end
end
end
end
end
end
end
::done::
print('done')
[DISABLE]
95575
"FNamePool scanner V4 (BatmanAk)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print('------------------')
local isUnicode=false
local size= targetIs64Bit() and 8 or 4
local result2,result,result3,result4,pointer1,pointer2,pointer3,tempstringoffset,str,tempfnamepooloffset=stringscan('ByteProperty',nil,nil,isUnicode)
for i=1,#result2 do
--print(result2[i])
result=pointerscan(getAddress(result2[i]..'-50'),nil,nil,getAddress(result2[i]))
for j=1,#result do
tempstringoffset=getAddress(result2[i])-readPointer(getAddress(result[j]))
for k=size,0x50,4 do
str=readString(readPointer(getAddress(result[j])+k)+tempstringoffset,0x30,isUnicode)
if str and str=='IntProperty' then
stringoffset=tempstringoffset
print(result2[i]..'<-'..result[j])
result3=pointerscan(getAddress(result[j]..'-50')-k,nil,nil,getAddress(result[j]))
for m=1,#result3 do
pointer1=readPointer(result3[m]..(targetIs64Bit() and '+8' or '+4'))
pointer1=readPointer(pointer1)
pointer2=readPointer(result3[m]..(targetIs64Bit() and '+10' or '+8'))
pointer2=readPointer(pointer2)
pointer3=readPointer(result3[m]..(targetIs64Bit() and '+18' or '+C'))
pointer3=readPointer(pointer3)
if pointer1 and pointer2 and pointer3 then
print(result2[i]..'<-'..result[j]..'<-'..result3[m])
--print(result2[i]..'<-'..result[j]..'<-'..result3[m])
stringoffset2=0xc--((getAddress(result[j])-readPointer(result3[m])+size)/2)-size
--print(string.format('%X',((getAddress(result[j])-readPointer(result3[m])+size)/2)-size))
stringmul=k
result4=pointerscan(getAddress(result3[m])-0x50,process,nil,getAddress(result3[m])+0x50)
for n=1,#result4 do
print(result2[i]..'<-'..result[j]..'<-'..result3[m]..'<-'..result4[n])
unregisterSymbol('FNamePool') registerSymbol('FNamePool',result4[n],true)
end
end
end
end
end
end
end
::done::
print('done')
[DISABLE]
95576
"Object scanner (region)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
--unregisterSymbol('FNamePool')
--registerSymbol('FNamePool','libUE4.so+41DE8A4',true)
--UE4ver=nil
--if not UE4ver then ue4versioncheck()end
--ue4config()
--ue4parsetable()
ue4parsetableFNamePool()
if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end
local Object=FindStringFName('Object',isMassEffect,true)
if not UObject then UObject = {} end
print(Object)
local startt=os.clock()
local address,pointer,pointer1,pointer2,pointer3,pointers,flag1=getAddress('FNamePool')
local size,sizes,regionsize,baseaddress,index=(targetIs64Bit() and 8 or 4),getregionsize(address)
sizes,regionsize,baseaddress,index=getregionsize(enumMemoryRegions()[index-5].BaseAddress)
address=baseaddress
for i=0,15 do
sizes=sizes+getregionsize(address+sizes+1)
end
printf('%X',sizes)
sizes= sizes>(0x1000000*4) and (0x1000000*4) or sizes
print(string.format('%X ~ %X',baseaddress,address+sizes))
local start,stop=baseaddress,address+sizes
unregisterSymbol('GUObjectArray')
for i=start,stop,4 do
if readPointer(readPointer(readPointer(readPointer(i))))then
pointer=i
for n=0,2 do
for o=4,(UE3 and size or 8*4),4 do
flag1=nil
for k=0,10*o,o do
pointers=readPointer(pointer+k)
if not readPointer(readPointer(pointers))
or not readPointer(readPointer(readPointer(pointers)))
or not inModule(readPointer(readPointer(pointers)))
or not checkvalue(pointers,0x50,k/o,2) then break end
if not flag1 then
flag1=checkvalue(pointers,0x60,Object,4) pointer1=pointers
if flag1 then
for j=4,0x80,4 do
pointer2=readPointer(pointer1+j)
if readPointer(pointer2) then pointer3=FNameStringAlgo(readInteger(pointer2+flag1-pointer1),true) if pointer3 and pointer3:find('Core') then pointer3=j break end end
end
if not pointer3 then flag1,pointer1=nil,nil end
end
end
if k==(10*o) and flag1 then print(string.format('%X %X',i,o)) registerSymbol('GUObjectArray',i,true) NOGUObjectsize=(n==0 and true or nil) goto done end
end
end
pointer=readPointer(pointer)
if not readPointer(pointer) then break end
end
end
end
::done::
if pointer1 and flag1 then
printf('%X',flag1-pointer1)
UObject.FNameIndex = flag1-pointer1
printf('%X',pointer3)
UObject.Outer = pointer3
for i=4,0x80,4 do
pointer2=readPointer(pointer1+i)
if readPointer(pointer2) then pointer3=checkvalue(pointer2+UObject.FNameIndex,UObject.FNameIndex+4,'Class',1) if pointer3 then pointer3=i break end end
end
printf('%X',pointer3)
UObject.Class = pointer3
printf('%X %X %X : %X',UObject.Outer,UObject.FNameIndex,UObject.Class,pointer1)
end
if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then
if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18
else UE4ver=20 end
end
printf('GUObjectArray = %X',getAddressSafe('GUObjectArray'))
print('done\n')
print(os.clock()-startt)
ue4parsetable()
[DISABLE]
95577
"UE3 Namepool & ObjectArray scanner (using string reference)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print('------------------')
local result1,num,address,result2,result3,pointer,flag1,flag2,flag3=stringscan('i>=0 && (i<ArrayNum||(i==0',process),0
local size=targetIs64Bit() and 8 or 4
if targetIs64Bit() then result2=sigscan('48 8D',process)end
for i=1,#result1 do
print(result1[i])
if not targetIs64Bit() then result2=pointerscan(getAddress(result1[i]),process)end
for j=1,#result2 do
if (targetIs64Bit() and string.find(disassemble(result2[j]),result1[i])) or not targetIs64Bit() then
if findOpcode(result2[j],(targetIs64Bit() and '*8' or '*4'),0x100) and readPointer(readPointer(findAddress('Array',0,result2[j]..'+4',0x10)[1])) then
--print(result1[i]..'<-'..result2[j])
result3=findAddress('GUObjectArray',0,result2[j]..'+4')
for k=1,#result3 do
flag3=false
address=getAddress(result3[k])
flag2=ValidateFNamePool(getAddress(address))
if flag2 then print(string.format('FNamePool=%X',getAddressSafe('FNamePool'))) end
pointer=readPointer(address)
if readPointer(readPointer(pointer)) then
for m=0,1 do
for n=0,20*size,size do
if not readPointer(readPointer(readPointer(pointer+n))) then break end
if n==20*size then flag3=true end
end
if flag3 then break end
pointer=readPointer(pointer)
end
end
if flag3 and getAddressSafe('GUObjectArray')~=getAddress(address) and getAddressSafe('FNamePool')~=getAddress(address) and getAddress(address)%4==0 and readPointer(readPointer(readPointer(address))) and readPointer(readPointer(address))%4==0 then unregisterSymbol('GUObjectArray')registerSymbol('GUObjectArray',address,true) print(string.format('GUObjectArray=%X',getAddress('GUObjectArray'))) flag1=true goto done end
if flag1 and flag2 then goto done end
end
--UObjectMul=targetIs64Bit() and 8 or 4
--if num>1 then break end
end
end
end
end
::done::
--[[
if not readPointer('GUObjectArray')then
result1=stringscan('Core',process)
for i=1,#result1 do
print(result1[i])
if not targetIs64Bit() then result2=pointerscan(getAddress(result1[i]),process)end
for j=1,#result2 do
if (targetIs64Bit() and string.find(disassemble(result2[j]),result1[i])) or not targetIs64Bit() then
if findOpcode(result2[j],(targetIs64Bit() and '*8' or '*4'),0x100) and readPointer(readPointer(findAddress('Array',0,result2[j]..'+4',nil,nil,nil,nil,nil,nil,0x10)[1])) then
print(result1[i]..'<-'..result2[j])
findAddress('GUObjectArray',1,result2[j]..'+4',nil,nil,nil,nil,nil,nil,0x10)
break
end
end
end
end
end
]]
print('done')
[DISABLE]
95578
"Object scanner"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
--unregisterSymbol('FNamePool')
--registerSymbol('FNamePool','libUE4.so+41DE8A4',true)
--UE4ver=nil
--if not UE4ver then ue4versioncheck()end
--ue4config()
--ue4parsetable()
ue4parsetableFNamePool()
if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end
local Object=FindStringFName('Object',isMassEffect,true)
if not UObject then UObject = {} end
print(Object)
local size,pointer,pointer1,pointer2,pointer3,pointer4,pointer5,pointer6,class,fname,outer,flag1=(targetIs64Bit() and 8 or 4)
local result,result2,result3=groupscan('4:'..Object)
print(#result)
for i=1,#result do
pointer=getAddress(result[i])-0x50
for j=0,0x200,4 do
pointer1=readPointer(pointer+j)
if readPointer(readPointer(pointer1)) and readPointer(readPointer(readPointer(pointer1))) and inModule(readPointer(readPointer(pointer1)))then
pointer2=checkvalue(pointer1,0x200,'Class',1)
if pointer2 then
pointer5=pointer2-pointer1
for k=0,0x200,4 do
pointer3=readPointer(pointer+k)
if readPointer(readPointer(pointer3)) and readPointer(readPointer(readPointer(pointer3))) and inModule(readPointer(readPointer(pointer3)))then
pointer4=checkvalue(pointer3,0x200,'Core',1)
if pointer4 then
pointer6=pointer4-pointer3
if pointer6==pointer5 then
pointer1=getAddress(result[i])-pointer6
if readPointer(readPointer(pointer1)) and readPointer(readPointer(readPointer(pointer1))) and inModule(readPointer(readPointer(pointer1)))then
outer,fname,class=pointer+k-pointer1,pointer6,pointer+j-pointer1
if class<0x80 and fname<0x80 and outer<0x80 and FNameStringAlgo(readInteger(readPointer(pointer1+class)+fname),true):len()<6 then
printf('%X %X %X : %X',outer,fname,class,pointer1)
goto done
end
end
end
end
end
end
end
end
end
end
::done::
local strlist={}
UObject.Outer = outer
UObject.FNameIndex = fname
UObject.Class = class
result2=pointerscan(pointer1)
print(#result2)
for i=#result2,1,-1 do
for j=0,0x160,4 do
pointer2=getAddress(result2[i])-0x130+j
flag1=nil
pointer=readPointer(pointer2)
if readPointer(readPointer(pointer)) and readPointer(readPointer(readPointer(pointer))) and inModule(readPointer(readPointer(pointer)))then
--printf('0. %X',getAddress(result2[i])-0x130+j)
strlist[#strlist+1]=string.format('0. %X\n',getAddress(result2[i])-0x130+j)
for o=4,UE3 and size or 8*4,4 do
for k=0,10*o,o do
pointer1=readPointer(pointer2+k)
if not readPointer(readPointer(pointer1))
or not readPointer(readPointer(readPointer(pointer1)))
or not inModule(readPointer(readPointer(pointer1)))
or not checkvalue(pointer1,0x50,k/o,2)
or not GetFullNameSafeAlgo(pointer1) then break end
if k==(10*o) then
printf('1. %X %X',pointer2,o) flag1=true
UObject.ObjectId= checkvalue(readPointer(pointer2+o*2),0x200,2,2)-readPointer(pointer2+o*2)
if pointer2%4==0 then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',pointer2,true)NOGUObjectsize=true end
result=pointerscan(pointer2)
for m=1,#result do
pointer=getAddress(result[m])
if pointer%4==0 then
if inModule(pointer2) and not inModule(pointer) then break end
printf('%X<-%X',pointer2,pointer)
unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',pointer,true)NOGUObjectsize=nil
if inModule(pointer) then goto done2 end
result3=pointerscan(pointer)
for n=1,#result3 do
pointer3=getAddress(result3[n])
if pointer3%4==0 then
printf('%X<-%X<-%X',pointer2,pointer,pointer3)
unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',pointer3,true)NOGUObjectsize=nil
if inModule(pointer3) then goto done2 end
end
end
end
end
if pointer2%0x100==0 and inModule(pointer2) then goto done2 end
end
if flag1 then break end
end
if flag1 then break end
end
if flag1 then break end
end
if flag1 then break end
end
end
::done2::
--if not flag1 then print(table.concat(strlist))end
--[[
if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then
if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18
elseif readInteger('GUObjectArray+14')==0 then UE4ver=9
else UE4ver=20 end
end
]]
if readPointer('GUObjectArray') then printf('GUObjectArray = %X\n',getAddress('GUObjectArray')) ue4parsetable() end
print('done\n')
[DISABLE]
95579
"Auto Assemble script"
Auto Assembler Script
{$lua}
function GetFullName(object)
if not GetFullNameMem then GetFullNameMem=allocateMemory(0x100)end
executeCodeEx(0, nil, getAddress('GetFullName'), object, GetFullNameMem)
local str=readPointer(GetFullNameMem)
if str then str=readString(str,readInteger(GetFullNameMem+0x8)*2,true) end
return str
end
if syntaxcheck then return end
[ENABLE]
[DISABLE]
95580
"DissectCode (Memory View -> Ctrl+J or (Tools -> Dissect code) )"
1
95581
"Save DissectCode"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1))
getDissectCode().saveToFile(path)
--getDissectCode().loadFromFile(path)
[DISABLE]
95582
"Load DissectCode"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1))
--getDissectCode().saveToFile(path)
getDissectCode().loadFromFile(path)
[DISABLE]