tag align to OCT release
download pre-compiled application here: https://opencheattables.com/viewtopic.php?f=17&t=1797

Release v560 — Address Finder v3, Property Walker Coverage, UE Version Override

Range: v488 → v560 (41 commits, ~5 weeks of work) Highlights: Reverse-reference scanning, OptionalProperty / MulticastSparseDelegate / Soft+Lazy+Delegate array drill-down, per-game UE version override with publisher bias detection, CE XML / CSX N-level pointer drill-down, UTF-8 hardening + dedicated C++ test suite.

Address Finder

Find References (v2 → v3)

• Reverse pointer scan — given any UObject*, find every UPROPERTY field across the live object array that holds a pointer to it, so users can navigate from a CE-found instance back to its logical owner.
• v2 coverage: WeakObjectProperty, SoftObjectProperty / SoftClassProperty, LazyObjectProperty, InterfaceProperty, TMap / TSet allocated slots (key + value sides for Object/Class).
• v3 coverage: DelegateProperty single binding + MulticastInlineDelegateProperty / MulticastDelegateProperty (walks each FScriptDelegate's FWeakObjectPtr); TArray<FScriptDelegate>; nested in StructProperty / OptionalProperty<Struct> to depth 3. fieldName appends .Key / .Value for map matches; deadline 30 s.

Container-aware lookup

• New Aura::FindInContainers scans ArrayProperty / MapProperty / SetProperty buffers, including nested in StructProperty and OptionalProperty<Struct> (depth 3).
• Slack / freed-slot support, 15 s deadline, response carries container_scan stats.
• Aura::FindByAddress returns match_kind (exact / contains / backward / nearest) for honest confidence reporting.

Property Walker — drill-down coverage

UI / Live Walker UX

• Auto-scroll-to-field after Open from Find Refs.
• Auto-drill into element [N] for direct-container hits (Container, Container.Key, Container.Value) — previously user had to click [N] manually.
• Class Structure: fixed flash-blank on selection; class-like nodes now route to themselves; new Package column; auto-run Find Instances pre-fill.
• Property Search: dedicated type-filter input + autocomplete; client-side result filter; type-only queries supported (e.g. browse all OptionalProperty fields).
• ProxyDeploy: tooltip flicker fix — anchor above bottom controls.

Export — CE XML / CSX

• N-level ObjectProperty drill-down for Copy CE Field, Copy CE XML, Export CSX. Drill Depth slider (0-4) drives both formats.
• Recursive walk through ObjectProperty / ClassProperty / WeakObjectProperty / Soft* / LazyObjectProperty / InterfaceProperty targets, depth-capped, shared visited HashSet for cycle protection.
• Cascade struct resolution: nested StructProperty / OptionalProperty<Struct> children inside drilled UObjects expand to real sub-fields (not empty GroupHeader placeholders).
• TArray<TSoftObjectPtr> per-element CE XML group with FName leaf.
• OptionalProperty CE XML emit: struct-typed → struct group; otherwise → 8 B hex leaf (was silently dropped).
• Fix: emit ObjectProperty / ClassProperty / WeakObjectProperty as 8 B leaf when not drilled.

UE Version Detection

• Per-game UE version override — new pipe cmd set_ue_version_override, persisted in HintCache JSON. UI ComboBox in Pointer panel: Auto / 4.18-4.27 / 5.0-5.8. Survives game restarts.
• Publisher thumbprint detection — reads PE LegalCopyright / CompanyName, matches against publisher table (currently SQUARE_ENIX). Match → forces bLowConfidence=true and uses publisher's bias fallback (SquareEnix → 4.27 instead of 5.04).
• Tier 3 hardening — bare "X.Y.D" pattern now requires Engine / Unreal / UE4 / UE5 / ++UE anchor in 256-byte window AND defers first hit so a real Tier 2 "Release-4.27" later in the module beats early stray "5.5.0" SDK strings. Tier 3 hits are flagged low-confidence even when accepted.
• 3-state UI badge: ✓ Detected (green) / 🔧 User Override (blue) / ⚠ Low Confidence (amber) + Publisher chip when thumbprint matched.

Affected games: DQ I&II HD-2D, FF7 Rebirth, FF7 Remake, Ghostwire (all UE4 forks previously misdetected as UE 5.5).

Stability / Hardening

• CE XML emit pointer cycle (UWorld → PersistentLevel → OwningWorld back-edges) caused StringBuilder OOM (~2 GB). Fixed via thread-static _emitPath HashSet pushed/popped on EmitDrilledPointer entry; back-edges emit a flat 8 B hex leaf labeled (cycle elided). Belt-and-braces MaxEmitPointerDepth=16 cap.
• UTF-16 surrogate handling in Serie::GetString wide path — root cause of recurring invalid UTF-8 byte at index 1: 0xA0 exceptions on UE 5.7 games (e.g. Squad, 240 K objects). Wide path was producing CESU-8 for surrogate range 0xD800..0xDFFF; nlohmann::json strict-validates and rejects. Fix: detect surrogate pairs → 4-byte UTF-8; lone surrogates → ?.
• ReadFString hardening — WC_ERR_INVALID_CHARS strict flag + Utf8Helpers::Sanitize post-pass.
• Utf8Helpers header-only extraction — Sanitize (Ubel) + EncodeUtf16 (Serie) merged; both call sites share one implementation.
• 31-case C++ self-test (dll/tests/utf8_helpers_test.cpp) — stand-alone executable, no GoogleTest. Covers ASCII, lone continuations (the 0xA0 case), CESU-8 surrogates, overlongs, truncated sequences, surrogate pairs → 4-byte UTF-8, idempotency, EncodeUtf16-output-passes-Sanitize-unchanged invariant. Wired into build.ps1 -Target Test before C# suite.

Documentation

• New docs/dev-log.md — running milestone log + capability matrix (read first for current status).
• docs/technical-notes.md — Phase B-K array reader and property-layout reference.
• README + spec docs refreshed to reflect build 547+ capabilities.
• Superseded design docs moved to docs/archive/.

Known Issues

• MulticastSparseDelegateProperty bindings still unavailable (storage external to field — needs separate AOB; resolved in v577 via SPARSE_ES2_1, see future release).
• FieldPathProperty drill-down (rare).
• Find Refs: TMap / TSet with weak-like inner sides (currently Object/Class only).
• GWorld: Star Wars Jedi untested; Satisfactory fails.
• Other publishers shipping unreliable version strings will need adding to kPublishers[] in Genau.cpp.

Pull Requests Merged

• #192 — Per-game UE version override + publisher bias + CE XML cycle fix
• #193 — UTF-8 hardening + Utf8Helpers extraction + C++ test target

Full Changelog: https://github.com/bbfox0703/UE5CEDumper/compare/v488...v560

Release v560 — Address Finder v3, Property Walker Coverage, UE Version Override

Range: v488 → v560 (41 commits, ~5 weeks of work)
Highlights: Reverse-reference scanning, OptionalProperty / MulticastSparseDelegate / Soft+Lazy+Delegate array drill-down, per-game UE version override with publisher bias detection, CE XML / CSX N-level pointer drill-down, UTF-8 hardening + dedicated C++ test suite.

Address Finder

Find References (v2 → v3)

• Reverse pointer scan — given any UObject*, find every UPROPERTY field across the live object array that holds a pointer to it, so users can navigate from a CE-found instance back to its logical owner.
• v2 coverage: WeakObjectProperty, SoftObjectProperty / SoftClassProperty, LazyObjectProperty, InterfaceProperty, TMap / TSet allocated slots (key + value sides for Object/Class).
• v3 coverage: DelegateProperty single binding + MulticastInlineDelegateProperty / MulticastDelegateProperty (walks each FScriptDelegate's FWeakObjectPtr); TArray<FScriptDelegate>; nested in StructProperty / OptionalProperty<Struct> to depth 3. fieldName appends .Key / .Value for map matches; deadline 30 s.

Container-aware lookup

• New Aura::FindInContainers scans ArrayProperty / MapProperty / SetProperty buffers, including nested in StructProperty and OptionalProperty<Struct> (depth 3).
• Slack / freed-slot support, 15 s deadline, response carries container_scan stats.
• Aura::FindByAddress returns match_kind (exact / contains / backward / nearest) for honest confidence reporting.

Property Walker — drill-down coverage

UI / Live Walker UX

• Auto-scroll-to-field after Open from Find Refs.
• Auto-drill into element [N] for direct-container hits (Container, Container.Key, Container.Value) — previously user had to click [N] manually.
• Class Structure: fixed flash-blank on selection; class-like nodes now route to themselves; new Package column; auto-run Find Instances pre-fill.
• Property Search: dedicated type-filter input + autocomplete; client-side result filter; type-only queries supported (e.g. browse all OptionalProperty fields).
• ProxyDeploy: tooltip flicker fix — anchor above bottom controls.

Export — CE XML / CSX

• N-level ObjectProperty drill-down for Copy CE Field, Copy CE XML, Export CSX. Drill Depth slider (0-4) drives both formats.
• Recursive walk through ObjectProperty / ClassProperty / WeakObjectProperty / Soft* / LazyObjectProperty / InterfaceProperty targets, depth-capped, shared visited HashSet for cycle protection.
• Cascade struct resolution: nested StructProperty / OptionalProperty<Struct> children inside drilled UObjects expand to real sub-fields (not empty GroupHeader placeholders).
• TArray<TSoftObjectPtr> per-element CE XML group with FName leaf.
• OptionalProperty CE XML emit: struct-typed → struct group; otherwise → 8 B hex leaf (was silently dropped).
• Fix: emit ObjectProperty / ClassProperty / WeakObjectProperty as 8 B leaf when not drilled.

UE Version Detection

• Per-game UE version override — new pipe cmd set_ue_version_override, persisted in HintCache JSON. UI ComboBox in Pointer panel: Auto / 4.18-4.27 / 5.0-5.8. Survives game restarts.
• Publisher thumbprint detection — reads PE LegalCopyright / CompanyName, matches against publisher table (currently SQUARE_ENIX). Match → forces bLowConfidence=true and uses publisher's bias fallback (SquareEnix → 4.27 instead of 5.04).
• Tier 3 hardening — bare "X.Y.D" pattern now requires Engine / Unreal / UE4 / UE5 / ++UE anchor in 256-byte window AND defers first hit so a real Tier 2 "Release-4.27" later in the module beats early stray "5.5.0" SDK strings. Tier 3 hits are flagged low-confidence even when accepted.
• 3-state UI badge: ✓ Detected (green) / 🔧 User Override (blue) / ⚠ Low Confidence (amber) + Publisher chip when thumbprint matched.

Affected games: DQ I&II HD-2D, FF7 Rebirth, FF7 Remake, Ghostwire (all UE4 forks previously misdetected as UE 5.5).

Stability / Hardening

• CE XML emit pointer cycle (UWorld → PersistentLevel → OwningWorld back-edges) caused StringBuilder OOM (~2 GB). Fixed via thread-static _emitPath HashSet pushed/popped on EmitDrilledPointer entry; back-edges emit a flat 8 B hex leaf labeled (cycle elided). Belt-and-braces MaxEmitPointerDepth=16 cap.
• UTF-16 surrogate handling in Serie::GetString wide path — root cause of recurring invalid UTF-8 byte at index 1: 0xA0 exceptions on UE 5.7 games (e.g. Squad, 240 K objects). Wide path was producing CESU-8 for surrogate range 0xD800..0xDFFF; nlohmann::json strict-validates and rejects. Fix: detect surrogate pairs → 4-byte UTF-8; lone surrogates → ?.
• ReadFString hardening — WC_ERR_INVALID_CHARS strict flag + Utf8Helpers::Sanitize post-pass.
• Utf8Helpers header-only extraction — Sanitize (Ubel) + EncodeUtf16 (Serie) merged; both call sites share one implementation.
• 31-case C++ self-test (dll/tests/utf8_helpers_test.cpp) — stand-alone executable, no GoogleTest. Covers ASCII, lone continuations (the 0xA0 case), CESU-8 surrogates, overlongs, truncated sequences, surrogate pairs → 4-byte UTF-8, idempotency, EncodeUtf16-output-passes-Sanitize-unchanged invariant. Wired into build.ps1 -Target Test before C# suite.

Documentation

• New [docs/dev-log.md](docs/dev-log.md) — running milestone log + capability matrix (read first for current status).
• [docs/technical-notes.md](docs/technical-notes.md) — Phase B-K array reader and property-layout reference.
• README + spec docs refreshed to reflect build 547+ capabilities.
• Superseded design docs moved to [docs/archive/](docs/archive/).

Known Issues

• MulticastSparseDelegateProperty bindings still unavailable (storage external to field — needs separate AOB; resolved in v577 via SPARSE_ES2_1, see future release).
• FieldPathProperty drill-down (rare).
• Find Refs: TMap / TSet with weak-like inner sides (currently Object/Class only).
• GWorld: Star Wars Jedi untested; Satisfactory fails.
• Other publishers shipping unreliable version strings will need adding to kPublishers[] in Genau.cpp.

Pull Requests Merged

• [#192](#192) — Per-game UE version override + publisher bias + CE XML cycle fix
• [#193](#193) — UTF-8 hardening + Utf8Helpers extraction + C++ test target

Full Changelog: v488...v560