Skip to content

Value Search

Jump to bottom
bbfox0703 edited this page Jul 11, 2026 · 4 revisions

🌐 English · 繁體中文 · 日本語

Value Search

The Value Search tab scans reflected (UPROPERTY) fields across all UObject instances for values matching a predicate — essentially Cheat Engine's Find First Scan adapted to UE's object graph. Use it to pin down a gameplay value's storage location(s), then Live-Walker to inspect the field's owning object and extract a pointer chain.

Single-Value Scan

The default mode: find all instances of one value across all objects.

Basic workflow

  1. Pick a data type from the Type dropdown: Int32, Float, FString, FVector, etc. Start with NumericNoByte if you're unsure (it scans word/dword/qword/float/double in one pass; excludes 1-byte fields so small values don't flood results).
  2. Choose a predicate from Scan:
    • Exact — value equals your input (e.g. HP = 100).
    • Bigger / Smaller — numerical ordering (e.g. level > 50).
    • Between — range (e.g. mana 25..75) — shows a live preview after you enter both bounds.
    • Contains / StartsWith / EndsWith — substring match for strings.
  3. Enter the value (e.g. 100, "PlayerName", 1.5,2.5,3.5 for FVector).
  4. Click First Scan. The DLL walks all GObject instances + their TArray elements, tests reflected numeric UPROPERTY fields against your predicate, and returns matches.
  5. Refine with Next Scan: change the predicate or value (e.g. HP changed to 95), click Next Scan. The DLL re-reads existing candidates and keeps only those still matching.
  6. Use Changed / Unchanged / Increased / Decreased on refine to compare against the previous scan (no explicit value needed — the value box hides).

Per-scan conditions

Control Behavior
Game classes only Default ON. Skip engine packages (/Script/Engine, /Script/CoreUObject, etc.); gameplay classes + Actor/Pawn/Component derivatives are always kept. Faster scans, cleaner results.
Parallel scan Default ON. First Scan uses worker threads (fast). OFF = single-threaded, stealthier against anti-tamper. Next Scan is already single-threaded.
Batch read Default ON. Read each object's fixed fields in one body read (fewer syscalls, better cache). OFF = one read per field (exact byte boundaries). First Scan only.
Deep (nested containers) Default OFF. Also scans inside deeply-nested containers (e.g. SaveSlot[1].ItemList[3].Mods[N].Value). Heavier, but finds values buried in arrays/structs that shallow scan misses.
Native-C (raw) Default OFF. Opt-in. See Native-C fields below.
Newest first Default OFF. Walk objects high-index-to-low (most-recently-allocated first), so truncation keeps fresh instances rather than old templates. Auto-enabled when Native-C is ON. WHEN TO UNCHECK: if the value lives on your main character spawned at game start (low index).
Skip Engine/System noise Default OFF. Pre-filter: skip pure engine/system classes (UI widgets, textures, sounds, Niagara, anim instances) at scan time — never enter results. Differs from the class picker below (which filters after). Gameplay guardrail keeps Actor/Pawn/Component/PlayerState/GameInstance derivatives. Locked at First Scan.
Max Default 50k. Stop when hit count reaches this; raise if results are truncated.
Timeout Default 25s. Deadline for the scan; raise for 400K+ object games that time out. Next Scan (refine) is fast — uses this for both modes.

Rounding mode (for numeric scans)

Round (default), Trunc, Ceil — how a fractional float/double target is reduced to the integer the game displays before comparison:

  • Round: 10.9 → 11; Between 10.9–11.1 → 11–11.
  • Trunc: 10.9 → 10; Between 10.9–11.1 → 10–11.
  • Ceil: 10.1 → 11; Between 10.1–11.1 → 11–12.

Integer fields and Float/Double field values are NOT affected; only a fractional target is coerced when entered. (Replaced the old ± tolerance band.)

Results grid

Columns: Class.Field | Type | Origin (Reflected vs Native-C) | Value | Offset | Address | Instance (object name).

Action buttons per row:

  • Live — jump to Live-Walker, focused on this field's offset within the instance.
  • inst — open Instance Finder, pre-filled with this field's owning class.
  • Addr — copy the field's absolute memory address.
  • 🔗 — show related objects (components, GAS AttributeSets, etc.) for this instance in the Related tab.
  • 🌍 — Locate in GWorld: find the shortest pointer path from GWorld down to this instance, open in Live-Walker.
  • ⚙ — Locate in GameEngine: same as GWorld but rooted at UGameEngine (reaches engine-owned objects GWorld can't).
  • 📊 Pivot (experimental) — send this field to the Class Pivot tab as a projected value across its class's instances (Class Pivot groups by identity or a separately-chosen key field, not by this field). Shown only when the experimental Class Pivot tab is available.

Filter & Sort (bottom row, server-side over full result set):

  • Keyword filter (any column, case-insensitive).
  • Sort picker: Scan order, Value, Class, Field, Type, Offset, Address, Instance; Desc toggle.
  • Page load: initially shows first 1,000 rows; Load More fetches the next page.

Multi-Value / Group Scan

Find objects holding all of 2–4 values simultaneously at distinct offsets — far more selective than individual single-value scans. Example: locate a stats object by matching Str=24, Def=18, Dex=15, Int=20 together.

Basic workflow

  1. Toggle Single value ↔ Multiple values (group) at the top.
  2. Enter 2–4 values — one per row. Each row has:
    • Data type (default NumericNoByte).
    • Scan type (Exact / Bigger / Smaller / Between / Changed / Unchanged / Increased / Decreased — same as single-value).
    • Value box(es); hides for prev-value types.
    • ..to box (only for Between).
    • Live Between range preview.
  3. Click Group First Scan to find objects matching ALL values at once.
  4. Click Group Next Scan to refine — e.g. enter new values or switch to Unchanged to narrow further.

Group-specific options

Control Behavior
Deep (nested containers) Default OFF. Each numeric TArray / struct-array element becomes its own match block; finds groups buried inside deeply-nested containers.
Cross-object (owned components) Default OFF. Fold each actor's owned sub-objects (components, GAS AttributeSets) into the actor's match block, so a group distributed across {actor, its components, attribute sets} is found.
Native-C (raw) Default OFF. Include unmanaged holes in each object's block.
Newest first Default OFF. Walk newest-first (auto-enabled with Native-C). Uncheck if the target is an early-spawned, low-index object.
Skip Engine/System noise Default OFF. Same pre-filter as single-value.
Rounding mode Shared with single-value; applies to all slots.
Timeout Shared with single-value.

Group results (master-detail)

Top grid: rows = matched objects. Columns: Class | Instance | Matched values (summary).

Select a row to expand and see the detail panel below:

  • Locked offset table (when all slots have converged to a single offset each) — e.g. "🔒 Class — Str@0x20, Def@0x24, Dex@0x28, Int@0x2C".
  • Per-slot matched field entries: Lock status | Class.Field path | Value | buttons (Live / Addr / 🌍 / ⚙ / 📊 Pivot (experimental — sends the slot to Class Pivot, shown only when that tab is available)).

All handoffs (Live, Locate, Copy) reuse single-value events; cross-object slots open the owning sub-object (component/AttributeSet).

Filter & Sort (server-side): keyword filter (class/instance/field/value), sort by Scan order / Class / Instance / First value / First offset.

Native-C Fields — Finding Non-UPROPERTY Values

By default, Value Search only sees UPROPERTY-reflected fields. Many games store gameplay values (HP, MP, stamina, stats) as plain C++ members without the UPROPERTY() macro — these are invisible to reflection.

Why Native-C scanning matters

  • The problem: A reflected field-walker reads only property metadata; unmanaged bytes are skipped. Cheat Engine's raw scan finds them; Value Search could not.
  • The solution: Enable Native-C (raw) to also scan the unmanaged holes — byte ranges within each object (from after the UObject header to the class's PropertiesSize) that no UPROPERTY covers. The scanner uses a "Guess What" heuristic to interpret raw bytes as Int32/Float/etc.

How it works

  1. Turn on Native-C (raw) (single or group mode).
  2. Pick your Data type (numeric only: Int32, Float, etc. — no strings, vectors, or bools).
  3. First Scan is intentionally noisy — any matching 4 bytes at a hole offset is a hit. Narrow by:
    • Game classes only toggle (skip engine noise).
    • Class picker below results (exclude obvious non-targets).
    • Or simply switch to Newest first to keep fresh instances (auto-enabled).
  4. Next Scan to converge: change the value or use Changed / Unchanged / Increased / Decreased to re-read and prune the noisy first results.

What you'll see

Matched rows show Origin column:

  • Reflected — a normal UPROPERTY field.
  • Native-C (Int32) — a raw hole interpreted as Int32; "?" suffix (Int32?) means uncertain confidence.

Deep + Native-C

When both Deep and Native-C are enabled, the raw scan additionally reaches inside struct-array elements — e.g. a value inside a TArray of a USTRUCT with no UPROPERTY members. Even heavier and noisier; pair with distinctive values + Next Scan refine.

Locate in GWorld / GameEngine

After a successful scan, click 🌍 Locate in GWorld on a result row to find the shortest pointer path from the global GWorld down to that instance, and jump to Live-Walker showing the chain.

🌍 GWorld — Reaches world-rooted actors (Pawns, NPCs, items, destructibles, etc.).
⚙ GameEngine — Reaches engine-owned objects instead (UI, GameInstance, LocalPlayer, engine systems). Use when the instance is not in the world graph.

If the instance has moved or been freed since the scan, the path search reports "no path" or "invalid."

Tips & Gotchas

  • Containers (TArray, TSet, TMap) — Every element is scanned and appears as FieldName[index]. Arrays over 10,000,000 elements are skipped as a corruption guard.
  • Instance selection — After a scan, click Load More to fetch additional pages (server-side pagination). Filter/Sort run on the full session in the DLL; the grid always shows the current window.
  • Session lifetime — A session persists until you click New Scan or switch tabs. Next Scan re-reads the current candidate set; New Scan discards it and resets for a fresh query.
  • Value2 (Between) — When Scan type is Between, the upper bound is required; the live preview shows the coerced integer + literal float ranges under your chosen rounding mode.
  • Case sensitivity — Only affects string types (FString, FName, FText); default is case-insensitive (Cheat Engine style).
  • String vectors — Enter FVector as X,Y,Z (e.g. 10.5,20.3,30.1).
  • Small values + NumericAll — Searching for 0, 1, or 255 with NumericAll (includes 1-byte fields) will match a huge number of fields across all objects; use NumericNoByte or a larger/more distinctive value to avoid flooding.
  • Native-C first scans truncate — On large games, noisy raw scans may hit the result cap before scanning all objects. Newest first ensures the survivors are the most-recently-allocated (freshest gameplay instances), not ancient CDOs. Game classes only pre-filters noise. Converge with Next Scan after narrowing.

Cross-references

  • Instances — Find instances of a specific class by name/property patterns.
  • Live-Walker — Inspect a UObject and walk its pointer chains; export Cheat Engine scripts.
  • Home — Overview and feature index.

See the repo README for build & usage instructions.

Clone this wiki locally