How vozdyxstuff/re-ue4ss works
Purpose and Deliverables
UE4SS is a native Unreal Engine 4/5 runtime extension for game modding, inspection, and reverse-engineering. It is deployed into a game’s Win64 binaries directory, typically through a proxy DLL, then exposes Lua and C++ mod APIs, Blueprint loading, reflection/property tooling, and code/mapping generators. Primary runtime sources are UE4SS/src/main_ue4ss_rewritten.cpp, UE4SS/src/UE4SSProgram.cpp, and UE4SS/src/UE4SSRuntime.cpp.
Injection and Runtime Bootstrap
A generated proxy DLL forwards a chosen Windows DLL’s exports while loading UE4SS into the game process. UE4SS/proxy_generator/main.cpp and UE4SS/proxy_generator/proxy/CMakeLists.txt define this proxy-generation/deployment boundary. The core program initializes crash handling, settings, signature resolution, hooks, and the runtime against the host Unreal process (UE4SS/src/UE4SSProgram.cpp, UE4SS/src/UE4SSRuntime.cpp, UE4SS/src/Signatures.cpp).
Unreal Compatibility and Memory Boundary
UE4SS bridges into an unknown game/engine binary through AOB signatures, version-specific layouts, and direct Unreal object access. UE4SS/include/UnrealDef.hpp supplies engine-facing definitions; UE4SS/include/Signatures.hpp represents address discovery; UE4SS/include/UnrealCustom/CustomProperty.hpp supports nonstandard reflected properties. Per-game overrides—settings, signatures, member-variable, and vtable layouts—are distributed under assets/CustomGameConfigs/; e.g., assets/CustomGameConfigs/Satisfactory/UE4SS-settings.ini.
Mod Execution Model
The mod layer supports Lua scripts and native C++ DLL mods through a shared mod abstraction: UE4SS/include/Mod/Mod.hpp, UE4SS/src/Mod/LuaMod.cpp, and UE4SS/src/Mod/CppMod.cpp. Runtime discovery/configuration loads bundled and user mod directories, with Lua scripts such as assets/Mods/BPModLoaderMod/Scripts/main.lua using the exposed API. The Lua boundary consists of interpreter/library setup and bindings for Unreal types, containers, hooks, scheduling, and custom properties (UE4SS/src/LuaLibrary.cpp, UE4SS/src/LuaType/LuaUObject.cpp, UE4SS/include/LuaCustomMemberFunctions.hpp).
UI, Inspection, and Diagnostics
An in-process ImGui UI provides console, debugger, profiler, dump controls, and live object/property viewing. The UI coordinator is UE4SS/src/GUI/GUI.cpp; rendering backends include DirectX 11 and GLFW/OpenGL (UE4SS/src/GUI/DX11.cpp, UE4SS/src/GUI/GLFW3_OpenGL3.cpp). Live View reads and edits loaded Unreal objects through reflection filters (UE4SS/src/GUI/LiveView.cpp, UE4SS/include/GUI/LiveView/Filter/HasProperty.hpp). Filesystem watching allows runtime reaction to asset/mod changes (UE4SS/src/FilesystemWatcher.cpp).
Generation and Dump Pipelines
Runtime reflection data can be converted into SDK headers, UHT-compatible headers, JSON, object text, and .usmap mappings. SDK generation is centered on UE4SS/src/SDKGenerator/Generator.cpp and UE4SS/src/SDKGenerator/UEHeaderGenerator.cpp; mapping generation is in UE4SS/src/USMapGenerator/Generator.cpp. These output-oriented stages are separated from the injected mod runtime but consume its discovered Unreal metadata.
Companion Tool and Build Infrastructure
UVTD is a separate native command-line tool for PDB/symbol analysis and generating Unreal virtual/member-variable/Lua-binding artifacts (UVTD/src/main.cpp, UVTD/src/UVTD.cpp, UVTD/src/UnrealVirtualGenerator.cpp). The repository is principally C++23/CMake, with xmake metadata and a Rust patternsleuth_bind dependency (CMakeLists.txt, UE4SS/CMakeLists.txt, deps/first/patternsleuth_bind/src/lib.rs). Material dependencies include Lua, PolyHook, Zydis, ImGui, GLFW, OpenGL/GLAD, Tracy, raw PDB parsing, and the Unreal pseudo-code submodule. Windows is the deployment target; Linux is supported for Windows cross-compilation via xwin or Wine/MSVC toolchains.
Main entry points: UE4SSRuntime.cpp UE4SS runtime · UnrealDef.hpp Unreal memory bridge · UE4SSProgram.cpp Program bootstrap · main.cpp Generated proxy DLL
Components 21
Injection & Runtime
Loads UE4SS into the host game and establishes engine access.
- Generated proxy DLL · Forwards a selected Windows DLL while loading UE4SS.
UE4SS/proxy_generator/main.cpp - Proxy build definition
UE4SS/proxy_generator/proxy/CMakeLists.txt - UE4SS entrypoint
UE4SS/src/main_ue4ss_rewritten.cpp - Program bootstrap · Initializes crash handling, settings, signatures, hooks, and runtime.
UE4SS/src/UE4SSProgram.cpp - UE4SS runtime
UE4SS/src/UE4SSRuntime.cpp - Signature resolution · Finds game addresses in unknown engine binaries.
UE4SS/src/Signatures.cpp - Unreal memory bridge · Version-aware layouts and direct object access.
UE4SS/include/UnrealDef.hpp - Per-game overrides · Settings, signatures, member layouts, and vtable layouts.
Mod APIs & UI
Executes mods and exposes in-process interaction tools.
- Mod abstraction · Shared interface for Lua and native mods.
UE4SS/include/Mod/Mod.hpp - Lua mods
UE4SS/src/Mod/LuaMod.cpp - C++ DLL mods
UE4SS/src/Mod/CppMod.cpp - Lua Unreal bindings · Exposes Unreal types, containers, hooks, scheduling, and properties.
UE4SS/src/LuaLibrary.cpp - BPModLoader script
assets/Mods/BPModLoaderMod/Scripts/main.lua - ImGui tools · Console, debugger, profiler, dumps, and live object inspection.
UE4SS/src/GUI/GUI.cpp - Live View · Reads and edits loaded Unreal objects through filters.
UE4SS/src/GUI/LiveView.cpp
Reflection Outputs
Converts discovered Unreal metadata into export formats.
- SDK/header generator · Produces SDK and UHT-compatible headers.
UE4SS/src/SDKGenerator/Generator.cpp - USMap generator · Produces .usmap mappings from reflection data.
UE4SS/src/USMapGenerator/Generator.cpp
Companion Tooling
Build-time and offline analysis components.
- UVTD · Analyzes PDB symbols and generates Unreal artifacts.
UVTD/src/main.cpp - CMake build · C++23 build and dependency integration.
CMakeLists.txt - patternsleuth_bind · Signature-pattern dependency.
deps/first/patternsleuth_bind/src/lib.rs
Other components
- Host Unreal game · Target Win64 game process.
Connections 24
- Proxy build definition → Generated proxy DLL: builds
- Generated proxy DLL → Host Unreal game: loads into
- Generated proxy DLL → UE4SS entrypoint: loads
- UE4SS entrypoint → Program bootstrap: starts
- Program bootstrap → UE4SS runtime: initializes
- Program bootstrap → Signature resolution: resolves addresses
- Per-game overrides → Program bootstrap: overrides settings
- Per-game overrides → Signature resolution: supplies signatures/layouts
- Signature resolution → Unreal memory bridge: locates engine access
- UE4SS runtime → Unreal memory bridge: uses
- UE4SS runtime → Mod abstraction: hosts
- Mod abstraction → Lua mods: implements
- Mod abstraction → C++ DLL mods: implements
- Lua mods → Lua Unreal bindings: uses
- BPModLoader script → Lua mods: runs in
- Lua Unreal bindings → Unreal memory bridge: binds
- UE4SS runtime → ImGui tools: hosts
- ImGui tools → Live View: includes
- Live View → Unreal memory bridge: inspects
- UE4SS runtime → SDK/header generator: provides metadata
- UE4SS runtime → USMap generator: provides metadata
- CMake build → Proxy build definition: configures
- CMake build → patternsleuth_bind: integrates
- UVTD → Unreal memory bridge: generates artifacts for