UE4,UE5引擎里 GWorld与GName,GObjectBaseArray定位实例
参考
021-SDK UE4,UE5框架下 定位 全局字符串数组入口基址
022-从逆向的角度测试UE4,UE5框架下UI对象的名字的获取
学习目标:
UE4,UE5引擎里 GWorld与GName,GObjectArrayBase
class UWorld : public UObject
{
public:
// ...
class ULevel* PersistentLevel;
class UNetDriver* NetDriver;
class AGameNetworkManager* NetworkManager;
// ...
class AGameStateBase* GameState;
// ...
class ULevel* CurrentLevel;
class UGameInstance* OwningGameInstance;
// ...
};
$-9 | 48:8BC3 | mov rax, rbx |
$-6 | 3805 423E2006 | cmp byte ptr ds:, al |
$ ==> | 48:0F4505 C9903006 | cmovnerax, qword ptr ds:[<GWorld>] |
$+8 | 803D A2422006 02 | cmp byte ptr ds:, 2 |
$+F | 72 C3 | jb mir4s.7FF7B74F17D3 |
$+11 | 48:85C0 | test rax, rax |
$+14 | 75 C3 | jne mir4s.7FF7B74F17D8 |
$+16 | 48:8D05 6402C903 | lea rax, qword ptr ds:| 00007FF7BB181A80:L"Failed to determine if OSS is server in PIE, OSS requests will fail"
$+1D | 41:B9 02000000 | mov r9d, 2 |
$+23 | 4C:8D05 8B422006 | lea r8, qword ptr ds: | 00007FF7BD6F5AB4:";:\x02"
$+2A | 48:894424 20 | mov qword ptr ss:, rax |
$+2F | 33D2 | xor edx, edx |
$+31 | 33C9 | xor ecx, ecx |
$+33 | E8 79B4A301 | call mir4s.7FF7B8F2CCB0 |
$+38 | EB A9 | jmp mir4s.7FF7B74F17E2 |
$-B5 | 48:897C24 50 | mov qword ptr ss:, rdi |
$-B0 | 48:8BCE | mov rcx, rsi |
$-AD | C64424 58 01 | mov byte ptr ss:, 1 |
$-A8 | 83FB 02 | cmp ebx, 2 |
$-A5 | 75 0C | jne mir4s.7FF7BA5107AD |
$-A3 | 48:8D5424 58 | lea rdx, qword ptr ss: | :L"DnsConfigService"
$-9E | E8 E56CC1FE | call mir4s.7FF7B9127490 |
$-99 | EB 09 | jmp mir4s.7FF7BA5107B6 |
$-97 | 48:8B02 | mov rax, qword ptr ds: |
$-94 | FF90 50010000 | call qword ptr ds: |
$-8E | 807C24 58 00 | cmp byte ptr ss:, 0 |
$-89 | 48:8BF8 | mov rdi, rax |
$-86 | 0F84 80000000 | je mir4s.7FF7BA510844 |
$-80 | 48:85C0 | test rax, rax |
$-7D | 75 74 | jne mir4s.7FF7BA51083D |
$-7B | 83FB 01 | cmp ebx, 1 |
$-78 | 75 6F | jne mir4s.7FF7BA51083D |
$-76 | 45:33C0 | xor r8d, r8d |
$-73 | 48:894424 68 | mov qword ptr ss:, rax |
$-6E | 48:8D5424 30 | lea rdx, qword ptr ss: |
$-69 | 48:8BCE | mov rcx, rsi |
$-66 | E8 8DC0C5FE | call mir4s.7FF7B916C870 |
$-61 | 397C24 38 | cmp dword ptr ss:, edi |
$-5D | 48:8D1D 5209C700 | lea rbx, qword ptr ds:|
$-56 | 4C:8BC3 | mov r8, rbx |
$-53 | 48:8D15 28E1FE01 | lea rdx, qword ptr ds:| 00007FF7BC4FE920:L"No world was found for object (%s) passed in to UEngine::GetWorldFromContextObject()."
$-4C | 4C:0F454424 30 | cmovner8, qword ptr ss: |
$-46 | 48:8D4C24 20 | lea rcx, qword ptr ss: |
$-41 | E8 A8B898FE | call mir4s.7FF7B8E9C0B0 |
$-3C | 397C24 28 | cmp dword ptr ss:, edi |
$-38 | 4C:8BC7 | mov r8, rdi |
$-35 | B2 03 | mov dl, 3 |
$-33 | 48:0F455C24 20 | cmovnerbx, qword ptr ss: |
$-2D | 48:8BCB | mov rcx, rbx |
$-2A | E8 C1E8C5FE | call mir4s.7FF7B916F0E0 |
$-25 | 48:8B4C24 20 | mov rcx, qword ptr ss: |
$-20 | 48:85C9 | test rcx, rcx |
$-1D | 74 05 | je mir4s.7FF7BA51082E |
$-1B | E8 E27D9DFE | call mir4s.7FF7B8EE8610 |
$-16 | 48:8B4C24 30 | mov rcx, qword ptr ss: |
$-11 | 48:85C9 | test rcx, rcx |
$-E | 74 05 | je mir4s.7FF7BA51083D |
$-C | E8 D37D9DFE | call mir4s.7FF7B8EE8610 |
$-7 | 807C24 58 00 | cmp byte ptr ss:, 0 |
$-2 | 75 07 | jne mir4s.7FF7BA51084B |
$ ==> | 48:8B3D 85A02E03 | mov rdi, qword ptr ds:[<GWorld>] |
$+7 | 48:8B5C24 60 | mov rbx, qword ptr ss: |
$+C | 48:8BC7 | mov rax, rdi |
$+F | 48:8B7C24 50 | mov rdi, qword ptr ss: |
$+14 | 48:83C4 40 | add rsp, 40 |
$+18 | 5E | pop rsi |
$+19 | C3 | ret |
$-14 | 48:8B4D F7 | mov rcx, qword ptr ss: |
$-10 | 48:85C9 | test rcx, rcx |
$-D | 74 06 | je mir4s.7FF7B86A5919 |
$-B | E8 F82C8400 | call mir4s.7FF7B8EE8610 |
$-6 | 90 | nop |
$-5 | EB 03 | jmp mir4s.7FF7B86A591E |
$-3 | 49:8BDC | mov rbx, r12 |
$ ==> | 48:8B35 AB4F1505 | mov rsi, qword ptr ds:[<GWorld>] |
$+7 | 48:85F6 | test rsi, rsi |
$+A | 0F84 C4000000 | je mir4s.7FF7B86A59F2 |
$+10 | 48:85DB | test rbx, rbx |
$+13 | 0F84 BB000000 | je mir4s.7FF7B86A59F2 |
$+19 | 48:8D4D 07 | lea rcx, qword ptr ss: |
$+1D | E8 A0ADEA01 | call mir4s.7FF7BA5506E0 |
$+22 | 48:894424 20 | mov qword ptr ss:, rax |
$+27 | 4D:8BCE | mov r9, r14 |
$+2A | 4D:8BC7 | mov r8, r15 |
$+2D | 48:8BD3 | mov rdx, rbx |
$+30 | 48:8BCE | mov rcx, rsi |
$+33 | E8 9AF3AF01 | call mir4s.7FF7BA1A4CF0 |
$+38 | 48:8BD8 | mov rbx, rax |
$+3B | 48:85C0 | test rax, rax |
$+3E | 75 4C | jne mir4s.7FF7B86A59AA |
$+40 | 803D FB000505 03 | cmp byte ptr ds:, 3 |
$+47 | 72 21 | jb mir4s.7FF7B86A5988 |
$+49 | 48:8D05 72DFBD02 | lea rax, qword ptr ds:| 00007FF7BB2838E0:L"Could not spawn."
$+50 | 48:894424 20 | mov qword ptr ss:, rax |
$+55 | 44:8D4B 03 | lea r9d, qword ptr ds: |
$+59 | 4C:8D05 E6000505 | lea r8, qword ptr ds: | 00007FF7BD6F5A64:" :\x02"
$+60 | 33D2 | xor edx, edx |
$+62 | 33C9 | xor ecx, ecx |
$+64 | E8 29738800 | call mir4s.7FF7B8F2CCB0 |
$+69 | 90 | nop |
$+6A | 48:8B4D BF | mov rcx, qword ptr ss: |
$+6E | 48:85C9 | test rcx, rcx |
$+71 | 74 06 | je mir4s.7FF7B86A5997 |
$+73 | E8 7A2C8400 | call mir4s.7FF7B8EE8610 |
$+78 | 90 | nop |
$+79 | 48:8B0F | mov rcx, qword ptr ds: |
$+7C | 48:85C9 | test rcx, rcx |
$+7F | 74 06 | je mir4s.7FF7B86A59A5 |
$+81 | E8 6C2C8400 | call mir4s.7FF7B8EE8610 |
$+86 | 90 | nop |
$+87 | E9 91000000 | jmp mir4s.7FF7B86A5A3B |
$+8C | E8 61620800 | call mir4s.7FF7B872BC10 |
$+91 | 48:8B53 10 | mov rdx, qword ptr ds: |
$+95 | 4C:8D40 30 | lea r8, qword ptr ds: |
$+99 | 49:6340 08 | movsxdrax, dword ptr ds: |
$+9D | 3B42 38 | cmp eax, dword ptr ds: |
$+A0 | 7F 0D | jg mir4s.7FF7B86A59CD |
$+A2 | 48:8BC8 | mov rcx, rax |
$+A5 | 48:8B42 30 | mov rax, qword ptr ds: |
$+A9 | 4C:3904C8 | cmp qword ptr ds:, r8 |
$+AD | 74 03 | je mir4s.7FF7B86A59D0 |
$+AF | 49:8BDC | mov rbx, r12 |
$+B2 | 48:8B4D BF | mov rcx, qword ptr ss: |
$+B6 | 48:85C9 | test rcx, rcx |
$+B9 | 74 06 | je mir4s.7FF7B86A59DF |
$+BB | E8 322C8400 | call mir4s.7FF7B8EE8610 |
$+C0 | 90 | nop |
$+C1 | 48:8B0F | mov rcx, qword ptr ds: |
$+C4 | 48:85C9 | test rcx, rcx |
$+C7 | 74 06 | je mir4s.7FF7B86A59ED |
$+C9 | E8 242C8400 | call mir4s.7FF7B8EE8610 |
$+CE | 90 | nop |
$+CF | 48:8BC3 | mov rax, rbx |
$+D2 | EB 4B | jmp mir4s.7FF7B86A5A3D |
$+D4 | 803D 67000505 03 | cmp byte ptr ds:, 3 |
$+DB | 72 23 | jb mir4s.7FF7B86A5A1E |
$+DD | 48:8D05 06DFBD02 | lea rax, qword ptr ds:| 00007FF7BB283908:L"Gen && GWorld NULL"
$+E4 | 48:894424 20 | mov qword ptr ss:, rax |
$+E9 | 41:B9 03000000 | mov r9d, 3 |
$+EF | 4C:8D05 50000505 | lea r8, qword ptr ds: | 00007FF7BD6F5A64:" :\x02"
$+F6 | 33D2 | xor edx, edx |
$+F8 | 33C9 | xor ecx, ecx |
$+FA | E8 93728800 | call mir4s.7FF7B8F2CCB0 |
$-94 | 4C:8D4424 58 | lea r8, qword ptr ss: | :L"DnsConfigService"
$-8F | 49:8BD6 | mov rdx, r14 |
$-8C | 49:8BCD | mov rcx, r13 |
$-89 | E8 9A56FFFF | call mir4s.7FF7BA50DA10 |
$-84 | 48:894424 50 | mov qword ptr ss:, rax |
$-7F | 48:85C0 | test rax, rax |
$-7C | 75 55 | jne mir4s.7FF7BA5183D5 |
$-7A | 41:3946 08 | cmp dword ptr ds:, eax |
$-76 | 74 03 | je mir4s.7FF7BA518389 |
$-74 | 49:8B36 | mov rsi, qword ptr ds: |
$-71 | 4C:8BC6 | mov r8, rsi |
$-6E | 48:8D15 5D71FE01 | lea rdx, qword ptr ds:| 00007FF7BC4FF4F0:L"Failed to load package '%s' into a new game world."
$-67 | 48:8D4D 40 | lea rcx, qword ptr ss: |
$-63 | E8 143D98FE | call mir4s.7FF7B8E9C0B0 |
$-5E | 48:8D45 40 | lea rax, qword ptr ss: |
$-5A | 4C:3BF8 | cmp r15, rax |
$-57 | 74 27 | je mir4s.7FF7BA5183CC |
$-55 | 49:8B0F | mov rcx, qword ptr ds: |
$-52 | 48:85C9 | test rcx, rcx |
$-4F | 74 05 | je mir4s.7FF7BA5183B2 |
$-4D | E8 5E029DFE | call mir4s.7FF7B8EE8610 |
$-48 | 48:8B45 40 | mov rax, qword ptr ss: |
$-44 | 49:8907 | mov qword ptr ds:, rax |
$-41 | 8B45 48 | mov eax, dword ptr ss: |
$-3E | 41:8947 08 | mov dword ptr ds:, eax |
$-3A | 8B45 4C | mov eax, dword ptr ss: |
$-37 | 41:8947 0C | mov dword ptr ds:, eax |
$-33 | E9 F2FDFFFF | jmp mir4s.7FF7BA5181BE |
$-2E | 48:8B4D 40 | mov rcx, qword ptr ss: |
$-2A | E9 DFFDFFFF | jmp mir4s.7FF7BA5181B4 |
$-25 | 48:8B7C24 40 | mov rdi, qword ptr ss: |
$-20 | 49:8B8D 18020000 | mov rcx, qword ptr ds: |
$-19 | 48:8B4424 50 | mov rax, qword ptr ss: |
$-14 | 0F29B424 70030000| movapsxmmword ptr ss:, xmm6 |
$-C | 48:8988 70010000 | mov qword ptr ds:, rcx |
$-5 | 48:8B5C24 50 | mov rbx, qword ptr ss: |
$ ==> | 48:891D CF242E03 | mov qword ptr ds:[<GWorld>], rbx |
$+7 | 48:85DB | test rbx, rbx |
$+A | 74 0F | je mir4s.7FF7BA518415 |
$+C | 41:8B95 50020000 | mov edx, dword ptr ds: |
$+13 | 48:8BCB | mov rcx, rbx |
$+16 | E8 8BAAC8FF | call mir4s.7FF7BA1A2EA0 |
$+1B | 41:83BD 70020000 0 | cmp dword ptr ds:, 0 |
$+23 | 45:8BCC | mov r9d, r12d |
$+26 | 7E 3D | jle mir4s.7FF7BA51845F |
$+28 | 49:8BD4 | mov rdx, r12 |
$+2B | 666666:0F1F8400 00 | nop word ptr ds:, ax |
$+36 | 49:8B85 68020000 | mov rax, qword ptr ds: |
$+3D | 48:8B0C02 | mov rcx, qword ptr ds: |
$+41 | 48:85C9 | test rcx, rcx |
$+44 | 74 0F | je mir4s.7FF7BA51844F |
$+46 | 49:8B85 78020000 | mov rax, qword ptr ds: |
$+4D | 48:3901 | cmp qword ptr ds:, rax |
$+50 | 75 03 | jne mir4s.7FF7BA51844F |
$+52 | 48:8919 | mov qword ptr ds:, rbx |
$+55 | 41:FFC1 | inc r9d |
$+58 | 48:83C2 08 | add rdx, 8 |
$+5C | 45:3B8D 70020000 | cmp r9d, dword ptr ds: |
$+63 | 7C D1 | jl mir4s.7FF7BA518430 |
$+65 | 49:8B8D 18020000 | mov rcx, qword ptr ds: |
$+6C | 49:8B95 78020000 | mov rdx, qword ptr ds: |
$+73 | 49:899D 78020000 | mov qword ptr ds:, rbx |
$+7A | 48:85C9 | test rcx, rcx |
$+7D | 74 13 | je mir4s.7FF7BA51848C |
$+7F | 48:8B01 | mov rax, qword ptr ds: |
$+82 | 4C:8BC3 | mov r8, rbx |
$+85 | FF90 78020000 | call qword ptr ds: |
$+8B | 49:8B9D 78020000 | mov rbx, qword ptr ds: |
$+92 | 41:0FB645 00 | movzx eax, byte ptr ds: |
$+97 | 8883 1A010000 | mov byte ptr ds:, al |
$+9D | 41:807D 00 03 | cmp byte ptr ds:, 3 |
$+A2 | 49:8B85 78020000 | mov rax, qword ptr ds: |
$+A9 | 75 06 | jne mir4s.7FF7BA5184AB |
$+AB | 8360 08 FD | and dword ptr ds:, FFFFFFFD |
$+AF | EB 3F | jmp mir4s.7FF7BA5184EA |
$+B1 | 8B40 0C | mov eax, dword ptr ds: |
$+B4 | 3B05 90A91F03 | cmp eax, dword ptr ds:|
$+BA | 7D 2A | jge mir4s.7FF7BA5184E0 |
$+BC | 99 | cdq |
$+BD | 0FB7D2 | movzx edx, dx |
$+C0 | 03C2 | add eax, edx |
$+C2 | 8BC8 | mov ecx, eax |
$+C4 | 0FB7C0 | movzx eax, ax |
$+C7 | 2BC2 | sub eax, edx |
$+C9 | 48:98 | cdqe |
$+CB | C1F9 10 | sar ecx, 10 |
$+CE | 48:63C9 | movsxdrcx, ecx |
$+D1 | 48:8D1440 | lea rdx, qword ptr ds: |
$+D5 | 48:8B05 5AA91F03 | mov rax, qword ptr ds:[<GObjArrayBase |
$+DC | 48:8B0CC8 | mov rcx, qword ptr ds: |
$+E0 | 48:8D04D1 | lea rax, qword ptr ds: |
$+E4 | EB 03 | jmp mir4s.7FF7BA5184E3 |
$-6D | 49:83C0 08 | add r8, 8 |
$-69 | 41:3BD1 | cmp edx, r9d |
$-66 | 7C E9 | jl mir4s.7FF7BA0D0150 |
$-64 | EB 15 | jmp mir4s.7FF7BA0D017E |
$-62 | 48:63C2 | movsxdrax, edx |
$-5F | 49:8B0CC2 | mov rcx, qword ptr ds: |
$-5B | 48:8B81 B0000000 | mov rax, qword ptr ds: |
$-54 | 48:8945 97 | mov qword ptr ss:, rax |
$-50 | 8B5D 97 | mov ebx, dword ptr ss: |
$-4D | 44:8965 6F | mov dword ptr ss:, r12d |
$-49 | 41:8BF4 | mov esi, r12d |
$-46 | 49:C7C6 FFFFFFFF | mov r14, FFFFFFFFFFFFFFFF |
$-3F | 45:85C9 | test r9d, r9d |
$-3C | 0F8E 75030000 | jle mir4s.7FF7BA0D050A |
$-36 | 4D:8BF4 | mov r14, r12 |
$-33 | 4C:8965 C7 | mov qword ptr ss:, r12 |
$-2F | 48:C7C3 FFFFFFFF | mov rbx, FFFFFFFFFFFFFFFF |
$-28 | 48:8B87 800C0000 | mov rax, qword ptr ds: |
$-21 | 4D:8B2C06 | mov r13, qword ptr ds: |
$-1D | 49:8B85 78020000 | mov rax, qword ptr ds: |
$-16 | 48:85C0 | test rax, rax |
$-13 | 0F84 25030000 | je mir4s.7FF7BA0D04E3 |
$-D | F680 1E010000 10 | test byte ptr ds:, 10 |
$-6 | 0F84 18030000 | je mir4s.7FF7BA0D04E3 |
$ ==> | 48:8905 FEA67203 | mov qword ptr ds:[<GWorld>], rax |
$+7 | 0F28D7 | movapsxmm2, xmm7 |
$+A | 48:8B07 | mov rax, qword ptr ds: |
$+D | 49:8BD5 | mov rdx, r13 |
$+10 | 48:8BCF | mov rcx, rdi |
$+13 | FF90 28040000 | call qword ptr ds: |
$+19 | 44:3865 77 | cmp byte ptr ss:, r12b |
$+1D | 75 1B | jne mir4s.7FF7BA0D0205 |
$+1F | 44:89A7 E4070000 | mov dword ptr ds:, r12d |
$+26 | 0F28D7 | movapsxmm2, xmm7 |
$+29 | 49:8B8D 78020000 | mov rcx, qword ptr ds: |
$+30 | BA 02000000 | mov edx, 2 |
$+35 | E8 6B580D00 | call mir4s.7FF7BA1A5A70 |
$+3A | 44:3825 0A546203 | cmp byte ptr ds:, r12b|
$+41 | 75 2D | jne mir4s.7FF7BA0D023B |
$+43 | 49:8B8D 78020000 | mov rcx, qword ptr ds: |
$+4A | E8 065B4800 | call mir4s.7FF7BA555D20 |
$+4F | 84C0 | test al, al |
$+51 | 74 1D | je mir4s.7FF7BA0D023B |
$+53 | 49:8B8D 78020000 | mov rcx, qword ptr ds: |
$+5A | E8 C675F6FF | call mir4s.7FF7BA0377F0 |
$+5F | 49:8B8D 78020000 | mov rcx, qword ptr ds: |
$+66 | 45:33C0 | xor r8d, r8d |
$+69 | 33D2 | xor edx, edx |
$+6B | E8 25DDF3FF | call mir4s.7FF7BA00DF60 |
$+70 | 49:8B95 78020000 | mov rdx, qword ptr ds: |
$+77 | 0FB682 1B010000 | movzx eax, byte ptr ds: |
$+7E | A8 01 | test al, 1 |
$+80 | 0F84 17020000 | je mir4s.7FF7BA0D0468 |
$+86 | 24 FE | and al, FE |
$+88 | 49:8D8D D0000000 | lea rcx, qword ptr ds: |
$+8F | 8882 1B010000 | mov byte ptr ds:, al |
$+95 | 45:33C0 | xor r8d, r8d |
$+98 | 48:8D15 8E713602 | lea rdx, qword ptr ds:| 00007FF7BC4373F8:L"causeevent="
$+9F | E8 31C34600 | call mir4s.7FF7BA53C5A0 |
$+A4 | 49:8B8D 18020000 | mov rcx, qword ptr ds: |
$+AB | 4C:8BF8 | mov r15, rax |
$+AE | 48:85C9 | test rcx, rcx |
$+B1 | 74 07 | je mir4s.7FF7BA0D0285 |
$+B3 | E8 AD7B0100 | call mir4s.7FF7BA0E7E30 |
$+B8 | EB 03 | jmp mir4s.7FF7BA0D0288 |
$+BA | 49:8BC4 | mov rax, r12 |
$+BD | 48:8945 BF | mov qword ptr ss:, rax |
$+C1 | 4D:85FF | test r15, r15 |
$+C4 | 0F84 BA010000 | je mir4s.7FF7BA0D044F |
$+CA | 48:85C0 | test rax, rax |
$+CD | 0F84 B1010000 | je mir4s.7FF7BA0D044F |
$+D3 | 803D 237E7203 05 | cmp byte ptr ds:, 5 |
$+DA | 72 27 | jb mir4s.7FF7BA0D02CE |
$+DC | 48:8D05 62713602 | lea rax, qword ptr ds:| 00007FF7BC437410:L"Issuing initial cause event passed from URL: %s"
$+E3 | 4C:897C24 28 | mov qword ptr ss:, r15 |
$+E8 | 41:B9 05000000 | mov r9d, 5 |
$+EE | 48:894424 20 | mov qword ptr ss:, rax |
**** Hidden Message *****
论坛网址 www.yjxsoft.com
郁金香老师：QQ-150330575
VIP群 153338418
QQ交流群 909233189569245158280115
页:
[1]