Developer knowledge network ยท moderated exchange

UnreliableCode Community

Developer Research, Reverse Engineering & Coding Community

Knowledge indexLive
4Categories
919Threads
2.8KPosts
Subforums Leaderboard Log In to Post
Analysis

Resolving dynamic GWorld pointer via non-volatile register search in .text section [v2.4 Technical Discussion]

ue5_explorer
UE Specialist
MEMBER
Rep: 107
Join Date: Mar 2020
Posts: 6
Thanks: 69
1 months ago ยท Jul 2, 2026 8:26 PM
#1

Rather than hardcoding static offsets for GWorld in Unreal Engine games, you can scan for functions initializing the world context:

  1. Scan for the opcode pattern: 48 8B 05 ? ? ? ? 48 85 C0 74 ? 48 8B 88 (mov rax, [rip + offset]).
  2. Compute 32-bit RIP-relative displacement: pGWorld = instructionAddress + 7 + *(int32_t*)(instructionAddress + 3).
  3. Verify pointer dereference points to valid UWorld containing PersistentLevel (0x30) and OwningGameInstance (0x180).

Automates offset updates across weekly patch deployments!

val_driver_guy
Driver Dev
MEMBER
Rep: 42
Join Date: May 2019
Posts: 24
Thanks: 37
1 months ago ยท Jul 3, 2026 3:12 AM
#2

Displacement math works reliably across all UE4 and UE5 builds. Clean explanation.

vtable_slayer
Senior Reverser
MEMBER
Rep: 215
Join Date: Mar 2018
Posts: 86
Thanks: 61
1 months ago ยท Jul 3, 2026 12:34 PM
#3

Pattern scanning GWorld on load avoids having to update signature offsets manually.