[游戏安全] UE4逆向笔记之GObjectArray

GObjectArray逆向：

首先查看源代码：

此处上面存在字符串特征：

Cannot Cancel Async Loading while async loading is suspended.

直接搜索该字符串就可以定位到GUObjectArray.GetObjectArrayNum():

然后查看GetObjectArrayNum的源代码：

FORCEINLINE int32 GetObjectArrayNum() const 
{ 
             return ObjObjects.Num();
}

跟进ObjObjects发现定义如下：

TUObjectArray ObjObjects;

继续跟进：

typedef FChunkedFixedUObjectArray TUObjectArray;

得到如下类：

class FChunkedFixedUObjectArray
{
    enum
    {
        NumElementsPerChunk = 64 * 1024,
    };

    /** Master table to chunks of pointers **/
    FUObjectItem** Objects;
    /** If requested, a contiguous memory where all objects are allocated **/
    FUObjectItem* PreAllocatedObjects;
    /** Maximum number of elements **/
    int32 MaxElements;
    /** Number of elements we currently have **/
    int32 NumElements;
    /** Maximum number of chunks **/
    int32 MaxChunks;
    /** Number of chunks we currently have **/
    int32 NumChunks;

找到方法的定义如下：

FORCEINLINE int32 Num() const
{
                    return NumElements;
}

发现返回的就是NumElements这个，所以7FF78E0D11A4该地址其实就是ObjObjects.NumElements,而上面存在5个元素，5*4=0x14，所以该地址-0x14就可以得到GObjectArray:

此时的第一个元素为：

class FUObjectItem
{
// Pointer to the allocated object
class UObjectBase* Object;
// Internal flags
int32 Flags;
// UObject Owner Cluster Index
int32 ClusterRootIndex;
// Weak Object Pointer Serial number associated with the object
int32 SerialNumber;
}

继续查看第一个元素就是UObject:

class UObject
{