UEFind by Fyyre

Windows x64 WinAPI tools for inspecting Unreal Engine processes:

Tool	Purpose
UENamePoolFinder	Locate FNamePool (GNames) and optionally GUObjectArray
UEObjectDumper	Dump UObjects (name, class, outer chain) using those structures
UEActorDumper	Extract actors + transforms from UWorld / ULevel
UESDKGenerator	Generate C++ SDK headers from reflected enums/structs/classes
UEMapExtractor	Structured world/level/actor/mesh map extraction (text + JSON)
UETeleport	Find local player, read location, teleport (write RootComponent)

Build

Requirements:

• Visual Studio 2019+ (or Build Tools) with C++ x64 toolset
• CMake 3.16+

# From a VS x64 Native Tools / developer prompt, or after vcvars64.bat:
cmake -S . -B build -G "Visual Studio 17 2022" -A x64
cmake --build build --config Release

Binaries:

• build\Release\UENamePoolFinder.exe
• build\Release\UEObjectDumper.exe
• build\Release\UEActorDumper.exe
• build\Release\UESDKGenerator.exe
• build\Release\UEMapExtractor.exe
• build\Release\UETeleport.exe

---

UENamePoolFinder

UENamePoolFinder.exe [process_name.exe]
UENamePoolFinder.exe --pid <pid>
UENamePoolFinder.exe --pid <pid> --out results.txt

Mode	Behavior
No args	Enumerate top-level windows whose class contains UnrealWindow
Process name	Match by executable name (with or without .exe)
--pid	Attach directly to the given PID
--out	Write the report to a custom path (default: UENamePoolFinder_results.txt)

Strategies for FNamePool: string signature (ByteProperty), RIP-relative instruction patterns, block-pointer heuristics. Also attempts GUObjectArray via classic strings.

---

UEObjectDumper

Dumps every valid slot in GUObjectArray, resolving names through FNamePool and walking the outer chain.

UEObjectDumper.exe [process_name.exe] [options]
UEObjectDumper.exe --pid <pid> [options]

Option	Description
--pid <n>	Attach to PID
--fnamepool <addr>	Skip auto-scan; use this FNamePool address
--gobjects <addr>	Skip auto-scan; use this GUObjectArray address
--output <file> / --out	Output path (default: UEObjects.txt)
--filter <substring>	Case-insensitive filter on name, class, or outer chain
--outer-depth <n>	Outer chain depth (default: 3)

---

UEActorDumper

Locates the active UWorld, walks PersistentLevel (and optional streaming levels), and dumps each actor’s name, class, and root-component transform.

UEActorDumper.exe [process_name.exe] [options]
UEActorDumper.exe --pid <pid> --fnamepool 0x... --gobjects 0x...
UEActorDumper.exe --pid <pid> --world 0x... --filter StaticMesh

Option	Description
--pid <n>	Attach to PID
--fnamepool <addr>	Known FNamePool address
--gobjects <addr>	Known GUObjectArray address
--world <addr>	Known UWorld or GWorld (pointer or object)
--output <file> / --out	Output path (default: UEActors.txt)
--filter <substring>	Filter by actor name / class / level
--no-streaming	Only dump the primary (persistent) level

Output columns

Level              | Actor Name                    | Class                        | Location (X Y Z)              | Rotation (P Y R)          | Scale
-------------------|-------------------------------|------------------------------|-------------------------------|---------------------------|------------------
PersistentLevel    | BP_PlayerStart_C_1            | PlayerStart                  | 1234.50  67.00  -89.25        | 0.00  90.00  0.00         | 1 1 1

Summary footer: world address/name, levels processed, actors dumped, transform hit count, time taken.

How it works

1. Obtain FNamePool + GUObjectArray (auto or manual).
2. Detect UObjectBase field layout (shared with UEObjectDumper).
3. Find UWorld: GWorld string/RIP patterns, else scan GObjects for class World and score by valid Level + Actors arrays. Optional --world.
4. Collect ULevel pointers from the world (PersistentLevel + streaming / level collections when visible).
5. On each level, locate the Actors TArray heuristically and resolve each actor’s name/class.
6. Find RootComponent (scene component) and read RelativeLocation / RelativeRotation / RelativeScale3D (float and double/LWC layouts).

---

UESDKGenerator (Dumper-7 style, dual backends)

Generates a Dumper-7-style C++ SDK. Supports both name systems and both property walkers:

Area	Older	Modern
Names	TNameEntryArray (pre-4.23 GNames)	FNamePool (4.23+/UE5)
Properties	UProperty list via Children	FField/FProperty via ChildProperties (4.25+)
GObjects	Flat or chunked	Chunked FChunkedFixedUObjectArray

UESDKGenerator.exe [process_name.exe] [options]
UESDKGenerator.exe --pid <pid> --fnamepool 0x... --gobjects 0x... --output SDK
UESDKGenerator.exe --pid <pid> --version 4.22 --gnames 0x...
UESDKGenerator.exe --pid <pid> --version 5.3 --properties ffield --filter Engine

Option	Description
--fnamepool <addr>	FNamePool (4.23+)
--gnames <addr>	Classic GNames / TNameEntryArray
--gobjects <addr>	GUObjectArray
--version <ver>	4.22, 4.27, 5.1, pre4.23, modern, auto
--properties <mode>	ffield / uproperty / auto
--output <dir>	Output directory (default: SDK)
--filter <substr>	Limit package/type names
--blueprint-only / --native-only	Filter Blueprint *_C types

Output layout

SDK/
├── BasicTypes.hpp
├── Enums.hpp
├── Structs.hpp      # inheritance, offsets, padding
├── Classes.hpp      # properties + function signatures
├── Offsets.hpp
├── SDK.hpp
└── SUMMARY.txt

How it works

1. Init name backend (FNamePool first, else classic GNames; overridable).
2. Locate GObjects (chunked or flat).
3. Detect UObject + UStruct layouts; score FField vs UProperty walkers.
4. Scan enums / structs / classes / functions; map types; emit headers with Dumper-7-style padding.

---

UEMapExtractor

Structured map / placement extraction: world, levels, actors, world-space transforms, mesh references, attach parents.

UEMapExtractor.exe [process.exe] [options]
UEMapExtractor.exe --pid <pid> --fnamepool 0x... --gobjects 0x... --output MapExtract.txt
UEMapExtractor.exe --pid <pid> --json --output map.json --filter StaticMesh

Option	Description
--fnamepool / --gobjects / --world	Known addresses
--output / --out	Default MapExtract.txt
--json	JSON output (also if path ends with .json)
--filter	Name / class / level / mesh substring
--no-streaming	PersistentLevel only

Per actor: address, name, class, level, location/rotation/scale (prefers ComponentToWorld), root component, mobility, StaticMesh/SkeletalMesh/ISM/HISM name, attach parent.

---

UETeleport

Find the local player pawn and read / write its RootComponent location (clear CharacterMovement velocity when found).

UETeleport.exe --pid <pid> --read-only
UETeleport.exe --pid <pid> --x 1000 --y 200 --z 50
UETeleport.exe --pid <pid> --fnamepool 0x... --gobjects 0x... --x 0 --y 0 --z 100

Option	Description
--x --y --z	Target location (required unless --read-only)
--read-only	Print current location only
--fnamepool / --gobjects	Known addresses
--offset-pawn	Controller → Pawn override
--offset-root	Actor → RootComponent
--offset-relloc	Root → RelativeLocation
--offset-movement / --offset-velocity	Character movement overrides
--float-vector / --double-vector	Force FVector width

Flow: PlayerController → AcknowledgedPawn/Pawn (fallback: player class name scan) → RootComponent → RelativeLocation write + Velocity zero.

Requires PROCESS_VM_WRITE for teleport (run as Administrator if needed). Anti-cheat may block writes.

---

Suggested workflow

1. UENamePoolFinder → note FNamePool / GObjects addresses
2. UEObjectDumper → explore object graph / verify names
3. UEActorDumper → flat placement table
4. UEMapExtractor → grouped map extract (meshes + hierarchy)
5. UETeleport → move local player to map coordinates
6. UESDKGenerator → reflected SDK for property browsing

Passing --fnamepool and --gobjects into later tools avoids repeating full-process scans.

---

Technical notes

• 64-bit only, WinAPI only (no third-party libraries)
• Safe ReadProcessMemory with readable-region scanning
• FName: block + offset decode, ANSI/wide entries, optional number suffix
• Chunked FChunkedFixedUObjectArray aware
• Requires PROCESS_VM_READ — run as Administrator if access is denied
• Anti-cheat may block process reads
• Offsets vary by UE version; heuristics try common layouts and score candidates

Disclaimer

For educational reverse-engineering only.