Source Universal Pattern Scanners & Signatures for GWorld & GUObjectArray in UE4 / UE5 - UnreliableCode Forums

SigScannerPro

Pattern Scanning & IDA

MEMBER

Rep: 210

Join Date: Jul 2023

Posts: 25

Thanks: 52

1y ago · Nov 20, 2024 2:15 PM

#1

Sharing tested signature patterns across multiple Unreal Engine 4 (4.20 - 4.27) and Unreal Engine 5 (5.0 - 5.4) shipping binaries:

1. GWorld Signatures:

CPP

// Standard UE4 / UE5 GWorld Pattern (RIP-relative mov to GWorld)
// Pattern 1:
"48 8B 1D ? ? ? ? 48 85 DB 74 ? 41 B0 01"
// Pattern 2:
"48 8B 05 ? ? ? ? 48 8B 88 ? ? ? ? 48 85 C9 74 ? E8"

// Helper to resolve RIP-relative 32-bit displacement:
uintptr_t ResolveRip(uintptr_t instructionAddr, int offsetToDisplacement, int instructionLength) {
    int32_t ripOffset = *reinterpret_cast<int32_t*>(instructionAddr + offsetToDisplacement);
    return instructionAddr + instructionLength + ripOffset;
}

2. GUObjectArray Signatures:

CPP

// Pattern 1 (UE4 / UE5 standard):
"48 8D 0D ? ? ? ? E8 ? ? ? ? 48 8D 0D ? ? ? ? E8 ? ? ? ? 48 8D 05 ? ? ? ? 48 89 05"
// Pattern 2 (Inside UObject::ProcessEvent):
"48 8B 05 ? ? ? ? 48 8B 0C C8 48 8B 04 D1"

3. FNamePool Signatures (UE4.23 - UE5.4):

CPP

// Pattern 1 (Inside FName::ToString):
"48 8D 05 ? ? ? ? EB ? 48 8D 0D ? ? ? ? E8 ? ? ? ? 48"
// Pattern 2:
"48 8D 0D ? ? ? ? E8 ? ? ? ? 4C 8B C0 48 85 C0 74 ? 48 8B C8"

Sharing tested signature patterns across multiple Unreal Engine 4 (4.20 - 4.27) and Unreal Engine 5 (5.0 - 5.4) shipping binaries:

[b]1. GWorld Signatures:[/b]
[code=cpp]// Standard UE4 / UE5 GWorld Pattern (RIP-relative mov to GWorld)
// Pattern 1:
"48 8B 1D ? ? ? ? 48 85 DB 74 ? 41 B0 01"
// Pattern 2:
"48 8B 05 ? ? ? ? 48 8B 88 ? ? ? ? 48 85 C9 74 ? E8"

// Helper to resolve RIP-relative 32-bit displacement:
uintptr_t ResolveRip(uintptr_t instructionAddr, int offsetToDisplacement, int instructionLength) {
    int32_t ripOffset = *reinterpret_cast<int32_t*>(instructionAddr + offsetToDisplacement);
    return instructionAddr + instructionLength + ripOffset;
}[/code]

[b]2. GUObjectArray Signatures:[/b]
[code=cpp]// Pattern 1 (UE4 / UE5 standard):
"48 8D 0D ? ? ? ? E8 ? ? ? ? 48 8D 0D ? ? ? ? E8 ? ? ? ? 48 8D 05 ? ? ? ? 48 89 05"
// Pattern 2 (Inside UObject::ProcessEvent):
"48 8B 05 ? ? ? ? 48 8B 0C C8 48 8B 04 D1"[/code]

[b]3. FNamePool Signatures (UE4.23 - UE5.4):[/b]
[code=cpp]// Pattern 1 (Inside FName::ToString):
"48 8D 05 ? ? ? ? EB ? 48 8D 0D ? ? ? ? E8 ? ? ? ? 48"
// Pattern 2:
"48 8D 0D ? ? ? ? E8 ? ? ? ? 4C 8B C0 48 85 C0 74 ? 48 8B C8"[/code]

SigScannerPro · Pattern scanning & Byte masking

The following users thanked SigScannerPro for this post:

DarkLogic

Game Logic & SDK Developer

MEMBER

Rep: 180

Join Date: Jun 2024

Posts: 28

Thanks: 41

1y ago · Nov 20, 2024 4:40 PM

#2

The

CODE

ResolveRip

helper is essential for x64 PE binaries because x64 instructions like

CODE

mov rax, [rip + 0x123456]

use 32-bit signed relative displacements from the next instruction address.

DarkLogic | Virtual method tables & SDKs

NullPtr_

Assembly & Engine Research

MEMBER

Rep: 260

Join Date: May 2023

Posts: 27

Thanks: 62

1y ago · Nov 21, 2024 9:12 AM

#3

Tested Pattern 1 for GWorld and FNamePool on a fresh UE5.3 game build and it resolved both RVAs on first scan! Solid work @SigScannerPro.

NullPtr_ · 0xDEADBEEF was here

UnreliableCode Community

Universal Pattern Scanners & Signatures for GWorld & GUObjectArray in UE4 / UE5

Create Forum Thread

Add Reputation