Skip to content

Instances

Jump to bottom
bbfox0703 edited this page Jun 25, 2026 · 2 revisions

🌐 English · 繁體中文 · 日本語

Instances (Instance Finder)

The Instances tab lets you search the live UE5 object graph by class name or object name, reverse-look-up objects by memory address, and inspect their field values. Once you find an instance, browse its fields and export data to Cheat Engine.

Finding Instances by Class or Object Name

Use the class and object name fields at the top to query the live game.

  1. Enter a class name (e.g. PlayerController, Character) in the first field. Substring match by default; tick Exact match for whole-name matching only.
  2. (Optional) Enter an object name in the second field (e.g. WB_HUD_MagicStone). Searches are case-insensitive and combined with the class box as AND — both must match the result.
  3. (Optional) Toggle Newest first to scan from the highest InternalIndex (catches just-spawned instances like enemies that just appeared). Off keeps the oldest first (class-default / template / earliest instances — good for finding a Blueprint's defaults).
  4. Adjust Max (the result cap, 100–50000; default 5000). The game-side scan is always exhaustive; this only caps the returned list. Raise it if you see "⚠ capped" in the status.
  5. Click Search or press Enter.

Results appear in the grid below. If truncated ("⚠ capped at N of max M"), either exclude noise classes in the class-filter picker (⚑) — that re-runs the scan in the game with those classes hidden — or raise Max.

Tip: The Newest first toggle and the Max cap are tuned to catch instances right after they spawn (avoid early cutoff) and skip system cruft (UI widgets, sound components). Click the Index column header to re-sort by index if you prefer a different order.

Temporary Client-Side Filter

Below the search bar is a keyword filter box labeled Filter results (Name / Class / Addr). Type space-separated search terms to narrow the returned rows without re-querying the game — terms are ANDed across object Name, Class name, and Address. This filter only works within the already-returned set; to recover an instance hidden past the result cap, use the class-filter picker or raise Max.

Finding Objects by Address

Paste an address into the Address field at the top (hex format like 0x7FF… or module.exe+offset). Click Lookup or press Enter. The app reverse-looks-up the UObject at that address and displays:

  • Exact: found a UObject at that exact address.
  • Inside: the address is within the object's fields (offset +0x...).
  • Contains: the address is inside a property (usually past the object's own data).
  • Backward: found during backward scan (past the UObject's data, likely raw heap / native data).
  • Nearest ⚠: no UObject at the address — the app found the nearest one. Likely raw heap / native allocation. Click the result row to inspect it anyway.

The status line also shows [scanned X/Y in Zms] — if "DEADLINE HIT" appears, the scan timed out before completing all objects; retry to continue.

Container Matches

If the address falls inside a TArray buffer (an array property), a separate section appears below the lookup status showing all container owner objects. Each row shows:

Column Meaning
Path The property path from root to the array element
Owner Class The UObject class holding the array
Inner The array element type
Owner Addr Address of the owning object

Per-row actions (right side):

  • Live (⚡): jump to the owner in [Live-Walker].
  • Addr (⚡): copy the owner's address.
  • 🌍 / ⚙: path-search from GWorld or UGameEngine down to the owner, auto-drilling into the matched container element.

Inspecting Fields

Click an instance in the results grid to load and display its fields in the bottom pane. The grid shows:

Column Meaning
Offset Hex offset within the object
Name Field name
Type Field type
Value Interpreted value (scalars, strings, pointers, etc.)
Hex Raw hex bytes
Address Absolute memory address of the field

Click Addr on any field to copy its absolute address to clipboard.

Action Buttons Above the Fields Grid

(Visible only when an instance is selected.)

  • Copy CE XML: export the instance as a CE XML pointer chain (copied to clipboard).
  • Open in Live Walker: open the selected instance in the [Live-Walker] tab for detailed inspection and pointer-chasing.
  • 🌍 Locate in GWorld: find the shortest pointer path from GWorld down to this instance. Reachable objects only. Shows the path in Live Walker.
  • ⚙ Locate in GameEngine: same as above but from the live UGameEngine, reaching engine-layer objects that GWorld doesn't expose. Not available if the engine isn't initialized.
  • 🔗 Related: show related objects (components, GAS ASCs, controller↔pawn links) in the [Related] tab.

Finding Functions That Take a Class Parameter

Select one or more instances in the grid and click ⤋ Find Func (top right) to see which UFunctions take the selected instance's class as a parameter or return value. This is a reflection scan that includes native functions.

  • Click ⤋ Find Func to scan all visible instances. If more than 25 distinct classes are selected, you'll be prompted to confirm (each class triggers a full game-wide scan; rows sharing a class reuse one).
  • Click ✕ Cancel to stop the scan early.
  • Per-instance Find Func button (right side of each row, purple text): scan just that instance's class.

Results appear in the Funcs column of each row, deduped by class within the run.

Per-Instance Inline Actions (Right Side of Each Row)

  • Addr: copy the instance's address.
  • AA: generate a CE Auto Assembler register-symbol script (copied to clipboard).
  • Name: copy the object name.
  • Class: copy the class name.
  • Find Func: find UFunctions for just this instance's class.

Locating Instances in the Live Object Graph

Once you find an instance, use 🌍 Locate in GWorld or ⚙ Locate in GameEngine to verify it's reachable in the live object graph:

  • GWorld: the world's actors and their components. Fails silently if the instance isn't in the GWorld hierarchy.
  • GameEngine: the live UGameEngine and everything beneath it — engine subsystems, console, viewport, etc. Reaches objects that GWorld doesn't expose.

Both buttons path-search from their root to the instance and open the path in [Live-Walker], stopping at the parent that points to it so you can step into the target.

Related Pages

Clone this wiki locally