bbfox0703/UE5CEDumper v3646

UE5CEDumper v3646

on GitHub

UE5CEDumper — Unreal Engine 4/5 dumper (C++ DLL + Cheat Engine bridge + Avalonia UI).

About this release

Mostly about seeing what a game does when you act: Live Funcs can now record a call trace, with the parameters and native call stacks of the functions you choose, read in a new Call Trace tab (experimental). Dump All also writes structs, enums and function parameters, and Dump Explorer compares two dumps. Several of these began as fireundubh's PRs #539 and #540 — thank you.

New

• Call Trace tab (experimental): tick Trace in Live Funcs and the same Start records every call as a call tree — who called what, on which object.
• Trace ticks in the Live Funcs table limit the trace to what the ticked functions call; a tick follows its function by name, even after the game unloads it.
• Params? column: the chosen functions' parameters, copied at the call and after it, decoded by type in Call Trace's Parameters tab.
• Stack? column: the chosen functions' native call stacks in Call Trace's Call stack tab; Copy puts a frame's address in Cheat Engine's form.
• The trace buffer slider (32–512 MB) shows how long it lasts and how much memory it costs; the stack budget (Standard / Low) limits what stacks add to the game's frame time.
• Live Funcs: Fetch limit (up to 32,768 rows), Min calls, Hide per-frame and Save .jsonl.
• Live Funcs: the capture settings fold into one summary line, and Clear T/P/S clears every choice at once.
• Dump All writes structs, enums and function parameters, and can also write an object index (Export menu).
• Dump Explorer shows structs, enums and function arguments, and Compare… turns two dumps of a game into an HTML report.
• UE version override reaches down to 4.11; its tooltip says what it changes, a version the game's own functions contradict is refused, and Auto goes back to the detected version at once.
• The Object Tree remembers that it was collapsed.

Fixed

• A UE 4.10 game (IS Defense) is refused as too old instead of being scanned and misread.
• On UE 4.11–4.17 games, function parameters are read from the layout the game really has, even when its UE version was detected or set wrongly.
• Calling a function from a Cheat Engine table is refused when its parameters would not fit the 1 KB parameter area, instead of risking an overrun when their size was misread.
• Invoke, the SDK header and Find Func no longer take a Blueprint function's local variables for parameters.
• Live Funcs: pressing Set Baseline again with Diff on kept the old Δ and NEW marks.
• Teleport's CSV and Lua export dialogs add the file extension when you type a name without one.
• Dump All's progress updates twice a second.

Call Trace: when to use it, and its limits

Experimental. Tick Enable advanced experimental features (the box at the bottom of the System tab), tick Trace in Live Funcs, Start and Stop, then open the Call Trace tab.

Use it to:

• Find which UFunction runs when you do something in the game, on which object, and what called it.
• See a function's parameters as the game passed them, decoded by type, at the call and after it returns.
• Get a chosen function's native call stack, and Copy a frame's address in Cheat Engine's form to dig further there (ASM opens it in CE's disassembler, and needs the AOBMaker CE plugin).

It does not:

• See calls that skip ProcessEvent: native C++ calling native C++, or a Blueprint calling a native function directly.
• Name most native frames: only ProcessEvent, a UFunction's native entry and the Blueprint interpreter; the rest show as module + offset.
• Pause, step or change the game: it watches. Use Cheat Engine or a debugger for that.
• Keep every stack: a per-second budget keeps the first calls of each second (Low halves it).

⚠ Native stacks are read on the game's own thread and add to its frame time. Save first and choose few functions: an unforeseen case could stall or crash the game.
ℹ️ It works in games where the dumper can be loaded; games with anti-cheat are out of scope, as for every other feature.

Known issues

• Turning the experimental features off after recording a trace still offers Open in Call Trace, which opens the hidden tab.
• A game refused as too old still shows "Object-array stride not detected" in the header, and its notice reads "UE 411" for 4.11.
• At the default window size, Call Trace's detail pane widens only to about 500 px; fold the Object Tree or widen the window for more.

⚠ Leave the UE version override on Auto unless detection is clearly wrong: a wrong version misreads data, and a function call built on it can crash the game.

ℹ️ If you use a proxy DLL, redeploy it from the Proxy Deploy tab: the call trace, parameters, stacks and the UE 4.10 check need this release's DLL in the game.

Details for anyone who wants them: v3615…v3646

⚠ If anything regresses for you, fall back to v3615.

Setup

• Deploy proxy DLL from UI's Proxy Deploy tab (recommended), inject via UI's Proxy Deploy tab (AntiVirus may block UI; add it to exclude list), inject via the bundled Cheat Engine table (UE5CEDumper.CT), or drop the proxy version.dll into the game's Binaries\Win64 (manual mode).
• If neither version.dll nor dinput8.dll is loaded by your game, try dxgi.dll; if that filename is already taken (ReShade commonly uses it), try winmm.dll.
• See README.md for details.

The exe is unsigned — Windows SmartScreen / antivirus may warn on first run. Verify the download with the included .sha256.
Inject scripts like inject-ue.ps1 or UE5DumpUI.exe may be labeled as a hacking tool by antivirus. Add them to your exclusion list, or review the code in this repository and compile it yourself.