26215
"Mirror 2"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_GameEngine,Mirror2_X-Win64-Shipping.exe,F8 48 8B 07 41 B0 01) // should be unique
alloc(newmem,$1000,INJECT_GameEngine)
registersymbol(gameEngine)
label(gameEngine return)
newmem:
mov [gameEngine],rdi
mov rax,[rdi]
mov r8l,01
jmp return
align 8,CC
gameEngine:
dq 0
INJECT_GameEngine+01:
jmp newmem
nop
return:
registersymbol(INJECT_GameEngine)
[DISABLE]
INJECT_GameEngine+01:
db 48 8B 07 41 B0 01
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: Mirror2_X-Win64-Shipping.exe+2BFF6E0
Mirror2_X-Win64-Shipping.exe+2BFF6BC: F2 0F 5C C2 - subsd xmm0,xmm2
Mirror2_X-Win64-Shipping.exe+2BFF6C0: 66 0F 5A F8 - cvtpd2ps xmm7,xmm0
Mirror2_X-Win64-Shipping.exe+2BFF6C4: 41 0F 2F FA - comiss xmm7,xmm10
Mirror2_X-Win64-Shipping.exe+2BFF6C8: 73 16 - jae Mirror2_X-Win64-Shipping.exe+2BFF6E0
Mirror2_X-Win64-Shipping.exe+2BFF6CA: 48 8B 07 - mov rax,[rdi]
Mirror2_X-Win64-Shipping.exe+2BFF6CD: 48 8B CF - mov rcx,rdi
Mirror2_X-Win64-Shipping.exe+2BFF6D0: 0F 5A CF - cvtps2pd xmm1,xmm7
Mirror2_X-Win64-Shipping.exe+2BFF6D3: FF 90 B0 02 00 00 - call qword ptr [rax+000002B0]
Mirror2_X-Win64-Shipping.exe+2BFF6D9: 0F 57 FF - xorps xmm7,xmm7
Mirror2_X-Win64-Shipping.exe+2BFF6DC: F2 0F 5A F8 - cvtsd2ss xmm7,xmm0
// ---------- INJECTING HERE ----------
Mirror2_X-Win64-Shipping.exe+2BFF6E0: 48 8B 07 - mov rax,[rdi]
// ---------- DONE INJECTING ----------
Mirror2_X-Win64-Shipping.exe+2BFF6E3: 41 B0 01 - mov r8l,01
Mirror2_X-Win64-Shipping.exe+2BFF6E6: 0F 28 CF - movaps xmm1,xmm7
Mirror2_X-Win64-Shipping.exe+2BFF6E9: 48 8B CF - mov rcx,rdi
Mirror2_X-Win64-Shipping.exe+2BFF6EC: FF 90 D0 02 00 00 - call qword ptr [rax+000002D0]
Mirror2_X-Win64-Shipping.exe+2BFF6F2: 48 8B 07 - mov rax,[rdi]
Mirror2_X-Win64-Shipping.exe+2BFF6F5: 41 B0 01 - mov r8l,01
Mirror2_X-Win64-Shipping.exe+2BFF6F8: 0F 28 CF - movaps xmm1,xmm7
Mirror2_X-Win64-Shipping.exe+2BFF6FB: 48 8B CF - mov rcx,rdi
Mirror2_X-Win64-Shipping.exe+2BFF6FE: FF 90 B8 02 00 00 - call qword ptr [rax+000002B8]
Mirror2_X-Win64-Shipping.exe+2BFF704: F6 87 A4 07 00 00 40 - test byte ptr [rdi+000007A4],40
}
26510
"Match 3 Game"
1
26218
"PlayerActor"
1
0
8 Bytes
[gameEngine]+780
0
5D8
E0
0
238
120
78
26259
"Attribute Sets"
0
1
+2A0
0
26373
"Health.BaseValue"
Float
+38
26374
"Health.CurrentValue"
Float
+3C
26375
" "
1
26376
"MaxHealth.BaseValue"
Float
+48
26377
"MaxHealth.CurrentValue"
Float
+4C
26378
" "
1
26379
"Turn.BaseValue"
Float
+58
26380
"Turn.CurrentValue"
Float
+5C
26381
" "
1
26382
"MaxTurn.BaseValue"
Float
+68
26383
"MaxTurn.CurrentValue"
Float
+6C
26384
" "
1
26385
"Mana.BaseValue"
Float
+78
26386
"Mana.CurrentValue"
Float
+7C
26387
" "
1
26388
"MaxMana.BaseValue"
Float
+88
26389
"MaxMana.CurrentValue"
Float
+8C
26390
" "
1
26391
"Attack.BaseValue"
Float
+98
26392
"Attack.CurrentValue"
Float
+9C
26393
" "
1
26394
"AttackInf.BaseValue"
Float
+A8
26395
"AttackInf.CurrentValue"
Float
+AC
26396
" "
1
26397
"PhysicDef.BaseValue"
Float
+B8
26398
"PhysicDef.CurrentValue"
Float
+BC
26399
" "
1
26400
"MagicDef.BaseValue"
Float
+C8
26401
"MagicDef.CurrentValue"
Float
+CC
26402
" "
1
26403
"AllDefense.BaseValue"
Float
+D8
26404
"AllDefense.CurrentValue"
Float
+DC
26405
" "
1
26406
"HPRecoverRate.BaseValue"
Float
+E8
26407
"HPRecoverRate.CurrentValue"
Float
+EC
26408
" "
1
26409
"ManaRecoverRate.BaseValue"
Float
+F8
26410
"ManaRecoverRate.CurrentValue"
Float
+FC
26411
" "
1
26412
"PhysicGemInf.BaseValue"
Float
+108
26413
"PhysicGemInf.CurrentValue"
Float
+10C
26414
" "
1
26415
"MagicGemInf.BaseValue"
Float
+118
26416
"MagicGemInf.CurrentValue"
Float
+11C
26417
" "
1
26418
"HealthGemInf.BaseValue"
Float
+128
26419
"HealthGemInf.CurrentValue"
Float
+12C
26420
" "
1
26421
"ManaGemInf.BaseValue"
Float
+138
26422
"ManaGemInf.CurrentValue"
Float
+13C
26423
" "
1
26424
"FinalGemInf.BaseValue"
Float
+148
26425
"FinalGemInf.CurrentValue"
Float
+14C
26426
" "
1
26427
"BreakArmorLevel.BaseValue"
Float
+158
26428
"BreakArmorLevel.CurrentValue"
Float
+15C
26429
"Buff List"
1
26258
"Buff List Size"
4 Bytes
+508
26430
"Buff 1 - Turn Duration"
4 Bytes
+500
50
0
26436
"Buff 2 - Turn Duration"
0
4 Bytes
+500
50
8
26435
"Buff 3 - Turn Duration"
0
4 Bytes
+500
50
10
26434
"Buff 4 - Turn Duration"
0
4 Bytes
+500
50
18
26433
"Buff 5 - Turn Duration"
0
4 Bytes
+500
50
20
26432
"Buff 6 - Turn Duration"
0
4 Bytes
+500
50
28
26431
"Buff 7 - Turn Duration"
0
4 Bytes
+500
50
30
26439
"Buff 8 - Turn Duration"
0
4 Bytes
+500
50
38
26438
"Buff 9 - Turn Duration"
0
4 Bytes
+500
50
40
26437
"Buff 10 - Turn Duration"
0
4 Bytes
+500
50
48
26219
"NPCActor"
1
0
8 Bytes
[gameEngine]+780
0
5E0
E0
0
238
120
78
26316
"Attribute Sets"
0
1
+2A0
0
26317
"Health.BaseValue"
Float
+38
26318
"Health.CurrentValue"
Float
+3C
26355
" "
1
26319
"MaxHealth.BaseValue"
Float
+48
26320
"MaxHealth.CurrentValue"
Float
+4C
26356
" "
1
26321
"Turn.BaseValue"
Float
+58
26322
"Turn.CurrentValue"
Float
+5C
26357
" "
1
26323
"MaxTurn.BaseValue"
Float
+68
26324
"MaxTurn.CurrentValue"
Float
+6C
26358
" "
1
26325
"Mana.BaseValue"
Float
+78
26326
"Mana.CurrentValue"
Float
+7C
26359
" "
1
26327
"MaxMana.BaseValue"
Float
+88
26328
"MaxMana.CurrentValue"
Float
+8C
26360
" "
1
26329
"Attack.BaseValue"
Float
+98
26330
"Attack.CurrentValue"
Float
+9C
26361
" "
1
26331
"AttackInf.BaseValue"
Float
+A8
26332
"AttackInf.CurrentValue"
Float
+AC
26362
" "
1
26333
"PhysicDef.BaseValue"
Float
+B8
26334
"PhysicDef.CurrentValue"
Float
+BC
26363
" "
1
26335
"MagicDef.BaseValue"
Float
+C8
26336
"MagicDef.CurrentValue"
Float
+CC
26364
" "
1
26337
"AllDefense.BaseValue"
Float
+D8
26338
"AllDefense.CurrentValue"
Float
+DC
26365
" "
1
26339
"HPRecoverRate.BaseValue"
Float
+E8
26340
"HPRecoverRate.CurrentValue"
Float
+EC
26366
" "
1
26341
"ManaRecoverRate.BaseValue"
Float
+F8
26342
"ManaRecoverRate.CurrentValue"
Float
+FC
26367
" "
1
26343
"PhysicGemInf.BaseValue"
Float
+108
26344
"PhysicGemInf.CurrentValue"
Float
+10C
26368
" "
1
26345
"MagicGemInf.BaseValue"
Float
+118
26346
"MagicGemInf.CurrentValue"
Float
+11C
26369
" "
1
26347
"HealthGemInf.BaseValue"
Float
+128
26348
"HealthGemInf.CurrentValue"
Float
+12C
26370
" "
1
26349
"ManaGemInf.BaseValue"
Float
+138
26350
"ManaGemInf.CurrentValue"
Float
+13C
26371
" "
1
26351
"FinalGemInf.BaseValue"
Float
+148
26352
"FinalGemInf.CurrentValue"
Float
+14C
26372
" "
1
26353
"BreakArmorLevel.BaseValue"
Float
+158
26354
"BreakArmorLevel.CurrentValue"
Float
+15C
26440
"Buff List"
1
26441
"Buff List Size"
4 Bytes
+508
26442
"Buff 1 - Turn Duration"
4 Bytes
+500
50
0
26443
"Buff 2 - Turn Duration"
0
4 Bytes
+500
50
8
26444
"Buff 3 - Turn Duration"
0
4 Bytes
+500
50
10
26445
"Buff 4 - Turn Duration"
0
4 Bytes
+500
50
18
26446
"Buff 5 - Turn Duration"
0
4 Bytes
+500
50
20
26447
"Buff 6 - Turn Duration"
0
4 Bytes
+500
50
28
26448
"Buff 7 - Turn Duration"
0
4 Bytes
+500
50
30
26449
"Buff 8 - Turn Duration"
0
4 Bytes
+500
50
38
26450
"Buff 9 - Turn Duration"
0
4 Bytes
+500
50
40
26451
"Buff 10 - Turn Duration"
0
4 Bytes
+500
50
48
26487
"Heart Game"
0
1
[gameEngine]+780
0
E0
0
238
120
78
26486
"Unlimited Time"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_HTime,Mirror2_X-Win64-Shipping.exe,8B 44 3B B4 89 43 B4 0F B6) // should be unique
alloc(newmem,$1000,INJECT_HTime)
label(code)
label(return)
newmem:
code:
mov eax,(float)99
mov [rbx-4C],eax
jmp return
INJECT_HTime:
jmp newmem
nop 2
return:
registersymbol(INJECT_HTime)
[DISABLE]
INJECT_HTime:
db 8B 44 3B B4 89 43 B4
unregistersymbol(INJECT_HTime)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Mirror2_X-Win64-Shipping.exe+1086B76
Mirror2_X-Win64-Shipping.exe+1086B51: E8 5A 3F FC FF - call Mirror2_X-Win64-Shipping.exe+104AAB0
Mirror2_X-Win64-Shipping.exe+1086B56: 8B 44 3B A8 - mov eax,[rbx+rdi-58]
Mirror2_X-Win64-Shipping.exe+1086B5A: 48 8D 57 D8 - lea rdx,[rdi-28]
Mirror2_X-Win64-Shipping.exe+1086B5E: 89 43 A8 - mov [rbx-58],eax
Mirror2_X-Win64-Shipping.exe+1086B61: 48 8D 4B D8 - lea rcx,[rbx-28]
Mirror2_X-Win64-Shipping.exe+1086B65: 8B 44 3B AC - mov eax,[rbx+rdi-54]
Mirror2_X-Win64-Shipping.exe+1086B69: 48 03 D3 - add rdx,rbx
Mirror2_X-Win64-Shipping.exe+1086B6C: 89 43 AC - mov [rbx-54],eax
Mirror2_X-Win64-Shipping.exe+1086B6F: 8B 44 3B B0 - mov eax,[rbx+rdi-50]
Mirror2_X-Win64-Shipping.exe+1086B73: 89 43 B0 - mov [rbx-50],eax
// ---------- INJECTING HERE ----------
Mirror2_X-Win64-Shipping.exe+1086B76: 8B 44 3B B4 - mov eax,[rbx+rdi-4C]
// ---------- DONE INJECTING ----------
Mirror2_X-Win64-Shipping.exe+1086B7A: 89 43 B4 - mov [rbx-4C],eax
Mirror2_X-Win64-Shipping.exe+1086B7D: 0F B6 44 3B B8 - movzx eax,byte ptr [rbx+rdi-48]
Mirror2_X-Win64-Shipping.exe+1086B82: 88 43 B8 - mov [rbx-48],al
Mirror2_X-Win64-Shipping.exe+1086B85: 0F B6 44 3B B9 - movzx eax,byte ptr [rbx+rdi-47]
Mirror2_X-Win64-Shipping.exe+1086B8A: 88 43 B9 - mov [rbx-47],al
Mirror2_X-Win64-Shipping.exe+1086B8D: 48 8B 44 3B C0 - mov rax,[rbx+rdi-40]
Mirror2_X-Win64-Shipping.exe+1086B92: 48 89 43 C0 - mov [rbx-40],rax
Mirror2_X-Win64-Shipping.exe+1086B96: 8B 44 1F C8 - mov eax,[rdi+rbx-38]
Mirror2_X-Win64-Shipping.exe+1086B9A: 89 43 C8 - mov [rbx-38],eax
Mirror2_X-Win64-Shipping.exe+1086B9D: 48 8B 44 3B D0 - mov rax,[rbx+rdi-30]
}
26482
"Turns Left"
4 Bytes
[gameEngine]+780
878
E0
0
238
120
78
26499
"Points Per Heart"
1
26488
"Heart 1"
Float
+858
18
26489
"Heart 2"
Float
+858
38
26490
"Heart 3"
Float
+858
58
26491
"Heart 4"
Float
+858
78
26492
"Heart 5"
Float
+858
98
26493
"Heart 6"
Float
+858
B8
26494
"Heart 7"
Float
+858
D8
26495
"Heart 8"
Float
+858
F8
26496
"Heart 9"
Float
+858
118
26497
"Heart 10"
Float
+858
138
26498
"Heart 11"
Float
+858
158
26500
"Heart 12"
Float
+858
178
26501
"Heart 13"
Float
+858
198
26502
"Heart 14"
Float
+858
1B8
26503
"Heart 15"
Float
+858
1D8
26504
"Heart 16"
Float
+858
1F8
26505
"Heart 17"
Float
+858
218
26506
"Heart 18"
Float
+858
238
26507
"Heart 19"
Float
+858
258
26508
"Heart 20"
Float
+858
278
26455
"999,999 Gold - (Buy Something)"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_Coins,Mirror2_X-Win64-Shipping.exe,F3 41 0F 11 49 28 FF) // should be unique
alloc(newmem,$1000,INJECT_Coins)
label(code)
label(return)
newmem:
code:
mov [r9+28],(float)999999
jmp return
INJECT_Coins:
jmp newmem
nop
return:
registersymbol(INJECT_Coins)
[DISABLE]
INJECT_Coins:
db F3 41 0F 11 49 28
unregistersymbol(INJECT_Coins)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Mirror2_X-Win64-Shipping.exe+104E66B
Mirror2_X-Win64-Shipping.exe+104E63C: 0F 2F CA - comiss xmm1,xmm2
Mirror2_X-Win64-Shipping.exe+104E63F: 72 33 - jb Mirror2_X-Win64-Shipping.exe+104E674
Mirror2_X-Win64-Shipping.exe+104E641: 0F 2F 15 E8 04 7D 02 - comiss xmm2,[Mirror2_X-Win64-Shipping.exe+381EB30]
Mirror2_X-Win64-Shipping.exe+104E648: 73 16 - jae Mirror2_X-Win64-Shipping.exe+104E660
Mirror2_X-Win64-Shipping.exe+104E64A: F3 41 0F 10 81 08 01 00 00 - movss xmm0,[r9+00000108]
Mirror2_X-Win64-Shipping.exe+104E653: F3 0F 5C C2 - subss xmm0,xmm2
Mirror2_X-Win64-Shipping.exe+104E657: F3 41 0F 11 81 08 01 00 00 - movss [r9+00000108],xmm0
Mirror2_X-Win64-Shipping.exe+104E660: F3 0F 5C CA - subss xmm1,xmm2
Mirror2_X-Win64-Shipping.exe+104E664: 0F 57 C0 - xorps xmm0,xmm0
Mirror2_X-Win64-Shipping.exe+104E667: F3 0F 5F C8 - maxss xmm1,xmm0
// ---------- INJECTING HERE ----------
Mirror2_X-Win64-Shipping.exe+104E66B: F3 41 0F 11 49 28 - movss [r9+28],xmm1
// ---------- DONE INJECTING ----------
Mirror2_X-Win64-Shipping.exe+104E671: FF 41 04 - inc [rcx+04]
Mirror2_X-Win64-Shipping.exe+104E674: 48 8B 5C 24 30 - mov rbx,[rsp+30]
Mirror2_X-Win64-Shipping.exe+104E679: 48 83 C4 20 - add rsp,20
Mirror2_X-Win64-Shipping.exe+104E67D: 5F - pop rdi
Mirror2_X-Win64-Shipping.exe+104E67E: C3 - ret
Mirror2_X-Win64-Shipping.exe+104E67F: CC - int 3
Mirror2_X-Win64-Shipping.exe+104E680: 40 57 - push rdi
Mirror2_X-Win64-Shipping.exe+104E682: 48 83 EC 20 - sub rsp,20
Mirror2_X-Win64-Shipping.exe+104E686: 48 8B 09 - mov rcx,[rcx]
Mirror2_X-Win64-Shipping.exe+104E689: E8 B2 2E FF FF - call Mirror2_X-Win64-Shipping.exe+1041540
}
26213
"Dumpers (Created By Cake-San) Thank you for this awsome dumper!"
004000
1
26122
"Dumper V5"
1
26123
"Unreal Engine"
Auto Assembler Script
{$lua}
function ue4config()
local sub=targetIs64Bit() and 0 or 4
UObject = {}
if UE4ver<=2 and targetIs64Bit() then ue4determineversion() end
-----------------------------
----------UE4 struct---------
if UE4ver>2 then
UObject.ObjectId= 0xC-sub
UObject.Class = 0x10-sub
UObject.FNameIndex = 0x18-(sub*2)
UObject.Outer = 0x20-(sub*2)
UObject.enumMul= 0x10
if UE4ver>=25 then
UObject.super= 0x40
UObject.member= 0x50
UObject.nextmember= 0x20
UObject.Offset= 0x4C
UObject.propsize=0x3C
UObject.bitmask= 0x7A
UObject.funct= 0xD8
UObject.Property= 0x78
elseif UE4ver>=22 then
UObject.super= 0x40
UObject.member= 0x48
UObject.funct= 0xC0
else
UObject.super= 0x30 -(sub*4)
UObject.member= 0x38 -(sub*5)
UObject.funct= 0xB0
end
if UE4ver<25 then
UObject.nextmember=0x28-(sub*3)
UObject.Offset= 0x44-(sub*4)
UObject.propsize= 0x34-(sub*3/2)
UObject.bitmask= 0x72-(sub*8)
UObject.Property= 0x70
end
if UE4ver<11 then
UObject.Offset= 0x4C
UObject.enumMul= 0xC
end
----------------------------
---------UE3 struct---------
--1.25
elseif UE4ver>=1 then
UObject.ObjectId= 0x4
UObject.Outer = 0x14
UObject.FNameIndex = 0x18
UObject.Class = 0x20
UObject.Offset= 0x48
UObject.super= 0x34
UObject.member= 0x38
UObject.nextmember=0x28
UObject.propsize= 0x30
UObject.bitmask= 0x60
UObject.Property= 0x58
UObject.enumMul= 0x8
--0.10246
else
UObject.ObjectId= 0x20
UObject.Outer = 0x28
UObject.FNameIndex = 0x2C
UObject.Class = 0x34
UObject.Offset= 0x60
UObject.super= 0x48
UObject.member= 0x4C
UObject.nextmember=0x3C
UObject.propsize= 0x44
UObject.bitmask= 0x70
end
---------------------------
end
local ue4type={
['BoolProperty']=vtByte,
['ByteProperty']=vtByte,
['FloatProperty']=vtSingle,
['StructProperty']=vtDword,
['IntProperty']=vtDword,
['NameProperty']=vtQword,
['Int64Property']=vtQword,
['TextProperty']=vtPointer,
['StrProperty']=vtPointer,
['ArrayProperty']=vtPointer,
['MapProperty']=vtPointer,
['ClassProperty']=vtPointer,
['ObjectProperty']=vtPointer}
function ue4versioncheck()
local fileversion,info =getFileVersion(enumModules()[1].PathToFile)
if not info then UE4ver=0 return end
--return info.minor
UE4ver=tonumber(info.minor..'.'..info.release)
end
function FNameStringAlgo(FName,IndexOnly)
if not FName then return nil end
local UEver=UE4ver
local sub=targetIs64Bit() and 0 or 4
local number,str,datatable
if not IndexOnly then
number=UEver>2 and readInteger(FName+4) or 0
FName=readInteger(FName)
else number=FName>>32 FName=FName&0xFFFFFFFF
end
if not FName then return nil end
if FNameList[FName] then
if number>0 then return FNameList[FName]..'_'..number-1 end
return FNameList[FName]
end
local CFName=FName
if UEver>=23 then
local i=(FName>>0x10)+1
FName=(FName&0xFFFF)*2
if i>#FNameDict or FName>#FNameDict[i] then return nil end
datatable={}
for m=1,2 do
datatable[m]=FNameDict[i][FName+m]
end
local le = byteTableToWord(datatable)
if not le then return nil end
le=le>>6
if le>200 then return nil end
local widechar=true and FNameDict[i][FName+1]&1==1 or false
if widechar then
datatable={}
for m=1,le*2 do
datatable[m]=FNameDict[i][FName+2+m]
end
str=byteTableToWideString(datatable)
else
datatable={}
for m=1,le do
datatable[m]=FNameDict[i][FName+2+m]
end
str=byteTableToString(datatable)
end
else
local i
if UEver>2 then
i=(FName>>0xE)+1
FName=(FName&0x3FFF)*(8-sub)
else i=1 FName=FName*(8-sub) end
if i>#FNameDict or FName>#FNameDict[i] then return nil end
local pointer
if targetIs64Bit() then
datatable={}
for m=1,8 do
datatable[m]=FNameDict[i][FName+m]
end
pointer=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do
datatable[m]=FNameDict[i][FName+m]
end
pointer=byteTableToDword(datatable)
end
if not pointer or pointer==0 then return nil end
--local offset=UE4ver>=22 and 0xC-sub or 0x10-(sub*2)
if FName==1 and not stringoffset or not stringoffsetid then
str=readString(pointer+8,13)
if str=='ByteProperty' then stringoffset=8
else str=readString(pointer+0xC,13)
if str=='ByteProperty' then stringoffset=0xC
else str=readString(pointer+0x10,13)
if str=='ByteProperty' then stringoffset=0x10 end
end
end
for j=0, stringoffset-4,4 do
if readInteger(pointer+j)==2 then stringoffsetid=j end
end
--print(string.format('%X',FName))
--print(string.format('%X',pointer))
--print(string.format('%X',offset))
else
local widechar=true and readInteger(pointer+stringoffsetid)&1==1 and UEver>2 or false
str= readString(pointer+stringoffset,200,widechar)
if not str then str= readString(pointer+stringoffset,100,widechar) end
if not str then str= readString(pointer+stringoffset,50,widechar) end
if not str then str= readString(pointer+stringoffset,30,widechar) end
if not str then
local le=0
--print(string.format('%X',FName))
--print(string.format('%X',pointer))
while(true)do
if le>50 then break end
if readBytes(pointer+stringoffset+le)==0 then break end
le=le+1
end
str= readString(pointer+stringoffset,le)
end
--print(string.format('%X',pointer+0xC))
end end
if not str then return nil end
if number>0 then return str..'_'..number-1 end
--print(str)
FNameList[CFName]=str
return str
end
function GetNameAlgo(object)
if not object then return nil end
if ObjectList[object] then --print(ObjectList[object])
return ObjectList[object]
end
local fnameoffset=UObject.FNameIndex
local typeoffset=UObject.Class
local pointer=readPointer(object+typeoffset)
if not pointer then return nil end
--print(string.format('%X',fnameoffset))
--print(string.format('%X',object+fnameoffset))
local str1=FNameStringAlgo(pointer+fnameoffset)
local str2=FNameStringAlgo(object+fnameoffset)
if not str2 then str2=FNameStringAlgo(object+fnameoffset-8)end
if not str1 or str1=='None' or not str2 or str2=='None' then return nil end
str1=str1..' '..str2
--print(ObjectList[object])
ObjectList[object]=str1
return str1
end
function GetFullNameAlgo(object)
if not object then return nil end
--if ObjectList[object] then return ObjectList[object] end
local pathoffset=UObject.Outer
local fnameoffset=UObject.FNameIndex
local str=GetNameAlgo(object)
if not str then return nil end
local number=readInteger(object+fnameoffset+4)
local typ=str:sub(1,string.find(str,' ')-1)
local isProperty=string.find(typ,'Property')
if not isProperty then isProperty=string.find(typ,'Function') end
local pointer=readPointer(object+pathoffset)
while(true)do
if not pointer or pointer==0 then break end
local stri=GetNameAlgo(pointer)
if not stri then break end
typ=stri:sub(1,string.find(stri,' ')-1)
local isPropertyc=string.find(typ,'Property')
if not isPropertyc then isPropertyc=string.find(typ,'Function') end
stri=string.sub(str,1,string.find(str,' '))..stri:sub(string.find(stri,' ')+1,stri:len())
local num=readInteger(pointer+fnameoffset+4)
if number~=num and num==0 or not isPropertyc and isProperty then stri=stri..':'
else stri=stri..'.' end
number=num
isProperty=isPropertyc
str=stri..string.sub(str,string.find(str,' ')+1,str:len())
pointer=readPointer(pointer+pathoffset)
if string.find(str,'%./') then
stri=string.sub(str,1,string.find(str,' '))
str=stri..str:sub(string.find(str,'%./')+1,str:len())
break end
end
if not str then return nil end
--ObjectList[object]=str
return str
end
function GetFullNameSuperAlgo(object)
local super=UObject.super
local str1 = GetFullNameAlgo(object)
if not str1 then return nil end
local pointer = readPointer(object+super)
if pointer then
local str2 = GetFullNameAlgo(pointer)
if str2 then return str1..' ~ '..str2 end
end
return str1
end
function GetFullNameSafesAlgo(object)
--if ObjectList[object] then return ObjectList[object] end
local fnameoffset=0x28
local typeoffset=0x8
local pathoffset=0x10
if not object then return nil end
local pointer=readPointer(object+typeoffset)
if not pointer then return nil end
local str1=FNameStringAlgo(pointer)
local str2=FNameStringAlgo(object+fnameoffset)
local pointer=readPointer(object+pathoffset)
if not pointer then return nil end
local str3=GetFullNameAlgo(pointer)
if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end
--print(str3)
--if string.find(str3,'%./') then string.sub
local str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2
--ObjectList[object]=str
return str
end
function GetFullNameSafeAlgo(object)
--if ObjectList[object] then return ObjectList[object] end
local fnameoffset=0x28
local typeoffset=0x8
local pathoffset=0x10
if not object then return nil end
local pointer=readPointer(object+typeoffset)
if not pointer then return nil end
local str1=FNameStringAlgo(pointer)
local str2=FNameStringAlgo(object+fnameoffset)
local pointer=readPointer(object+pathoffset)
if not pointer then return nil end
local str3=GetFullNameAlgo(pointer)
if not str3 then str3=GetFullNameSafesAlgo(pointer)end
if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end
--print(str3)
--if string.find(str3,'%./') then string.sub
local str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2
--ObjectList[object]=str
return str
end
function FindString(namestr,start,stop)
for i=start,stop do
local name=FNameStringAlgo(i,true)
if name and name:len()<200 and name:len()>2 and not string.find(name,'%c') then
--print(name)
if name and name:len()<200 and name:len()>2 and not string.find(name,'%c') then
if namestr==name then FNameResult=i return end
end
end
end
end
function FindStringFName(namestr)
local size
if UE4ver>=23 then size=(#FNameDict<<0x10)-1
elseif UE4ver>2 then size=(#FNameDict<<0xE)-1
else size=math.floor(#FNameDict[1]/4) end
local count=0x200
size=math.floor((size/count)+0.5)
ue4parsetablecheck()
FNameResult=nil
local result
local num,start,stop=count,0,0
for i=0,size do
start=stop
stop=stop+num
if FNameResult then break end
createThread(FindString(namestr,start,stop-1))
end
result=FNameResult
FNameResult=nil
return result
end
function hasProperty(object)
local str1
if UE4ver>=25 then str1=GetFullNameSafeAlgo(object)
else str1=GetFullNameAlgo(object) end
if not str1 then return nil end
local pointer =readPointer(object+UObject.Property)
if pointer then
local str2 = GetFullNameAlgo(pointer)
if not str2 then str2=GetFullNameSafeAlgo(pointer)end
if str2 then return str1..' ~ '..str2 end
end
return str1
end
function printInheritC(class)
for i=0,10 do
if not class or class==0 then break end
print(GetFullNameSuperAlgo(class))
class=readPointer(class+UObject.super)
end
end
function printInheritI(instance)
instance=readPointer(instance+UObject.Class)
printInheritC(instance)
end
function getregionsize(address)
local allregion=enumMemoryRegions()
for i=#allregion,1,-1 do
if allregion[i].BaseAddress<=address then
local BaseAddress=allregion[i].BaseAddress
local RegionSize=allregion[i].RegionSize
local curSize=BaseAddress+RegionSize-address
return curSize,RegionSize,BaseAddress
end
end
end
--[[
function parsefrombig(tab,index,size)
local datatable={}
if not tab then return nil end
for i=1,size do
datatable[i]=tab[index+i]
end
return datatable
end
]]
function ue4parsetable()
FNameList={}
ObjectList={}
FullNameList={}
sub=targetIs64Bit() and 0 or 4
local pool=getAddressSafe('FNamePool')
local pool2=getAddressSafe('GUObjectArray')
if pool and pool2 then
if UE4ver>=20 then GUObjectsize=readInteger(getAddress('GUObjectArray+24')-(sub*2))
elseif UE4ver>11 then GUObjectsize=readInteger('GUObjectArray+1C')
else GUObjectsize=readInteger(getAddress('GUObjectArray+8')-(sub*2))
end
FNameDict={}
GUObjectDict={}
for i=0,500 do
local pointer
if UE4ver>=23 then pointer=readPointer(pool+i*(8-sub)+0x10)
elseif UE4ver>2 then pointer=readPointer(readPointer(pool)+i*(8-sub))
else pointer=readPointer(pool+i*(8-sub)) end
if pointer and pointer~=0 then
local size=getregionsize(pointer)
if not size or size==0 then break end
FNameDict[i+1]=readBytes(pointer,size-1,true)
else break
end
end
for i=0,500 do
if UE4ver>=20 then
pointer=readPointer(readPointer(pool2+0x10)+i*(8-sub))
if pointer and pointer~=0 then
--print(string.format('%X',pointer))
GUObjectDict[i+1]=readBytes(pointer,getregionsize(pointer)-1,true)
else break
end
elseif UE4ver>11 then pointer=readPointer(pool2+0x10)
if pointer and pointer~=0 then
GUObjectDict[i+1]=readBytes(pointer,getregionsize(pointer)-1,true) break
else break end
elseif UE4ver>2 then pointer=readPointer(readPointer(pool2)+i*8+0x10)
if pointer and pointer~=0 then
GUObjectDict[i+1]=readBytes(pointer,getregionsize(pointer)-1,true)
else break end
else pointer=readPointer(pool2)
if pointer and pointer~=0 then
GUObjectDict[i+1]=readBytes(pointer,getregionsize(pointer)-1,true) break
else break end
end
end
end
end
function ue4parsetablecheck()
if not FNameDict or not GUObjectDict then ue4parsetable()
else
local pointer,pointei,datatable,m
if targetIs64Bit() then
datatable={}
for m=1,8 do datatable[m]=GUObjectDict[1][m]end
pointer=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do datatable[m]=GUObjectDict[1][m]end
pointer=byteTableToDword(datatable)
end
if UE4ver>=20 then pointei=readPointer('[[GUObjectArray+10]]')
elseif UE4ver>11 then pointei=readPointer('[GUObjectArray+10]')
elseif UE4ver>2 then pointei=readPointer('[[GUObjectArray]+10]')
else pointei=readPointer('[GUObjectArray]') end
--print(string.format('%X',pointei))
--print(string.format('%X',pointer))
if pointei ~= pointer then ue4parsetable() end
local GUObjectsizes
if UE4ver>=20 then GUObjectsizes=readInteger(getAddress('GUObjectArray+24')-(sub*2))
elseif UE4ver>11 then GUObjectsizes=readInteger('GUObjectArray+1C')
else GUObjectsizes=readInteger(getAddress('GUObjectArray+8')-(sub*2)) end
if GUObjectsizes~=GUObjectsize then ue4parsetable() end
end
end
function FindObject(threadlist,ObjectId,address,size,i,start,stop,fullname)
local pointer,datatable
for j=start,stop do
if UE4ver<11 and targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x8+m] then break end
datatable[m]=GUObjectDict[i][j*0x8+m]
end
pointer=byteTableToQword(datatable)
elseif UE4ver<11 then
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x4+m] then break end
datatable[m]=GUObjectDict[i][j*0x4+m]
end
pointer=byteTableToDword(datatable)
elseif targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x18+m] then break end
datatable[m]=GUObjectDict[i][j*0x18+m]
end
pointer=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x10+m] then break end
datatable[m]=GUObjectDict[i][j*0x10+m]
end
pointer=byteTableToDword(datatable)
end
if pointer and pointer~=0 then
local objid=readInteger(pointer+ObjectId)
if objid and objid<size then
local name=GetFullNameAlgo(pointer)
if name and string.find(name,' ') then
name=string.sub(name,string.find(name,' ')+1,name:len())
name=name:lower()
if not FullNameList[name]then FullNameList[name]=pointer end
if FullNameList[fullname] then
ObjectResult=FullNameList[fullname]
for k,v in ipairs(threadlist) do v.terminate() end
return
end
end
end
end
end
end
function StaticFindObjectAlgo(fullname)
ue4parsetablecheck()
fullname=fullname:lower()
if FullNameList[fullname] then return FullNameList[fullname]end
local threadlist={}
local k=1
local count=0x200
local size=GUObjectsize
local sizess= targetIs64Bit() and (UE4ver>11 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count)
local ObjectId=UObject.ObjectId
ObjectResult=nil
for i=1,#GUObjectDict do
local num,start,stop=count,0,0
for j=0,math.floor(#GUObjectDict[i]/sizess) do
start=stop
stop=stop+num
if ObjectResult then break end
threadlist[k]=createThread(FindObject(threadlist,ObjectId,GUObjectDict[i],size,i,start,stop-1,fullname))
k=k+1
end
end
local result=ObjectResult
ObjectResult=nil
return result
end
function registerFunc(ObjectId,address,size,i,start,stop)
local funct=UObject.funct
for j=start,stop do
local pointer
if UE4ver<11 and targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x8+m] then break end
datatable[m]=GUObjectDict[i][j*0x8+m]
end
pointer=byteTableToQword(datatable)
elseif UE4ver<11 then
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x4+m] then break end
datatable[m]=GUObjectDict[i][j*0x4+m]
end
pointer=byteTableToDword(datatable)
elseif targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x18+m] then break end
datatable[m]=GUObjectDict[i][j*0x18+m]
end
pointer=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x10+m] then break end
datatable[m]=GUObjectDict[i][j*0x10+m]
end
pointer=byteTableToDword(datatable)
end
if pointer and pointer~=0 then
local objid=readInteger(pointer+ObjectId)
if objid and objid<size then
local name=GetFullNameAlgo(pointer)
if name and string.find(name,' ') then
local typ=string.sub(name,1,string.find(name,' ')-1)
if typ=='Function' then
local fullname=string.sub(name,string.find(name,' ')+1,name:len())
local func=readPointer(pointer+funct)
if func and func~=0 then extralist.addSymbol('UE',fullname,func,1)end
end
end
end
end
end
end
function registerFuncAlgo()
local funct=UObject.funct
ue4parsetablecheck()
if not extralist then
extralist=createSymbolList()
extralist.register()
end
if not enumUEObjIsRunning and UEObj then
for i,v in ipairs(UEObj) do
if v.Type=='Function' then
local func=readPointer(v.Address+funct)
if func and func~=0 then extralist.addSymbol('UE',v.FullName,func,1)end
end
end
else
local k=1
local count=0x200
local size=GUObjectsize
local sizess= UE4ver>2 and (targetIs64Bit() and 0x18*count or 0x10*count) or 0x4*count
local ObjectId=UObject.ObjectId
for i=1,#GUObjectDict do
local num,start,stop=count,0,0
for j=0,math.floor(#GUObjectDict[i]/sizess) do
start=stop
stop=stop+num
if ObjectResult then break end
createThread(registerFunc(ObjectId,GUObjectDict[i],size,i,start,stop-1))
k=k+1
end
end
end
end
function isStructExist(name)
for i=1,#StructList do
if StructList[i].Name==name then return StructList[i] end
end
return nil
end
function SaveAndRemoveStruct()
StructList={}
local count=getStructureCount()
for i=count-1,0,-1 do
local struct=getStructure(i)
StructList[i+1]=struct
struct:removeFromGlobalStructureList()
end
end
function DeleteStruct(Struct)
local count=#StructList
for i=1,count do
if Struct==StructList[i] then
Struct:Destroy()
StructList[i]=nil
end
if not StructList[i] and StructList[i+1] then
StructList[i]=StructList[i+1]
StructList[i+1]=nil
end
end
end
function LoadStruct()
for i=1,#StructList do
StructList[i]:addToGlobalStructureList()
end
end
function ChildStructStart(structname,elementname)
local struct=isStructExist(structname)
if struct then
for i=0,struct.Count-1 do
if struct.Element[i].Name==elementname then return struct.Element[i].ChildStructStart end end
else return nil end
end
function findAddress(name,number,AddressOrAOBString,modulename,stopaddress,Nth,aobscanOnly,gethead,nop)
local size,address=0x100
AddressOrAOBString,address=string.lower(AddressOrAOBString):gsub('banana','')
if(address>0)then
local f
if(modulename==0 or modulename==nil or modulename=='')then f=AOBScan(AddressOrAOBString)
else
if type(modulename)==type(0) then modulename=string.format('%X',modulename)
elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end
local ms = createMemScan()
if(stopaddress==0 or stopaddress==nil or stopaddress=='')then
stopaddress=getNameFromAddress(getAddress(modulename),true,false)
if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end
if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end
modulename=getAddress([["]]..stopaddress..[["]])
stopaddress=modulename+getModuleSize(stopaddress)
modulename=string.format('%X',modulename)
end
ms.firstScan(soExactValue,vtByteArray,rtTruncated,AddressOrAOBString,'',getAddress(modulename),getAddress(stopaddress),'',fsmNotAligned,'',true,false,false,false)
ms.waitTillDone()
f = createFoundList(ms)
f.initialize()
ms.destroy()
end
address={}
for i=0,f.Count-1 do address[i+1]=f[i]end
f.destroy()
if Nth==nil or Nth==0 or Nth=='' then Nth=1 end
if gethead then
local addresss=GetAddressSafe(address[Nth])
if not addresss then addresss=GetAddressSafe(address[Nth-1])end
if addresss and addresss~=0 then
for i=0,0x1000 do
addresss=addresss-1
if readBytes(addresss,1)==0xCC then break end
if nop then local ext, opc, byt, add=splitDisassembledString(disassemble(addresss)) if string.find(opc,'nop') then addresss=addresss+getInstructionSize(addresss)-1 break end end
end
address[Nth]=addresss+1 end
end
if number==nil or number==0 or number=='' then
if aobscanOnly then return address end
else
if(#address==0)then error(name..' aob no result found') end
if(getAddress(address[Nth])==nil)then error(name..' aob result '..Nth..' doesnt exist') end
unregisterSymbol(name)
registerSymbol(name,getAddressSafe(address[Nth]),true)
if aobscanOnly then return end
end
AddressOrAOBString=GetAddressSafe(address[Nth])
end
AddressOrAOBString=getAddressSafe(AddressOrAOBString)
if(AddressOrAOBString==nil)then error(name..' still cant be found')end
local addr={}
local i=0
local j=1
while(i<size) do
local ext, opc, byt, add=splitDisassembledString(disassemble(getAddressSafe(AddressOrAOBString)+i))
if(ext~="")then
if(opc:find(",")~=nil)then
opc=opc:sub(opc:find(",")+1,opc:len())
else
opc=opc:sub(opc:find(" ")+1,opc:len())
end
addr[j]=opc:gsub("%[",""):gsub("]","") j=j+1
end
if opc:find('],') then
opc=opc:sub(opc:find("%[")+1,opc:find("]")-1)
if tonumber(opc,16) then addr[j]=opc j=j+1 end
end
i=i+getInstructionSize(AddressOrAOBString+i)
end
--for i=1,#addr do print(addr[i]) end
if number==nil or number==0 or number=='' then return addr end
local offset
if(type(number)==type(''))then
offset=string.find(number,',')
if(offset==nil)then number=getAddress(number)
else offset=getAddress(string.sub(number,offset+1,number:len()))
number=getAddress(string.sub(number,1,string.find(number,',')-1))
end
end
if offset==nil then offset=0 end
unregisterSymbol(name)
registerSymbol(name,getAddressSafe(addr[number])-offset,true)
end
function ue4determineversion()
local address=findAddress('FNamePool',0,'48 8D 0D * * * * E8 * * * * 4C 8B C0 C6banana',process,nil,0,true)[1]
if address then findAddress('FNamePool',1,address) UE4ver=25 ue4parsetable() ue4config()
local address=getAddressSafe(StaticFindObjectAlgo('/Script/Engine.GameEngine'))
if not address or address==0 then error('StaticFindObject not functioning as expected...')end
UE4ver=nil
local pointer=readPointer(address+UObject.member)
if pointer then pointer=readPointer(pointer) if pointer then UE4ver=25 end end
if not UE4ver then UE4ver=23 end
else
address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[1]
if address then findAddress('FNamePool',1,address)
else findAddress('FNamePool',1,'C3 * DB 48 89 1D * * * * * * 48 8B 5C 24 20banana',process,nil,2)end
local address=readPointer('[[GUObjectArray+10]]+18')
if address>0x10000 then
UE4ver=22
ue4parsetable()
ue4config()
FNameStringAlgo(1,true)
local address=getAddressSafe(StaticFindObjectAlgo('/Script/Engine.GameEngine'))
if not address or address==0 then error('StaticFindObject not functioning as expected...')end
UE4ver=nil
local pointer=readPointer(address+UObject.member)
if pointer then pointer=readPointer(pointer) if pointer then UE4ver=22 end end
if not UE4ver then UE4ver=20 end
else UE4ver=18 end
end
end
function fillstruct4bytes(Struct)
if not getElementByOffset(Struct,0) then local e=Struct.addElement() e.Offset=0 e.Vartype=vtDword end
Struct.beginUpdate()
local count=Struct.Count-1
local list,k,element1,element2,size,bytesize={},1
for i=0,count do
element1=Struct.Element[i]
element2=Struct.Element[i+1]
if element2 then
bytesize=element1.Bytesize
if bytesize<4 then bytesize=4 end
size=element2.Offset-element1.Offset-bytesize
if size>0 then
if size%4>0 then size=4-size%4+size end
local start=element1.Offset
if start%4>0 then start=4-start%4+start
else start=start+4 end
size=size/4
for j=0,size-1 do
if (start+j*4)>=(element1.Offset+bytesize) then
list[k]=start+j*4
k=k+1
end
end
end
end
end
for i,v in ipairs(list) do local e=Struct.addElement() e.Offset=v e.Vartype=vtDword end
Struct.endUpdate()
end
function ue4createstruct(FullNameOrAddress,StructName,isGlobal,isfullname,Structu,AddedOffset,AddedName)
if not FullNameOrAddress then return end
if StructName and isGlobal then local Struct=isStructExist(StructName) if Struct then DeleteStruct(Struct)end end
local member,Offset,Property,bitmask,nextmember,super,propsize=UObject.member,UObject.Offset,UObject.Property,UObject.bitmask,UObject.nextmember,UObject.super,UObject.propsize
local Object,Name,Class,PropName,Typ,Off,pointer,e,f=FullNameOrAddress
local isUE425=UE4ver>=25
if type(FullNameOrAddress)==type('') then Object=StaticFindObjectAlgo(FullNameOrAddress) end
if not Object then print(FullNameOrAddress..' not found...') return end
Name=GetNameAlgo(Object)
if not Name or not string.find(Name,' ') then print(FullNameOrAddress..' invalid Object?') return end
if not StructName then
Class=Name:sub(1,string.find(Name,' ')-1)
Name=Name:sub(string.find(Name,' ')+1,Name:len())
else Name=StructName end
local Struct=Structu
if not Struct then Struct=createStructure(Name)end
if not AddedName then AddedName='' end
local RunningStructName=name
if not AddedOffset then
if not RunningStruct then RunningStruct={} end
RunningStruct[#RunningStruct+1]=RunningStructName
AddedOffset=0 Struct.beginUpdate()
else
local FullName=GetFullNameAlgo(Object)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
if not LocalStruct then LocalStruct={}end
if LocalStruct[FullName] then copyStruct(LocalStruct[FullName],Struct,AddedOffset,AddedName)
else
local copy=createStructure(FullName)
ue4createstruct(Object,nil,nil,isfullname,copy)
LocalStruct[FullName]=copy
copyStruct(LocalStruct[FullName],Struct,AddedOffset,AddedName)
end
return
end
--print(string.format('%X',Object))
while(true)do
if not Object or Object==0 then break end
Name=GetNameAlgo(Object)
if not Name then break end
Name=Name:sub(string.find(Name,' ')+1,Name:len())
if Name=='Object' then break end
print(GetFullNameAlgo(Object))
pointer=readPointer(Object+UObject.member)
while(true)do
if not pointer or pointer==0 then break end
PropName=isUE425 and GetFullNameSafeAlgo(pointer) or GetFullNameAlgo(pointer)
if PropName and string.find(PropName,' ') then
Typ=PropName:sub(1,string.find(PropName,' ')-1)
if not string.find(Typ,'Function')then
if not isfullname then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())
else PropName=PropName:sub(string.find(PropName,' ')+1,PropName:len())end
PropName=AddedName..PropName
Off=readInteger(pointer+Offset)+AddedOffset
if Class=='UserDefinedStruct' and string.find(PropName,'_') then PropName=PropName:sub(1,string.find(PropName,'_')-1)end
if Typ=='StructProperty' then
ue4createstruct(readPointer(pointer+Property),nil,nil,isfullname,Struct,Off,PropName..'.')
if not getElementByOffset(Struct,Off) then e=Struct.addElement() e.Offset=Off e.Name=PropName e.Vartype=vtDword end
else
e=Struct.addElement()
e.Offset=Off
e.Name=PropName
if not ue4type[Typ] then e.Vartype=vtDword
else e.Vartype=ue4type[Typ]end
if Typ=='ArrayProperty' or Typ=='MapProperty' then
f=Struct.addElement() f.Offset=e.Offset+8-sub f.Name=e.Name..'_size' f.Vartype=vtDword
f=Struct.addElement() f.Offset=e.Offset+0xC-sub f.Name=e.Name..'_sizes' f.Vartype=vtDword
local isMap= Typ=='MapProperty'
Prop=readPointer(pointer+Property)
PropName=GetFullNameAlgo(Prop)
if not PropName then PropName=GetFullNameSafeAlgo(Prop)end
if PropName then
Typ=PropName:sub(1,string.find(PropName,' ')-1)
PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())
if string.find(PropName,':') then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())end
if Typ=='StructProperty' then
Prop=readPointer(Prop+Property)
PropName=GetNameAlgo(Prop)
if PropName then
PropName=PropName:sub(string.find(PropName,' ')+1,PropName:len())..'[]'
--print(Typ..' '..PropName)
end
else PropName=PropName..'[]' end
if not ArrayStruct then ArrayStruct={} end
if ArrayStruct[PropName] then e.setChildStruct(ArrayStruct[PropName])
else
local stru=createStructure(PropName)
ArrayStruct[PropName]=stru
e.setChildStruct(stru)
stru.beginUpdate()
for j=0,1 do
Prop=readPointer(pointer+Property+j*(8-sub))
PropName=GetFullNameAlgo(Prop)
if not PropName then PropName=GetFullNameSafeAlgo(Prop)end
if PropName then
Typ=PropName:sub(1,string.find(PropName,' ')-1)
--if Typ=='StructProperty' then print(PropName)end
PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())
if string.find(PropName,':') then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())end
local psize=isMap and 0x10 or readInteger(Prop+propsize)
local Offs=isMap and readInteger(Prop+Offset) or 0
local Propt
if Typ=='StructProperty' then
Propt=readPointer(Prop+Property)
end
for p=0,10 do
Off=p*psize+Offs
local ItemName=string.format('[%u] ',p)
if Typ=='StructProperty' then
ue4createstruct(Propt,nil,nil,isfullname,stru,Off,ItemName)
--if not getElementByOffset(stru,Off) then e=stru.addElement() e.Offset=Off e.Name=PropName e.Vartype=vtDword end
else
local g=stru.addElement()
g.Offset=Off
g.Name=ItemName..PropName
if not ue4type[Typ] then g.Vartype=vtDword
else g.Vartype=ue4type[Typ]end
end
end
end
end
stru.endUpdate()
fillstruct4bytes(stru)
end
end
elseif Typ=='BoolProperty' then e.ChildStructStart=readBytes(pointer+bitmask,1)end
end
end
end
pointer=readPointer(pointer+nextmember)
end
Object=readPointer(Object+super)
end
if AddedOffset>0 then return end
Struct.endUpdate()
fillstruct4bytes(Struct)
if isGlobal then StructList[#StructList+1]=Struct end
local count=#RunningStruct
for i=1,count do
if RunningStruct[i]==RunningStructName then RunningStruct[i]=nil end
if not RunningStruct[i] and RunningStruct[i+1] then RunningStruct[i]=RunningStruct[i+1] RunningStruct[i+1]=nil end
end
end
function getElementByOffset(struct,offset)
for i=0,struct.Count-1 do
if struct.Element[i].Offset==offset then return i end
end
return nil
end
function copyStruct(original,copy,AddedOffset,AddedName)
if not copy then copy=createStructure(original.Name..'_copy')end
if not AddedOffset then AddedOffset=0 end
if not AddedName then AddedName='' end
copy.beginUpdate()
for i=0,original.Count-1 do
local e=copy.addElement()
e.Offset=original.Element[i].Offset+AddedOffset
if original.Element[i].Name=='' then e.Name=original.Element[i].Name
else e.Name=AddedName..original.Element[i].Name end
e.Vartype=original.Element[i].Vartype
e.ChildStruct=original.Element[i].ChildStruct
e.ChildStructStart=original.Element[i].ChildStructStart
e.Bytesize=original.Element[i].Bytesize
end
copy.endUpdate()
return copy
end
function ue4createstructfast(fullnameortable,StructName,isGlobal,isfullname,structu,AddedOffset,AddedName,depth,callernum)
if not callernum then callernum=0 end
if not depth then depth=10 end
local depths=0
callernum=callernum+1
if callernum>10 then return end
if StructName and isGlobal then local struct=isStructExist(StructName) if struct then DeleteStruct(struct) end end
if not UEObj then enumUEObj() end
local tabl=fullnameortable
if type(fullnameortable)==type('') then
for i,v in ipairs(UEObj) do if v.FullName==fullnameortable then tabl=v break end end
end
--[[
if not tabl or type(tabl)~=type({}) then
enumUEObj()
if type(fullnameortable)==type('') then
for i,v in ipairs(UEObj) do if v.FullName==fullnameortable then tabl=v break end end
end
end
]]
if not tabl or type(tabl)~=type({}) then
print(tostring(fullnameortable)..' not found...')
return
end
local name=StructName
if not name then name=tabl.Name end
local struct=structu
if not struct then struct=createStructure(name)end
if not AddedName then AddedName='' end
local RunningStructName=name
if not AddedOffset then
if not RunningStruct then RunningStruct={} end
RunningStruct[#RunningStruct+1]=RunningStructName
AddedOffset=0 struct.beginUpdate()
elseif tabl and tabl.FullName then
if not LocalStruct then LocalStruct={}end
if LocalStruct[tabl.FullName] then copyStruct(LocalStruct[tabl.FullName],struct,AddedOffset,AddedName)
else
local copy=createStructure(tabl.FullName)
ue4createstructfast(tabl,nil,nil,isfullname,copy)
LocalStruct[tabl.FullName]=copy
copyStruct(LocalStruct[tabl.FullName],struct,AddedOffset,AddedName)
end
return
end
--print(tostring(tabl))
local isUserDefinedStruct=string.find(tabl.Type,'UserDefinedStruct')
local e,typ,propname
while(true)do
if not tabl then break end
if type(tabl)==type(1) or tabl.Name=='Object' then break end
print(tostring(tabl.Type)..' '..tostring(tabl.FullName))
if tabl.Member then
for i=1,#tabl.Member do
if tabl.Member[i].Type~='Function' then
if isfullname then e.Name=string.format('%s %s%s',tabl.Member[i].Type,AddedName,tabl.Member[i].FullName)
else
propname=AddedName..tabl.Member[i].Name
if isUserDefinedStruct then propname=propname:sub(1,string.find(propname,'_')-1) end
end
if tabl.Member[i].Type=='StructProperty' then
ue4createstructfast(tabl.Member[i].Property,nil,nil,isfullname,struct,tabl.Member[i].Offset+AddedOffset,propname..'.',depth,callernum)
if not getElementByOffset(struct,tabl.Member[i].Offset+AddedOffset) then e=struct.addElement() e.Offset=tabl.Member[i].Offset+AddedOffset e.Name=propname e.Vartype=vtDword end
else
e=struct.addElement()
e.Offset=tabl.Member[i].Offset+AddedOffset
typ=tabl.Member[i].Type
e.Name=propname
e.Vartype=ue4type[typ]
if e.Vartype==nil then e.Vartype=vtDword end
if typ=='ArrayProperty' or typ=='MapProperty' then
local isMap= Typ=='MapProperty'
local Typ=tabl.Member[i].Property[1].Type
if Typ=='StructProperty' then propname=tabl.Member[i].Property[1].Property.Name..'[]'
else propname=tabl.Member[i].Property[1].Name..'[]' end
if not ArrayStruct then ArrayStruct={} end
if ArrayStruct[propname] then e.setChildStruct(ArrayStruct[propname])
else
local stru=createStructure(propname)
stru.beginUpdate()
for p=1,#tabl.Member[i].Property do
local PropName=tabl.Member[i].Property[p].Name
local Typ=tabl.Member[i].Property[p].Type
local psize=isMap and 0x10 or tabl.Member[i].Property[p].Size
local Offs=isMap and tabl.Member[i].Property[p].Offset or 0
for l=0,10 do
Off=l*psize+Offs
local ItemName=string.format('[%u] ',l)
if Typ=='StructProperty' then
ue4createstructfast(tabl.Member[i].Property[p].Property,nil,nil,isfullname,stru,Off,ItemName,depth,callernum)
--if not getElementByOffset(stru,Off) then g=stru.addElement() g.Offset=Off g.Name=ItemName..PropName g.Vartype=vtDword end
else
g=stru.addElement()
g.Offset=Off
g.Name=ItemName..PropName
if not ue4type[Typ] then g.Vartype=vtDword
else g.Vartype=ue4type[Typ]end
end
end
end
stru.endUpdate()
if stru.Count>1 then
fillstruct4bytes(stru)
e.setChildStruct(stru)
ArrayStruct[propname]=stru
else stru:Destroy()end
end
local f=struct.addElement() f.Offset=e.Offset+8-sub f.Name=e.Name..'_size' f.Vartype=vtDword
f=struct.addElement() f.Offset=e.Offset+0xC-sub f.Name=e.Name..'_sizes' f.Vartype=vtDword
elseif typ=='BoolProperty' then e.ChildStructStart=tabl.Member[i].BitField end
end
end
end
end
depths=depths+1
if depths>depth then break end
tabl=tabl.Parent
end
if AddedName~='' then return end
struct.endUpdate()
fillstruct4bytes(struct)
if isGlobal then StructList[#StructList+1]=struct end
local count=#RunningStruct
for i=1,count do
if RunningStruct[i]==RunningStructName then RunningStruct[i]=nil end
if not RunningStruct[i] and RunningStruct[i+1] then RunningStruct[i]=RunningStruct[i+1] RunningStruct[i+1]=nil end
end
end
function uecreatestruct(instance,name,depth,isfullname)
local pointer=readPointer(instance+UObject.Class)
local classname=GetFullNameAlgo(pointer)
if not classname then print('instance is invalid') return end
if classname:find(' ') then classname=classname:sub(classname:find(' ')+1) end
print(string.format("createThread(ue4createstruct(\'%s\',\'%s\',0))",classname,name))
ue4createstruct(pointer,name,depth,isfullname)
end
function ue_structureDissectOverrideCallback(Struct, Instance)
--print('banana2')
local name,fullname,class
address,name,fullname,class=ue_findRealStartOfObject(Instance)
if class then
-- print('banana3')
--if UEObj and (not enumUEObjIsRunning or enumUEObjIsUpdateOnly) then ue4createstructfast(fullname,nil,nil,nil,Struct) end
SaveAndRemoveStruct()
ue4createstruct(class,nil,nil,nil,Struct)
LoadStruct()
if Struct.Count>1 then return true
else return false end
end
--ue_fillstruct(readPointer(Instance+UObject.Class),structure)
--print('banana4')
return nil
end
function ue_structureNameLookupCallback(address)
--print('banana1')
local name,fullname
address,name,fullname=ue_findRealStartOfObject(address)
if name then return name,address end
return nil
end
function ue_SymbolLookupCallback(symbol)
--print('banana1')
local str='Function '
if string.find(symbol,str) then
symbol=symbol:sub(string.find(symbol,str)+str:len(),symbol:len())
local pointer=StaticFindObjectAlgo(symbol)
if pointer then return readPointer(pointer+UObject.funct)end
end
return nil
end
function ue_findRealStartOfObject(address)
local pointer=readPointer(address+UObject.Class)
if pointer then
local FullName=GetFullNameAlgo(pointer)
if FullName then
local Name=GetNameAlgo(pointer)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
Name=Name:sub(string.find(Name,' ')+1,Name:len())
return address,Name,FullName,pointer
end
end
if UEObj and (not enumUEObjIsRunning or enumUEObjIsUpdateOnly) then
for i=1,#UEObj do
if UEObj[i].MemberSize and UEObj[i].Class and UEObj[i].Class.MemberSize and UEObj[i].Class.MemberSize>0 and not string.find(UEObj[i].Class.FullName,'/Script/CoreUObject.') then
if address>=UEObj[i].Address and address<UEObj[i].Address+UEObj[i].Class.MemberSize then
local name
return UEObj[i].Address,UEObj[i].Class.Name,UEObj[i].Class.FullName,UEObj[i].Class.Address
end
end
end
end
return address
end
function enumUEObjT(file,size,i,start,stop)
local datatable,Address,FName,Name,FullName,typ,typ1,isProperty,l,pointer,stri,num,isPropertyc,EObj,k=0
local Class,ObjectId,super,Offset,nextmember,member,propsize,bitmask,Property,Outer=UObject.Class,UObject.ObjectId,UObject.super,UObject.Offset,UObject.nextmember,UObject.member,UObject.propsize,UObject.bitmask,UObject.Property,UObject.Outer
local UEver=UE4ver
local pointersize= targetIs64Bit() and 8 or 4
for j=start,stop do
if UE4ver<11 and targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x8+m] then break end
datatable[m]=GUObjectDict[i][j*0x8+m]
end
Address=byteTableToQword(datatable)
elseif UE4ver<11 then
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x4+m] then break end
datatable[m]=GUObjectDict[i][j*0x4+m]
end
Address=byteTableToDword(datatable)
elseif targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x18+m] then break end
datatable[m]=GUObjectDict[i][j*0x18+m]
end
Address=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x10+m] then break end
datatable[m]=GUObjectDict[i][j*0x10+m]
end
Address=byteTableToDword(datatable)
end
if Address and Address~=0 then
objid=readInteger(Address+ObjectId)
if objid then
if objid<size then
FullName=GetFullNameAlgo(Address)
if FullName then
isProperty=false
typ1=FullName:sub(1,string.find(FullName,' ')-1)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len()) isProperty=true
elseif string.find(FullName,'%.') then Name=FullName:sub(string.find(FullName,'%.')+1,FullName:len())
else Name=FullName end
if UEObjIndex[FullName] and UEObj[UEObjIndex[FullName]] then UEObj[UEObjIndex[FullName]].Address=Address
else
EObj={}
EObj.Address=Address
EObj.Id=objid
EObj.Class=temp[readPointer(Address+Class)]
EObj.Type=typ1
EObj.FullName=FullName
EObj.Name=Name
if isProperty then
isProperty=readPointer(Address+Outer)
if isProperty and isProperty~=0 then
EObj.Outer=isProperty
EObj.Size=readInteger(Address+propsize)
EObj.Offset=readInteger(Address+Offset)
if typ1=='BoolProperty' then EObj.BitField=readBytes(Address+bitmask,1)
elseif typ1=='StructProperty' or typ1=='ObjectProperty' then EObj.Property=readPointer(Address+Property)
elseif typ1=='MapProperty' or typ1=='ArrayProperty' then
EObj.Property={}
local count= typ1=='MapProperty' and 1 or 0
for p=0,count do
local prop=readPointer(Address+Property+p*8)
FullName=GetFullNameAlgo(prop)
if not FullName then FullName=GetFullNameSafeAlgo(prop)end
if FullName then
typ=FullName:sub(1,string.find(FullName,' ')-1)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len())
else Name=FullName end
if string.find(Name,'%:') then Name=Name:sub(string.find(Name,'%:')+1,Name:len())end
local Prop={}
Prop.Address=prop
Prop.Type=typ
Prop.FullName=FullName
Prop.Name=Name
Prop.Size=readInteger(prop+propsize)
Prop.Offset=readInteger(prop+Offset)
if typ=='BoolProperty' then Prop.BitField=readBytes(prop+bitmask,1)
elseif typ=='StructProperty' or typ=='ObjectProperty' then Prop.Property=readPointer(prop+Property)end
EObj.Property[p+1]=Prop
end
end
end
else print(FullName..' nil outer')
end
end
Parent=readPointer(Address+super)
if Parent and Parent~=0 then EObj.Parent=Parent end
temp[Address]=EObj
if UEver>=25 then
k=1
EObj.MemberSize=readInteger(Address+member+pointersize)
Address=readPointer(Address+member)
EObj.Member={}
while(true)do
if UEver>=25 then FullName=GetFullNameSafeAlgo(Address)
else FullName=GetFullNameAlgo(Address) end
if not FullName then break end
typ=FullName:sub(1,string.find(FullName,' ')-1)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len())
else Name=FullName end
EObj.Member[k]={}
EObj.Member[k].Address=Address
EObj.Member[k].Type=typ
EObj.Member[k].FullName=FullName
EObj.Member[k].Name=Name
EObj.Member[k].Size=readInteger(Address+propsize)
EObj.Member[k].Offset=readInteger(Address+Offset)
if typ=='BoolProperty' then EObj.Member[k].BitField=readBytes(Address+bitmask,1)
elseif typ=='StructProperty' or typ=='ObjectProperty' then EObj.Member[k].Property=readPointer(Address+Property)
elseif typ=='MapProperty' or typ=='ArrayProperty' then
EObj.Member[k].Property={}
for p=0,1 do
local prop=readPointer(Address+Property+p*8)
FullName=GetFullNameAlgo(prop)
if not FullName then FullName=GetFullNameSafeAlgo(prop)end
if FullName then
typ=FullName:sub(1,string.find(FullName,' ')-1)
FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len())
if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len())
else Name=FullName end
if string.find(Name,'%:') then Name=Name:sub(string.find(Name,'%:')+1,Name:len())end
local Prop={}
Prop.Address=prop
Prop.Type=typ
Prop.FullName=FullName
Prop.Name=Name
Prop.Size=readInteger(prop+propsize)
Prop.Offset=readInteger(prop+Offset)
if typ=='BoolProperty' then Prop.BitField=readBytes(prop+bitmask,1)
elseif typ=='StructProperty' or typ=='ObjectProperty' then local propt=readPointer(prop+Property) if propt then Prop.Property=propt end end
EObj.Member[k].Property[p+1]=Prop
end
end
if #EObj.Member[k].Property==0 then EObj.Member[k].Property=nil end
end
Address=readPointer(Address+nextmember)
k=k+1
end
if #EObj.Member==0 then EObj.Member=nil end
end
UEObj[#UEObj+1]=EObj
UEObjIndex[EObj.FullName]=#UEObj+1
end
end
end
end
end
end
--print(i..':'..k)
end
function enumUEObj(isSilent,isUpdateOnly)
if isUpdateOnly then enumUEObjIsUpdateOnly=true end
enumUEObjIsRunning=true
local sub=targetIs64Bit() and 0 or 4
ue4parsetablecheck()
local count=0x200
local size=GUObjectsize
local sizess= targetIs64Bit() and (UE4ver>11 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count)
local starttime=os.time()
if not isUpdateOnly then
UEObj={}
UEObjIndex={}
end
temp={}
for i=1,#GUObjectDict do
local num,start,stop=count,0,0
for j=0,math.floor(#GUObjectDict[i]/sizess+0.5) do
start=stop
stop=stop+num
createThread(enumUEObjT(file,size,i,start,stop-1))
end
end
if not isUpdateOnly then
if UE4ver>=25 then
for i=1,#UEObj do
if UEObj[i].Parent then
if temp[UEObj[i].Parent] then
UEObj[i].Parent=temp[UEObj[i].Parent]
end
end
if UEObj[i].Member then
for j=1,#UEObj[i].Member do
if UEObj[i].Member[j].Property then
if temp[UEObj[i].Member[j].Property] then
UEObj[i].Member[j].Property=temp[UEObj[i].Member[j].Property]
elseif type(UEObj[i].Member[j].Property)==type({}) then
for p=1,#UEObj[i].Member[j].Property do
if temp[UEObj[i].Member[j].Property[p].Property] then
UEObj[i].Member[j].Property[p].Property=temp[UEObj[i].Member[j].Property[p].Property]
elseif UEObj[i].Member[j].Property[p].Property then print(string.format('%X no object?',UEObj[i].Member[j].Property[p].Property))
elseif UEObj[i].Member[j].Property[p].Type=='StructProperty' or UEObj[i].Member[j].Property[p].Type=='ObjectProperty' then print(string.format('%s %s no property?',UEObj[i].Member[j].Property[p].Type,UEObj[i].Member[j].Property[p].FullName))
end
end
end
end
end
end
end
else
for i=1,#UEObj do
if UEObj[i].Parent then
if temp[UEObj[i].Parent] then
UEObj[i].Parent=temp[UEObj[i].Parent]
end
end
if UEObj[i].Outer then
if temp[UEObj[i].Outer]then
if temp[UEObj[i].Property] then
UEObj[i].Property=temp[UEObj[i].Property]
elseif type(UEObj[i].Property)==type({}) then
for p=1,#UEObj[i].Property do
if temp[UEObj[i].Property[p].Property] then
UEObj[i].Property[p].Property=temp[UEObj[i].Property[p].Property]
else print(string.format('%X no object?',UEObj[i].Property[p].Property))
end
end
end
if not temp[UEObj[i].Outer].Member then temp[UEObj[i].Outer].Member={}end
temp[UEObj[i].Outer].Member[#temp[UEObj[i].Outer].Member+1]=UEObj[i]
else print(UEObj[i].FullName..' missing outer') end
end
end
end
end
temp=nil
enumUEObjIsUpdateOnly=false
enumUEObjIsRunning=false
if not isSilent then print(string.format('\nA Total of %u objects had been enumerated in %u seconds',#UEObj,os.time()-starttime))end
end
function findOpcodes(address,opcode,size)
if not size then size=0x50 end
address=getAddressSafe(address)
if not address then return nil end
local addr={}
local i=0
local j=1
while(i<size) do
local ext, opc, byt, add=splitDisassembledString(disassemble(address+i))
if string.find(opc,opcode) then
addr[j]=address+i
j=j+1
end
i=i+getInstructionSize(address+i)
end
return addr
end
--local ext, opc, byt, add=splitDisassembledString(disassemble(findOpcodes('/Script/Astro.PrinterComponent:UpdatePreprinting_exec','call')[1]))
--return opc:sub(string.find(opc,' ')+1,opc:len())
function groupscan(value,modulename,stopaddress)
local ms = createMemScan()
if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end
ms.firstScan(soExactValue,vtGrouped,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function pointerscan(value,modulename,stopaddress)
local ms = createMemScan()
if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end
ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function UEfindInstancesOfClass(fullnameOrAddress)
local class,address=UObject.Class
if type(fullnameOrAddress)==type('')then address=StaticFindObjectAlgo(fullnameOrAddress)
else address=fullnameOrAddress end
local fname=readInteger(address+UObject.FNameIndex)
local result=groupscan(string.format('%u:%u 4:%u',targetIs64Bit() and 8 or 4,address,fname))
for i,v in ipairs(result) do result[i]=tonumber(v,16)-class end
return result
end
function StructAddToListSymbol(StructName,StartOffset,StopOffset,BaseAddress,OffsetOnly)
if not StartOffset then StartOffset=0 end
if not StopOffset then StopOffset=0xFFFFFF end
local structCount=getStructureCount()
local struct
for i=0,structCount-1 do
local stru=getStructure(i)
if stru.Name==StructName then struct=stru break end
end
if struct then
for i=0,struct.Count-1 do
local e=struct.Element[i]
if e.Offset>=StartOffset and e.Offset<=StopOffset then
local rec=getAddressList().createMemoryRecord()
rec.setDescription(e.Name)
if OffsetOnly then
if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.Offset[0]=e.Offset
else rec.setAddress(string.format('+%X',e.Offset))end
else
if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.OffsetText[0]=StructName..'.'..e.Name
else rec.setAddress(string.format('+%s.%s',StructName,e.Name))end
end
rec.Type=e.Vartype
end
end
end
end
function getInsForJump(address,registername,destination,allocsize,SharedMemoryName)
address = getAddressSafe(address)
if not address then error('getInsForJump address nil') return end
if not allocsize then allocsize=4096 end
destination=getAddressSafe(destination)
if not destination then
if not SharedMemoryName then destination = allocateMemory(allocsize,address)
else destination = allocateSharedMemory(SharedMemoryName,allocsize) end
end
local size = (address+5-destination>0x7FFFFFFF) and 14 or 5
if registername then
unregisterSymbol(registername)
registerSymbol(registername,destination,true)
end
local opcodes = {}
local i = 0
while(i<size) do
local ext, opc=splitDisassembledString(disassemble(address+i))
opcodes[#opcodes+1] = opc
i=i+getInstructionSize(address+i)
end
local copy = table.concat(opcodes,'\r\n')
local readAsTable = true
local byt = readBytes(address,i,readAsTable)
for j=1,#byt do byt[j] = ('%02X'):format(byt[j]) end
local bytes = table.concat(byt, ' ')
return i,copy,bytes,size,destination
end
function enablescript(name,registername,addressname,script,disable)
local address=getAddress(addressname)
if disable then script=(script):format(address,registername,readBytes(registername,1))
else
local i,copy,bytes,size =getInsForJump(address,name)
script=(script):format(registername, registername, name, copy, registername, i, bytes, address)..string.rep('nop\n',i-size)..'returnhere:'
end
local success,erro=autoAssembleCheck(script)
if not success then print('\n'..erro..'\n')local scriptstr=createStringlist()scriptstr.Text=script for j=0,scriptstr.Count-1 do print(string.format('%u\t%s',j+1,scriptstr[j])) end
if not disable then deAlloc(name)unregisterSymbol(name)end error(name..' autoAssemble failed')end
autoAssemble(script)
if disable then deAlloc(name)unregisterSymbol(name)unregisterSymbol(registername)end
end
function cycleFullCompact(sender,force)
local state = not(compactmenuitem.Caption == 'Compact View Mode')
if force~=nil
then state = not force
end
compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = state
getMainForm().Panel4.Visible = state
getMainForm().Panel5.Visible = state
end
function addCompactMenu()
if compactmenualreadyexists
then return end
local parent = getMainForm().Menu.Items
compactmenuitem = createMenuItem(parent)
parent.add(compactmenuitem)
compactmenuitem.Caption = 'Compact View Mode'
compactmenuitem.OnClick = cycleFullCompact
compactmenualreadyexists = 'yes'
end
addCompactMenu()
--cycleFullCompact(nil,true)
if syntaxcheck then return end
[ENABLE]
if not process or not enumModules()[1] then print('Error: No process selected...') error('process is nil') end
local starttime=os.time()
ue4versioncheck()
if targetIs64Bit() then
local address=findAddress('GUObjectArray',0,'44 8B * * * 48 8D 05 * * * * * * * * * 48 89 71 10banana',process,nil,0,true)[1]
if not address then address=findAddress('GUObjectArray',0,'40 53 48 83 EC 20 48 8B D9 48 85 D2 74 * 8Bbanana',process,nil,0,true)[1]end
if not address then address=findAddress('GUObjectArray',0,'4C 8B 05 * * * * 45 3B 88banana',process,nil,0,true)[1]end
if not address then error('GUObjectArray aob not found...')end
findAddress('GUObjectArray',1,address)
ue4config()
if UE4ver>=23 then
address=findAddress('FNamePool',0,'4C 8D 05 * * * * EB 16 48 8D 0D * * * * E8banana',process,nil,0,true)[1]
if not address then address=findAddress('FNamePool',0,'48 8D 0D * * * * E8 * * * * 4C 8B C0 C6banana',process,nil,0,true)[1]end
if address then findAddress('FNamePool',1,address)
else error('FNamePool aob not found...')end
else
address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[2]
if not address then address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[1] end
if address then findAddress('FNamePool',1,address)
else findAddress('FNamePool',1,'C3 * DB 48 89 1D * * * * * * 48 8B 5C 24 20banana',process,nil,2)end
end
local address=findAddress('GEngine',0,'41 B8 01 00 00 00 * * * 48 8B 0D * * * * E8 * * * * 48 85 C0banana',process,nil,0,true)[1]
if not address then address=findAddress('GEngine',0,'48 8B 1D * * * * 48 85 DB 74 * 48 8Dbanana',process,nil,0,true)[1]end
if not address then error('GEngine aob not found...')end
findAddress('GEngine',1,address)
--findAddress('GEngine',1,'41 B8 01 00 00 00 * * * 48 8B 0D * * * * E8 * * * * 48 85 C0banana',process)
else
ue4config()
if UE4ver>2 then
findAddress('GEngine',1,'56 8B 35 * * * * 85 F6 74banana',process)
findAddress('GUObjectArray',1,'8B 44 24 04 56 8B F1 85 C0 74 17 8B 40 08banana',process)
findAddress('FNamePool',1,'33 F6 89 35 * * * * 8B C6 5Ebanana',process,nil,1,nil,true,true)
else
findAddress('GEngine',1,'56 8B 35 * * * * 85 F6 74banana',process)
findAddress('FNamePool',1,'8B 07 8B 0D * * * * 8B 04 81banana',process)
findAddress('GUObjectArray',1,'8B 15 * * * * 8B 04 82 85banana',process)
end
end
print('AOBScan done : '..os.time()-starttime)
ue4parsetable()
--findAddress('GWorld',1,'4D 8B 94 24 50 0C 00 00banana',process)
FNameStringAlgo(1,true)
print('Table parsing done : '..os.time()-starttime)
if UE4ver>2 then
-- createThread(function()
SaveAndRemoveStruct()
createThread(ue4createstruct('/Script/Engine.GameEngine','GameEngine',1))
createThread(ue4createstruct('/Script/Engine.GameViewportClient','GameViewportClient',0))
createThread(ue4createstruct('/Script/Engine.GameInstance','GameInstance',0))
createThread(ue4createstruct('/Script/Engine.LocalPlayer','LocalPlayer',1))
createThread(ue4createstruct('/Script/Engine.PlayerController','PlayerController',2))
createThread(ue4createstruct('/Script/Engine.CharacterMovementComponent','MovementComponent',0))
createThread(ue4createstruct('/Script/Engine.CapsuleComponent','CapsuleComponent',3))
createThread(ue4createstruct('/Script/Engine.Character','GPlayer',0))
createThread(ue4createstruct('/Script/Engine.World','World',0))
local RunningStructCounter=0
while(true)do
if #RunningStruct==0 then break
else sleep(1)end
RunningStructCounter=RunningStructCounter+1
if RunningStructCounter>180000 then break end
end
LoadStruct()
-- end)
end
print('All done : '..os.time()-starttime..'\n')
if not ue_SymbolLookupCallbackID then
ue_SymbolLookupCallbackID=registerSymbolLookupCallback(ue_SymbolLookupCallback,slNotSymbol)
end
--registerFuncAlgo()
GetLuaEngine().close()
[DISABLE]
--cycleFullCompact(nil,false)
unregisterSymbolLookupCallback(ue_SymbolLookupCallbackID)
ue_SymbolLookupCallbackID=nil
unregisterSymbol('GEngine')
unregisterSymbol('GUObjectArray')
unregisterSymbol('FNamePool')
26124
"Enable ue_structureDissectCallback (Experimental)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
if not ue_structureDissectOverrideCallbackID then
ue_structureDissectOverrideCallbackID=registerStructureDissectOverride(ue_structureDissectOverrideCallback)
end
if not ue_structureNameLookupCallbackID then
ue_structureNameLookupCallbackID=registerStructureNameLookup(ue_structureNameLookupCallback)
end
UEObjt=createThread(function()
while(true)do
if not UEObj and not enumUEObjIsRunning then enumUEObj(1)
elseif not enumUEObjIsRunning then enumUEObj(1,1)end
sleep(30000)
end
end)
[DISABLE]
unregisterStructureDissectOverride(ue_structureDissectOverrideCallbackID)
unregisterStructureNameLookup(ue_structureNameLookupCallbackID)
ue_structureDissectOverrideCallbackID=nil
ue_structureNameLookupCallbackID=nil
UEObjt:terminate()
26125
"Basic UE Object Dumper Algo"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local Offset,ObjectId,nextmember,member,enumMul,Property=UObject.Offset,UObject.ObjectId,UObject.nextmember,UObject.member,UObject.enumMul,UObject.Property
function ue4dump(file,address,size,i,start,stop)
local k=0
local addy= targetIs64Bit() and 8 or 4
local en= targetIs64Bit() and 0x40 or 0x2C
local pointer,datatable,pointers,propname,offset,list,str,strid,name,objid
for j=start,stop do
if UE4ver<11 and targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x8+m] then break end
datatable[m]=GUObjectDict[i][j*0x8+m]
end
pointer=byteTableToQword(datatable)
elseif UE4ver<11 then
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x4+m] then break end
datatable[m]=GUObjectDict[i][j*0x4+m]
end
pointer=byteTableToDword(datatable)
elseif targetIs64Bit() then
datatable={}
for m=1,8 do
if not GUObjectDict[i][j*0x18+m] then break end
datatable[m]=GUObjectDict[i][j*0x18+m]
end
pointer=byteTableToQword(datatable)
else
datatable={}
for m=1,4 do
if not GUObjectDict[i][j*0x10+m] then break end
datatable[m]=GUObjectDict[i][j*0x10+m]
end
pointer=byteTableToDword(datatable)
end
if pointer and pointer~=0 then
local objid=readInteger(pointer+ObjectId)
if objid then
if objid<size then
str=string.format('%016X',pointer)
strid=string.format('%08u',objid)
name=GetFullNameSuperAlgo(pointer,true)
if name then
typ=name:sub(1,string.find(name,' ')-1)
if string.find(typ,'Property') then
if (typ=='StructProperty' or string.find(typ,'ObjectProperty') or string.find(typ,'ArrayProperty') ) and Property then
name=hasProperty(pointer)
end
strid=string.format('%8X',readInteger(pointer+Offset))
end
file:write(string.format('[%s] %s %s\n',strid,str,name))
if (typ=='UserDefinedEnum' or typ=='Enum') and enumMul then
list=pointer+en
for i=0,readInteger(list+8)-1 do
pointers=readPointer(list)+i*enumMul
offset=readBytes(pointers+addy,1)
if offset==0 then offset=i end
propname=FNameStringAlgo(pointers)
strid=string.format('%8X',offset)
str=string.format('%016X',pointers)
file:write(string.format('[%s] %s %s\n',strid,str,propname))
end
elseif ( typ=='MapProperty' or string.find(typ,'ArrayProperty') ) and Property then
for n=0,1 do
pointers=readPointer(pointer+n*8+Property)
propname=hasProperty(pointers)
if propname then
offset=readInteger(pointers+Offset)
strid=string.format('%8X',offset)
str=string.format('%016X',pointers)
file:write(string.format('[%s] %s %s\n',strid,str,propname))
end
end
end
if UE4ver>=25 then
local pointers= readPointer(pointer+member)
while(true)do
propname=GetFullNameSafeAlgo(pointers)
if not propname then break end
offset=readInteger(pointers+Offset)
strid=string.format('%8X',offset)
str=string.format('%016X',pointers)
typ=propname:sub(1,string.find(propname,' ')-1)
if typ=='StructProperty' or string.find(typ,'ObjectProperty') or string.find(typ,'ArrayProperty') then
propname=hasProperty(pointers)
end
file:write(string.format('[%s] %s %s\n',strid,str,propname))
if typ=='MapProperty' or string.find(typ,'ArrayProperty') then
for n=0,2 do
pointer=readPointer(pointers+n*8+Property)
propname=hasProperty(pointer)
if propname then
offset=readInteger(pointer+Offset)
strid=string.format('%8X',offset)
str=string.format('%016X',pointer)
file:write(string.format('[%s] %s %s\n',strid,str,propname))
end
end
end
pointers=readPointer(pointers+nextmember)
end
end
k=k+1
end
end
end
end
end
totalobject=totalobject+k
--print(i..':'..k)
end
local sub=targetIs64Bit() and 0 or 4
ue4parsetablecheck()
local count=0x200
local size=GUObjectsize
local sizess= targetIs64Bit() and (UE4ver>11 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count)
local starttime=os.time()
local Path = 'C:\\test\\'
local filename= string.format('[%s] ObjectsDump.txt',process)
local file,err = io.open(Path..filename, 'w')
assert(file,err)
file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date()))
--local re={rei1,rei2,rei3,rei4,rei5}
totalobject=0
--allobject=createStringlist()
for i=1,#GUObjectDict do
local num,start,stop=count,0,0
for j=0,math.floor(#GUObjectDict[i]/sizess+0.5) do
start=stop
stop=stop+num
createThread(ue4dump(file,GUObjectDict[i],size,i,start,stop-1))
end
end
file:close()
print(string.format('\nA Total of %u objects had been dumped in %u seconds',totalobject,os.time()-starttime))
print(Path..filename)
[DISABLE]
26126
"Basic UE Name Dumper Algo"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function uenamedump(file,start,stop)
for i=start,stop do
local name=FNameStringAlgo(i,true)
if name and name:len()<200 and name:len()>3 and not string.find(name,'%c') then
--print(name)
local strid=string.format('%08X',i)
file:write(string.format('[%s] %s\n',strid,name))
totalname=totalname+1
end
end
end
local size
if UE4ver>=23 then size=(#FNameDict<<0x10)-1
elseif UE4ver>2 then size=(#FNameDict<<0xE)-1
else size=math.floor(#FNameDict[1]/4) end
local count=0x200
size=math.floor((size/count)+0.5)
local starttime=os.time()
local Path = 'C:\\test\\'
local filename= string.format('[%s] NamesDump.txt',process)
local file,err = io.open(Path..filename, 'w')
assert(file,err)
file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date()))
totalname=0
ue4parsetablecheck()
local num,start,stop=count,0,0
for i=0,size do
start=stop
stop=stop+num
createThread(uenamedump(file,start,stop-1))
end
file:close()
print(string.format('\nA Total of %u names had been dumped in %u seconds',totalname,os.time()-starttime))
print(Path..filename)
[DISABLE]
26127
"NoClip & Fly Numpad6 :Toggle, Space :Up, LeftCtrl :Down"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bActorEnableCollision')
if address then
local bActorEnableCollision=readBytes(address,1) & ~ ChildStructStart('PlayerController','bActorEnableCollision')
writeBytes(address,bActorEnableCollision)
end
--[[
Enum /Script/Engine.EMovementMode
0:MOVE_None
1:MOVE_Walking
2:MOVE_NavWalking
3:MOVE_Falling
4:MOVE_Swimming
5:MOVE_Flying
6:MOVE_Custom
7:MOVE_MAX
local list=+0x40
for i=0,readInteger(list+8)-1 do
local pointer=readPointer(list)+i*0x10
local enum=readInteger(pointer+8)
local name=FNameString(pointer)
print(enum..':'..name)
end
]]
if not RelativeLocationZoffset then
local address=getAddress('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]')
local value=readInteger(address+getAddress('CapsuleComponent.RelativeLocation.Z'))
local list=groupscan(string.format('4:%u',value),address,address+0x1000)
RelativeLocationZoffset={}
for i=1,#list do
RelativeLocationZoffset[i]=getAddress(list[i])-address
end
end
updown = createTimer()
updown.Interval = 5
updown.OnTimer = function(t)
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]')
if address then
if isKeyPressed(VK_SPACE) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])+20)
end
end
if isKeyPressed(VK_LCONTROL) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])-20)
end
end
end
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MovementMode')
if address then
writeBytes(address,5)
end
end
[DISABLE]
updown.destroy()
local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bActorEnableCollision')
if address then
local bActorEnableCollision=readBytes(address,1) | ChildStructStart('PlayerController','bActorEnableCollision')
writeBytes(address,bActorEnableCollision)
end
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MovementMode')
if address then
writeBytes(address,1)
end
Toggle Activation
102
0
26128
"WASD"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
wasd = createTimer()
wasd.Interval = 5
wasd.OnTimer = function(t)
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]')
if address then
if isKeyPressed(VK_S) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)+20)
end
end
if isKeyPressed(VK_W) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)-20)
end
end
if isKeyPressed(VK_A) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)+20)
end
end
if isKeyPressed(VK_D) then
for i=1,#RelativeLocationZoffset do
writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)-20)
end
end
end
end
[DISABLE]
wasd.destroy()
26129
"bCanBeDamaged false (Godmode) Numpad4 :Deactive, Numpad5 :Active"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
--CanBeDamaged = createTimer()
--CanBeDamaged.setInterval(1000)
--CanBeDamaged.OnTimer = function()
local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bCanBeDamaged')
if address then
local bCanBeDamaged=readBytes(address,1) & ~ ChildStructStart('PlayerController','bCanBeDamaged')
writeBytes(address,bCanBeDamaged)
end
--end
[DISABLE]
--CanBeDamaged.destroy()
local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bCanBeDamaged')
if address then
local bCanBeDamaged=readBytes(address,1) | ChildStructStart('PlayerController','bCanBeDamaged')
writeBytes(address,bCanBeDamaged)
end
Activate
101
0
Deactivate
100
1
26130
"Jump Multiplier Numpad0 :Deactive, Numpad1 :Active & Increase"
Auto Assembler Script
{$lua}
jumpmultiplier=1
if syntaxcheck then return end
if not jumpdefault then jumpdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity')end
if not MaxAccelerationdefault then MaxAccelerationdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration')end
if not AirControldefault then AirControldefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl')end
[ENABLE]
jumpmuti=createHotkey(function()jumpmultiplier=jumpmultiplier+0.5 end,VK_NUMPAD1)
jump = createTimer()
jump.setInterval(1000)
jump.OnTimer = function()
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity')
local address2=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration')
local address3=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl')
if address then writeFloat(address,jumpdefault*jumpmultiplier)
writeFloat(address2,MaxAccelerationdefault*jumpmultiplier)
writeFloat(address3,AirControldefault*jumpmultiplier)
end
end
[DISABLE]
jump.destroy()
jumpmuti.destroy()
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity')
local address2=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration')
local address3=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl')
if address then writeFloat(address,jumpdefault)
writeFloat(address2,MaxAccelerationdefault)
writeFloat(address3,AirControldefault)
end
Activate
97
0
Deactivate
96
1
26131
"WalkSpeed Multiplier Numpad2 :Deactive, Numpad3 :Active & Increase"
Auto Assembler Script
{$lua}
walkmultiplier=1
if syntaxcheck then return end
if not walkdefault then walkdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed')end
[ENABLE]
walkpmuti=createHotkey(function() walkmultiplier=walkmultiplier+0.5 end,VK_NUMPAD3)
walk = createTimer()
walk.setInterval(1000)
walk.OnTimer = function()
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed')
if address then writeFloat(address,walkdefault*walkmultiplier)end
end
[DISABLE]
walk.destroy()
walkpmuti.destroy()
local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed')
if address then writeFloat(address,walkdefault)end
Activate
99
0
Deactivate
98
1
26132
"UWorld"
0
1
GEngine
0
GameViewportClient.World
GameEngine.GameViewport
26133
"Player"
1
GEngine
0
PlayerController.Character
LocalPlayer.PlayerController
0
GameInstance.LocalPlayers
GameEngine.GameInstance
26134
"CharacterMovement"
0
1
+GPlayer.CharacterMovement
0
26135
"JumpZVelocity"
Float
+MovementComponent.JumpZVelocity
26136
"MaxWalkSpeed"
Float
+MovementComponent.MaxWalkSpeed
26137
"MaxWalkSpeedCrouched"
Float
+MovementComponent.MaxWalkSpeedCrouched
26138
"MaxAcceleration"
Float
+MovementComponent.MaxAcceleration
26139
"Tools"
1
26140
"FNamePool scanner"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function stringscan(value,modulename,stopaddress,isUnicode)
local ms = createMemScan()
if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end
ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
function pointerscan(value,modulename,stopaddress)
local ms = createMemScan()
if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end
ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)
ms.waitTillDone()
local f = createFoundList(ms)
f.initialize()
ms.destroy()
local result={}
for i=0,f.Count-1 do result[i+1]=f[i] end
f.destroy()
return result
end
createThread(function()
print('------------------')
local isUnicode=true
local strlist,result,result2,result3=stringscan('ByteProperty',nil,nil,isUnicode)
for i=1,#strlist do
result=stringscan('IntProperty',getAddressSafe(strlist[i]),getAddressSafe(strlist[i]..'+50'),isUnicode)
if #result>0 then
result=stringscan('None',getAddressSafe(strlist[i]..'-50'),getAddressSafe(strlist[i]),isUnicode)
print(strlist[i])
if #result>0 then
if string.sub(strlist[i],strlist[i]:len()-3,strlist[i]:len()-2)=='00' then
result=pointerscan(getAddressSafe(string.sub(strlist[i],1,strlist[i]:len()-2)..'00'))
for j=1,#result do
print(strlist[i]..'<-'..result[j])
if string.sub(result[j],result[j]:len()-1,result[j]:len())=='00' then
result2=pointerscan(getAddressSafe(result[j]))
for k=1,#result2 do
print(strlist[i]..'<-'..result[j]..'<-'..result2[k])
result3=pointerscan(getAddressSafe(result2[k]),getAddress(process),getAddress(process)+getModuleSize(process))
for l=1,#result3 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l]) end
end
end
end
end
end
end
end
print('done')
end)
[DISABLE]
26141
"DissectCode (Memory View -> Ctrl+J or (Tools -> Dissect code) )"
1
26142
"Save DissectCode"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1))
getDissectCode().saveToFile(path)
--getDissectCode().loadFromFile(path)
[DISABLE]
26143
"Load DissectCode"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1))
--getDissectCode().saveToFile(path)
getDissectCode().loadFromFile(path)
[DISABLE]