26113 "RuleNo1" 1 26111 "Player" Auto Assembler Script [ENABLE] aobscanmodule(INJECT_Playerbase,RuleNo1-Win64-Shipping.exe,4C 8B 0F 4C 8D 44 24 40 48 8B D0) // should be unique alloc(newmem,$1000,INJECT_Playerbase) registersymbol(playerbase) label(playerbase) label(code) label(return) newmem: code: mov [playerbase],rdi mov r9,[rdi] lea r8,[rsp+40] jmp return playerbase: dq INJECT_Playerbase: jmp newmem nop 3 return: registersymbol(INJECT_Playerbase) [DISABLE] INJECT_Playerbase: db 4C 8B 0F 4C 8D 44 24 40 unregistersymbol(playerbase) unregistersymbol(INJECT_Playerbase) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: RuleNo1-Win64-Shipping.exe+2CDEAB7 RuleNo1-Win64-Shipping.exe+2CDEA92: 84 C0 - test al,al RuleNo1-Win64-Shipping.exe+2CDEA94: 74 36 - je RuleNo1-Win64-Shipping.exe+2CDEACC RuleNo1-Win64-Shipping.exe+2CDEA96: 48 8B 5E 10 - mov rbx,[rsi+10] RuleNo1-Win64-Shipping.exe+2CDEA9A: 48 8B CB - mov rcx,rbx RuleNo1-Win64-Shipping.exe+2CDEA9D: F3 0F 11 74 24 40 - movss [rsp+40],xmm6 RuleNo1-Win64-Shipping.exe+2CDEAA3: E8 78 36 78 FE - call RuleNo1-Win64-Shipping.exe+1462120 RuleNo1-Win64-Shipping.exe+2CDEAA8: 48 8B 53 08 - mov rdx,[rbx+08] RuleNo1-Win64-Shipping.exe+2CDEAAC: 48 8B C8 - mov rcx,rax RuleNo1-Win64-Shipping.exe+2CDEAAF: 48 8B F8 - mov rdi,rax RuleNo1-Win64-Shipping.exe+2CDEAB2: E8 49 87 76 FE - call RuleNo1-Win64-Shipping.exe+1447200 // ---------- INJECTING HERE ---------- RuleNo1-Win64-Shipping.exe+2CDEAB7: 4C 8B 0F - mov r9,[rdi] // ---------- DONE INJECTING ---------- RuleNo1-Win64-Shipping.exe+2CDEABA: 4C 8D 44 24 40 - lea r8,[rsp+40] RuleNo1-Win64-Shipping.exe+2CDEABF: 48 8B D0 - mov rdx,rax RuleNo1-Win64-Shipping.exe+2CDEAC2: 48 8B CF - mov rcx,rdi RuleNo1-Win64-Shipping.exe+2CDEAC5: 41 FF 91 18 02 00 00 - call qword ptr [r9+00000218] RuleNo1-Win64-Shipping.exe+2CDEACC: 48 83 C6 28 - add rsi,28 RuleNo1-Win64-Shipping.exe+2CDEAD0: 49 3B F6 - cmp rsi,r14 RuleNo1-Win64-Shipping.exe+2CDEAD3: 0F 85 1E FF FF FF - jne RuleNo1-Win64-Shipping.exe+2CDE9F7 RuleNo1-Win64-Shipping.exe+2CDEAD9: 48 8B 35 48 F6 DC 01 - mov rsi,[RuleNo1-Win64-Shipping.exe+4AAE128] RuleNo1-Win64-Shipping.exe+2CDEAE0: 48 63 05 49 F6 DC 01 - movsxd rax,dword ptr [RuleNo1-Win64-Shipping.exe+4AAE130] RuleNo1-Win64-Shipping.exe+2CDEAE7: 4C 8D 34 40 - lea r14,[rax+rax*2] } 26390 "Player Name" 0 String 40 1 0 1

[playerbase]+240

0 300 26112 "BASE" 0 0080FF 4 Bytes

playerbase

0 26114 "Health" 0 4 Bytes

playerbase

C74 26122 "God Mode" 0:Off 1:On 0 Byte

playerbase

C8D 26394 "Super Jump" 0 Float

playerbase

340 26120 "Player Level" 0 4 Bytes

playerbase

C88 26118 "Experience" 0 4 Bytes

playerbase

C80 26123 "XP SUM" 0 4 Bytes

playerbase

C90 26392 "Player Speed" 1 26365 "Player Speed" 0 Float

playerbase

98 26368 "Run Speed" 0 Float

[playerbase]+118

64C 26369 "Walk Speed" 0 Float

[playerbase]+118

650 26131 "Level Init" 0 4 Bytes

playerbase

CB0 26119 "Level Max" 0 4 Bytes

playerbase

C84 26115 "Currency" 0 4 Bytes

playerbase

C78 26153 "Heavy Weapons" 0 4 Bytes

playerbase

CFC 26178 "DashSpeed" 0 Float

playerbase

D30 26391 "Current Weapon" 1 26366 "Total Ammo" 0 4 Bytes

[playerbase]+118

640 26367 "Current Ammo" 0 4 Bytes

[playerbase]+118

644 26375 "Min Bullet Spread X" 0 Float

[playerbase]+118

708 26376 "Max Bullet Spread X" 0 Float

[playerbase]+118

70C 26377 "Min Bullet Spread Y" 0 Float

[playerbase]+118

710 26378 "Max Bullet Spread Y" 0 Float

[playerbase]+118

714 26379 "Min Bullet Spread Z" 0 Float

[playerbase]+118

718 26380 "Max Bullet Spread Z" 0 Float

[playerbase]+118

71C 26381 "Bullet Spread Reset Duration" 0 Float

[playerbase]+118

720 26382 "Bullet Spread Multiplier" 0 Float

[playerbase]+118

724 26383 "Bullet Spread Intensity" 0 Float

[playerbase]+118

728 26388 "Bullet Spread Multiplier Aiming" 0 Float

[playerbase]+118

7E0 26384 "Min Recoil Intensity" 0 Float

[playerbase]+118

72C 26385 "Max Recoil Intensity" 0 Float

[playerbase]+118

730 26386 "Recoil Reset Duration" 0 Float

[playerbase]+118

734 26387 "Max Recoil Location X" 0 Float

[playerbase]+118

738 26393 "Grenades" 1 26373 "Max Total Grenades" 0 4 Bytes

[playerbase]+118

668 26374 "Max Current Grenades" 0 4 Bytes

[playerbase]+118

66C 26389 "Grenade Ammo Current" 0 4 Bytes

[playerbase]+118

854 26372 "Grenade Throw Force" 0 Float

[playerbase]+118

65C 26355 "Unlock Weapons" 1 26116 "Machine Gun Unlocked?" 0:No 1:Yes 0 Byte

playerbase

C7C 26162 "MachineGun 2 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D14 26252 "MachineGun 3 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

DD8 26117 "Shotgun 1 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

C7D 26159 "Shotgun 2 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D09 26185 "Shotgun 3 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D55 26190 "Shotgun 4 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D64 26158 "SMG1 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D08 26163 "Rifle 1 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D15 26261 "Rifle 2 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

DF2 26299 "Rifle 3 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

E88 26307 "Rifle 4 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

E98 26154 "Dual PPK Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D00 26155 "Deagle Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D01 26156 "Dual Deagle Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D02 26220 "Pistol 5 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

D98 26225 "Pistol 6 Unlocked ?" 0:No 1:Yes 0 Byte

playerbase

D9D 26228 "Pistol #7 Unlocked ?" 0:No 1:Yes 0 Byte

playerbase

DA8 26235 "Pistol 8? Unlocked ?" 0:No 1:Yes 0 Byte

playerbase

DB4 26239 "Pistol #9 Unlocked ?" 0:No 1:Yes 0 Byte

playerbase

DB8 26244 "Pistol 10 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

DC3 26266 "H1 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

DFA 26294 "H2 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

E79 26301 "H3 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

E8A 26310 "H4 Unlocked?" 0:No 1:Yes 0 Byte

playerbase

E9B 26356 "Magazine" 1 26128 "Pistol Mag Min" 0 4 Bytes

playerbase

CA4 26125 "Pistol Mag Max" 0 4 Bytes

playerbase

C98 26219 "Pistol 5 Min Mag" 0 4 Bytes

playerbase

D94 26226 "Pistol 6 Min Mag" 0 4 Bytes

playerbase

DA0 26227 "Pistol #7 Min Mag" 0 4 Bytes

playerbase

DA4 26234 "Pistol #8 Min Mag" 0 4 Bytes

playerbase

DB0 26240 "Pistol #9 Min Mag" 0 4 Bytes

playerbase

DBC 26245 "Pistol 10 Min Mag" 0 4 Bytes

playerbase

DC4 26130 "Machine Gun Mag Min" 0 4 Bytes

playerbase

CAC 26127 "Machine Gun Mag Max" 0 4 Bytes

playerbase

CA0 26160 "Machine Gun 2 Mag Min" 0 4 Bytes

playerbase

D0C 26251 "Machine Gun 3 Mag Min" 0 4 Bytes

playerbase

DD4 26129 "Shotgun 1 Mag Min" 0 4 Bytes

playerbase

CA8 26126 "Shotgun Mag Max" 0 4 Bytes

playerbase

C9C 26161 "Shotgun 2 Mag Min" 0 4 Bytes

playerbase

D10 26187 "Shotgun 3 Min Mag" 0 4 Bytes

playerbase

D58 26189 "Shotgun 4 Min Mag" 0 4 Bytes

playerbase

D60 26141 "Dual Pistol Mag Min" 0 4 Bytes

playerbase

CD8 26254 "Rifle 1 Min Mag" 0 4 Bytes

playerbase

DDC 26263 "Rifle 2 Min Mag" 0 4 Bytes

playerbase

DF4 26298 "Rifle 3 Min Mag" 0 4 Bytes

playerbase

E84 26306 "Rifle 4 Min Mag" 0 4 Bytes

playerbase

E94 26151 "Deagle Min Mag" 0 4 Bytes

playerbase

CF4 26157 "Dual Deagle Min Mag" 0 4 Bytes

playerbase

D04 26268 "H1 Min Mag" 0 4 Bytes

playerbase

DFC 26296 "H2 Min Mag" 0 4 Bytes

playerbase

E7C 26303 "H3 Min Mag" 0 4 Bytes

playerbase

E8C 26311 "H4 Min Mag" 0 4 Bytes

playerbase

E9C 26142 "SG1 Bullets SM Max" 0 4 Bytes

playerbase

CDC 26357 "Cooldowns" 1 26137 "Cycle Weapons Cooldown" 0 Float

playerbase

CC8 26140 "Pistol CD" 0 Float

playerbase

CD4 26149 "Shotgun Fire Rate CD" 0 Float

playerbase

CEC 26152 "Deagle CD" 0 Float

playerbase

CF8 26174 "Dash Cooldown" 0 Float

playerbase

D20 26183 "Double Shotty CD" 0 Float

playerbase

D50 26192 "PKM FB CD" 0 Float

playerbase

D68 26193 "Shotgun 3 Fire CD" 0 Float

playerbase

D6C 26331 "H4 CD" 0 Byte

playerbase

EF0 26204 "FOV CD" 0 Float

playerbase

D80 26258 "Enemy Death SFX CD" 0 Float

playerbase

DEC 26282 "Irulean VO CD" 0 Float

playerbase

E44 26358 "Quick Switch" 1 26164 "PPK QuickSwitch" 0 Byte

playerbase

D16 26166 "Deagle Quickswitch" 0 Byte

playerbase

D18 26167 "Dual Deagles Quickswitch" 0 Byte

playerbase

D19 26168 "Shotgun 1 Quickswitch" 0 Byte

playerbase

D1A 26169 "Shotgun 2 Quickswitch" 0 Byte

playerbase

D1B 26170 "MachineGun 1 Quickswitch" 0 Byte

playerbase

D1C 26171 "MachineGun 2 Quickswitch" 0 Byte

playerbase

D1D 26172 "Rifle 1 Quick Switch" 0 Byte

playerbase

D1E 26186 "Shotgun 3 Quickswitch" 0 Byte

playerbase

D56 26188 "Shotgun 4 Quickswitch" 0 Byte

playerbase

D5C 26195 "Shotgun 3 QuickSwitch?" 0 Byte

playerbase

D71 26196 "Shotgun 4 QuickSwitch?" 0 Byte

playerbase

D72 26221 "Pistol 5 Quickswitch?" 0 Byte

playerbase

D99 26224 "Pistol 6 Quick Switch?" 0 Byte

playerbase

D9C 26229 "Pistol #7 Quick Switch?" 0 Byte

playerbase

DA9 26233 "Pistol 8? Quick Switch?" 0 Byte

playerbase

DAD 26238 "Pistol #9 Quick Switch?" 0 Byte

playerbase

DB7 26243 "Pistol Quickswitch 10" 0 Byte

playerbase

DC2 26253 "MachineGun 3 Quickswitch?" 0 Byte

playerbase

DD9 26262 "Rifle 2 Quick Switch" 0 Byte

playerbase

DF3 26267 "H1 Quick Switch" 0 Byte

playerbase

DFB 26295 "H2 Quick Switch" 0 Byte

playerbase

E7A 26302 "H3 Quick Switch" 0 Byte

playerbase

E8B 26312 "H4 Quick Switch" 0 Byte

playerbase

EA0 26165 "Dual PPK Quickswitch" 0 Byte

playerbase

D17 26359 "Recoil" 1 26199 "Quickswitch Pistol Recoil" 0 Byte

playerbase

D78 26200 "Quickswitch Machine Gun Recoil" 0 Byte

playerbase

D79 26201 "Quickswitch Deagle Recoil" 0 Byte

playerbase

D7A 26202 "Quickswitch Shotgun 1 Recoil" 0 Byte

playerbase

D7B 26203 "Quickswitch Shotgun 3 Recoil" 0 Byte

playerbase

D7C 26214 "Quickswitch Dual Deagle 2 Recoil" 0 Byte

playerbase

D8D 26281 "Quickswitch H1 Recoil" 0 Byte

playerbase

E40 26248 "P9 Pistol 9 QuickSwitch Recoil" 0 Byte

playerbase

DD0 26308 "Quickswitch DD Recoil" 0 Byte

playerbase

E99 26361 "Spread" 1 26135 "Min Bullet Spread Trace" 0 Float

playerbase

CC0 26136 "Max Bullet Spread Trace" 0 Float

playerbase

CC4 26360 "Can Spawn" 1 26205 "Can Spawn Shotgun 1?" 0 Byte

playerbase

D84 26209 "Can Spawn Shotgun 2?" 0 Byte

playerbase

D88 26255 "Rifle 1 Can Spawn?" 0 Byte

playerbase

DE0 26260 "Rifle 2 Can Spawn?" 0 Byte

playerbase

DF1 26265 "H1 Can Spawn?" 0 Byte

playerbase

DF9 26206 "Can Spawn Dual PPK?" 0 Byte

playerbase

D85 26207 "Can Spawn Deagle?" 0 Byte

playerbase

D86 26208 "Can Spawn Dual Deagle?" 0 Byte

playerbase

D87 26210 "Can Spawn Machine Gun 1?" 0 Byte

playerbase

D89 26211 "Can Spawn Machine Gun 2?" 0 Byte

playerbase

D8A 26250 "Can Spawn Machine Gun 3?" 0 Byte

playerbase

DD2 26212 "Can Spawn Shotgun 3?" 0 Byte

playerbase

D8B 26213 "Can Spawn Shotgun 4?" 0 Byte

playerbase

D8C 26218 "Can Spawn Pistol 5?" 0 Byte

playerbase

D91 26223 "Can Spawn Pistol 6?" 0 Byte

playerbase

D9B 26231 "Can Spawn Pistol #7?" 0 Byte

playerbase

DAB 26232 "Can Spawn Pistol #8?" 0 Byte

playerbase

DAC 26241 "Can Spawn Pistol #9?" 0 Byte

playerbase

DC0 26246 "Can Spawn Pistol 10" 0 Byte

playerbase

DC8 26362 "Score Stats" 1 26352 "God Still to Leaderboard" 0 Byte

playerbase

F3D 26283 "High Score_PS" 0 4 Bytes

playerbase

E48 26340 "Leader Board Score (Updates After Hit)" 0 4 Bytes

playerbase

F10 26338 "Comp Leaderboard Upload?" 0 Byte

playerbase

F0C 26343 "Grenade Score" 0 4 Bytes

playerbase

F18 26333 "Ball Score " 0 4 Bytes

playerbase

EF4 26337 "Green Block Score" 4 Bytes

1C7249D4FC8

26363 "Basketball" 1 26325 "Basketball Mode?" 0 Byte

playerbase

EE0 26326 "2 Pt Range?" 0 Byte

playerbase

EE1 26327 "3 Pt Range?" 0 Byte

playerbase

EE2 26328 "4 Pt Range?" 0 Byte

playerbase

EE3 26329 "5 Pt Range?" 0 Byte

playerbase

EE4 26332 "New B Ball High Score?" 0 Byte

playerbase

EF1 26341 "B Ball Mode?" 0 Byte

playerbase

F14 26318 "Throw Speed" 0 Float

playerbase

EC0 26342 "Lazy Boy Game Mode" 0 Byte

playerbase

F15 26364 "Misc" 1 26146 "DoOnce?_2_0" 0 Byte

playerbase

CE6 26147 "DoOnce?_0_0" 0 Byte

playerbase

CE7 26148 "DoOnce?_3_0" 0 Byte

playerbase

CE8 26173 "IsCinematic?" 0 Byte

playerbase

D1F 26175 "DashVector.X" 0 Float

playerbase

D24 26176 "DashVector.Y" 0 Float

playerbase

D28 26177 "DashVector.Z" 0 Float

playerbase

D2C 26339 "CanDash?" 0 Byte

playerbase

F0D 26197 "CanReset?" 0 Byte

playerbase

D73 26216 "BulletTimeEnabled?" 0 Byte

playerbase

D8F 26257 "DamageInvuln" 0 Byte

playerbase

DE8 26286 "Spawn Death VO" 0 4 Bytes

playerbase

E58 26288 "Enemy Kill VO" 0 4 Bytes

playerbase

E60 26287 "RandomIntNumber" 0 4 Bytes

playerbase

E5C 26289 "RandomIntNumber_Kill" 0 4 Bytes

playerbase

E64 26304 "Missile?" 0 Byte

playerbase

E90 26321 "LMB Down?" 0 Byte

playerbase

ED0 26322 "GreenTag?" 0 Byte

playerbase

ED1 26323 "AutoReload?" 0 Byte

playerbase

ED2 26351 "Weapon Swap Wrap Around" 0 Byte

playerbase

F3C 26353 "Cooldown_DamageEventSFX" 0 Float

playerbase

F40 26354 "Arcade Mode?" 0 Byte

playerbase

F44 26121 "Deadman" 0 Byte

playerbase

C8C 26370 "minCasingEjectForce" 0 Float

[playerbase]+118

654 26371 "maxCasingEjectForce" 0 Float

[playerbase]+118

658 26109 "Dumper" 1 25330 "Unreal Engine" Auto Assembler Script {$lua} function ue4config() local sub=targetIs64Bit() and 0 or 4 UObject = {} --if UE4ver<=2 and targetIs64Bit() then ue4determineversion() end ----------------------------- ----------UE4 struct--------- if UE4ver>2 then UObject.ObjectId= 0xC-sub UObject.Class = 0x10-sub UObject.FNameIndex = 0x18-(sub*2) UObject.Outer = 0x20-(sub*2) if UE4ver>=25 then UObject.super= 0x40 UObject.member= 0x50 UObject.nextmember= 0x20 UObject.Offset= 0x4C UObject.propsize=0x3C UObject.bitmask= 0x7A UObject.funct= 0xD8 UObject.Property= 0x78 elseif UE4ver>=22 then UObject.super= 0x40 UObject.member= 0x48 UObject.funct= 0xC0 else UObject.super= 0x30 -(sub*4) UObject.member= 0x38 -(sub*5) UObject.funct= 0xB0 end if UE4ver<25 then UObject.nextmember=0x28-(sub*3) UObject.Offset= 0x44-(sub*4) UObject.propsize= 0x34-(sub*3/2) UObject.bitmask= 0x72-(sub*8) UObject.Property= 0x70-(sub*8) end if UE4ver<11 then UObject.Offset= 0x4C end ---------------------------- ---------UE3 struct--------- --1.25 --[[ elseif UE4ver>=1 then UObject.ObjectId= 0x4 UObject.Outer = 0x14 UObject.FNameIndex = 0x18 UObject.Class = 0x20 UObject.Offset= 0x48 UObject.super= 0x34 UObject.member= 0x38 UObject.nextmember=0x28 UObject.propsize= 0x30 UObject.bitmask= 0x60 UObject.Property= 0x58 ]] --0.10246 else --[[ UObject.ObjectId= 0x20 UObject.Outer = 0x28 UObject.FNameIndex = 0x2C UObject.Class = 0x34 UObject.Offset= 0x60 UObject.super= 0x48 UObject.member= 0x4C UObject.nextmember=0x3C UObject.propsize= 0x44 UObject.bitmask= 0x70]] end --------------------------- end ue4type={ ['BoolProperty']=vtByte, ['ByteProperty']=vtByte, ['FloatProperty']=vtSingle, ['StructProperty']=vtDword, ['IntProperty']=vtDword, ['NameProperty']=vtQword, ['Int64Property']=vtQword, ['TextProperty']=vtPointer, ['StrProperty']=vtPointer, ['ArrayProperty']=vtPointer, ['MapProperty']=vtPointer, ['ClassProperty']=vtPointer, ['ObjectProperty']=vtPointer} function ue4versioncheck() --if true then return 0 end local fileversion,info =getFileVersion(enumModules()[1].PathToFile) if not info then return 0 end return tonumber(info.minor..'.'..info.release) end function FNameStringAlgo(FName,IndexOnly) if not FName then return nil end local UEver=UE4ver local sub=targetIs64Bit() and 0 or 4 local number,str,datatable if not IndexOnly then number=UEver>2 and readInteger(FName+4) or 0 FName=readInteger(FName) else number=FName>>32 FName=FName&0xFFFFFFFF end if not FName then return nil end if isMassEffect then local i=(FName>>0x1D)&7 FName=FName&0x1FFFFFFF --[[ datatable={} for m=1,100 do datatable[m]=FNameDict[1+i][FName+m+stringoffset] end str= byteTableToString(datatable)]] str=readString(readPointer(getAddress('FNamePool')+i*8)+FName+stringoffset) return str end if FNameList[FName] then if number>0 then return FNameList[FName]..'_'..number-1 end return FNameList[FName] end local CFName=FName if readPointer(FNameString) then if not FNameStringStub then FNameStringStub=createExecuteCodeExStub(0,FNameString,0,0)end if not FNameStringRE then FNameStringRE=createRemoteExecutor()end if not mem then mem=allocateMemory(0x100)end writeQword(mem+0x50+UObject.FNameIndex,FName) FNameStringRE.executeStub(FNameStringStub,{mem+0x50,mem}) str=readPointer(mem) if str then str=readString(str,readInteger(mem+0x8)*2,true) end --deAlloc(mem) elseif UEver>=23 then local i=(FName>>0x10)+1 FName=(FName&0xFFFF)*2 if i>#FNameDict or FName>#FNameDict[i] then return nil end datatable={} for m=1,2 do datatable[m]=FNameDict[i][FName+m] end local le = byteTableToWord(datatable) if not le then return nil end le=le>>6 if le>200 then return nil end local widechar=true and FNameDict[i][FName+1]&1==1 or false --print(FName) if CFName==3 and not stringoffset then for k=2,0x20,2 do datatable={} for m=1,le do datatable[m]=FNameDict[i][FName+k+m] end if byteTableToString(datatable)=='ByteProperty' then stringoffset=k break end --print(k) end end if not stringoffset then return end if widechar then datatable={} for m=1,le*2 do datatable[m]=FNameDict[i][FName+stringoffset+m] end str=byteTableToWideString(datatable) else datatable={} for m=1,le do datatable[m]=FNameDict[i][FName+stringoffset+m] end str=byteTableToString(datatable) end else local i if FNamePool2 then FName= FName <0x25A and readInteger(FName*4+FNamePool) or FName --[[ elseif UEver>2 then i=(FName>>0xE)+1 FName=(FName&0x3FFF)*(8-sub) else i=1 FName=FName*(8-sub) end]] else i=UEver>7 and (FName>>0xE)+1 or 1 FName= (UEver>7 and (FName&0x3FFF) or FName) * (8-sub) end if FNameDict and (i>#FNameDict or ( FNameDict[i] and FName>#FNameDict[i]) ) then return nil end local pointer if FNamePool2 then pointer=readPointer(FNamePool2)+FName elseif targetIs64Bit() then datatable={} for m=1,8 do datatable[m]=FNameDict[i][FName+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do datatable[m]=FNameDict[i][FName+m] end pointer=byteTableToDword(datatable) end if not readPointer(pointer) then return nil end local pointers,pointers2=pointer if stringoffset2 then pointer=readPointer(pointer+stringoffset2)end pointers2=pointer --local offset=UE4ver>=22 and 0xC-sub or 0x10-(sub*2) if CFName==1 and (not stringoffset or not stringoffsetid) then for k=0,0x30,4 do str=readString(pointer+k,13) if str=='ByteProperty' then stringoffset=k break end end if not stringoffset then for k=0,0x30,4 do str=readString(pointer+k,13*2,true) if str=='ByteProperty' then stringoffset=k forcewidechar=true break end end end pointer=pointers for j=0, stringoffset-4,4 do if readInteger(pointer+j)==2 then stringoffsetid=j end end --print(string.format('%X',FName)) --print(string.format('%X',pointer)) --print(string.format('%X',offset)) else if not stringoffset then return end --print(string.format('%X',pointer)) pointer=pointers local widechar=stringoffsetid and (readInteger(pointer+stringoffsetid)&1==1 or false) or false pointer=pointers2 if stringoffset2 and not readPointer(pointer) then pointer=pointers+stringoffset2 end widechar= forcewidechar and true or widechar str= readString(pointer+stringoffset,200,widechar) if not str then str= readString(pointer+stringoffset,100,widechar) end if not str then str= readString(pointer+stringoffset,50,widechar) end if not str then str= readString(pointer+stringoffset,30,widechar) end if not str then local le=0 --print(string.format('%X',FName)) --print(string.format('%X',pointer)) while(true)do if le>50 then break end if readBytes(pointer+stringoffset+le)==0 then break end le=le+1 end str= readString(pointer+stringoffset,le) end --print(stringoffset) end end if not str then return nil end if number>0 then return str..'_'..number-1 end --print(str) FNameList[CFName]=str --print(str) return str end function GetNameAlgo(object) if not object then return nil end if ObjectList[object] then --print(ObjectList[object]) return ObjectList[object] end local fnameoffset=UObject.FNameIndex local typeoffset=UObject.Class local pointer=readPointer(object+typeoffset) if not pointer then return nil end --print(string.format('%X',fnameoffset)) --print(string.format('%X',object+fnameoffset)) local str1=FNameStringAlgo(readInteger(pointer+fnameoffset),true) --if readInteger(pointer+fnameoffset+4)~=0 then return nil end local str2=FNameStringAlgo(object+fnameoffset) if not str2 then str2=FNameStringAlgo(object+fnameoffset-8)end if not str1 or str1=='None' or not str2 or str2=='None' then return nil end str1=str1..' '..str2 --print(ObjectList[object]) ObjectList[object]=str1 return str1 end function GetFullNameAlgo(object) if not object then return nil end --if ObjectList[object] then return ObjectList[object] end local pathoffset=UObject.Outer local fnameoffset=UObject.FNameIndex local str=GetNameAlgo(object) if not str then return nil end local number=readInteger(object+fnameoffset+4) local typ=str:sub(1,string.find(str,' ')-1) local isProperty=string.find(typ,'Property') if not isProperty then isProperty=string.find(typ,'Function') end local pointer=readPointer(object+pathoffset) while(true)do if not pointer or pointer==0 then break end local stri=GetNameAlgo(pointer) if not stri then break end typ=stri:sub(1,string.find(stri,' ')-1) local isPropertyc=string.find(typ,'Property') if not isPropertyc then isPropertyc=string.find(typ,'Function') end stri=string.sub(str,1,string.find(str,' '))..stri:sub(string.find(stri,' ')+1,stri:len()) local num=readInteger(pointer+fnameoffset+4) if number~=num and num==0 or not isPropertyc and isProperty then stri=stri..':' else stri=stri..'.' end number=num isProperty=isPropertyc str=stri..string.sub(str,string.find(str,' ')+1,str:len()) pointer=readPointer(pointer+pathoffset) if string.find(str,'%./') then stri=string.sub(str,1,string.find(str,' ')) str=stri..str:sub(string.find(str,'%./')+1,str:len()) break end end if not str then return nil end --ObjectList[object]=str return str end function GetFullNameSuperAlgo(object) local super=UObject.super local str1 = GetFullNameSafeAlgo(object) if not str1 then return nil end local pointer = readPointer(object+super) if pointer then local str2 = GetFullNameSafeAlgo(pointer) if str2 then return str1..' ~ '..str2 end end return str1 end function GetFullNameSafesAlgo(object) --if ObjectList[object] then return ObjectList[object] end local fnameoffset=0x28 local typeoffset=0x8 local pathoffset=0x10 if not object then return nil end local pointer=readPointer(object+typeoffset) if not pointer then return nil end local str1=FNameStringAlgo(pointer) local str2=FNameStringAlgo(object+fnameoffset) local pointer=readPointer(object+pathoffset) if not pointer then return nil end local str3=GetFullNameAlgo(pointer) if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end --print(str3) --if string.find(str3,'%./') then string.sub local str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2 --ObjectList[object]=str return str end function GetFullNameSafeAlgo(object) --if ObjectList[object] then return ObjectList[object] end local str= GetFullNameAlgo(object) if str then return str end local fnameoffset=0x28 local typeoffset=0x8 local pathoffset=0x10 if not object then return nil end local pointer=readPointer(object+typeoffset) if not pointer then return nil end local str1=FNameStringAlgo(pointer) local str2=FNameStringAlgo(object+fnameoffset) local pointer=readPointer(object+pathoffset) if not pointer then return nil end local str3=GetFullNameAlgo(pointer) if not str3 then str3=GetFullNameSafesAlgo(pointer)end if not str1 or str1=='None' or not str2 or str2=='None' or not str3 then return nil end --print(str3) --if string.find(str3,'%./') then string.sub str=str1..string.sub(str3,string.find(str3,' '),str3:len())..':'..str2 --ObjectList[object]=str return str end function FindString(namestr,start,stop,isNoIndex) local acclen=0 for i=start,stop do local name=FNameStringAlgo(i+acclen,true) if name and name:len()<200 and name:len()>2 and not string.find(name,'%c') then --print(name) if name and name:len()<200 and name:len()>2 and not string.find(name,'%c') then if namestr==name then FNameResult=i+acclen return end if isNoIndex then acclen=acclen+name:len()end end end end end function FindStringFName(namestr,isNoIndex) local size if FNamePool2 then size=readInteger(FNamePool2+8) elseif UE4ver>=23 then size=(#FNameDict<<0x10)-1 elseif UE4ver>2 then size=(#FNameDict<<0xE)-1 else size=math.floor(#FNameDict[1]/4) end local count=0x200 size=math.floor((size/count)+0.5) ue4parsetablecheck() FNameResult=nil local result local num,start,stop=count,0,0 for i=0,size do start=i*num stop=(i+1)*num if FNameResult then break end createThread(FindString(namestr,start,stop-1,isNoIndex)) end result=FNameResult FNameResult=nil return result end function hasProperty(object) local str1,str2 str1=GetFullNameSafeAlgo(object) if not str1 then return nil end local pointer =readPointer(object+UObject.Property) if pointer then str2=GetFullNameSafeAlgo(pointer) if str2 then return str1..' ~ '..str2 end end return str1 end function printInheritC(class) for i=0,10 do if not class or class==0 then break end print(GetFullNameSuperAlgo(class)) class=readPointer(class+UObject.super) end end function printInheritI(instance) instance=readPointer(instance+UObject.Class) printInheritC(instance) end function getregionsize(address) local allregion=enumMemoryRegions() for i=#allregion,1,-1 do if allregion[i].BaseAddress<=address then local BaseAddress=allregion[i].BaseAddress local RegionSize=allregion[i].RegionSize local curSize=BaseAddress+RegionSize-address return curSize,RegionSize,BaseAddress,i end end end --[[ function parsefrombig(tab,index,size) local datatable={} if not tab then return nil end for i=1,size do datatable[i]=tab[index+i] end return datatable end ]] sub=targetIs64Bit() and 0 or 4 function ue4parsetableFNamePool() BasicEnumObject_running=nil ObjectTable={} ObjectList={} FullNameList={} FNameList={} if readPointer(FNameString) or string.find(process,'StateOfDecay2')then return end local pool=getAddressSafe('FNamePool') if pool then local pointer,pointers if not readPointer(readPointer(pool)) then pointer=pool+0x10 else pointer=pool if readPointer(readPointer(readPointer(pointer)))then if readPointer(readPointer(readPointer(readPointer(pointer))))then pointer=readPointer(pointer) end end end if not readPointer(pointer)then pointer=readPointer(pool2+0x10)end FNameDict={} local j=0 for i=0,500 do pointers=readPointer(pointer+i*(8-sub)) if readPointer(pointers) then FNameDict[i+1]=readBytes(pointers,getregionsize(pointers)-1,true) else j=j+1 end if j>5 then break end --[[ local pointer if UE4ver>=23 then pointer=readPointer(pool+i*(8-sub)+0x10) elseif UE4ver>2 then pointer=readPointer(readPointer(pool)+i*(8-sub)) else pointer=readPointer(pool+i*(8-sub)) end if pointer and pointer~=0 then local size=getregionsize(pointer) if not size or size==0 then break end FNameDict[i+1]=readBytes(pointer,size-1,true) else break end]] end end end function ue4parsetable() local size=targetIs64Bit() and 8 or 4 ue4parsetableFNamePool() local pool2=getAddressSafe('GUObjectArray') if pool2 then GUObjectDict={} if NOGUObjectsize then GUObjectsize=0xFFFFFFFF GUObjectDict[1]=readBytes(pool2,getregionsize(pool2)-1,true) return end local pointer,pointers=readPointer(pool2) GUObjectsize=readInteger(pool2+size) if not readPointer(pointer)then GUObjectsize=readInteger(pool2+0x10+size*2) pointer=readPointer(pool2+0x10)end if not readPointer(readPointer(pointer)) then pointer=pointer+0x10 end --if GetFullNameSafeAlgo(readPointer(pointer)) then pointer=pool2 end if not readPointer(readPointer(readPointer(readPointer(readPointer(pointer))))) then pointer=pool2 end --[[ local pointerss=readPointer(pointer) for i=size,0x50,4 do if readPointer(pointerss+i) and readPointer(readPointer(readPointer(pointerss+i))) then UObjectMul=i break end end ]] local j=0 for i=0,500 do pointers=readPointer(pointer+i*(8-sub)) if readPointer(pointers) then GUObjectDict[#GUObjectDict+1]=readBytes(pointers,getregionsize(pointers)-1,true) else j=j+1 end if j>5 then break end end --[[ if not UObject then UObject={}end if not UObject.FNameIndex then local datatable for i=size,0x50,4 do datatable={} for m=1,size do datatable[m]=GUObjectDict[1][m+i]end pointer = targetIs64Bit() and byteTableToQword(datatable) or byteTableToDword(datatable) if readPointer(pointer) and readPointer(readPointer(readPointer(pointer))) then UObjectMul=i break end end for i=0,3 do datatable={} for m=1,size do datatable[m]=GUObjectDict[1][m+i*UObjectMul]end pointer = targetIs64Bit() and byteTableToQword(datatable) or byteTableToDword(datatable) if readPointer(pointer) and checkvalue(pointer+size,0x100,'Object',1) then UObject.FNameIndex=checkvalue(pointer+size,0x50,'Object',1)-pointer UObject.ObjectId=checkvalue(pointer+size,0x100,i,4)-pointer for j=size,0x100,4 do if checkvalue(readPointer(pointer+j),0x100,'Class',1) then UObject.Class=j break end end for j=size,0x100,4 do if checkvalue(readPointer(pointer+j),0x100,'Core',1) then UObject.Outer=j break end end break end end end ]] end end function ue4parsetablecheck() if not FNameDict or not GUObjectDict then ue4parsetable() else local pointer,pointei,datatable,m if targetIs64Bit() then datatable={} for m=1,8 do datatable[m]=GUObjectDict[1][m]end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do datatable[m]=GUObjectDict[1][m]end pointer=byteTableToDword(datatable) end if UE4ver>=20 then pointei=readPointer('[[GUObjectArray+10]]') elseif UE4ver>11 then pointei=readPointer('[GUObjectArray+10]') elseif UE4ver>2 then pointei=readPointer('[[GUObjectArray]+10]') else pointei=readPointer('[GUObjectArray]') end --print(string.format('%X',pointei)) --print(string.format('%X',pointer)) if pointei ~= pointer then ue4parsetable() end local GUObjectsizes if UE4ver>=20 then GUObjectsizes=readInteger(getAddress('GUObjectArray+24')-(sub*2)) elseif UE4ver>11 then GUObjectsizes=readInteger('GUObjectArray+1C') else GUObjectsizes=readInteger(getAddress('GUObjectArray+8')-(sub*2)) end if GUObjectsizes~=GUObjectsize then ue4parsetable() end end end function UE4AutoConfig() if not UObject then UObject = {} end local size,pointer,pointers=(targetIs64Bit() and 8 or 4) local varsize={[0]=1,[2]=4,[3]=8,[4]=4,[12]=size} local GameEngine=StaticFindObjectAlgo('/Script/Engine.GameEngine') local Engine=StaticFindObjectAlgo('/Script/Engine.Engine') print(string.format('GameEngine = %X',GameEngine)) print(string.format('Engine = %X\n',Engine)) UObject.super=checkvalue(GameEngine,0x100,Engine,size)-GameEngine local Name,Typ for i=GameEngine,GameEngine+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Property ') then pointer=readPointer(i) UObject.member=i-GameEngine break end end Typ=Name:sub(1,string.find(Name,' ')-1) UObject.propsize=checkvalue(pointer,0x100,varsize[ue4type[Typ]],4)-pointer local classsize=readInteger(UObject.member+size+GameEngine) UObject.Offset=checkvalue(pointer,0x100,tostring(classsize-0x100)..'~'..tostring(classsize),4)-pointer for i=pointer,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Property ') then UObject.nextmember=i-pointer break end end pointer=readPointer(Engine+UObject.member) for i=pointer+UObject.nextmember,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Class ') then UObject.Property=i-pointer break end end UObject.bitmask=UObject.Property+2 pointer=StaticFindObjectAlgo('/Script/CoreUObject.Object:ExecuteUbergraph') print(string.format('ExecuteUbergraph = %X\n',pointer)) for i=pointer+UObject.Property,pointer+0x100,size do if inModule(readPointer(i)) then UObject.funct=i-pointer break end end pointer=StaticFindObjectAlgo('/Script/CoreUObject.EInterpCurveMode') print(string.format('EInterpCurveMode = %X\n',pointer)) for j=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+j) --pointers=readPointer(pointers) if pointers and checkvalue(pointers,0x50,'CIM_Linear',1) then UObject.enumoffset=UObject.Outer+j pointer=readPointer(pointer+UObject.enumoffset) print(string.format('EInterpCurveMode enums = %X\n',pointer)) UObject.enumname=checkvalue(pointer,0x50,'CIM_Linear',1)-pointer UObject.enumindex=checkvalue(pointer,0x50,1,2) and checkvalue(pointer,0x50,1,2)-checkvalue(pointer,0x50,'CIM_CurveAuto',1) or 4 for k=UObject.enumname+8,0x50,4 do if readInteger(pointer+k)>4 and FNameStringAlgo(readInteger(pointer+k),true) then UObject.enummul=k break end end break end end print(string.format([[ UObject.ObjectId = 0x%X UObject.Class = 0x%X UObject.FNameIndex = 0x%X UObject.Outer = 0x%X UObject.super = 0x%X UObject.member = 0x%X UObject.nextmember = 0x%X UObject.propsize = 0x%X UObject.Offset = 0x%X UObject.Property = 0x%X UObject.bitmask = 0x%X UObject.funct = 0x%X UObject.enumoffset = 0x%X UObject.enummul = 0x%X UObject.enumname = 0x%X UObject.enumindex = 0x%X ]],UObject.ObjectId,UObject.Class,UObject.FNameIndex, UObject.Outer,UObject.super,UObject.member,UObject.nextmember, UObject.propsize,UObject.Offset,UObject.Property, UObject.bitmask,UObject.funct,UObject.enumoffset, UObject.enummul,UObject.enumname, UObject.enumindex)) end function UE3AutoConfig() if not UObject then UObject = {} end local size,pointer,pointers=(targetIs64Bit() and 8 or 4) local varsize={[0]=1,[2]=4,[3]=8,[4]=4,[12]=size} local GameEngine=StaticFindObjectAlgo('Engine.GameEngine') local Engine=StaticFindObjectAlgo('Engine.Engine') print(string.format('GameEngine = %X',GameEngine)) print(string.format('Engine = %X\n',Engine)) UObject.super=checkvalue(GameEngine,0x100,Engine,size)-GameEngine local Name,Typ for i=GameEngine+UObject.Outer,GameEngine+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and (string.find(Name,'Function ') or string.find(Name,'Property ')) then pointer=readPointer(i) UObject.member=i-GameEngine break end end for i=UObject.Outer+size,0x100,size do Name=GetFullNameSafeAlgo(readPointer(pointer+i)) if Name and (string.find(Name,'Property ') or string.find(Name,'Function ') or string.find(Name,'Struct ')) and not string.find(Name,'Core') then Name=GetFullNameSafeAlgo(readPointer(readPointer(pointer+i)+i)) if Name and (string.find(Name,'Property ') or string.find(Name,'Function ') or string.find(Name,'Struct ')) and not string.find(Name,'Core') then UObject.nextmember=i break end end end for i=0,100 do pointer=readPointer(UObject.nextmember+pointer) Name=GetFullNameSafeAlgo(pointer) --print(Name) if Name and string.find(Name,'ObjectProperty ') then break end end Typ=Name:sub(1,string.find(Name,' ')-1) --print(string.format('%X = %s',pointer,GetFullNameSafeAlgo(pointer))) UObject.propsize=checkvalue(pointer,0x100,varsize[ue4type[Typ]],2)-pointer local classsize=readInteger(UObject.member+size+GameEngine) UObject.Offset=checkvalue(pointer,0x100,tostring(classsize-0x200)..'~'..tostring(classsize),4)-pointer --pointer=readPointer(Engine+UObject.member) for i=pointer+UObject.nextmember,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Class ') then UObject.Property=i-pointer break end end UObject.bitmask=UObject.Property+2 pointer=StaticFindObjectAlgo('Core.Object:FindObject') print(string.format('FindObject = %X\n',pointer)) for i=pointer+UObject.ObjectId,pointer+0x100,4 do if inModule(readPointer(i)) then UObject.funct=i-pointer break end end pointer=StaticFindObjectAlgo('Core.Object.EInterpCurveMode') print(string.format('EInterpCurveMode = %X\n',pointer)) for i=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+i) pointers=readPointer(pointers) if pointers then for j=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+i+j) --pointers=readPointer(pointers) if pointers and checkvalue(pointers,0x50,'CIM_Linear',1) then UObject.enumoffset=UObject.Outer+i+j pointer=readPointer(pointer+UObject.enumoffset) UObject.enumname=0--checkvalue(pointer,0x50,FindStringFName('CIM_Linear'),4)-pointer UObject.enumindex=4--checkvalue(pointer,0x50,1,4)-checkvalue(pointer,0x50,FindStringFName('CIM_CurveAuto'),4) UObject.enummul=8--checkvalue(pointer,0x50,2,4)-checkvalue(pointer,0x50,1,4) break end end break end end print(string.format([[ UObject.ObjectId = 0x%X UObject.Class = 0x%X UObject.FNameIndex = 0x%X UObject.Outer = 0x%X UObject.super = 0x%X UObject.member = 0x%X UObject.nextmember = 0x%X UObject.propsize = 0x%X UObject.Offset = 0x%X UObject.Property = 0x%X UObject.bitmask = 0x%X UObject.funct = 0x%X UObject.enumoffset = 0x%X UObject.enummul = 0x%X UObject.enumname = 0x%X UObject.enumindex = 0x%X ]],UObject.ObjectId,UObject.Class,UObject.FNameIndex, UObject.Outer,UObject.super,UObject.member,UObject.nextmember, UObject.propsize,UObject.Offset,UObject.Property, UObject.bitmask,UObject.funct,UObject.enumoffset, UObject.enummul,UObject.enumname, UObject.enumindex)) end function FindObject(threadlist,ObjectId,size,i,start,stop,fullname) local pointer,datatable for j=start,stop do if UObjectMul then if targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*UObjectMul+m] then break end datatable[m]=GUObjectDict[i][j*UObjectMul+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) end elseif UE4ver<11 and targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x8+m] then break end datatable[m]=GUObjectDict[i][j*0x8+m] end pointer=byteTableToQword(datatable) elseif UE4ver<11 then datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) elseif targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x18+m] then break end datatable[m]=GUObjectDict[i][j*0x18+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x10+m] then break end datatable[m]=GUObjectDict[i][j*0x10+m] end pointer=byteTableToDword(datatable) end if pointer and pointer~=0 then local objid=readInteger(pointer+ObjectId) if objid and objid<size then local name=GetFullNameSafeAlgo(pointer) if name and string.find(name,' ') then name=string.sub(name,string.find(name,' ')+1,name:len()) name=name:lower() if not FullNameList[name]then FullNameList[name]=pointer end if FullNameList[fullname] then ObjectResult=FullNameList[fullname] for k,v in ipairs(threadlist) do v.terminate() end return end end end end end end function StaticFindObjectAlgo(fullname) ue4parsetablecheck() fullname=fullname:lower() if FullNameList[fullname] then return FullNameList[fullname]end local threadlist={} local k=1 local count=0x200 local size=GUObjectsize local sizess= targetIs64Bit() and (UE4ver>10 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count) local ObjectId=UObject.ObjectId ObjectResult=nil for i=1,#GUObjectDict do local num,start,stop=count,0,0 for j=0,math.floor(#GUObjectDict[i]/sizess) do start=stop stop=stop+num if ObjectResult then break end threadlist[k]=createThread(FindObject(threadlist,ObjectId,size,i,start,stop-1,fullname)) k=k+1 end end local result=ObjectResult ObjectResult=nil return result end function BasicObject(ObjectId,size,i,start,stop) local pointer,datatablen,name,ObjectData,objid Threadlist[#Threadlist+1]=i for j=start,stop do if UObjectMul then if targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*UObjectMul+m] then break end datatable[m]=GUObjectDict[i][j*UObjectMul+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) end elseif UE4ver<11 and targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x8+m] then break end datatable[m]=GUObjectDict[i][j*0x8+m] end pointer=byteTableToQword(datatable) elseif UE4ver<11 then datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) elseif targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x18+m] then break end datatable[m]=GUObjectDict[i][j*0x18+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x10+m] then break end datatable[m]=GUObjectDict[i][j*0x10+m] end pointer=byteTableToDword(datatable) end if pointer and pointer~=0 then objid=readInteger(pointer+ObjectId) if objid and objid<size and not Temporary[pointer] then name=GetFullNameSafeAlgo(pointer) if name and string.find(name,' ') then ObjectData={} ObjectData.ObjId=objid ObjectData.Address=pointer ObjectData.Type=string.sub(name,1,string.find(name,' ')-1) ObjectData.FullName=string.sub(name,string.find(name,' ')+1,name:len()) ObjectData.Super=UObject.super and readPointer(pointer+UObject.super) or nil if not readPointer(ObjectData.Super) then ObjectData.Super=nil end ObjectTable[#ObjectTable+1]=ObjectData Temporary[pointer]=ObjectData end end end end Threadlist[#Threadlist]=nil end function BasicEnumObject() if BasicEnumObject_running then return end BasicEnumObject_running=true ObjectTable={} ue4parsetablecheck() local count=0x200 local size=GUObjectsize local sizess= targetIs64Bit() and (UE4ver>10 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count) local ObjectId=UObject.ObjectId local num,start,stop Temporary={} Threadlist={} local LastStop for i=1,#GUObjectDict do num,start,stop=count,0,0 for j=0,math.floor(#GUObjectDict[i]/sizess) do start=stop stop=stop+num --print(start..'~'..stop) createThread(BasicObject(ObjectId,size,i,start,stop-1)) if i==#GUObjectDict and j==math.floor(#GUObjectDict[i]/sizess) then LastStop=stop end end end for i=0,10000 do if #Threadlist==0 then break end sleep(1) end for i=1,#ObjectTable do if Temporary[ObjectTable[i].Super] then if not Temporary[ObjectTable[i].Super].Uper then Temporary[ObjectTable[i].Super].Uper={}end Temporary[ObjectTable[i].Super].Uper[#Temporary[ObjectTable[i].Super].Uper+1]=ObjectTable[i] ObjectTable[i].Super=Temporary[ObjectTable[i].Super] end end BasicEnumObject_running=nil Temporary=nil Threadlist=nil --print('done') end function registerFunc(ObjectId,size,i,start,stop) local funct=UObject.funct for j=start,stop do local pointer if UObjectMul then if targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*UObjectMul+m] then break end datatable[m]=GUObjectDict[i][j*UObjectMul+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) end elseif UE4ver<11 and targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x8+m] then break end datatable[m]=GUObjectDict[i][j*0x8+m] end pointer=byteTableToQword(datatable) elseif UE4ver<11 then datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) elseif targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x18+m] then break end datatable[m]=GUObjectDict[i][j*0x18+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x10+m] then break end datatable[m]=GUObjectDict[i][j*0x10+m] end pointer=byteTableToDword(datatable) end if pointer and pointer~=0 then local objid=readInteger(pointer+ObjectId) if objid and objid<size then local name=GetFullNameSafeAlgo(pointer) if name and string.find(name,' ') then local typ=string.sub(name,1,string.find(name,' ')-1) if typ=='Function' then local fullname=string.sub(name,string.find(name,' ')+1,name:len()) local func=readPointer(pointer+funct) if func and func~=0 then extralist.addSymbol('UE',fullname,func,1)end end end end end end end function registerFuncAlgo() local funct=UObject.funct ue4parsetablecheck() if not extralist then extralist=createSymbolList() extralist.register() end if not enumUEObjIsRunning and UEObj then for i,v in ipairs(UEObj) do if v.Type=='Function' then local func=readPointer(v.Address+funct) if func and func~=0 then extralist.addSymbol('UE',v.FullName,func,1)end end end else local k=1 local count=0x200 local size=GUObjectsize local sizess= UE4ver>2 and (targetIs64Bit() and 0x18*count or 0x10*count) or 0x4*count local ObjectId=UObject.ObjectId for i=1,#GUObjectDict do local num,start,stop=count,0,0 for j=0,math.floor(#GUObjectDict[i]/sizess) do start=stop stop=stop+num if ObjectResult then break end createThread(registerFunc(ObjectId,size,i,start,stop-1)) k=k+1 end end end end function isStructExist(name) for i=1,#StructList do if StructList[i].Name==name then return StructList[i] end end return nil end function SaveAndRemoveStruct() StructList={} local count=getStructureCount() for i=count-1,0,-1 do local struct=getStructure(i) StructList[i+1]=struct struct:removeFromGlobalStructureList() end end function DeleteStruct(Struct) local count=#StructList for i=1,count do if Struct==StructList[i] then Struct:Destroy() StructList[i]=nil end if not StructList[i] and StructList[i+1] then StructList[i]=StructList[i+1] StructList[i+1]=nil end end end function LoadStruct() for i=1,#StructList do StructList[i]:addToGlobalStructureList() end end function ChildStructStart(structname,elementname) local struct=isStructExist(structname) if struct then for i=0,struct.Count-1 do if struct.Element[i].Name==elementname then return struct.Element[i].ChildStructStart end end else return nil end end function findAddress(name,number,AddressOrAOBString,modulename,stopaddress,Nth,aobscanOnly,gethead,nop) local size,address=0x100 AddressOrAOBString,address=string.lower(AddressOrAOBString):gsub('banana','') if(address>0)then local f if(modulename==0 or modulename==nil or modulename=='')then f=AOBScan(AddressOrAOBString) else if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end local ms = createMemScan() if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end ms.firstScan(soExactValue,vtByteArray,rtTruncated,AddressOrAOBString,'',getAddress(modulename),getAddress(stopaddress),'',fsmNotAligned,'',true,false,false,false) ms.waitTillDone() f = createFoundList(ms) f.initialize() ms.destroy() end address={} for i=0,f.Count-1 do address[i+1]=f[i]end f.destroy() if Nth==nil or Nth==0 or Nth=='' then Nth=1 end if gethead then local addresss=GetAddressSafe(address[Nth]) if not addresss then addresss=GetAddressSafe(address[Nth-1])end if addresss and addresss~=0 then for i=0,0x1000 do addresss=addresss-1 if readBytes(addresss,1)==0xCC then break end if nop then local ext, opc, byt, add=splitDisassembledString(disassemble(addresss)) if string.find(opc,'nop') then addresss=addresss+getInstructionSize(addresss)-1 break end end end address[Nth]=addresss+1 end end if number==nil or number==0 or number=='' then if aobscanOnly then return address end else if(#address==0)then error(name..' aob no result found') end if(getAddress(address[Nth])==nil)then error(name..' aob result '..Nth..' doesnt exist') end unregisterSymbol(name) registerSymbol(name,getAddressSafe(address[Nth]),true) if aobscanOnly then return end end AddressOrAOBString=GetAddressSafe(address[Nth]) end AddressOrAOBString=getAddressSafe(AddressOrAOBString) if(AddressOrAOBString==nil)then error(name..' still cant be found')end local addr={} local i=0 local j=1 while(i<size) do local ext, opc, byt, add=splitDisassembledString(disassemble(getAddressSafe(AddressOrAOBString)+i)) if(ext~="")then if(opc:find(",")~=nil)then opc=opc:sub(opc:find(",")+1,opc:len()) else opc=opc:sub(opc:find(" ")+1,opc:len()) end addr[j]=opc:gsub("%[",""):gsub("]","") j=j+1 end if opc:find('],') then opc=opc:sub(opc:find("%[")+1,opc:find("]")-1) if tonumber(opc,16) then addr[j]=opc j=j+1 end end i=i+getInstructionSize(AddressOrAOBString+i) end --for i=1,#addr do print(addr[i]) end if number==nil or number==0 or number=='' then return addr end local offset if(type(number)==type(''))then offset=string.find(number,',') if(offset==nil)then number=getAddress(number) else offset=getAddress(string.sub(number,offset+1,number:len())) number=getAddress(string.sub(number,1,string.find(number,',')-1)) end end if offset==nil then offset=0 end unregisterSymbol(name) registerSymbol(name,getAddressSafe(addr[number])-offset,true) end function ue4determineversion() local address=findAddress('FNamePool',0,'48 8D 0D * * * * E8 * * * * 4C 8B C0 C6banana',process,nil,0,true)[1] if address then findAddress('FNamePool',1,address) UE4ver=25 ue4parsetable() ue4config() local address=getAddressSafe(StaticFindObjectAlgo('/Script/Engine.GameEngine')) if not address or address==0 then error('StaticFindObject not functioning as expected...')end UE4ver=nil local pointer=readPointer(address+UObject.member) if pointer then pointer=readPointer(pointer) if pointer then UE4ver=25 end end if not UE4ver then UE4ver=23 end else address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[1] if address then findAddress('FNamePool',1,address) else findAddress('FNamePool',1,'C3 * DB 48 89 1D * * * * * * 48 8B 5C 24 20banana',process,nil,2)end local address=readPointer('[[GUObjectArray+10]]+18') if address>0x10000 then UE4ver=22 ue4parsetable() ue4config() FNameStringAlgo(1,true) local address=getAddressSafe(StaticFindObjectAlgo('/Script/Engine.GameEngine')) if not address or address==0 then error('StaticFindObject not functioning as expected...')end UE4ver=nil local pointer=readPointer(address+UObject.member) if pointer then pointer=readPointer(pointer) if pointer then UE4ver=22 end end if not UE4ver then UE4ver=20 end else UE4ver=18 end end end function checkvalue(address,size,value,typ) local cvalue,tempvalue,value2=readBytes(address,size,true) if type(value)==type('') and string.find(value,'~') then value2=tonumber(value:sub(string.find(value,'~')+1,value:len())) value=tonumber(value:sub(1,string.find(value,'~')-1)) end if not cvalue then return false end if typ==1 then for i=1,#cvalue,4 do datatable={} for m=1,4 do datatable[m]=cvalue[m+i-1] end tempvalue=byteTableToDword(datatable) --print(FNameStringAlgo(tempvalue,true)) local str=FNameStringAlgo(tempvalue,true) if str and string.find(str,value) then return address+i-1 end end elseif typ==2 then for i=1,#cvalue,2 do datatable={} for m=1,2 do datatable[m]=cvalue[m+i-1] end tempvalue=byteTableToWord(datatable) if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end end elseif typ==4 then for i=1,#cvalue,4 do datatable={} for m=1,4 do datatable[m]=cvalue[m+i-1] end tempvalue=byteTableToDword(datatable) if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end end elseif typ==8 then for i=1,#cvalue,4 do datatable={} for m=1,8 do datatable[m]=cvalue[m+i-1] end tempvalue=byteTableToQword(datatable) if tempvalue==value or (value2 and tempvalue>=value and tempvalue<=value2 ) then return address+i-1 end end end return nil end function fillstruct4bytes(Struct) if not getElementByOffset(Struct,0) then local e=Struct.addElement() e.Offset=0 e.Vartype=vtDword end Struct.beginUpdate() local count=Struct.Count-1 local list,k,element1,element2,size,bytesize={},1 for i=0,count do element1=Struct.Element[i] element2=Struct.Element[i+1] if element2 then bytesize=element1.Bytesize if bytesize<4 then bytesize=4 end size=element2.Offset-element1.Offset-bytesize if size>0 then if size%4>0 then size=4-size%4+size end local start=element1.Offset if start%4>0 then start=4-start%4+start else start=start+4 end size=size/4 for j=0,size-1 do if (start+j*4)>=(element1.Offset+bytesize) then list[k]=start+j*4 k=k+1 end end end end end for i,v in ipairs(list) do local e=Struct.addElement() e.Offset=v e.Vartype=vtDword end Struct.endUpdate() end function ue4createstruct(FullNameOrAddress,StructName,isGlobal,isfullname,Structu,AddedOffset,AddedName,Instance) if not FullNameOrAddress then return elseif type(FullNameOrAddress)==type({})then RunningStructCounter=0 SaveAndRemoveStruct() for i=1,#FullNameOrAddress do createThread(ue4createstruct(FullNameOrAddress[i],StructName[i],isGlobal,isfullname,Structu,AddedOffset,AddedName,Instance)) end while(true)do if not RunningStruct or #RunningStruct==0 then break else sleep(1)end RunningStructCounter=RunningStructCounter+1 if RunningStructCounter>180000 then break end end RunningStructCounter=nil LoadStruct() return end if StructName and isGlobal then local Struct=isStructExist(StructName) if Struct then return end end--DeleteStruct(Struct)end end local member,Offset,Property,bitmask,nextmember,super,propsize=UObject.member,UObject.Offset,UObject.Property,UObject.bitmask,UObject.nextmember,UObject.super,UObject.propsize local Object,Name,Class,PropName,Typ,Off,pointer,e,f=FullNameOrAddress local isUE425=UE4ver>=25 if type(FullNameOrAddress)==type('') then Object=StaticFindObjectAlgo(FullNameOrAddress) end if not Object then print(FullNameOrAddress..' not found...') return end Name=GetNameAlgo(Object) if not Name or not string.find(Name,' ') then print(FullNameOrAddress..' invalid Object?') return end if not StructName then Class=Name:sub(1,string.find(Name,' ')-1) Name=Name:sub(string.find(Name,' ')+1,Name:len()) else Name=StructName end local Struct=Structu if not Struct then Struct=createStructure(Name)end if not AddedName then AddedName='' end local RunningStructName=name if not AddedOffset then if not RunningStruct then RunningStruct={} end RunningStruct[#RunningStruct+1]=RunningStructName AddedOffset=0 Struct.beginUpdate() else local FullName=GetFullNameSafeAlgo(Object) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) if not LocalStruct then LocalStruct={}end if LocalStruct[FullName] then copyStruct(LocalStruct[FullName],Struct,AddedOffset,AddedName) else local copy=createStructure(FullName) ue4createstruct(Object,nil,nil,isfullname,copy) LocalStruct[FullName]=copy copyStruct(LocalStruct[FullName],Struct,AddedOffset,AddedName) end return end --if not RunningStructCounter and AddedName=='' then SaveAndRemoveStruct() end --print(string.format('%X',Object)) while(true)do if not Object or Object==0 then break end Name=GetNameAlgo(Object) if not Name then break end Name=Name:sub(string.find(Name,' ')+1,Name:len()) if Name=='Object' then break end print(GetFullNameSafeAlgo(Object)) pointer=readPointer(Object+UObject.member) while(true)do if not pointer or pointer==0 then break end PropName=GetFullNameSafeAlgo(pointer) if PropName and string.find(PropName,':') then Typ=PropName:sub(1,string.find(PropName,' ')-1) if not string.find(Typ,'Function')then if not isfullname then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len()) else PropName=PropName:sub(string.find(PropName,' ')+1,PropName:len())end PropName=AddedName..PropName Off=readInteger(pointer+Offset)+AddedOffset if Class=='UserDefinedStruct' and string.find(PropName,'_') then PropName=PropName:sub(1,string.find(PropName,'_')-1)end if Typ=='StructProperty' then ue4createstruct(readPointer(pointer+Property),nil,nil,isfullname,Struct,Off,PropName..'.') if not getElementByOffset(Struct,Off) then e=Struct.addElement() e.Offset=Off e.Name=PropName e.Vartype=vtDword end else e=Struct.addElement() e.Offset=Off e.Name=PropName if Instance and PropName=='RowStruct' then local spointer=readPointer(Instance+Off) local sname,sstruct=GetFullNameSafeAlgo(spointer) if sname then print(sname) if string.find(sname,'.') then sname=sname:sub(string.find(sname,'.')+1,sname:len())end if not ArrayStruct then ArrayStruct={} end if ArrayStruct[sname] then sstruct=ArrayStruct[PropName] else sstruct=createStructure(sname) ArrayStruct[sname]=sstruct ue4createstruct(spointer,nil,nil,isfullname,sstruct) end f=Struct.addElement() f.Offset=e.Offset+8-sub f.Name='Table' f.Vartype=vtPointer local ssstruct=createStructure('DataTable') f.setChildStruct(ssstruct) for r=0,10 do f=ssstruct.addElement() f.Offset=r*0x18 f.Name=string.format('[%u] FName',r) f.Vartype=vtQword f=ssstruct.addElement() f.Offset=r*0x18+8 f.Name=string.format('[%u] Data',r) f.Vartype=vtPointer f.setChildStruct(sstruct) end fillstruct4bytes(ssstruct) f=Struct.addElement() f.Offset=e.Offset+0x10-sub*2 f.Name='Size' f.Vartype=vtDword end end if not ue4type[Typ] then e.Vartype=vtDword else e.Vartype=ue4type[Typ]end if Typ=='ArrayProperty' or Typ=='MapProperty' then f=Struct.addElement() f.Offset=e.Offset+8-sub f.Name=e.Name..'_size' f.Vartype=vtDword f=Struct.addElement() f.Offset=e.Offset+0xC-sub f.Name=e.Name..'_sizes' f.Vartype=vtDword local isMap= Typ=='MapProperty' Prop=readPointer(pointer+Property) PropName=GetFullNameSafeAlgo(Prop) if not PropName then PropName=GetFullNameSafeAlgo(Prop)end if PropName then Typ=PropName:sub(1,string.find(PropName,' ')-1) PropName=PropName:sub(string.find(PropName,':')+1,PropName:len()) if string.find(PropName,':') then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())end if Typ=='StructProperty' then Prop=readPointer(Prop+Property) PropName=GetNameAlgo(Prop) if PropName then PropName=PropName:sub(string.find(PropName,' ')+1,PropName:len())..'[]' --print(Typ..' '..PropName) end else PropName=PropName..'[]' end if not ArrayStruct then ArrayStruct={} end if ArrayStruct[PropName] then e.setChildStruct(ArrayStruct[PropName]) else local stru=createStructure(PropName) ArrayStruct[PropName]=stru e.setChildStruct(stru) stru.beginUpdate() local ppsize=0 if isMap then for j=0,1 do Prop=readPointer(pointer+Property+j*(8-sub)) PropName=GetFullNameSafeAlgo(Prop) if PropName then ppsize=(readInteger(Prop+propsize)<4 and 4 or readInteger(Prop+propsize))+ppsize end end ppsize=ppsize+0x8 --print(ppsize) end for j=0,1 do Prop=readPointer(pointer+Property+j*(8-sub)) PropName=GetFullNameSafeAlgo(Prop) if PropName then Typ=PropName:sub(1,string.find(PropName,' ')-1) --if Typ=='StructProperty' then print(PropName)end PropName=PropName:sub(string.find(PropName,':')+1,PropName:len()) if string.find(PropName,':') then PropName=PropName:sub(string.find(PropName,':')+1,PropName:len())end local psize=isMap and ppsize or readInteger(Prop+propsize) local Offs=isMap and readInteger(Prop+Offset) or 0 local Propt if Typ=='StructProperty' then Propt=readPointer(Prop+Property) end for p=0,10 do Off=p*psize+Offs local ItemName=string.format('[%u] ',p) if Typ=='StructProperty' then ue4createstruct(Propt,nil,nil,isfullname,stru,Off,ItemName) --if not getElementByOffset(stru,Off) then e=stru.addElement() e.Offset=Off e.Name=PropName e.Vartype=vtDword end else local g=stru.addElement() g.Offset=Off g.Name=ItemName..PropName if not ue4type[Typ] then g.Vartype=vtDword else g.Vartype=ue4type[Typ]end end end end end stru.endUpdate() fillstruct4bytes(stru) end end elseif Typ=='BoolProperty' then e.ChildStructStart=readBytes(pointer+bitmask,1)end end end end pointer=readPointer(pointer+nextmember) end Object=readPointer(Object+super) end if AddedName~='' then return end Struct.endUpdate() fillstruct4bytes(Struct) if isGlobal then StructList[#StructList+1]=Struct end local count=#RunningStruct for i=1,count do if RunningStruct[i]==RunningStructName then RunningStruct[i]=nil end if not RunningStruct[i] and RunningStruct[i+1] then RunningStruct[i]=RunningStruct[i+1] RunningStruct[i+1]=nil end end if not RunningStructCounter then LoadStruct() end end function getElementByOffset(struct,offset) for i=0,struct.Count-1 do if struct.Element[i].Offset==offset then return i end end return nil end function copyStruct(original,copy,AddedOffset,AddedName) if not copy then copy=createStructure(original.Name..'_copy')end if not AddedOffset then AddedOffset=0 end if not AddedName then AddedName='' end copy.beginUpdate() for i=0,original.Count-1 do local e=copy.addElement() e.Offset=original.Element[i].Offset+AddedOffset if original.Element[i].Name=='' then e.Name=original.Element[i].Name else e.Name=AddedName..original.Element[i].Name end e.Vartype=original.Element[i].Vartype e.ChildStruct=original.Element[i].ChildStruct e.ChildStructStart=original.Element[i].ChildStructStart e.Bytesize=original.Element[i].Bytesize end copy.endUpdate() return copy end function ue4createstructfast(fullnameortable,StructName,isGlobal,isfullname,structu,AddedOffset,AddedName,depth,callernum) if not callernum then callernum=0 end if not depth then depth=10 end local depths=0 callernum=callernum+1 if callernum>10 then return end if StructName and isGlobal then local struct=isStructExist(StructName) if struct then DeleteStruct(struct) end end if not UEObj then enumUEObj() end local tabl=fullnameortable if type(fullnameortable)==type('') then for i,v in ipairs(UEObj) do if v.FullName==fullnameortable then tabl=v break end end end --[[ if not tabl or type(tabl)~=type({}) then enumUEObj() if type(fullnameortable)==type('') then for i,v in ipairs(UEObj) do if v.FullName==fullnameortable then tabl=v break end end end end ]] if not tabl or type(tabl)~=type({}) then print(tostring(fullnameortable)..' not found...') return end local name=StructName if not name then name=tabl.Name end local struct=structu if not struct then struct=createStructure(name)end if not AddedName then AddedName='' end local RunningStructName=name if not AddedOffset then if not RunningStruct then RunningStruct={} end RunningStruct[#RunningStruct+1]=RunningStructName AddedOffset=0 struct.beginUpdate() elseif tabl and tabl.FullName then if not LocalStruct then LocalStruct={}end if LocalStruct[tabl.FullName] then copyStruct(LocalStruct[tabl.FullName],struct,AddedOffset,AddedName) else local copy=createStructure(tabl.FullName) ue4createstructfast(tabl,nil,nil,isfullname,copy) LocalStruct[tabl.FullName]=copy copyStruct(LocalStruct[tabl.FullName],struct,AddedOffset,AddedName) end return end --print(tostring(tabl)) local isUserDefinedStruct=string.find(tabl.Type,'UserDefinedStruct') local e,typ,propname while(true)do if not tabl then break end if type(tabl)==type(1) or tabl.Name=='Object' then break end print(tostring(tabl.Type)..' '..tostring(tabl.FullName)) if tabl.Member then for i=1,#tabl.Member do if tabl.Member[i].Type~='Function' then if isfullname then e.Name=string.format('%s %s%s',tabl.Member[i].Type,AddedName,tabl.Member[i].FullName) else propname=AddedName..tabl.Member[i].Name if isUserDefinedStruct then propname=propname:sub(1,string.find(propname,'_')-1) end end if tabl.Member[i].Type=='StructProperty' then ue4createstructfast(tabl.Member[i].Property,nil,nil,isfullname,struct,tabl.Member[i].Offset+AddedOffset,propname..'.',depth,callernum) if not getElementByOffset(struct,tabl.Member[i].Offset+AddedOffset) then e=struct.addElement() e.Offset=tabl.Member[i].Offset+AddedOffset e.Name=propname e.Vartype=vtDword end else e=struct.addElement() e.Offset=tabl.Member[i].Offset+AddedOffset typ=tabl.Member[i].Type e.Name=propname e.Vartype=ue4type[typ] if e.Vartype==nil then e.Vartype=vtDword end if typ=='ArrayProperty' or typ=='MapProperty' then local isMap= Typ=='MapProperty' local Typ=tabl.Member[i].Property[1].Type if Typ=='StructProperty' then propname=tabl.Member[i].Property[1].Property.Name..'[]' else propname=tabl.Member[i].Property[1].Name..'[]' end if not ArrayStruct then ArrayStruct={} end if ArrayStruct[propname] then e.setChildStruct(ArrayStruct[propname]) else local stru=createStructure(propname) stru.beginUpdate() local ppsize=0 if isMap then for p=1,#tabl.Member[i].Property do ppsize=(tabl.Member[i].Property[p].Size<4 and 4 or tabl.Member[i].Property[p].Size)+ppsize end ppsize=ppsize+0x8 end for p=1,#tabl.Member[i].Property do local PropName=tabl.Member[i].Property[p].Name local Typ=tabl.Member[i].Property[p].Type local psize=isMap and ppsize or tabl.Member[i].Property[p].Size local Offs=isMap and tabl.Member[i].Property[p].Offset or 0 for l=0,10 do Off=l*psize+Offs local ItemName=string.format('[%u] ',l) if Typ=='StructProperty' then ue4createstructfast(tabl.Member[i].Property[p].Property,nil,nil,isfullname,stru,Off,ItemName,depth,callernum) --if not getElementByOffset(stru,Off) then g=stru.addElement() g.Offset=Off g.Name=ItemName..PropName g.Vartype=vtDword end else g=stru.addElement() g.Offset=Off g.Name=ItemName..PropName if not ue4type[Typ] then g.Vartype=vtDword else g.Vartype=ue4type[Typ]end end end end stru.endUpdate() if stru.Count>1 then fillstruct4bytes(stru) e.setChildStruct(stru) ArrayStruct[propname]=stru else stru:Destroy()end end local f=struct.addElement() f.Offset=e.Offset+8-sub f.Name=e.Name..'_size' f.Vartype=vtDword f=struct.addElement() f.Offset=e.Offset+0xC-sub f.Name=e.Name..'_sizes' f.Vartype=vtDword elseif typ=='BoolProperty' then e.ChildStructStart=tabl.Member[i].BitField end end end end end depths=depths+1 if depths>depth then break end tabl=tabl.Parent end if AddedName~='' then return end struct.endUpdate() fillstruct4bytes(struct) if isGlobal then StructList[#StructList+1]=struct end local count=#RunningStruct for i=1,count do if RunningStruct[i]==RunningStructName then RunningStruct[i]=nil end if not RunningStruct[i] and RunningStruct[i+1] then RunningStruct[i]=RunningStruct[i+1] RunningStruct[i+1]=nil end end end function uecreatestruct(instance,name,depth,isfullname) local pointer=readPointer(instance+UObject.Class) local classname=GetFullNameSafeAlgo(pointer) if not classname then print('instance is invalid') return end if classname:find(' ') then classname=classname:sub(classname:find(' ')+1) end print(string.format("createThread(ue4createstruct(\'%s\',\'%s\',0))",classname,name)) ue4createstruct(pointer,name,depth,isfullname) end function ue_structureDissectOverrideCallback(Struct, Instance) --print('banana2') local name,fullname,class address,name,fullname,class=ue_findRealStartOfObject(Instance) if class then -- print('banana3') --if UEObj and (not enumUEObjIsRunning or enumUEObjIsUpdateOnly) then ue4createstructfast(fullname,nil,nil,nil,Struct) end SaveAndRemoveStruct() ue4createstruct(class,nil,nil,nil,Struct,nil,nil,Instance) --LoadStruct() if Struct.Count>1 then return true else return false end end --ue_fillstruct(readPointer(Instance+UObject.Class),structure) --print('banana4') return nil end function ue_structureNameLookupCallback(address) --print('banana1') local name,fullname address,name,fullname=ue_findRealStartOfObject(address) if name then return name,address end return nil end function ue_SymbolLookupCallback(symbol) --print('banana1') local str='Function ' if string.find(symbol,str) then symbol=symbol:sub(string.find(symbol,str)+str:len(),symbol:len()) local pointer=StaticFindObjectAlgo(symbol) if pointer then return readPointer(pointer+UObject.funct)end end return nil end function ue_findRealStartOfObject(address) local pointer=readPointer(address+UObject.Class) if pointer then local FullName=GetFullNameSafeAlgo(pointer) if FullName then local Name=GetNameAlgo(pointer) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) Name=Name:sub(string.find(Name,' ')+1,Name:len()) return address,Name,FullName,pointer end end if UEObj and (not enumUEObjIsRunning or enumUEObjIsUpdateOnly) then for i=1,#UEObj do if UEObj[i].MemberSize and UEObj[i].Class and UEObj[i].Class.MemberSize and UEObj[i].Class.MemberSize>0 and not string.find(UEObj[i].Class.FullName,'/Script/CoreUObject.') then if address>=UEObj[i].Address and address<UEObj[i].Address+UEObj[i].Class.MemberSize then local name return UEObj[i].Address,UEObj[i].Class.Name,UEObj[i].Class.FullName,UEObj[i].Class.Address end end end end return address end function enumUEObjT(file,size,i,start,stop) local datatable,Address,FName,Name,FullName,typ,typ1,isProperty,l,pointer,stri,num,isPropertyc,EObj,k=0 local Class,ObjectId,super,Offset,nextmember,member,propsize,bitmask,Property,Outer=UObject.Class,UObject.ObjectId,UObject.super,UObject.Offset,UObject.nextmember,UObject.member,UObject.propsize,UObject.bitmask,UObject.Property,UObject.Outer local UEver=UE4ver local pointersize= targetIs64Bit() and 8 or 4 for j=start,stop do if UObjectMul then datatable={} for m=1,8 do if not GUObjectDict[i][j*UObjectMul+m] then break end datatable[m]=GUObjectDict[i][j*UObjectMul+m] end Address=byteTableToQword(datatable) elseif UE4ver<11 and targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x8+m] then break end datatable[m]=GUObjectDict[i][j*0x8+m] end Address=byteTableToQword(datatable) elseif UE4ver<11 then datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end Address=byteTableToDword(datatable) elseif targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x18+m] then break end datatable[m]=GUObjectDict[i][j*0x18+m] end Address=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x10+m] then break end datatable[m]=GUObjectDict[i][j*0x10+m] end Address=byteTableToDword(datatable) end if Address and Address~=0 then objid=readInteger(Address+ObjectId) if objid then if objid<size then FullName=GetFullNameSafeAlgo(Address) if FullName then isProperty=false typ1=FullName:sub(1,string.find(FullName,' ')-1) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len()) isProperty=true elseif string.find(FullName,'%.') then Name=FullName:sub(string.find(FullName,'%.')+1,FullName:len()) else Name=FullName end if UEObjIndex[FullName] and UEObj[UEObjIndex[FullName]] then UEObj[UEObjIndex[FullName]].Address=Address else EObj={} EObj.Address=Address EObj.Id=objid EObj.Class=temp[readPointer(Address+Class)] EObj.Type=typ1 EObj.FullName=FullName EObj.Name=Name if isProperty then isProperty=readPointer(Address+Outer) if isProperty and isProperty~=0 then EObj.Outer=isProperty EObj.Size=readInteger(Address+propsize) EObj.Offset=readInteger(Address+Offset) if typ1=='BoolProperty' then EObj.BitField=readBytes(Address+bitmask,1) elseif typ1=='StructProperty' or typ1=='ObjectProperty' then EObj.Property=readPointer(Address+Property) elseif typ1=='MapProperty' or typ1=='ArrayProperty' then EObj.Property={} local count= typ1=='MapProperty' and 1 or 0 for p=0,count do local prop=readPointer(Address+Property+p*8) FullName=GetFullNameSafeAlgo(prop) if FullName then typ=FullName:sub(1,string.find(FullName,' ')-1) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len()) else Name=FullName end if string.find(Name,'%:') then Name=Name:sub(string.find(Name,'%:')+1,Name:len())end local Prop={} Prop.Address=prop Prop.Type=typ Prop.FullName=FullName Prop.Name=Name Prop.Size=readInteger(prop+propsize) Prop.Offset=readInteger(prop+Offset) if typ=='BoolProperty' then Prop.BitField=readBytes(prop+bitmask,1) elseif typ=='StructProperty' or typ=='ObjectProperty' then Prop.Property=readPointer(prop+Property)end EObj.Property[p+1]=Prop end end end else print(FullName..' nil outer') end end Parent=readPointer(Address+super) if Parent and Parent~=0 then EObj.Parent=Parent end temp[Address]=EObj if UEver>=25 then k=1 EObj.MemberSize=readInteger(Address+member+pointersize) Address=readPointer(Address+member) EObj.Member={} while(true)do if UEver>=25 then FullName=GetFullNameSafeAlgo(Address) else FullName=GetFullNameSafeAlgo(Address) end if not FullName then break end typ=FullName:sub(1,string.find(FullName,' ')-1) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len()) else Name=FullName end EObj.Member[k]={} EObj.Member[k].Address=Address EObj.Member[k].Type=typ EObj.Member[k].FullName=FullName EObj.Member[k].Name=Name EObj.Member[k].Size=readInteger(Address+propsize) EObj.Member[k].Offset=readInteger(Address+Offset) if typ=='BoolProperty' then EObj.Member[k].BitField=readBytes(Address+bitmask,1) elseif typ=='StructProperty' or typ=='ObjectProperty' then EObj.Member[k].Property=readPointer(Address+Property) elseif typ=='MapProperty' or typ=='ArrayProperty' then EObj.Member[k].Property={} for p=0,1 do local prop=readPointer(Address+Property+p*8) FullName=GetFullNameSafeAlgo(prop) if FullName then typ=FullName:sub(1,string.find(FullName,' ')-1) FullName=FullName:sub(string.find(FullName,' ')+1,FullName:len()) if string.find(FullName,'%:') then Name=FullName:sub(string.find(FullName,'%:')+1,FullName:len()) else Name=FullName end if string.find(Name,'%:') then Name=Name:sub(string.find(Name,'%:')+1,Name:len())end local Prop={} Prop.Address=prop Prop.Type=typ Prop.FullName=FullName Prop.Name=Name Prop.Size=readInteger(prop+propsize) Prop.Offset=readInteger(prop+Offset) if typ=='BoolProperty' then Prop.BitField=readBytes(prop+bitmask,1) elseif typ=='StructProperty' or typ=='ObjectProperty' then local propt=readPointer(prop+Property) if propt then Prop.Property=propt end end EObj.Member[k].Property[p+1]=Prop end end if #EObj.Member[k].Property==0 then EObj.Member[k].Property=nil end end Address=readPointer(Address+nextmember) k=k+1 end if #EObj.Member==0 then EObj.Member=nil end end UEObj[#UEObj+1]=EObj UEObjIndex[EObj.FullName]=#UEObj+1 end end end end end end --print(i..':'..k) end function enumUEObj(isSilent,isUpdateOnly) if isUpdateOnly then enumUEObjIsUpdateOnly=true end enumUEObjIsRunning=true local sub=targetIs64Bit() and 0 or 4 ue4parsetablecheck() local count=0x200 local size=GUObjectsize local sizess= targetIs64Bit() and (UE4ver>11 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count) local starttime=os.time() if not isUpdateOnly then UEObj={} UEObjIndex={} end temp={} for i=1,#GUObjectDict do local num,start,stop=count,0,0 for j=0,math.floor(#GUObjectDict[i]/sizess+0.5) do start=stop stop=stop+num createThread(enumUEObjT(file,size,i,start,stop-1)) end end if not isUpdateOnly then if UE4ver>=25 then for i=1,#UEObj do if UEObj[i].Parent then if temp[UEObj[i].Parent] then UEObj[i].Parent=temp[UEObj[i].Parent] end end if UEObj[i].Member then for j=1,#UEObj[i].Member do if UEObj[i].Member[j].Property then if temp[UEObj[i].Member[j].Property] then UEObj[i].Member[j].Property=temp[UEObj[i].Member[j].Property] elseif type(UEObj[i].Member[j].Property)==type({}) then for p=1,#UEObj[i].Member[j].Property do if temp[UEObj[i].Member[j].Property[p].Property] then UEObj[i].Member[j].Property[p].Property=temp[UEObj[i].Member[j].Property[p].Property] elseif UEObj[i].Member[j].Property[p].Property then print(string.format('%X no object?',UEObj[i].Member[j].Property[p].Property)) elseif UEObj[i].Member[j].Property[p].Type=='StructProperty' or UEObj[i].Member[j].Property[p].Type=='ObjectProperty' then print(string.format('%s %s no property?',UEObj[i].Member[j].Property[p].Type,UEObj[i].Member[j].Property[p].FullName)) end end end end end end end else for i=1,#UEObj do if UEObj[i].Parent then if temp[UEObj[i].Parent] then UEObj[i].Parent=temp[UEObj[i].Parent] end end if UEObj[i].Outer then if temp[UEObj[i].Outer]then if temp[UEObj[i].Property] then UEObj[i].Property=temp[UEObj[i].Property] elseif type(UEObj[i].Property)==type({}) then for p=1,#UEObj[i].Property do if temp[UEObj[i].Property[p].Property] then UEObj[i].Property[p].Property=temp[UEObj[i].Property[p].Property] else print(string.format('%X no object?',UEObj[i].Property[p].Property)) end end end if not temp[UEObj[i].Outer].Member then temp[UEObj[i].Outer].Member={}end temp[UEObj[i].Outer].Member[#temp[UEObj[i].Outer].Member+1]=UEObj[i] else print(UEObj[i].FullName..' missing outer') end end end end end temp=nil enumUEObjIsUpdateOnly=false enumUEObjIsRunning=false if not isSilent then print(string.format('\nA Total of %u objects had been enumerated in %u seconds',#UEObj,os.time()-starttime))end end function findOpcodes(address,opcode,size) if not size then size=0x50 end address=getAddressSafe(address) if not address then return nil end local addr={} local i=0 local j=1 while(i<size) do local ext, opc, byt, add=splitDisassembledString(disassemble(address+i)) if string.find(opc,opcode) then addr[j]=address+i j=j+1 end i=i+getInstructionSize(address+i) end return addr end function findLastCall(address,size) if not size then size=0x1000 end local result=findOpcode(address,'ret',size) if not result then print(address..' cant find ret?') return nil end result=result-getAddress(address) result=findOpcodes(address,'call ',result) local ext, opc, byt, add=splitDisassembledString(disassemble(result[#result])) opc=opc:gsub('call ','') return opc end function followjmp(address,size) if not size then size=0x1000 end local result=findOpcode(address,'jmp ',size) if not result then print(address..' cant find jmp?') return nil end local ext, opc, byt, add=splitDisassembledString(disassemble(result)) opc=opc:gsub('jmp ','') return opc end function followcall(address,size) if not size then size=0x1000 end local result=findOpcode(address,'call ',size) if not result then print(address..' cant find call?') return nil end local ext, opc, byt, add=splitDisassembledString(disassemble(result)) opc=opc:gsub('call ','') return opc end --local ext, opc, byt, add=splitDisassembledString(disassemble(findOpcodes('/Script/Astro.PrinterComponent:UpdatePreprinting_exec','call')[1])) --return opc:sub(string.find(opc,' ')+1,opc:len()) function groupscan(value,modulename,stopaddress) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end ms.firstScan(soExactValue,vtGrouped,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function pointerscan(value,modulename,stopaddress,value2) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end print(modulename..'~'..stopaddress) if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function UEfindInstancesOfClass(fullnameOrAddress) local class,Name,address,Typ=UObject.Class local results,j={},1 if type(fullnameOrAddress)==type('')then address=StaticFindObjectAlgo(fullnameOrAddress) else address=fullnameOrAddress end local result,result2=pointerscan(address) for i=1,#result do Name=GetFullNameSafeAlgo(getAddress(result[i])-class) if not Name then Name=GetFullNameSafeAlgo(getAddress(result[i])-UObject.super)end if Name and Name~='None' then Typ=Name:sub(1,string.find(Name,' ')-1) if string.find(Typ,'Class') then result2=pointerscan(getAddress(result[i])-UObject.super) for k=1,#result2 do Name=GetFullNameSafeAlgo(getAddress(result2[k])-class) if not Name then Name=GetFullNameSafeAlgo(getAddress(result2[k])-UObject.super)end if Name and Name~='None' then results[j]={} results[j].Name=Name results[j].Address=math.floor(getAddress(result2[k])-class) j=j+1 end end else results[j]={} results[j].Name=Name results[j].Address=math.floor(getAddress(result[i])-class) j=j+1 end end end --for i,v in ipairs(result) do result[i]=tonumber(v,16)-class end return results end function StructAddToListSymbol(StructName,StartOffset,StopOffset,BaseAddress,OffsetOnly) if not StartOffset then StartOffset=0 end if not StopOffset then StopOffset=0xFFFFFF end local structCount=getStructureCount() local struct for i=0,structCount-1 do local stru=getStructure(i) if stru.Name==StructName then struct=stru break end end if struct then for i=0,struct.Count-1 do local e=struct.Element[i] if e.Offset>=StartOffset and e.Offset<=StopOffset then local rec=getAddressList().createMemoryRecord() rec.setDescription(e.Name) if OffsetOnly then if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.Offset[0]=e.Offset else rec.setAddress(string.format('+%X',e.Offset))end else if BaseAddress then rec.setAddress(BaseAddress) rec.OffsetCount=1 rec.OffsetText[0]=StructName..'.'..e.Name else rec.setAddress(string.format('+%s.%s',StructName,e.Name))end end rec.Type=e.Vartype end end end end function getInsForJump(address,registername,destination,allocsize,SharedMemoryName) address = getAddressSafe(address) if not address then error('getInsForJump address nil') return end if not allocsize then allocsize=4096 end destination=getAddressSafe(destination) if not destination then if not SharedMemoryName then destination = allocateMemory(allocsize,address) else destination = allocateSharedMemory(SharedMemoryName,allocsize) end end local size = (address+5-destination>0x7FFFFFFF) and 14 or 5 if registername then unregisterSymbol(registername) registerSymbol(registername,destination,true) end local opcodes = {} local i = 0 while(i<size) do local ext, opc=splitDisassembledString(disassemble(address+i)) opcodes[#opcodes+1] = opc i=i+getInstructionSize(address+i) end local copy = table.concat(opcodes,'\r\n') local readAsTable = true local byt = readBytes(address,i,readAsTable) for j=1,#byt do byt[j] = ('%02X'):format(byt[j]) end local bytes = table.concat(byt, ' ') return i,copy,bytes,size,destination end function enablescript(name,registername,addressname,script,disable) local address=getAddress(addressname) if disable then script=(script):format(address,registername,readBytes(registername,1)) else local i,copy,bytes,size =getInsForJump(address,name) script=(script):format(registername, registername, name, copy, registername, i, bytes, address)..string.rep('nop\n',i-size)..'returnhere:' end local success,erro=autoAssembleCheck(script) if not success then print('\n'..erro..'\n')local scriptstr=createStringlist()scriptstr.Text=script for j=0,scriptstr.Count-1 do print(string.format('%u\t%s',j+1,scriptstr[j])) end if not disable then deAlloc(name)unregisterSymbol(name)end error(name..' autoAssemble failed')end autoAssemble(script) if disable then deAlloc(name)unregisterSymbol(name)unregisterSymbol(registername)end end function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode') if force~=nil then state = not force end compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode' getMainForm().Splitter1.Visible = state getMainForm().Panel4.Visible = state getMainForm().Panel5.Visible = state end function addCompactMenu() if compactmenualreadyexists then return end local parent = getMainForm().Menu.Items compactmenuitem = createMenuItem(parent) parent.add(compactmenuitem) compactmenuitem.Caption = 'Compact View Mode' compactmenuitem.OnClick = cycleFullCompact compactmenualreadyexists = 'yes' end addCompactMenu() --cycleFullCompact(nil,true) if syntaxcheck then return end [ENABLE] if not process or not enumModules()[1] then print('Error: No process selected...') error('process is nil') end if string.find(process,'MassEffect') then isMassEffect=true --findAddress('GUObjectArray',1,'4C * * * * * * 49 3B * 0F 84 * * * * 48 89 * * * 48 89banana',process) --print('------------------') local result2,result=findAddress('FNamePool',0,'C0 CA 45 80 00 00 00 00 00 00 00 00 4E 6F 6E 65 00banana',process,nil,0,true) for i=1,#result2 do result=pointerscan(getAddress(result2[i]),process) for j=1,#result do stringoffset=0xC unregisterSymbol('FNamePool') registerSymbol('FNamePool',result[j],true) end end else isMassEffect=nil end local starttime=os.time() if not UE4ver then UE4ver=ue4versioncheck() end if not getAddressSafe('GUObjectArray') and not getAddressSafe('FNamePool') then if targetIs64Bit() then local address=findAddress('GUObjectArray',0,'44 8B * * * 48 8D 05 * * * * * * * * * 48 89 71 10banana',process,nil,0,true)[1] if not address then address=findAddress('GUObjectArray',0,'40 53 48 83 EC 20 48 8B D9 48 85 D2 74 * 8Bbanana',process,nil,0,true)[1]end if not address then address=findAddress('GUObjectArray',0,'4C 8B 05 * * * * 45 3B 88banana',process,nil,0,true)[1]end if not address then findAddress('GUObjectArray','1,-0x68','4C 8B 44 24 60 8B 44 24 78 * * * 48 8Dbanana',process) else findAddress('GUObjectArray',1,address)end if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18 elseif readInteger('GUObjectArray+14')==0 then UE4ver=9 else UE4ver=20 end end ue4config() if UE4ver>=23 then address=findAddress('FNamePool',0,'4C 8D 05 * * * * EB 16 48 8D 0D * * * * E8banana',process,nil,0,true)[1] if not address then address=findAddress('FNamePool',0,'48 8D 0D * * * * E8 * * * * 4C 8B C0 C6banana',process,nil,0,true)[1]end if address then findAddress('FNamePool',1,address) else error('FNamePool aob not found...')end elseif string.find(process,'StateOfDecay2')then findAddress('FNamePool',1,'48 8D * * * * * 8B * * 85 * 74 * 8Dbanana',process,nil,1,nil,true,true) findAddress('FNamePool2',3,'48 8D * * * * * 8B * * 85 * 74 * 8Dbanana',process,nil,1,nil,true,true) FNamePool=getAddress('FNamePool') FNamePool2=getAddress('FNamePool2') else address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[2] if not address then address=findAddress('FNamePool',0,'48 83 EC 28 48 8B 05 * * * * 48 85 C0 75 * B9 * * 00 00 48 89 5C 24 20 E8banana',process,nil,0,true)[1] end if address then findAddress('FNamePool',1,address) else findAddress('FNamePool',1,'C3 * DB 48 89 1D * * * * * * 48 8B 5C 24 20banana',process,nil,2)end end else ue4config() if UE4ver>2 then findAddress('GUObjectArray',1,'8B 44 24 04 56 8B F1 85 C0 74 17 8B 40 08banana',process) findAddress('FNamePool',1,'33 F6 89 35 * * * * 8B C6 5Ebanana',process,nil,1,nil,true,true) else findAddress('FNamePool',1,'8B 07 8B 0D * * * * 8B 04 81banana',process) findAddress('GUObjectArray',1,'8B 15 * * * * 8B 04 82 85banana',process) end end end if targetIs64Bit() then if UE4ver>7 then local address=findAddress('GEngine',0,'41 B8 01 00 00 00 * * * 48 8B 0D * * * * E8 * * * * 48 85 C0banana',process,nil,0,true)[1] if not address then address=findAddress('GEngine',0,'48 8B 1D * * * * 48 85 DB 74 * 48 8Dbanana',process,nil,0,true)[1]end if not address then error('GEngine aob not found...')end findAddress('GEngine',1,address) --findAddress('GEngine',1,'41 B8 01 00 00 00 * * * 48 8B 0D * * * * E8 * * * * 48 85 C0banana',process) end else if UE4ver>2 then findAddress('GEngine',1,'56 8B 35 * * * * 85 F6 74banana',process) else findAddress('GEngine',1,'56 8B 35 * * * * 85 F6 74banana',process) end end print('AOBScan done : '..os.time()-starttime) ue4parsetable() FNameStringAlgo(1,true) FNameStringAlgo(3,true) if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end print('Table parsing done : '..os.time()-starttime) if UE4ver>7 then UE4AutoConfig() else UE3AutoConfig() end --findAddress('GWorld',1,'4D 8B 94 24 50 0C 00 00banana',process) if UE4ver>7 then ue4createstruct({ '/Script/Engine.GameEngine', '/Script/Engine.GameViewportClient', '/Script/Engine.GameInstance', '/Script/Engine.LocalPlayer', '/Script/Engine.PlayerController', '/Script/Engine.CharacterMovementComponent', '/Script/Engine.CapsuleComponent', '/Script/Engine.Character', '/Script/Engine.World' },{ 'GameEngine', 'GameViewportClient', 'GameInstance', 'LocalPlayer', 'PlayerController', 'MovementComponent', 'CapsuleComponent', 'GPlayer', 'World' },1) end createThread(BasicEnumObject()) print('All done : '..os.time()-starttime..'\n') if not ue_SymbolLookupCallbackID then ue_SymbolLookupCallbackID=registerSymbolLookupCallback(ue_SymbolLookupCallback,slNotSymbol) end --registerFuncAlgo() GetLuaEngine().close() [DISABLE] --cycleFullCompact(nil,false) unregisterSymbolLookupCallback(ue_SymbolLookupCallbackID) ue_SymbolLookupCallbackID=nil --[[ unregisterSymbol('GEngine') unregisterSymbol('GUObjectArray') unregisterSymbol('FNamePool')]] 26076 "Enable ue_structureDissectCallback (Experimental)" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] if not ue_structureDissectOverrideCallbackID then ue_structureDissectOverrideCallbackID=registerStructureDissectOverride(ue_structureDissectOverrideCallback) end if not ue_structureNameLookupCallbackID then ue_structureNameLookupCallbackID=registerStructureNameLookup(ue_structureNameLookupCallback) end --[[ UEObjt=createThread(function() while(true)do if not UEObj and not enumUEObjIsRunning then enumUEObj(1) elseif not enumUEObjIsRunning then enumUEObj(1,1)end sleep(30000) end end) ]] [DISABLE] unregisterStructureDissectOverride(ue_structureDissectOverrideCallbackID) unregisterStructureNameLookup(ue_structureNameLookupCallbackID) ue_structureDissectOverrideCallbackID=nil ue_structureNameLookupCallbackID=nil --UEObjt:terminate() 26108 "Basic UE Object Dumper Algo" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] local Offset,ObjectId,nextmember,member,Property=UObject.Offset,UObject.ObjectId,UObject.nextmember,UObject.member,UObject.Property local enumoffset,enummul,enumname,enumindex=UObject.enumoffset,UObject.enummul,UObject.enumname,UObject.enumindex function ue4dump(file,size,i,start,stop) --print(start..' ~ '..stop) local k=0 local pointer,datatable,pointers,propname,offset,list,str,strid,name,objid for j=start,stop do if UObjectMul then if targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*UObjectMul+m] then break end datatable[m]=GUObjectDict[i][j*UObjectMul+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) end elseif UE4ver<11 and targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x8+m] then break end datatable[m]=GUObjectDict[i][j*0x8+m] end pointer=byteTableToQword(datatable) elseif UE4ver<11 then datatable={} for m=1,4 do if not GUObjectDict[i][j*0x4+m] then break end datatable[m]=GUObjectDict[i][j*0x4+m] end pointer=byteTableToDword(datatable) elseif targetIs64Bit() then datatable={} for m=1,8 do if not GUObjectDict[i][j*0x18+m] then break end datatable[m]=GUObjectDict[i][j*0x18+m] end pointer=byteTableToQword(datatable) else datatable={} for m=1,4 do if not GUObjectDict[i][j*0x10+m] then break end datatable[m]=GUObjectDict[i][j*0x10+m] end pointer=byteTableToDword(datatable) end if pointer and pointer~=0 then local objid=readInteger(pointer+ObjectId) if objid and readPointer(readPointer(pointer)) then --if objid<size then str=string.format('%016X',pointer) strid=string.format('%08u',objid) if UObject.super then name=GetFullNameSuperAlgo(pointer,true) else name=GetFullNameSafeAlgo(pointer,true)end if name then typ=name:sub(1,string.find(name,' ')-1) if string.find(typ,'Property') then if (typ=='StructProperty' or string.find(typ,'ObjectProperty') or string.find(typ,'ArrayProperty') ) and Property then name=hasProperty(pointer) end strid=string.format('%8X',readInteger(pointer+Offset)) end file:write(string.format('[%s] %s %s\n',strid,str,name)) if (typ=='UserDefinedEnum' or typ=='Enum') and enummul then list=pointer+enumoffset for i=0,readInteger(list+8-sub)-1 do pointers=readPointer(list)+i*enummul offset=readBytes(pointers+enumindex,1) if offset==0 then offset=i end propname=FNameStringAlgo(pointers+enumname) strid=string.format('%8X',offset) str=string.format('%016X',pointers) file:write(string.format('[%s] %s %s\n',strid,str,propname)) end elseif ( typ=='MapProperty' or string.find(typ,'ArrayProperty') ) and Property then for n=0,1 do pointers=readPointer(pointer+n*8+Property) propname=hasProperty(pointers) if propname then offset=readInteger(pointers+Offset) strid=string.format('%8X',offset) str=string.format('%016X',pointers) file:write(string.format('[%s] %s %s\n',strid,str,propname)) end end end if UE4ver>=25 then local pointers= readPointer(pointer+member) while(true)do propname=GetFullNameSafeAlgo(pointers) if not propname then break end offset=readInteger(pointers+Offset) strid=string.format('%8X',offset) str=string.format('%016X',pointers) typ=propname:sub(1,string.find(propname,' ')-1) if typ=='StructProperty' or string.find(typ,'ObjectProperty') or string.find(typ,'ArrayProperty') then propname=hasProperty(pointers) end file:write(string.format('[%s] %s %s\n',strid,str,propname)) if typ=='MapProperty' or string.find(typ,'ArrayProperty') then for n=0,2 do pointer=readPointer(pointers+n*8+Property) propname=hasProperty(pointer) if propname then offset=readInteger(pointer+Offset) strid=string.format('%8X',offset) str=string.format('%016X',pointer) file:write(string.format('[%s] %s %s\n',strid,str,propname)) end end end pointers=readPointer(pointers+nextmember) end end k=k+1 else file:write(string.format('[%s] %s Invalid Object\n',strid,str)) end --end end end end totalobject=totalobject+k --print(i..':'..k) end local sub=targetIs64Bit() and 0 or 4 ue4parsetablecheck() local count=0x200 local size=GUObjectsize local sizess= targetIs64Bit() and (UE4ver>10 and 0x18*count or 0x8*count) or (UE4ver>11 and 0x10*count or 0x4*count) local starttime=os.time() local Path = 'C:\\Users\\'..os.getenv('USERNAME')..'\\Desktop\\' local filename= string.format('[%s] ObjectsDump.txt',process) local file,err = io.open(Path..filename, 'w') assert(file,err) file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date())) --local re={rei1,rei2,rei3,rei4,rei5} totalobject=0 --allobject=createStringlist() for i=1,#GUObjectDict do local num,start,stop=count,0,0 for j=0,math.floor(#GUObjectDict[i]/sizess+0.5) do start=stop stop=stop+num createThread(ue4dump(file,size,i,start,stop-1)) end end file:close() print(string.format('\nA Total of %u objects had been dumped in %u seconds',totalobject,os.time()-starttime)) print(Path..filename) [DISABLE] 26051 "Basic UE Name Dumper Algo" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function uenamedump(file,start,stop) for i=start,stop do local name=FNameStringAlgo(i,true) if name and name:len()<200 and name:len()>3 and not string.find(name,'%c') then --print(name) local strid=string.format('%08X',i) file:write(string.format('[%s] %s\n',strid,name)) totalname=totalname+1 end end end local size if readPointer(FNameString) or string.find(process,'StateOfDecay2')then size=0xFFFFFFFF elseif UE4ver>=23 then size=(#FNameDict<<0x10)-1 elseif UE4ver>2 then size=(#FNameDict<<0xE)-1 else size=math.floor(#FNameDict[1]/4) end local count=0x200 size=math.floor((size/count)+0.5) local starttime=os.time() local Path = 'C:\\Users\\'..os.getenv('USERNAME')..'\\Desktop\\' local filename= string.format('[%s] NamesDump.txt',process) local file,err = io.open(Path..filename, 'w') assert(file,err) file:write(string.format('Process: %s\nUE version: %.2f\nTimeStamp: %s\n\n',process,UE4ver,os.date())) totalname=0 ue4parsetablecheck() local num,start,stop=count,0,0 for i=0,size do start=stop stop=stop+num createThread(uenamedump(file,start,stop-1)) end file:close() print(string.format('\nA Total of %u names had been dumped in %u seconds',totalname,os.time()-starttime)) print(Path..filename) [DISABLE] 26081 "Construct Console" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function AAscript(script) local success,erro=autoAssembleCheck(script) if not success then print('\n'..erro..'\n') local scriptstr=createStringlist()scriptstr.Text=script for j=0,scriptstr.Count-1 do print(string.format('%u\t%s',j+1,scriptstr[j])) end error('autoAssemble failed') end autoAssemble(script) end AAscript("aobscanmodule(StaticConstructObject,$process,4C ?? ?? ?? ?? 55 53 56 57 41 54 41 55 41 56 41 57 48 8D ?? ?? ?? ?? ?? ?? 48 81 ?? ?? ?? ?? ?? 48 8B ?? ?? ?? ?? ?? 48 33 ?? 48 89)\nregistersymbol(StaticConstructObject)") local StaticConstructObject=getAddress('StaticConstructObject') local Console=executeCodeEx ( 0,nil, getAddress(StaticConstructObject), getAddress('[[GEngine]+GameEngine.ConsoleClass]'), getAddress('[[GEngine]+GameEngine.GameViewport]'), 0,0,0,0,0,0,0 ) writePointer('[[GEngine]+GameEngine.GameViewport]+GameViewportClient.ViewportConsole',Console) [DISABLE] --"NewObject with empty name can't be used to create default subobjects" 26091 "Get GEngine " Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] unregisterSymbol('GEngine') --[[ local result=UEfindInstancesOfClass('/Script/Engine.GameEngine') for i=1,#result do print(string.format('%X:%s',result[i].Address,result[i].Name)) if string.find(result[i].Name,'e_') then registerSymbol('GEngine',pointerscan(result[i].Address,process)[1]) end end ]] --[[ BasicEnumObject() for i=1,#ObjectTable do if string.find(ObjectTable[i].Type,'GameEngine') and not string.find(ObjectTable[i].FullName,'Default') then print(string.format('%X:%s',ObjectTable[i].Address,GetFullNameSafeAlgo(ObjectTable[i].Address))) registerSymbol('GEngine',pointerscan(ObjectTable[i].Address,process)[1]) break end if i==#ObjectTable then print('GameEngine instance not found...')end end ]] function FindObjectName(name) for i=1,#ObjectTable do if string.find(ObjectTable[i].FullName,name) then return ObjectTable[i]end end end function FindObjectType(name,exception) for i=1,#ObjectTable do if string.find(ObjectTable[i].Type,name) and not string.find(ObjectTable[i].FullName,exception) then return ObjectTable[i]end end end --ue4parsetable() --BasicEnumObject() local Object=FindObjectName('GameEngine') for i=0,4 do if Object.Uper and Object.Uper[1] then Object=Object.Uper[1] else break end end Object=Object.FullName:sub(string.find(Object.FullName,'%.')+1,Object.FullName:len()) Object=FindObjectType(Object,'Default') print(string.format('%X : %s %s',Object.Address,Object.Type,Object.FullName)) registerSymbol('GEngine',pointerscan(Object.Address,process)[1],true) [DISABLE] 26040 "NoClip & Fly Numpad6 :Toggle, Space :Up, LeftCtrl :Down" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bActorEnableCollision') if address then local bActorEnableCollision=readBytes(address,1) & ~ ChildStructStart('PlayerController','bActorEnableCollision') writeBytes(address,bActorEnableCollision) end --[[ Enum /Script/Engine.EMovementMode 0:MOVE_None 1:MOVE_Walking 2:MOVE_NavWalking 3:MOVE_Falling 4:MOVE_Swimming 5:MOVE_Flying 6:MOVE_Custom 7:MOVE_MAX local list=+0x40 for i=0,readInteger(list+8)-1 do local pointer=readPointer(list)+i*0x10 local enum=readInteger(pointer+8) local name=FNameString(pointer) print(enum..':'..name) end ]] if not RelativeLocationZoffset then local address=getAddress('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]') local value=readInteger(address+getAddress('CapsuleComponent.RelativeLocation.Z')) local list=groupscan(string.format('4:%u',value),address,address+0x1000) RelativeLocationZoffset={} for i=1,#list do RelativeLocationZoffset[i]=getAddress(list[i])-address end end updown = createTimer() updown.Interval = 5 updown.OnTimer = function(t) local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]') if address then if isKeyPressed(VK_SPACE) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])+20) end end if isKeyPressed(VK_LCONTROL) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i], readFloat(address+RelativeLocationZoffset[i])-20) end end end local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MovementMode') if address then writeBytes(address,5) end end [DISABLE] updown.destroy() local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bActorEnableCollision') if address then local bActorEnableCollision=readBytes(address,1) | ChildStructStart('PlayerController','bActorEnableCollision') writeBytes(address,bActorEnableCollision) end local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MovementMode') if address then writeBytes(address,1) end Toggle Activation 102 0 26041 "WASD" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] wasd = createTimer() wasd.Interval = 5 wasd.OnTimer = function(t) local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CapsuleComponent]') if address then if isKeyPressed(VK_S) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)+20) end end if isKeyPressed(VK_W) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i]-8, readFloat(address+RelativeLocationZoffset[i]-8)-20) end end if isKeyPressed(VK_A) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)+20) end end if isKeyPressed(VK_D) then for i=1,#RelativeLocationZoffset do writeFloat(address+RelativeLocationZoffset[i]-4, readFloat(address+RelativeLocationZoffset[i]-4)-20) end end end end [DISABLE] wasd.destroy() 26039 "bCanBeDamaged false (Godmode) Numpad4 :Deactive, Numpad5 :Active" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] --CanBeDamaged = createTimer() --CanBeDamaged.setInterval(1000) --CanBeDamaged.OnTimer = function() local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bCanBeDamaged') if address then local bCanBeDamaged=readBytes(address,1) & ~ ChildStructStart('PlayerController','bCanBeDamaged') writeBytes(address,bCanBeDamaged) end --end [DISABLE] --CanBeDamaged.destroy() local address=getAddressSafe('[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+PlayerController.bCanBeDamaged') if address then local bCanBeDamaged=readBytes(address,1) | ChildStructStart('PlayerController','bCanBeDamaged') writeBytes(address,bCanBeDamaged) end Activate 101 0 Deactivate 100 1 26025 "Jump Multiplier Numpad0 :Deactive, Numpad1 :Active & Increase" Auto Assembler Script {$lua} jumpmultiplier=1 if syntaxcheck then return end if not jumpdefault then jumpdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity')end if not MaxAccelerationdefault then MaxAccelerationdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration')end if not AirControldefault then AirControldefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl')end [ENABLE] jumpmuti=createHotkey(function()jumpmultiplier=jumpmultiplier+0.5 end,VK_NUMPAD1) jump = createTimer() jump.setInterval(1000) jump.OnTimer = function() local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity') local address2=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration') local address3=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl') if address then writeFloat(address,jumpdefault*jumpmultiplier) writeFloat(address2,MaxAccelerationdefault*jumpmultiplier) writeFloat(address3,AirControldefault*jumpmultiplier) end end [DISABLE] jump.destroy() jumpmuti.destroy() local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.JumpZVelocity') local address2=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxAcceleration') local address3=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.AirControl') if address then writeFloat(address,jumpdefault) writeFloat(address2,MaxAccelerationdefault) writeFloat(address3,AirControldefault) end Activate 97 0 Deactivate 96 1 26026 "WalkSpeed Multiplier Numpad2 :Deactive, Numpad3 :Active & Increase" Auto Assembler Script {$lua} walkmultiplier=1 if syntaxcheck then return end if not walkdefault then walkdefault=readFloat('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed')end [ENABLE] walkpmuti=createHotkey(function() walkmultiplier=walkmultiplier+0.5 end,VK_NUMPAD3) walk = createTimer() walk.setInterval(1000) walk.OnTimer = function() local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed') if address then writeFloat(address,walkdefault*walkmultiplier)end end [DISABLE] walk.destroy() walkpmuti.destroy() local address=getAddressSafe('[[[[[[[GEngine]+GameEngine.GameInstance]+GameInstance.LocalPlayers]]+LocalPlayer.PlayerController]+PlayerController.Character]+GPlayer.CharacterMovement]+MovementComponent.MaxWalkSpeed') if address then writeFloat(address,walkdefault)end Activate 99 0 Deactivate 98 1 26052 "UWorld" 0 1

GEngine

0 GameViewportClient.World GameEngine.GameViewport 25848 "Player" 1

GEngine

0 PlayerController.Character LocalPlayer.PlayerController 0 GameInstance.LocalPlayers GameEngine.GameInstance 25853 "CharacterMovement" 0 1

+GPlayer.CharacterMovement

0 25854 "JumpZVelocity" Float

+MovementComponent.JumpZVelocity

25855 "MaxWalkSpeed" Float

+MovementComponent.MaxWalkSpeed

25857 "MaxWalkSpeedCrouched" Float

+MovementComponent.MaxWalkSpeedCrouched

25858 "MaxAcceleration" Float

+MovementComponent.MaxAcceleration

26049 "Tools" 1 26048 "FNamePool scanner" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function stringscan(value,modulename,stopaddress,isUnicode) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true) ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function pointerscan(value,modulename,stopaddress,value2) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end print(modulename..'~'..stopaddress) if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end print('------------------') local isUnicode=false local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode) for i=1,#strlist do result=stringscan('IntProperty',getAddressSafe(strlist[i]),getAddressSafe(strlist[i]..'+50'),isUnicode) if #result>0 then result=stringscan('None',getAddressSafe(strlist[i]..'-50'),getAddressSafe(strlist[i]),isUnicode) print(strlist[i]) if #result>0 then if string.sub(strlist[i],strlist[i]:len()-3,strlist[i]:len()-2)=='00' then result=pointerscan(getAddressSafe(string.sub(strlist[i],1,strlist[i]:len()-2)..'00')) for j=1,#result do pointer1=readPointer(result[j]..(targetIs64Bit() and '+8' or '+4')) pointer1=readPointer(pointer1) pointer2=readPointer(result[j]..(targetIs64Bit() and '+10' or '+8')) pointer2=readPointer(pointer2) pointer3=readPointer(result[j]..(targetIs64Bit() and '+18' or '+C')) pointer3=readPointer(pointer3) if pointer1 and pointer2 and pointer3 then print(strlist[i]..'<-'..result[j]) unregisterSymbol('FNamePool') registerSymbol('FNamePool',result[j]..'-10',true) if ue4versioncheck()<=2 then UE4ver=23 end if string.sub(result[j],result[j]:len()-1,result[j]:len())=='00' then result2=pointerscan(getAddressSafe(result[j])) for k=1,#result2 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]) result3=pointerscan(getAddressSafe(result2[k]),getAddress(process),getAddress(process)+getModuleSize(process)) for l=1,#result3 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l]) unregisterSymbol('FNamePool') registerSymbol('FNamePool',result3[l],true) if ue4versioncheck()<=2 then UE4ver=22 end goto done end end end end end end end end end ::done:: print('done') [DISABLE] 26096 "FNamePool scanner V2" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function stringscan(value,modulename,stopaddress,isUnicode) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true) ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function pointerscan(value,modulename,stopaddress,value2) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end print(modulename..'~'..stopaddress) if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end print('------------------') local isUnicode=false local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode) for i=1,#strlist do result=stringscan('IntProperty',getAddressSafe(strlist[i]),getAddressSafe(strlist[i]..'+50'),isUnicode) if #result>0 then result=stringscan('None',getAddressSafe(strlist[i]..'-50'),getAddressSafe(strlist[i]),isUnicode) print(strlist[i]) if #result>0 then if string.sub(strlist[i],strlist[i]:len()-3,strlist[i]:len()-2)=='00' then result=pointerscan(getAddressSafe(string.sub(strlist[i],1,strlist[i]:len()-2)..'00'),nil,nil,getAddressSafe(string.sub(strlist[i],1,strlist[i]:len()-2)..'00')+0x50) for j=1,#result do pointer1=readPointer(result[j]..(targetIs64Bit() and '+8' or '+4')) pointer1=readPointer(pointer1) pointer2=readPointer(result[j]..(targetIs64Bit() and '+10' or '+8')) pointer2=readPointer(pointer2) pointer3=readPointer(result[j]..(targetIs64Bit() and '+18' or '+C')) pointer3=readPointer(pointer3) if pointer1 and pointer2 and pointer3 then print(strlist[i]..'<-'..result[j]) unregisterSymbol('FNamePool') registerSymbol('FNamePool',result[j]..'-10',true) if ue4versioncheck()<=2 then UE4ver=23 end --if string.sub(result[j],result[j]:len()-1,result[j]:len())=='00' then result2=pointerscan(getAddressSafe(result[j])) for k=1,#result2 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]) if inModule(result2[k]) then UE4ver=ue4versioncheck() unregisterSymbol('FNamePool') registerSymbol('FNamePool',result2[k],true) goto done end result3=pointerscan(getAddressSafe(result2[k]),getAddress(process),getAddress(process)+getModuleSize(process)) for l=1,#result3 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]..'<-'..result3[l]) unregisterSymbol('FNamePool') registerSymbol('FNamePool',result3[l],true) if ue4versioncheck()<=2 then UE4ver=22 end goto done end end --end end end end end end end ::done:: print('done') [DISABLE] 26099 "FNamePool scanner V3" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function stringscan(value,modulename,stopaddress,isUnicode) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true) ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function pointerscan(value,modulename,stopaddress,value2) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end print(modulename..'~'..stopaddress) if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end print('------------------') local isUnicode=true local strlist,result,result2,result3,pointer1,pointer2,pointer3=stringscan('ByteProperty',nil,nil,isUnicode) for i=1,#strlist do print(strlist[i]) result=pointerscan(getAddress(strlist[i])-0x50,nil,nil,getAddress(strlist[i])) for j=1,#result do if string.sub(result[j],result[j]:len()-3,result[j]:len()-2)=='00' then print(result[j]) pointer1=readPointer(result[j]..(targetIs64Bit() and '+8' or '+4')) pointer1=readPointer(pointer1) pointer2=readPointer(result[j]..(targetIs64Bit() and '+10' or '+8')) pointer2=readPointer(pointer2) pointer3=readPointer(result[j]..(targetIs64Bit() and '+18' or '+C')) pointer3=readPointer(pointer3) if pointer1 and pointer2 and pointer3 then print(strlist[i]..'<-'..result[j]) result2=pointerscan(getAddressSafe(string.sub(result[j],1,result[j]:len()-2)..'00')) for k=1,#result2 do print(strlist[i]..'<-'..result[j]..'<-'..result2[k]) if inModule(result2[k]) then UE4ver=ue4versioncheck() unregisterSymbol('FNamePool') registerSymbol('FNamePool',result2[k],true) goto done end end end end end end ::done:: print('done') [DISABLE] 26105 "FNamePool scanner V4" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] function stringscan(value,modulename,stopaddress,isUnicode) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end ms.firstScan(soExactValue,vtString,rtTruncated,value,'',modulename,stopaddress,'',fsmNotAligned,'',false,false,isUnicode,true) ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end function pointerscan(value,modulename,stopaddress,value2) local ms = createMemScan() if(modulename==0 or modulename==nil or modulename=='')then modulename=0 stopaddress=0x00007fffffffffff end if type(modulename)==type(0) then modulename=string.format('%X',modulename) elseif type(modulename)==type('') then modulename=[["]]..modulename..[["]] end if(stopaddress==0 or stopaddress==nil or stopaddress=='')then stopaddress=getNameFromAddress(getAddress(modulename),true,false) if(stopaddress:find("+")~=nil)then stopaddress=stopaddress:sub(0,stopaddress:find("+")-1)end if(getModuleSize(stopaddress)==nil)then error('Module '..modulename..' not found') end modulename=getAddress([["]]..stopaddress..[["]]) stopaddress=modulename+getModuleSize(stopaddress) modulename=string.format('%X',modulename) end if type(stopaddress)==type(0) then stopaddress=string.format('%X',stopaddress)end print(modulename..'~'..stopaddress) if value2 then ms.firstScan(soValueBetween,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false) else ms.firstScan(soExactValue,targetIs64Bit() and vtQword or vtDword,rtTruncated,value,value2,modulename,stopaddress,'',fsmNotAligned,'',false,false,false,false)end ms.waitTillDone() local f = createFoundList(ms) f.initialize() ms.destroy() local result={} for i=0,f.Count-1 do result[i+1]=f[i] end f.destroy() return result end print('------------------') local isUnicode=false local size= targetIs64Bit() and 8 or 4 local result2,result,result3,result4,pointer1,pointer2,pointer3,tempstringoffset,str,tempfnamepooloffset=stringscan('ByteProperty',nil,nil,isUnicode) for i=1,#result2 do --print(result2[i]) result=pointerscan(getAddress(result2[i]..'-50'),nil,nil,getAddress(result2[i])) for j=1,#result do tempstringoffset=getAddress(result2[i])-readPointer(getAddress(result[j])) for k=size,0x50,4 do str=readString(readPointer(getAddress(result[j])+k)+tempstringoffset,0x30,isUnicode) if str and str=='IntProperty' then stringoffset=tempstringoffset print(result2[i]..'<-'..result[j]) result3=pointerscan(getAddress(result[j]..'-50')-k,nil,nil,getAddress(result[j])) for m=1,#result3 do --print(result2[i]..'<-'..result[j]..'<-'..result3[m]) stringoffset2=((getAddress(result[j])-readPointer(result3[m])+size)/2)-size --print(string.format('%X',((getAddress(result[j])-readPointer(result3[m])+size)/2)-size)) stringmul=k --[[ pointer1=readPointer(result3[m]..(targetIs64Bit() and '+8' or '+4')) pointer1=readPointer(pointer1) pointer2=readPointer(result3[m]..(targetIs64Bit() and '+10' or '+8')) pointer2=readPointer(pointer2) pointer3=readPointer(result3[m]..(targetIs64Bit() and '+18' or '+C')) pointer3=readPointer(pointer3) if pointer1 and pointer2 and pointer3 then print(result2[i]..'<-'..result[j]..'<-'..result3[m]) end]] result4=pointerscan(getAddress(result3[m])-0x100,process,nil,getAddress(result3[m])) for n=1,#result4 do print(result2[i]..'<-'..result[j]..'<-'..result3[m]..'<-'..result4[n]) unregisterSymbol('FNamePool') registerSymbol('FNamePool',result4[n],true) goto done end end end end end end ::done:: print('done') [DISABLE] 26080 "UE4 Object scanner" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] --unregisterSymbol('FNamePool') --registerSymbol('FNamePool','libUE4.so+41DE8A4',true) --UE4ver=nil --if not UE4ver then ue4versioncheck()end --ue4config() --ue4parsetable() ue4parsetableFNamePool() FNameStringAlgo(1,true) FNameStringAlgo(3,true) if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end Aligned=true function ue4parsetablecheck() end local Object=FindStringFName('Object') local Class=FindStringFName('Class') local CoreUObject=FindStringFName('/Script/CoreUObject') if not UObject then UObject = {} end print(Object) print(Class) print(CoreUObject) local size,pointer,pointer2,pointer3=(targetIs64Bit() and 8 or 4) local result,result2=groupscan('4:'..Object) print(#result) for i=1,#result do if checkvalue(getAddress(result[i])-0x50,0x50,1,4)then for j=0,0x100,size do pointer=readPointer(getAddress(result[i])-0x50+j) if not pointer then break end if checkvalue(pointer,0x50,Class,4) then pointer3=pointer for k=0,0x100,size do local pointer=readPointer(getAddress(result[i])-0x50+k) if not pointer then break end if checkvalue(pointer,0x50,CoreUObject,4)then --print(result[i]) local value=targetIs64Bit() and readInteger(pointer+4) or readSmallInteger(pointer+2) --print(string.format('%X',readInteger(pointer))) if targetIs64Bit() then pointer2=checkvalue(getAddress(result[i])-0x50,0x50,value,(size/2)) else for p=0,10 do if pointer2 then break end pointer2=checkvalue(getAddress(result[i])-0x50,0x50,value-5+p,(size/2)) end end if pointer2 then pointer2=pointer2-(size/2) print(string.format('%X',pointer2)) UObject.ObjectId=checkvalue(pointer2,0x50,1,4)-pointer2 UObject.Class=checkvalue(pointer2,0x50,pointer3,size)-pointer2 UObject.FNameIndex=checkvalue(pointer2,0x50,Object,4)-pointer2 UObject.Outer=checkvalue(pointer2,0x50,pointer,size)-pointer2 local str if UE4ver<9 and targetIs64Bit() then str=string.format('8:0x%X 8:0x%X',pointer,pointer2) elseif UE4ver<9 then str=string.format('4:0x%X 4:0x%X',pointer,pointer2) elseif targetIs64Bit() then str=string.format('8:0x%X 8:* 8:* 8:0x%X',pointer,pointer2) else str=string.format('4:0x%X 4:* 4:* 4:* 4:0x%X',pointer,pointer2) end print(str) result2=groupscan(str) for n=1,#result2 do local result3 if not Aligned or getAddress(result2[n])%size==0 then print(string.format('%X<-%s',pointer2,result2[n])) --result3=pointerscan(getAddress(result2[n]:sub(1,result2[n]:len()-2)..'00')) end if not result3 or #result3<=0 then result3=pointerscan(getAddress(result2[n]))end for o=1,#result3 do local result4 if not Aligned or getAddress(result3[o])%size==0 then --if not inModule(result3[o]) then print(string.format('%X<-%s<-%s',pointer2,result2[n],result3[o])) --end if inModule(result3[o]) and (readInteger(result3[o]..'-10+1C')<0x7FFFFF or readInteger(result3[o]..'-10+24')<0x7FFFFF) then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result3[o]..'-10',true) goto done end result4=pointerscan(getAddress(result3[o])) end if not result4 then result4={}end for q=1,#result4 do if not Aligned or getAddress(result4[q])%size==0 then print(string.format('%X<-%s<-%s<-%s',pointer2,result2[n],result3[o],result4[q])) if inModule(result4[q]) then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result4[q]..'-10',true) goto done end end end end end end end end end end end end ::done:: if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18 else UE4ver=20 end end print('done\n') ue4parsetable() [DISABLE] 26086 "UE4 Object scanner V2" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] --unregisterSymbol('FNamePool') --registerSymbol('FNamePool','libUE4.so+41DE8A4',true) --UE4ver=nil --if not UE4ver then ue4versioncheck()end --ue4config() --ue4parsetable() ue4parsetableFNamePool() FNameStringAlgo(1,true) FNameStringAlgo(3,true) if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end Aligned=true function ue4parsetablecheck() end local Object=FindStringFName('Object') local Class=FindStringFName('Class') local CoreUObject=FindStringFName('/Script/CoreUObject') if not UObject then UObject = {} end print(Object) print(Class) print(CoreUObject) local size,pointer,pointer2,pointer3=(targetIs64Bit() and 8 or 4) local result,result2=groupscan('4:'..Object) print(#result) for i=1,#result do if checkvalue(getAddress(result[i])-0x50,0x50,1,4)then for j=0,0x100,size do pointer=readPointer(getAddress(result[i])-0x50+j) if not pointer then break end if checkvalue(pointer,0x50,Class,4) then pointer3=pointer for k=0,0x100,size do local pointer=readPointer(getAddress(result[i])-0x50+k) if not pointer then break end if checkvalue(pointer,0x50,CoreUObject,4)then --print(result[i]) local value=targetIs64Bit() and readInteger(pointer+4) or readSmallInteger(pointer+2) --print(string.format('%X',readInteger(pointer))) if targetIs64Bit() then pointer2=checkvalue(getAddress(result[i])-0x50,0x50,value,(size/2)) else for p=0,10 do if pointer2 then break end pointer2=checkvalue(getAddress(result[i])-0x50,0x50,value-5+p,(size/2)) end end if pointer2 then pointer2=pointer2-(size/2) print(string.format('%X',pointer2)) UObject.ObjectId=checkvalue(pointer2,0x50,1,4)-pointer2 UObject.Class=checkvalue(pointer2,0x50,pointer3,size)-pointer2 UObject.FNameIndex=checkvalue(pointer2,0x50,Object,4)-pointer2 UObject.Outer=checkvalue(pointer2,0x50,pointer,size)-pointer2 local str for p=4,0,-1 do str=string.format('%u:0x%X',size,pointer) for q=1,p do str=str..' 4:*' end str=str..string.format(' %u:0x%X',size,pointer2) UObjectMul=(4*p)+size print(str) result2=groupscan(str) for n=1,#result2 do local result3 if result2[n]:sub(result2[n]:len()-1,result2[n]:len())=='00' then print(string.format('%X<-%s',pointer2,result2[n])) result3=pointerscan(getAddress(result2[n])) end if not result3 then result3={}end for o=1,#result3 do local result4 if not Aligned or getAddress(result3[o])%size==0 then --if not inModule(result3[o]) then print(string.format('%X<-%s<-%s',pointer2,result2[n],result3[o])) --end if inModule(result3[o]) and (readInteger(result3[o]..'-10+1C')<0x7FFFFF or readInteger(result3[o]..'-10+24')<0x7FFFFF) then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result3[o]..'-10',true) result4=pointerscan(getAddress(result3[o]..'-10'),process) if result4[1] then print(string.format('%X<-%s<-%s<-%s',pointer2,result2[n],result3[o],result4[1])) unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result4[1],true) end goto done end result4=pointerscan(getAddress(result3[o])) end if not result4 then result4={}end for q=1,#result4 do if not Aligned or getAddress(result4[q])%size==0 then print(string.format('%X<-%s<-%s<-%s',pointer2,result2[n],result3[o],result4[q])) if inModule(result4[q]) then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result4[q]..'-10',true) goto done end end end end end end end end end end end end end ::done:: if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18 elseif readInteger('GUObjectArray+14')==0 then UE4ver=9 else UE4ver=20 end end print('done\n') ue4parsetable() [DISABLE] 26085 "UE4 Auto config" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] if not UObject then UObject = {} end local size,pointer,pointers=(targetIs64Bit() and 8 or 4) local varsize={[0]=1,[2]=4,[3]=8,[4]=4,[12]=size} local GameEngine=StaticFindObjectAlgo('/Script/Engine.GameEngine') local Engine=StaticFindObjectAlgo('/Script/Engine.Engine') print(string.format('GameEngine = %X',GameEngine)) print(string.format('Engine = %X\n',Engine)) UObject.super=checkvalue(GameEngine,0x100,Engine,size)-GameEngine local Name,Typ for i=GameEngine,GameEngine+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Property ') then pointer=readPointer(i) UObject.member=i-GameEngine break end end Typ=Name:sub(1,string.find(Name,' ')-1) UObject.propsize=checkvalue(pointer,0x100,varsize[ue4type[Typ]],4)-pointer local classsize=readInteger(UObject.member+size+GameEngine) UObject.Offset=checkvalue(pointer,0x100,tostring(classsize-0x100)..'~'..tostring(classsize),4)-pointer for i=pointer,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Property ') then UObject.nextmember=i-pointer break end end pointer=readPointer(Engine+UObject.member) for i=pointer+UObject.nextmember,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Class ') then UObject.Property=i-pointer break end end UObject.bitmask=UObject.Property+2 pointer=StaticFindObjectAlgo('/Script/CoreUObject.Object:ExecuteUbergraph') print(string.format('ExecuteUbergraph = %X\n',pointer)) for i=pointer+UObject.Property,pointer+0x100,size do if inModule(readPointer(i)) then UObject.funct=i-pointer break end end pointer=StaticFindObjectAlgo('/Script/CoreUObject.EInterpCurveMode') print(string.format('EInterpCurveMode = %X\n',pointer)) for j=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+j) --pointers=readPointer(pointers) if pointers and checkvalue(pointers,0x50,'CIM_Linear',1) then UObject.enumoffset=UObject.Outer+j pointer=readPointer(pointer+UObject.enumoffset) print(string.format('EInterpCurveMode enums = %X\n',pointer)) UObject.enumname=checkvalue(pointer,0x50,'CIM_Linear',1)-pointer UObject.enumindex=checkvalue(pointer,0x50,1,2) and checkvalue(pointer,0x50,1,2)-checkvalue(pointer,0x50,'CIM_CurveAuto',1) or 4 for k=UObject.enumname+8,0x50,4 do if readInteger(pointer+k)>4 and FNameStringAlgo(readInteger(pointer+k),true) then UObject.enummul=k break end end break end end print(string.format([[ UObject.ObjectId = 0x%X UObject.Class = 0x%X UObject.FNameIndex = 0x%X UObject.Outer = 0x%X UObject.super = 0x%X UObject.member = 0x%X UObject.nextmember = 0x%X UObject.propsize = 0x%X UObject.Offset = 0x%X UObject.Property = 0x%X UObject.bitmask = 0x%X UObject.funct = 0x%X UObject.enumoffset = 0x%X UObject.enummul = 0x%X UObject.enumname = 0x%X UObject.enumindex = 0x%X ]],UObject.ObjectId,UObject.Class,UObject.FNameIndex, UObject.Outer,UObject.super,UObject.member,UObject.nextmember, UObject.propsize,UObject.Offset,UObject.Property, UObject.bitmask,UObject.funct,UObject.enumoffset, UObject.enummul,UObject.enumname, UObject.enumindex)) [DISABLE] 26104 "UE3 Object scanner" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] UE4ver=ue4versioncheck() --unregisterSymbol('FNamePool') --registerSymbol('FNamePool','libUE4.so+41DE8A4',true) --UE4ver=nil --if not UE4ver then ue4versioncheck()end --ue4config() --ue4parsetable() ue4parsetableFNamePool() FNameStringAlgo(1,true) FNameStringAlgo(3,true) if not stringoffset then print('error: stringoffset/ByteProperty not found') error() end Aligned=true function ue4parsetablecheck() end local Object=FindStringFName('Object',isMassEffect) if not UObject then UObject = {} end print(Object) local size,pointer,pointer1,pointer2,pointer3=(targetIs64Bit() and 8 or 4) local result,result2=groupscan('4:'..Object) print(#result) for i=1,#result do pointer=getAddress(result[i])-0x50 for j=0,0x100,4 do pointer1=checkvalue(readPointer(pointer+j),0x100,'Class',1) if pointer1 then for k=0,0x100,4 do pointer2=checkvalue(readPointer(pointer+k),0x100,'Core',1) if pointer2 then pointer1=pointer1-readPointer(pointer+j) pointer2=pointer2-readPointer(pointer+k) if pointer1==pointer2 then pointer=getAddress(result[i])-pointer1 print(string.format('%X',pointer)) for l=1,3 do pointer3=checkvalue(pointer+size,0x100,l,4) if pointer3 then print(l) UObject.ObjectId=pointer3-pointer UObject.FNameIndex=pointer1 UObject.Class=pointer1+j-0x50 UObject.Outer=pointer1+k-0x50 result2=pointerscan(pointer) for m=1,#result2 do local val=0 for o=1,100 do val=o if not readPointer(readPointer(readPointer(getAddress(result2[m])+o*size))) then break end end if val==100 then print(string.format('%X',getAddressSafe(result2[m])-(size*l))) result=pointerscan(getAddressSafe(result2[m])-(size*l),process) unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',getAddressSafe(result2[m])-(size*l),true) NOGUObjectsize=true for n=1,#result do print(result2[m]..'<-'..result[n]) if inModule(result[n]) and getAddress(result[n])%4==0 then unregisterSymbol('GUObjectArray') registerSymbol('GUObjectArray',result[n],true) NOGUObjectsize=nil goto done end end end if m==#result2 then goto done end end end end end end end end end end ::done:: --[[ if ue4versioncheck()<=2 and targetIs64Bit() and UE4ver<23 then if readInteger('GUObjectArray+24')==0xFFFFFFFF then UE4ver=18 elseif readInteger('GUObjectArray+14')==0 then UE4ver=9 else UE4ver=20 end end ]] ue4parsetable() print('done\n') [DISABLE] 26098 "UE3 Auto config" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] if not UObject then UObject = {} end local size,pointer,pointers=(targetIs64Bit() and 8 or 4) local varsize={[0]=1,[2]=4,[3]=8,[4]=4,[12]=size} local GameEngine=StaticFindObjectAlgo('Engine.GameEngine') local Engine=StaticFindObjectAlgo('Engine.Engine') print(string.format('GameEngine = %X',GameEngine)) print(string.format('Engine = %X\n',Engine)) UObject.super=checkvalue(GameEngine,0x100,Engine,size)-GameEngine local Name,Typ for i=GameEngine+UObject.Outer,GameEngine+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and (string.find(Name,'Function ') or string.find(Name,'Property ')) then pointer=readPointer(i) UObject.member=i-GameEngine break end end for i=UObject.Outer+size,0x100,size do Name=GetFullNameSafeAlgo(readPointer(pointer+i)) if Name and (string.find(Name,'Property ') or string.find(Name,'Function ') or string.find(Name,'Struct ')) and not string.find(Name,'Core') then Name=GetFullNameSafeAlgo(readPointer(readPointer(pointer+i)+i)) if Name and (string.find(Name,'Property ') or string.find(Name,'Function ') or string.find(Name,'Struct ')) and not string.find(Name,'Core') then UObject.nextmember=i break end end end for i=0,100 do pointer=readPointer(UObject.nextmember+pointer) Name=GetFullNameSafeAlgo(pointer) --print(Name) if Name and string.find(Name,'ObjectProperty ') then break end end Typ=Name:sub(1,string.find(Name,' ')-1) --print(string.format('%X = %s',pointer,GetFullNameSafeAlgo(pointer))) UObject.propsize=checkvalue(pointer,0x100,varsize[ue4type[Typ]],2)-pointer local classsize=readInteger(UObject.member+size+GameEngine) UObject.Offset=checkvalue(pointer,0x100,tostring(classsize-0x200)..'~'..tostring(classsize),4)-pointer --pointer=readPointer(Engine+UObject.member) for i=pointer+UObject.nextmember,pointer+0x100,size do Name=GetFullNameSafeAlgo(readPointer(i)) if Name and string.find(Name,'Class ') then UObject.Property=i-pointer break end end UObject.bitmask=UObject.Property+2 pointer=StaticFindObjectAlgo('Core.Object:FindObject') print(string.format('FindObject = %X\n',pointer)) for i=pointer+UObject.ObjectId,pointer+0x100,4 do if inModule(readPointer(i)) then UObject.funct=i-pointer break end end pointer=StaticFindObjectAlgo('Core.Object.EInterpCurveMode') print(string.format('EInterpCurveMode = %X\n',pointer)) for i=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+i) pointers=readPointer(pointers) if pointers then for j=size,0x50,size do pointers=readPointer(pointer+UObject.Outer+i+j) --pointers=readPointer(pointers) if pointers and checkvalue(pointers,0x50,'CIM_Linear',1) then UObject.enumoffset=UObject.Outer+i+j pointer=readPointer(pointer+UObject.enumoffset) UObject.enumname=0--checkvalue(pointer,0x50,FindStringFName('CIM_Linear'),4)-pointer UObject.enumindex=4--checkvalue(pointer,0x50,1,4)-checkvalue(pointer,0x50,FindStringFName('CIM_CurveAuto'),4) UObject.enummul=8--checkvalue(pointer,0x50,2,4)-checkvalue(pointer,0x50,1,4) break end end break end end print(string.format([[ UObject.ObjectId = 0x%X UObject.Class = 0x%X UObject.FNameIndex = 0x%X UObject.Outer = 0x%X UObject.super = 0x%X UObject.member = 0x%X UObject.nextmember = 0x%X UObject.propsize = 0x%X UObject.Offset = 0x%X UObject.Property = 0x%X UObject.bitmask = 0x%X UObject.funct = 0x%X UObject.enumoffset = 0x%X UObject.enummul = 0x%X UObject.enumname = 0x%X UObject.enumindex = 0x%X ]],UObject.ObjectId,UObject.Class,UObject.FNameIndex, UObject.Outer,UObject.super,UObject.member,UObject.nextmember, UObject.propsize,UObject.Offset,UObject.Property, UObject.bitmask,UObject.funct,UObject.enumoffset, UObject.enummul,UObject.enumname, UObject.enumindex)) [DISABLE] 26092 "to Single Line Address" Auto Assembler Script {$lua} function toStr(rec) local tec,str,list=rec,'',{} while(true)do if not tec or not tec.Address then break end list[#list+1]=tec tec=tec.Parent end for i=#list,1,-1 do str=string.format('%s%s',str,list[i].Address) for j=list[i].OffsetCount-1,0,-1 do str=string.format('[%s]+%s',str,list[i].OffsetText[j]) end end return str end if syntaxcheck then return end [ENABLE] memrec.Child[0].Address=toStr(memrec.Child[0]) memrec.Child[0].OffsetCount=0 [DISABLE] 26093 "to Structural Address" Auto Assembler Script {$lua} function toStr(rec) local tec,str,list=rec,'',{} while(true)do if not tec or not tec.Address then break end list[#list+1]=tec tec=tec.Parent end for i=#list,1,-1 do str=string.format('%s%s',str,list[i].Address) for j=list[i].OffsetCount-1,0,-1 do str=string.format('[%s]+%s',str,list[i].OffsetText[j]) end end return str end function toStructural(rec) local str,str2,list=toStr(rec),'',{} if str:find(']') then str2=str:sub(1,str:find(']')-1):gsub('%[','') else str2=str end rec.Address=str2 while(true)do if not str:find(']') then break end str=str:sub(str:find(']')+2,str:len()) if str:find(']') then str2=str:sub(1,str:find(']')-1):gsub('%[','') else str2=str end list[#list+1]=str2 end rec.OffsetCount=#list+1 for i=#list,1,-1 do rec.OffsetText[#list-i]=list[i] end end if syntaxcheck then return end [ENABLE] toStructural(memrec.Child[0]) [DISABLE] 26029 "DissectCode (Memory View -> Ctrl+J or (Tools -> Dissect code) )" 1 26028 "Save DissectCode" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1)) getDissectCode().saveToFile(path) --getDissectCode().loadFromFile(path) [DISABLE] 26030 "Load DissectCode" Auto Assembler Script {$lua} if syntaxcheck then return end [ENABLE] local path=string.format('C:\\Users\\%s\\Documents\\My Cheat Tables\\%s_dissectCode',os.getenv('USERNAME'),process:sub(1,string.find(process,'%.')-1)) --getDissectCode().saveToFile(path) getDissectCode().loadFromFile(path) [DISABLE]