二、UE4四件套获取

发表于 2024-04-21 分类于 UnrealEngine

一、UWorld

字符串：SeamlessTravel FlushLevelStreaming源代码如下：

GWorld = LoadedWorld;    //特征
if (!LoadedWorld->bIsWorldInitialized)
{
    LoadedWorld->InitWorld();
}
bWorldChanged = true;
// Track session change on seamless travel.
NETWORK_PROFILER(GNetworkProfiler.TrackSessionChange(true, LoadedWorld->URL));
checkSlow((LoadedWorld->GetNetMode() == NM_Client) == bIsClient);
if (bCreateNewGameMode)
{
    LoadedWorld->SetGameMode(PendingTravelURL);
}
// if we've already switched to entry before and this is the transition to the new map, re-create the gameinfo
if (bSwitchedToDefaultMap && !bIsClient)
{
    if (FAudioDevice* AudioDevice = LoadedWorld->GetAudioDeviceRaw())
    {
        AudioDevice->SetDefaultBaseSoundMix(LoadedWorld->GetWorldSettings()->DefaultBaseSoundMix);
    }
    // Copy cheat flags if the game info is present
    // @todo UE4 FIXMELH - see if this exists, it should not since it's created in GameMode or it's garbage info
    if (LoadedWorld->NetworkManager != nullptr)
    {
        LoadedWorld->NetworkManager->bHasStandbyCheatTriggered = bHasStandbyCheatTriggered;
    }
}
// Make sure "always loaded" sub-levels are fully loaded
{
    SCOPE_LOG_TIME_IN_SECONDS(TEXT("    SeamlessTravel FlushLevelStreaming "), nullptr)  //特征
    LoadedWorld->FlushLevelStreaming(EFlushLevelStreamingType::Visibility);    
}

document_image_rId4

document_image_rId5

Count：

Uworld -> ULevel -> Count

调试符号：Gworld

跳过去直接拿

二、GName

字符串：ByteProperty

源代码如下：

static FNamePool& GetNamePool()
{
    if (bNamePoolInitialized)
    {
        return *(FNamePool*)NamePoolData;
    }
    FNamePool* Singleton = new (NamePoolData) FNamePool;
    bNamePoolInitialized = true;
    return *Singleton;
}

document_image_rId6

算法逆推：

//
//   Version:4.22
//
string NameStore::GetName(int i)
{
    int Id = (int)(i  / (int)GameInst::ChunkSize);  //0 旧版本中未加密游戏的ChunkSize固定为16384
    int Idtemp = (int)(i % (int)GameInst::ChunkSize);//1
    auto NamePtr = Process::Read<uint64_t>(Names + Id * 8);  //Names已经空读了一层
    auto Name = Process::Read<uint64_t>(NamePtr + 8 * Idtemp);
    char name[0x100] = {0};
    if (Process::ReadMemory(PVOID(Name + 0x10), name, 0x100)) // 0xC需要手动测
    {
        return name;
    }
    return string();
}

UE中，每个ID都会对应一个属于自己的字符串。比如下表

Id	String
0	None
1	ByteProperty
2	IntProperty
3	BoolProperty
4	FloatProperty
…..	…..

那么，可以利用算法进行反推出Gname。那么假设ID=1，则Id = 1 / 16384 = 0、Idtemp = 1 % 16384 = 1。ChunkSize固定为0x4000（16384）。
搜索ByteProperty。

document_image_rId7

将结果逐个Ctrl+B进行查看，直到找得到如下图内容。

document_image_rId8

然后将字符串None的地址减掉??后的地址（offset = ②地址 - ①地址 = 0xC）。

document_image_rId9

然后将ByteProperty地址剪掉offset后进行搜索。

document_image_rId10

排除掉最后两个，然后将第一个地址减掉Idtemp后进行搜索。

document_image_rId11

只有一个结果，由于id=0，所以在搜索一次，得到GName。

document_image_rId12

地址遍历：

uint64_t Base = GetModuleHandleA("xxxxx.exe");
int i = 0;
do
  uint64_t gname = Mem::Read<uint64_t>(Base + 0x8 * i);
  if(gname != NULL)
  {
    char* byteProperty = GetName(gname,1);
    if(!strcmp(byteProperty,"ByteProeprty"))
      break;
  }
while(true);
printf("offset_gname=%x\n",i*8);

直接从进程.exe开始+8或者+4进行遍历，每一次遍历就将遍历到的地址假设为GName，然后配合算法计算1返回的字符串，若返回的字符串为ByteProperty，则表明本次遍历到的地址为GName。

调试符号：FName::GetNames

三、GObjectArray

字符串：GObject: CanvasObject

document_image_rId14

document_image_rId15

由于GObjectArray是全局，然后C++编译器直接把GObjectArray的Num成员以地址形式输出。查看NumElements偏移然后计算即可。

document_image_rId16

构造特征：

首先简单认识一下UObject的结构和一些属性。

class UObject
{
  /** virtual function table */
  void* vtf; 
/** Flags used to track and report various object states. This needs to be 8 byte aligned on 32-bit
	    platforms to reduce memory waste */
	EObjectFlags					ObjectFlags;
	/** Index into GObjectArray...very private. */
	int32							InternalIndex;                //表明该对象在GObjectArray中的第几个
	/** Class the object belongs to. */
	UClass*							ClassPrivate;
	/** Name of this object */
	FName							NamePrivate;
	/** Object this object resides in. */
	UObject*						OuterPrivate;
}

还有GObjectArray结构。

class FUObjectItem
{
  	// Pointer to the allocated object
	class UObjectBase* Object;
	// Internal flags
	int32 Flags;
	// UObject Owner Cluster Index
	int32 ClusterRootIndex;	
	// Weak Object Pointer Serial number associated with the object
	int32 SerialNumber;
}
class TUObjectArray
{
  enum
	{
		NumElementsPerChunk = 64 * 1024,
	};
	/** Master table to chunks of pointers **/
	FUObjectItem** Objects;
	/** If requested, a contiguous memory where all objects are allocated **/
	FUObjectItem* PreAllocatedObjects;
	/** Maximum number of elements **/
	int32 MaxElements;
	/** Number of elements we currently have **/
	int32 NumElements;
	/** Maximum number of chunks **/
	int32 MaxChunks;
	/** Number of chunks we currently have **/
	int32 NumChunks;
}
class FUObjectArray
{
  int32 ObjFirstGCIndex;
	/** Index pointing to last object created in range disregarded for GC.					*/
	int32 ObjLastNonGCIndex;
	/** Maximum number of objects in the disregard for GC Pool */
	int32 MaxObjectsNotConsideredByGC;
	/** If true this is the intial load and we should load objects int the disregarded for GC range.	*/
	bool OpenForDisregardForGC;
	/** Array of all live objects.											*/
	TUObjectArray ObjObjects;
}