-
Notifications
You must be signed in to change notification settings - Fork 6
Interesting Funcs and Props
bbfox0703 edited this page Jul 11, 2026
·
5 revisions
Instead of hand-scanning thousands of UFunctions and UPROPERTY fields, the Interesting Funcs and Interesting Props tabs surface high-value ones via keyword scoring and structural heuristics — so a Cheat Engine table-maker jumps straight to candidates like teleport / damage / money functions, or HP / gold / stat properties in unconventional locations.
The Interesting Funcs panel scans all UFunctions across loaded UClasses, scores each by keyword matches (e.g. "Teleport", "GiveMoney", "Kill"), flags from reflection (Native, Static, Exec), and class-membership bonuses, then ranks by combined score descending. High-scoring functions are hidden by default (below a threshold of 5); toggle Show All to include low-scorers.
- Click Load to scan all UFunctions (takes 2–10 seconds on large games with 1M+ objects). Score is computed client-side; the status row shows total functions, scanned classes, and how many surpassed the threshold.
- Filter results using:
- Game Only – skip /Script/Engine and other engine packages (~5x smaller result set for typical games).
- Filter text box – substring match against function name OR class name (case-insensitive; e.g. "Money" finds both AddMoney and PlayerInventory::AddMoney).
- Category dropdown – Stats / Inventory / Movement / Combat / Utility / Other (categories are picked from the strongest-scoring keyword per function).
- Show All – include all functions, even below-threshold ones (useful when you know a function exists but the scoring didn't rank it high).
- Class filter – exclude noisy classes (UI widgets, system components) via the facet picker.
- Select one or more rows (Ctrl/Shift+click) to batch-generate a Cheat Table or inspect individual functions.
| Control | Purpose |
|---|---|
| Game Only | Exclude engine packages (/Script/Engine, /Script/CoreUObject). Recheck and reload to apply. |
| Filter | Substring match on function or class name, case-insensitive. |
| Category | Stats > Inventory > Movement > Combat > Utility (picked from strongest-scoring keyword). |
| Show All | Bypass the score threshold (5) and display all functions. |
| Clear | Reset Filter, Category, and Show All to defaults. |
| Class filter | Right-click to open facet picker; tick to exclude classes. |
- Score – numeric score used for ranking; hover for breakdown (keyword hits, class bonus, flag bonus).
- Cat – category label + color (Stats, Inventory, Movement, Combat, Utility, Other).
- Class – owning UClass name.
- Function – UFunction name.
- Flags – reflection flags (Native, Static, Exec, etc.).
- Params – parameter count.
- Uses – properties this function reads/writes (filled by batch "Props" scan; shows "0" for native functions or no-access funcs, or a preview like "2 · Health, Mana, …").
| Button | Action |
|---|---|
| inst | Open this function's class in the Instance Finder tab (pre-fills class name, runs search). |
| Props | List properties this function's bytecode reads/writes (modal dialog; native functions show nothing). |
| Live | Open in Live Walker. If no live (non-CDO) instance exists, falls back to Class Struct; auto-expands Functions section and selects the row. |
| 🌍 | Locate in GWorld — find a live instance of this function's class, show the pointer path from GWorld to it (parent mode). Disabled until GWorld resolves. |
| ⚙ | Locate in GameEngine — find a live instance of this function's class, show the pointer path from the live UGameEngine to it. Reaches engine-layer objects GWorld can't; for most world actors use 🌍. |
| AA(B) | Copy AA Script (Baked) — open the Baked Invoke dialog for this function. Requires ue5_invoke_helper.lua embedded in your CE table (Tools → Export CE Helper Lua File). |
| Name | Copy bare function name to clipboard (no class prefix, so it pastes directly into CE scripts). |
- ⤋ Props – fill the Uses column for selected rows (or all rows if none selected), so you see field references without opening per-row dialogs. Fast — each call reads one function's bytecode only. Shows progress; cancellable. Cached across filter changes (re-batch only includes not-yet-done rows).
- 📦 Generate CT – generate a .CT file with baked-invoke entries for every selected row (Ctrl/Shift+click to multi-select first). For functions with parameters, the generated script's helper zero-fills the PARAMS buffer; edit the baked PARAMS table in Cheat Engine before activating. Rows must have a valid class and function name.
- Progress bar – visible during Load; incremental status shows load phase ("Loading all UFunctions (2–10s on large games)…").
- Status text – displays final count, scanned class count, threshold-qualified rows, and scanned-object count. Recomputes when filters change.
- Class filter note – shows count of rows hidden by class exclusions (helps distinguish empty grids caused by stale filters from genuine misses).
- AOBMaker note – shown when the Cheat Engine AOBMaker plugin is unreachable ("AOBMaker plugin not found — AA Script export will fall back to clipboard"). AA(B) still works via clipboard fallback; the workflow is just degraded.
The Interesting Props panel searches for high-value properties using a keyword-driven approach — it issues parallel queries for seed keywords (HP, Damage, Gold, Speed, etc.), scores results by keyword matches and structural heuristics, deduplicates, and displays them ranked by score. A standout feature: Unusual Location badge (⚠) highlights properties whose owning class sits outside the conventional Character/Pawn/PlayerState hierarchy (LocalPlayer, HUD, GameViewportClient, CheatManager, etc.) — the places a CE maker might miss but cheats often hide.
- Click Load to fan-out searches across the seed keyword list and score the results. Status text shows raw hit count, scanned classes, scoring phase progress, and final unique property count + threshold/unusual breakdowns.
- Filter results using:
- Game Only – skip engine packages (recommended on — game-specific properties are cheat-table targets).
- Filter text box – substring match on property name OR class name, case-insensitive.
- Category dropdown – Stats / Combat / Resources / Movement / Utility / Other.
- ⚠ Unusual Only – show only properties whose owning class is in the Unusual Location list (LocalPlayer / GameViewportClient / HUD / CheatManager). This is the key differentiator from regular Property Search: surfaces the hidden gems.
- Show All – include all properties, even below-threshold ones (threshold is 4).
- Class filter – exclude noisy classes.
- Select rows (Ctrl/Shift+click) to batch-find functions that reference them or generate a freeze-based Cheat Table.
| Control | Purpose |
|---|---|
| Game Only | Exclude engine packages. Recommended on. Recheck and reload to apply. |
| Filter | Substring match on property or class name, case-insensitive. |
| Category | Stats, Combat, Resources, Movement, Utility, Other. |
| ⚠ Unusual Only | Show ONLY properties in unusual locations (LocalPlayer, HUD, GameViewportClient, CheatManager). |
| Show All | Bypass the score threshold (4) and display all properties. |
| Clear | Reset Filter, Category, Unusual Only, and Show All to defaults. |
| Class filter | Right-click to open facet picker; tick to exclude classes. |
- Score – numeric score used for ranking; hover for breakdown.
- Cat – category label + color.
- ⚠ Location – badge when the property is in an Unusual Location (LocalPlayer, HUD, GameViewportClient, CheatManager). Sortable. Hover for score details.
- Class – owning or defining UClass name.
- Property – UPROPERTY name.
- Type – UE type (BoolProperty, IntProperty, FloatProperty, etc.).
- Offset – hex offset in the class instance.
- Funcs – functions that reference this property (filled by batch "Find Funcs" scan; shows counts like "2 · AddHealth, TakeDamage, …").
| Button | Action |
|---|---|
| inst | Open this property's class in the Instance Finder tab (pre-fills class name, runs search). |
| Find Funcs | List UFunctions that read/write this property (static bytecode cross-reference scan). Opens a modal dialog. Time-intensive (full game-wide bytecode sweep per row); batch "⤋ Funcs" is faster. |
| Live | Open this property's class in Live Walker (live instance lookup), or fall back to Class Struct if no live instance. |
| Name | Copy bare property name to clipboard. |
| 🌍 | Locate in GWorld — find a live instance of this property's class, show the pointer path from GWorld to it (parent mode). Disabled until GWorld resolves. |
| ⚙ | Locate in GameEngine — find a live instance of this property's class, show the pointer path from the live UGameEngine to it. Reaches engine-layer objects; for most world actors use 🌍. |
- Find functions using this field – same as the per-row "Find Funcs" button.
- Pivot this property… (experimental) – send this field to the Class Pivot tab as a projected value to inspect across the owning class's instances (Class Pivot groups by identity or a separately-chosen key field, not by this field). Shown only when the experimental Class Pivot tab is available.
- ⤋ Funcs – find functions that reference selected rows (or all rows if none selected). Each call runs a full game-wide bytecode sweep (hundreds of ms each), so a warning appears for 25+ rows. Fills the Funcs column inline; cancellable. Cached across filter changes.
- 📦 Generate CT – generate a .CT file with freeze entries for every selected row (Ctrl/Shift+click to multi-select first). Only freeze-supported types are included (numeric, bool, enum, string-ish); struct / array / non-scalar rows are skipped with a status-line note. Each entry uses ue5_freeze_helper.lua — embed it in the resulting CT via Tools → Inject Freeze Helper in Cheat Engine, or open and edit CFG.value before enabling.
- Progress bar – visible during Load.
- Status text – displays final unique property count, threshold-qualified count, and unusual location count (e.g., "523 unique properties (threshold 4+: 108, ⚠ unusual: 12)").
- Class filter note – shows count of rows hidden by class exclusions.
Both panels use client-side scoring tables to rank results. Scoring components include:
- Keyword hits – matches against a curated seed-keyword list (e.g., "Teleport", "Health", "Gold"). More keywords matched = higher score.
- Class bonus – owning class name also scored (e.g., PlayerCharacter, GameMode). Bonus applied once per function/property, not per keyword.
- Flag bonus (Funcs only) – reflection flags like Native, Static, Exec add points.
- Unusual location bonus (Props only) – properties in LocalPlayer / HUD / GameViewportClient / CheatManager / UCheatManager receive a boost and the ⚠ badge.
Thresholds: Funcs default to 5, Props default to 4. Tune via Show All toggle.
| Action | Destination | Pre-fills |
|---|---|---|
| inst button | Instance Finder tab | Class name; runs search |
| Live button | Live Walker or Class Struct | Class instance or metadata; expands Functions/Properties section |
| 🌍 button | Live Walker | Pointer path from GWorld to a live instance (parent mode) |
| ⚙ button | Live Walker | Pointer path from GameEngine to a live instance |
| Props (Funcs) / Find Funcs (Props) | Modal dialog | Bytecode cross-reference results (no tab change) |
| 📦 Generate CT | Save dialog | Generated .CT file (baked-invoke or freeze format) |
| Pivot this property… (Props, right-click) (experimental) | Class Pivot tab | The field, projected as a value across its class's instances (shown only when Class Pivot is available) |
- Keyword misses: The seed-keyword list is finite (HP, Damage, Gold, Speed, etc.). A property or function outside that list won't score high even if it's game-relevant. Workaround: use the Filter box to manually search, or check Show All to see everything.
- Native functions show no Props: Native (non-Blueprint) UFunctions have no bytecode, so the Props modal and Uses column show nothing. Only Blueprint functions are cross-referenceable.
- Unusual-location filtering is powerful: When chasing a cheat, toggle ⚠ Unusual Only to highlight properties developers tucked into LocalPlayer, GameViewportClient, or HUD — the places a raw class hierarchy search would miss.
- Batch "Find Funcs" is slow: Each property triggers a full game-wide bytecode scan (~hundreds of ms). Pre-select 5–10 high-confidence rows, or cancel if it's taking too long.
- Freeze-script generation skips complex types: Struct, array, and other non-scalar properties are silently dropped from the Cheat Table batch. Use the Property Search tab or Class Struct for deep manual inspection.
- Live-Funcs — the behaviour-based counterpart: find a function by performing the action and seeing what fired, instead of guessing its name.
- Live-Walker — walk and inspect live objects in the GWorld graph; used to drill into function/property targets discovered here.
- Value-Search — raw memory value scanner; complements Interesting Props by finding values you know but whose property name you don't.
- Instances — instance finder; used by the per-row inst handoff to pre-fill class name and search for live objects.
- Quick-Start — overall workflow guide.
- UE5CEDumper README — project overview and feature summary.