Reverse Unreal Engine Games Using IDA Pro + Other Tools

[Do0ks]

Reverse Unreal Engine Games Using IDA Pro.

A REAL fcking spoiler. Don't look at this spoiler or use this tool if you actually want to learn.

Spoiler

I made a tool that automatically does everything in this tutorial. I highly encourage you to learn first, then be lazy about it. If you don't push yourself to learn, you will never make tools like this:

https://github.com/Do0ks/GSpots
It's still in development..

I've been giving this some thought, dreading every second of this because I hate making tutorials and this is going to be stupid long, but I did want to take the time to make this tutorial. Reversing Unreal Engine games is actually quite simple, just as easy as unity games in my opinion. Sorry for any typos or spelling errors I'll most likely make as I'm going to try to blow through this as quick as I can. I will try to touch on everything I can. Somethings I will tell you to google. I have to pick and choose battles, but if something is unclear don't hesitate to leave a comment.

I know there's some "cool" tools out there. There's Unreal dumpers that work directly with Cheat Engine, however these tools really make us lazy.. At least it did for me, and what do you really learn from it? How to click a few buttons? Dope... Let's get our hands dirty, find GWorld, GNames and GObjects base addresses in IDA Pro, Load them into a dumper called UEDumper and make some pretty baller Cheat Engine tables.

Scope Overview:

This tutorial focuses on advanced reverse-engineering techniques using IDA Pro to identify critical Unreal Engine components—GWorld, GNames, and GObjects—within any game. We will explore two primary methods:

• Custom Game Analysis:
  Develop a custom game as a controlled reference to better understand the underlying structure. I will be mainly covering the custom game as a controlled reference

• Signature and Offset Extraction:
  Utilize a specialized IDA Pro plugin to extract reliable Array of Bytes (AOB) signatures from your reference game. These signatures will serve as a basis for searching and identifying corresponding patterns in the target game. Additionally, integrate UEDumper to efficiently locate the necessary offsets to develop Cheat Engine Tables.

---

Prerequisite:

• IDA Pro (Ghidra will work too, I won't be covering it though)

• Unreal Engine Dumper - UEDumper

• IDA plugin - SigMaker

• Visual Studio

• Epic Game Launcher

---

Okay, now that nonsense is out of the way, let's pick a game. Any Unreal game will do, but for this tutorial I'm going to choose a game off Steam called Easy Shooter. Perfect for our tutorial because the developer has abounded the game, It has horrible reviews and little to no effort was placed into building the game (all this really doesn't matter). Download your game!

Checking The Games Architecture:
I actually forgot about this part, lets just get this out of the way. We need to find out if the game we are reversing is a 32-bit or 64-bit game. We can easily do this by running the game, pressing CTRL+SHIFT+ESC >> Navigate to "Details" and looks for our game.

Spoiler

x64. Take Note.

Checking Unreal Engine Version:
Once you've download your game you want to reverse, navigate to the local directory where the game is saved. You can easily do this though your Steam client; Right Click your game >> Manage >> Browse local files.

Spoiler

This will open the directory where your the steam game is located. Now navigate to:
GameName (EasyShooter in this case) >> Binaries >> Win64 (may be Win32, still relevant)
You should see your games EXE.
Right Click >> Properties >> Details >> Under "Product Version".

Spoiler

4.22. Take Note.

Unreal Version not displayed here?:

• Spoiler

  Here is my source code that you can use to automatically find the version of Unreal Engine the game is running. All you need to do it build it into a .dll in Visual Studio and inject it into the running game. A message box will prompt telling you the Unreal Engine Version, then the game should close. I'm not going to explain how to do this, if you're at this stage in your game hacking journey you should know how to build and inject things.
  ⠀
  https://github.com/Do0ks/UEVersionScanner
  ⠀
  If you're not using Visual Studio to build, remove #include "pch.h"

Why are we doing this? We need to identify the Unreal Engine version used in the game we're reverse engineering so that we can develop a matching version for a solid point of comparison. As you may have experienced, decompiled pseudocode is often difficult to interpret without proper context, and having an accurate comparison can significantly simplify the reversal process.

Typically, the Unreal Engine version the original developer employed is the same one we would use. However, there are exceptions. Developers can download the Unreal Engine source code and modify its functionality to make decompilation more challenging. For example, Fortnite uses a proprietary version of Unreal, meaning its open-source code won’t align with the standard version—making this method less effective, especially since we aren’t reverse engineering online games.

One final point: some people prefer to work directly with the source code instead of creating and decompiling an additional game for comparison. While this approach is certainly possible, it leaves more room for errors. Since this tutorial is aimed at beginners using IDA and not necessary the coding aspect, we’ll focus on the less error-prone method. Let’s move on..

---

Let's Build A Game!
I'm assuming you already have epic. If not, Google it and install it. If not still, Here you go Epic Download .

After, launch Epic >> Left side click Unreal Engine >> Top bar click "Library" >> Click the plus sign >> Click the version number >> Pick the appropriate version number (4.22 for the tutorial) >> Click install... What a convoluted process.

Spoiler

Note: Disregard the patch number 4.22.3. Only focus on the major and minor version numbers 4.22.3

Once Installed, Click Launch.
This is where it gets weird. Because Unreal Engine changes between major versions, depending on what version you have the process on how to build the game changes. I'm going to cover UE4 and 5, just incase you have a game on something like 5.5, while I'm reversing 4.22.

Once launched, under New Project, pick either first or third person blueprint (I don't think it really matters, I always just choose third person). Pick the file path where you want your fame to be saved and give it a name, then click "Create Project".

Spoiler

Once Unreal has finished loading, there's only 2 things we need to do. We need to include debugging files with out game build so we can get the .pdbs, and, well build the game. (If the following steps doesn't match your unreal, hang tight! Keep reading and i'll explain newer versions before moving on). A PDB file contains debugging symbols and metadata about a program, such as function names, variable names, and line numbers. This information helps debuggers map the compiled binary back to the original source code, making it easier to diagnose and fix issues during development. As you can image, a pdb file can really aid us in our reversal process, especially if a developer forgets to remove them.

Building Older Unreal Games - UE4

• Spoiler

  Main Interface:

  Spoiler

  

  First, lets enable debugging files to be included in our shipping game.
  Navigate to File >> Package Project >> Packaging Settings >> Tick "Include Debug Files".

  Spoiler

  

  Now to build the game.
  Navigate to File >> Package Project >> Build Configuration >> Click "Shipping"
  Then navigate to File >> Package Project >> Windows >> Click Windows(64-bit), or 32-bit if that matches the game that's being reversed

Building Newer Unreal Games - UE5

• Spoiler

  Main Interface:

  Spoiler

  

  First, lets enable debugging files to be included in our shipping game.
  Navigate to "Platforms" >> Packaging Settings >> Tick "Include Debug Files" (Search it if you cant find it).

  Spoiler

  

  Spoiler

  

  Now to build the game.
  Navigate to "Platforms" >> Windows >> Tick "Shipping".
  Then navigate to "Platforms" >> Windows >> Tick "Package Project".

---

Reversal Process Overview.
Now we covered all that, let's get into the fun stuff. In this section, we’ll demonstrate how to integrate our custom game into IDA Pro alongside its corresponding PDB files. We’ll then apply a similar process to the target game we intend to reverse engineer. In most cases games won’t include PDB files. Reputable developers typically remove PDB files from official releases to safeguard their code. However, on occasion, you might encounter a game that inadvertently includes these files. If that happens, you can skip the step of creating your own game for comparative purposes if you want. As noted earlier, PDB files contain essential debugging symbols and metadata, which greatly facilitate the reverse-engineering process. If you're new I recommend just following this tutorial until you are comfortable completing the reversal process without reference to this tutorial.

Adding SigMaker to IDA:
Really easy to do. Extract the contents from the SigMaker download, locate your IDA installation path and drag the contents over to IDAs plugin folder. You will know its the right plugins folder because it will have a bunch of .dll files in it.

Decompiling Our Referencing Game.
First, lets load up IDA choosing the appropriate executable that matches both of your referencing and reversal games architecture. Mine is x64 as we covered.

We should be greeted with a screen that looks similar to this;

Spoiler

Click "New", then a window will pop up asking for the file you want IDA to analyze. You want navigate to the folder where your game that you made is saved. Unreals default is your Documents. I did not change this for myself so it should be the same for you unless you've made changes.

Spoiler

^{Note the path in the picture. You are going to want the exe in the "binaries" directory}
Right after, another window will pop up. Just stick to the defaults for the sake of simplicity of the tutorial. Technically you can manually load in the games you want to reverse, do the rebasing of the program right from there etc. but. whatever. Just hit "Okay".

Spoiler

Now a Important part. The next window that pops up Should be asking you if you want to load in the .pdb files associated with the game. Click YES.

Spoiler

This will take a hot minute so lets start decompiling the game we want to make cheats for.

Decompiling Our Reversal Game.
I'm not going to go into great detail with this one because the steps are the same as the referencing game. There is some minor differences which is as follows;

• You do not need to include a pdb file. click NO to this part.

• Sometimes, IDA will prompt a file explorer window asking you to include a audio file, you can just click cancel to this. It did not pop up for me this time, but if it does just know you don't have to add that.... Here's an example of what it looks like

  Spoiler

  

• You'll need to rebase this one. We didn’t rebase the reference game because its file offset on the hard drive was used solely for reference. However, for the game we’re reversing, it’s essential to view the actual file offset. Rebasing allows us to disregard the specific location on the hard drive and instead simulate the scenario where the game occupies the entire disk. I know this concept can be a bit confusing at first but the more you do this, the easier it becomes.
  ⠀
  After everything is initialized (You will start seeing assembly on the screen), go to Edit >> Segments >> Rebase Program.
  A new window will come up asking you how you want to rebase the program. The only thing you need to change here is the Value, and that should become 0. Press Okay.

  Spoiler

  

A Side By Side Comparison
At this point you should have both the Referencing Game and Reversal Game all decompiled. I just wanted to take a moment to go over some differences between the two, hopefully this may clear up any confusion. Below is a screenshot of both Referencing Game and Reversal Game (Reversal Game is on the left, Referencing Game is on the right).

Spoiler

You may notice differences right off the bat such as the Reversal Games Function list has a bunch of "sub_CrapHere", "unknown_libname_29", but the Referencing Game has much more meaningful names like "Locale::getRoot(void)" or "upvr_deleteIObject_53"... How about the actual Assembly. I don't know what "call sub_8338F0" is, but I have a good feeling I know what "call ?ToString@FName@@" is. This is just an example how a reference can make our life so much easier.. Thanks .pdbs!

Configuring IDA
I'm not going to get into detail about what the configuration is about. Just follow as I do.

Go to Options at the top menu bar >> General and apply the settings "Function offsets and set "Number of opcode bytes (non-graph) to 10). You can enable auto comments if you like, it just adds comments to assembly to make it a bit easier to read. Apply to both Referencing Game and Reversal Game.

Spoiler

After, we can load up the string viewer on both Referencing Game and Reversal Game.
Go to View >> Open Subviews >> Strings. (Or press Shift+F12)

Once the String Viewer loads up, right click anywhere in the string viewer and click "Setup....". Here you're going to want C-Style, Unicode C-Style, and C-Style(32-bit) Enabled. These settings will save globally so you wont have to redo this step again.

Spoiler

Spoiler

Sidenote: IF you want, you can clean up IDAs main face by closing out of everything but IDA View-A and Strings, you can and this is what I'll be doing.

Spoiler

[Do0ks]

Finding GWORLD
To find GWorld, we can manipulate strings within the unreal engine code to bring us to, or very close to the place in we need to be to grab the offset of GWorld. We are actually going to be focusing more on string manipulation then anything else for this tutorial. Pull up notepad, were going to want to mark down each one as we find them. I will supply the strings that I know and has been working for me 100 percent of the time.

SeamlessTravel FlushLevelStreaming

SeamlessTravel FlushLevelStreaming is a string that seems to remain consistent thought out UE4 and UE5, and it points us to the region that we can find GWorld in. In the string view window, press CTRL+F and past SeamlessTravel FlushLevelStreaming. Do this on both both Referencing Game and Reversal Game. You should only get one result. Double click it on both. After you should have a side by side comparison that looks similar to this

Spoiler

We can see some similarities throughout this:

• Both the Referencing Game and Reversal Game has "SeamlessTravel FlushLevelStreaming ',0".

• The Reversal Game as "sub_18BBF60" but the Referencing Game has FSeamlessTravelHandler::Tick(void) for the "; DATA XREF:".

I think its safe to assume sub_18BBF60 is FSeamlessTravelHandler::Tick(void). We also see XREF is referencing the "SeamlessTravel FlushLevelStreaming" inside FSeamlessTravelHandler::Tick(void) and sub_18BBF60, so lets follow that path. Double click them.

You should now see a screen that looks like this:

Spoiler

Again, lets just take a moment to look at the similarities between the two. Look at the assembly. xor, mov, lea, move, lea. they line up perfectly with each other. The call functions now have meaningful names, etc. I really want to express how important it is to recognize these similarities. I picked a easy game that lines up almost perfectly just to push this. Study these patterns.. This is how we KNOW we are in the right spot in the game. Reversing will become so much easier if you recognize this. I promise it wont always be this easy to reverse games. Anyway, I'm not going to comment on this anymore. Lets move on.

Press F5 to generate the pseudocode for the function.
You will see a screen similar to this:

Spoiler

Now our goal is to use our Referencing Game that has meaningful names to find GWorld. I know GWorld is above SeamlessTravel FlushLevelStreaming, so scroll up and and find GWorld and do the same with the Reversal Game. Know that you wont just see "GWorld" on the Reversal Game, which is why I was expressing the importance of recognizing similarities between the two. If all goes well, you should be looking at something very similar to this:

Spoiler

Great! We have found GWorld. On the Referencing Game we see "GWorld = 0i64;" and on the Reversal Game we see "qword_2EF0780 = 0i64;" so qword_2EF0780 is GWorld. Lets take note of the file offset, 2EF0780 as 0x2EF0780.

---

Finding GNAMES
Okay, so Unreal Engine 4.23 and below does not use fname::pool so I'm going to have to brake this part up into 2 sections. I will reverse a different game for ones that are looking to reverse a game higher version than 4.23 just to cover everything.

UE 4.23 and Below:

• Spoiler

  To find GNames in UE that's 4.23 and below we can't use fname::pool as previously stated so we are going to use string like we did finding GWorld. We will be targeting "MulticastDelegateProperty".

  MulticastDelegateProperty

  On your Referencing Game, First close the Pseudocode Window so you are only left with IDA View-A and Strings window (Just for organization).

  Like before, in the string viewer search for MulticastDelegateProperty. You should get 2 hits, choose the first.

  Spoiler

  

  We need to follow the xref to find what that string is referencing. Click into it.

  Spoiler

  

  Now we are in the heart of the FNames array.

  Spoiler

  

  We want this, but we need to go further back. Lets scroll up till we see something that gets FNames.

  Spoiler

  

  Within a few scrolls, I see a call that "GetsNames@FNames". Seems promising. Lets follow that.
  It leads us to a small function that gets FNames. Lets hit F5 and check out the pseudocode.

  Spoiler

  

  Great. Here's where the plugin SigMaker comes into play. I assume SigMaker runs a AOB scan and try's to find a unique spot so you can use that to search that spot in other files, at least that's what we are going with it. There's two ways you can trigger SigMaker. You can access it from Edit >> Plugins >> SigMaker, or by the shortcut key CRTL+ALT+S, do one or the other and a box will prompt. Just keep "Auto Create Ida Pattern" ticked and click "OK". Give it some time, but should happen pretty quick. In the output window you will see your signature that links back to this area. Once its done, it should looks something like this:

  Spoiler

  

  Now copy that signature and move over to your Reversal Game. Press ALT+B to bring up the Binary Search box, paste your AOB in the String Section. Leave everything to the default settings, but tick "Find All Occurrences" and press "Okay". A new window will pop come up labeled "Occurrences of binary".. You should have ideally one result. Sometimes you will get more. Its up to you to do some investigative work and get back to a place that you can compare in. For me, I was given one result.

  Spoiler

  

  After clicking into the result, it didn't lead me to the function, but a call to that function. Sometimes you'll have to follow the call, especially if the AOB leads you to the call (It will automatically highlight).

  Spoiler

  

  After clicking into the call, we can now find GNames. After a small comparison we can assume this is the correct function and we can copy the offset to GNames to a notepad. Mine is 0x2DEDA20

  Spoiler

  

Above UE 4.23:

• Spoiler

  Finding GNames above 4.23 is a bit different to find then the method we would use on older Unreal Engines. My method of finding GNames is not exactly finding GNames first, but finding something close by GNames. More often than not, GNames is linked next to everywhere (Because its global table that stores all unique names (FNames) that in turn makes names like "Ammo", "Health", and "Armor"), so its just much easier to find a function close by, then find GNames from there.

  This part may be a bit confusing, but look at it this way. Pretend we are using Cheat Engine and trying to find health that's not displayed at all on screen, but our stamina is. We would take time to find stamina, dissect the memory region and find health that way. Same concept. For GNames we are going to be searching "FName::ToString(void)" within the function list, not the strings window. FName::ToString(void) seems to remain consistent.

  Spoiler

  

  FName::ToString(void)

  On our Referencing Game, first close the String and Pseudocode Windows so you are only left with IDA View-A window (Just for organization).
  Then click within the Function window, press CRTL+F and search FName::ToString(void). You will get only one result, double click and you will be come to something that should look close to this.

  Spoiler

  

  Spoiler

  

  Now, This IS where our FNames is, and I would love to say lets make a signature here to search it within our Reversal Game but it takes forever to search for a signature here, chances are you'll get many hits on that signature and none of them hits will point to a spot where we can safely compare. So, we are just going to scroll up to the next function and grab a signature there.

  Spoiler

  

  We can see that the Random Function still has to do with FNames, but its right next door so lets try generating a signature here. Click within the random function and press F5 to generate the pseudocode.

  Spoiler

  

  Here's where the plugin SigMaker comes into play. I assume SigMaker runs a AOB scan and try's to find a unique spot so you can use that to search that spot in other files, at least that's what we are going with it. There's two ways you can trigger SigMaker. You can access it from Edit >> Plugins >> SigMaker, or by the shortcut key CRTL+ALT+S, do one or the other and a box will prompt. Just keep "Auto Create Ida Pattern" ticked and click "OK". Give it some time, but should happen pretty quick. In the output window you will see your signature that links back to this area. Once its done, it should looks something like this:

  Spoiler

  

  Now copy that signature and move over to your Reversal Game. Press ALT+B to bring up the Binary Search box, paste your AOB in the String Section. Leave everything to the default settings, but tick "Find All Occurrences" and press "Okay". A new window will pop come up labeled "Occurrences of binary".. You should have ideally one result. Sometimes you will get more. Its up to you to do some investigative work and get back to a place that you can compare in. For me, I was given 0 results..... Well, that didnt go as planed. BUT, thats okay. This is apart of reverse engineering. I just scrolled up to the very next function, repeated the scan and then i got 1 result.

  Spoiler

  

  Double clicking into the result, now i just had to scroll down 2 functions and I was greeted with come comparable results.

  Spoiler

  

  So, If we were reversing this game, our file offset would be 0x147F88A80 (Note: I did NOT rebase this. I only wanted to show HOW to find GName.. Always rebase your Reversing Game.)

Finding GOBJCTS
Last step and luckily, GObjects is a breeze to find on all the versions of unreal. I've narrowed it down to what seems to be consistent throughout, and that's "getobjectcluster". We will be searching this in the Function search. If you went though the GNames for UE above 4.23, you already know how to search the functions. Regardless, I will cover it again.

Spoiler

On your Referencing Game, First close the String and Pseudocode Windows so you are only left with IDA View-A window. Then click within the Function window, press CRTL+F and search getobjectcluster. You will get only one result, double click and you will be come to something that should look close to this.

Spoiler

Click into the only result, and we are already there. Press F5 to view the pseudocode.

Spoiler

Now we can use SigMaker to get a signature by pressing CRTL+ALT+S.
Now copy that signature and move over to your Reversal Game. Press ALT+B to bring up the Binary Search box, paste your AOB in the String Section.
You should only get one result. Follow the result then press F5 for the pseudocode.

Spoiler

Pretty solid comparison. We can assume GObjects is 0x2DF1D28

Final Notes Before Moving On
I understand this part can be confusing. It's a lot of jumping back and forth trying to find some kind of consistency between the two. If you don't get it the first time, keep trying. It will all click eventually. If enough people request, I will make a video tutorial too. I again want to express the how important it is to recognize similarities. If we review everything including the file offsets (0x2EF0780, 0x2DEDA20, and 0x2DF1D28), they are similar too, very close in memory. Recognize these patterns and apply the scientific method. As you reverse more games, you will find yourself having to veer off from this tutorial which is a good thing!

[Do0ks]

Working With UEDumper
Okay.. We have been though a lot. Now it's time to start having fun... Well, almost. Let's configure UEDumper so we can dump the game.. Again lol. I’m assuming you have some basic coding experience, no matter your background, every tutorial stresses the importance of learning at least the fundamentals of C++, and this process is no exception. Understanding the basics will significantly enhance your reverse-engineering workflow in IDA, clarify stack operations, and improve your cheat development process tenfold. I say this because I'm not going to go over the process of setting up your IDE or the settings in Visual Basics. I wont be explaining how the code works, etc. 100 Percent up to you to learn cpp.

Opening Up UEDumper In Visual Studio
Opening up Visual Studio, click "Open a local folder"

Spoiler

Navigate to the UEDumper file location then open the folder you've extracted.

Spoiler

(Or you can open UEDumper.sln directly)

Once the project loads there is two header files we must edit. Engine >> Userdefined >> UEdefinitions.h and Offsets.h.

Spoiler

Starting with UEdefinitions.h, we need to set the Unreal Engine version of our Reversal Game. For this tutorial, we reversed a game on 4.22, so I'll select that. and place it in the section that says "//set your games ue version"(line 68).

Spoiler

You may have noticed that the highest this 'can' go is 5.03.. It can support higher versions. I have reversed 5.5 and this still dumped it. To dump higher than 5.03, just use UE_5_03.

Next, we will head over to the Offsets.h file and place our file offsets in that we got when using IDA.
Scroll to the bottom of the file and you'll see this:

Spoiler

We want to place all the 0xDEADBEEF with the corresponding offsets of each field.
So for the tutorial, I would fill in "OFFSET_GNAMES" with 0x2DEDA20, "OFFSET_GOBJECTS" with 0x2DF1D28 and "OFFSET_GWORLD" with 0x2EF0780

Spoiler

After, be sure to set the build to release

Spoiler

Then build the project by going to Build >> Build Solution.
This will take a moment but once its done, in the output section you'll see that the build succeeded along with the builds location.

Spoiler

We are now done with Visual Studio.

Dumping The Game

Lets navigate to the build..

Spoiler

Great, it's there. Lets just put this to the side and boot our game up! When you boot the game up its important to be in the main game play when dumping the game with UEDumper. Not the main menu, or the credit screen, the actual game. Once you are in the game, lets load up UEDumper.

Spoiler

There's 2 Spots you need to fill out. The folder name and the process name. I usually just make the folder name the same as the process name just so i don't have to keep manually typing things, but each to their own. To get the process name, you can just copy the games exe name and add .exe to the end. You can also get this from task manager or Cheat Engine. The process name for Unreal Engine is almost always ending with "-Win64-Shipping.exe". Mine is EasyShooter-Win64-Shipping.exe.

Spoiler

After you can click "Create" then "Find", lastly a button will pop up, click "Dump". If all goes well, you should have the game fully dumped!

Spoiler

(Note: If the dump fails, UEDumper will tell you what went wrong. Read this, and go back to IDA and try to find the actual offset. UE isn't broken. It's because you didn't find the correct offset. This happens. It happens to me sometimes.)

Spoiler

We ARE at the tail end! You've came so far and if this is your first time dumping games like this you should feel accomplished!
Im not going to get heavy into this part as its another tutorial, but UEDumper can generate SDKs so you can easily make external cheats if that floats your boat. (Project >> Generate SDK) But we are more going to focus on the "Live editor".

At the top Bar, click "Live editor". A new window will pop up, just click continue. After, you will end up on this page

Spoiler

Top left corner you'll see "Add Inspector" Click that. Another window will pop up. Click "Add Offset"

Spoiler

Now take note of the "Offset leads to:" area I highlighted. This is the base address to UWorld in Memory! This will be your hooking point to build some baller cheat tables! Mine is 0x7FF76B740780
After Taking Note of that, click "Add".

Explore here, The red +HEX is your offsets in memory. Take the time to find a cheat here. I will tell you that most of the good stuff lives in UGameInstance, AGameModeBase, and AGameStateBase. Its good to explore everything thought.

Making A Baller Cheat Engine Table
At last, everything has brought us to this moment. We can Finally make a pretty awesome Cheat Table to share with our friends over at OCT. I'm not going to go into details on how to use cheat engine. If you're doing this tutorial you should 100 percent know your way around Cheat Engine.

• Copy your UWorld Base Address

• Memory View >> CTRL+G >> Hook >> RegisterSymbol and Define here

• Follow UE offsets to add cheats manually.

• Congrats. You Did it.

Yes... As I said, you should know how to use cheat engine fully before worrying about this stuff which is why I didn't give much detail. If you are hung up on the Cheat Engine part, You should take a step back and learn CE to the fullest. Its one of the only tools I would say its worth FULLY learning, its that important.

IMPORTANT INFORMATION: MUST READ
This tutorial was written for OCT (https://opencheattables.com). You do not have my permission to copy and paste my work on any other website. You must visit https://opencheattables.com to view this tutorial. This stays here. Don't be a douche snozzle.

Extra Challenge
Fully Completed this tutorial? I would love to see your work! Upload your table to OCT and share it in this tread!

Happy Hacking!

A REAL fcking spoiler. Don't look any further or use this tool if you actually want to learn.

Spoiler

I made a tool that automatically does everything in this tutorial. I highly encourage you to learn first, then be lazy about it. If you don't push yourself to learn, you will never make tools like this:

https://github.com/Do0ks/GSpots
It's still in development..

[JustcallmemrX]

reverse Unreal Engine Games

Hi Do0ks, I don’t understand the purpose of reverse Unreal Engine Games. Is it just to make cheat tables, mod assets in the game like graphics and stuff?
I use to mod mono behavior assets in mono games (and I’m good at it) to make permanent cheats and it is hard work, sometimes taking days (a week or more if the game is huge) to complete.
Is it possible to just extract the assets in Unreal Engine Games like in mono games and merge them back for permanent cheats?

[Do0ks]

reverse Unreal Engine Games

Hi Do0ks, I don’t understand the purpose of reverse Unreal Engine Games. Is it just to make cheat tables, mod assets in the game like graphics and stuff?
I use to mod mono behavior assets in mono games (and I’m good at it) to make permanent cheats and it is hard work, sometimes taking days (a week or more if the game is huge) to complete.
Is it possible to just extract the assets in Unreal Engine Games like in mono games and merge them back for permanent cheats?

Umm, hmm. We have two sides of the spectrum here.

Reversing unreal games (for me) is to get pointers to next to everything in the game including a solid base address, and yes my primary purpose of reversing unreal game is to make cheat engine tables. I can rock out a pretty complete table within a day, vs. if I would try to scan for everything it could take up to a few weeks. I know there's tools like UModel or UnrealPak that can extract textures, models, and sounds which I would assume would work great for making mods. I don't think there is a way just to rebuild an Unreal game without completely reversing and rebuilding it yourself, or making "permanent" cheats.

As for mono games, I definitely see the possibility for permanent cheats, most of the code can be extracted, viewed, edited, and recompiled within minutes. Again, I really don't get into making permanent cheats so I cant comment on it to much.

I guess I just don't want to spend that kind of time making cheats. Pretty cool your good at it! I would love to see some of your work, perhaps a tutorial

[JustcallmemrX]

I guess I just don't want to spend that kind of time making cheats. Pretty cool your good at it! I would love to see some of your work, perhaps a tutorial

Yeah, whatever we enjoy doing right.
If I can ever get me another gaming computer, I am going to check out the game Our Adventurer Guild,
a mono game which I keep reading on the internet is a pretty good game and I love RPG games.
If I don’t run into any problems like obfuscated assets,
And once I complete it, I will give you the modded
Files. I guess they would let me post them on here as long as they are in an RAR with a password.