UE4 Function Address Finder

Automated pattern scanner that locates the engine globals and core functions you need to build SDKs, mod loaders, or research tools against any shipped Unreal Engine 4 binary — without hand-tuning offsets in IDA every time the game patches.

Supports UE4 4.8 through 4.27. Outputs ready-to-use profile files for SDK generators.

---

What it finds

Symbol / function	What it's for
GNames	Name table — required for any UE4 reflection / SDK work
FNamePool	Newer (4.23+) name storage layout
GObjects	Global object array — entry point for almost all introspection
GWorld	The active UWorld pointer — needed for any in-world interaction
GameStateInit	Hook point for initialization-time injection
BeginPlay	Per-actor lifecycle hook
StaticLoadObject	Load assets at runtime from outside the game's normal flow
SpawnActorFTrans	Spawn actors with a transform — used by every mod loader
CallFunctionByNameWithArguments	Invoke arbitrary UFunctions by name
ProcessEvent	The canonical UE4 invocation entry point — required for almost all hooking

---

Why this exists

Locating these addresses by hand in IDA or Ghidra takes 2-6 hours per game, every time the game updates. The values shift with every recompile, so any tool that hardcodes them breaks on the next patch. This project automates the work using array-of-bytes (AOB) signatures: it scans for the byte patterns surrounding each symbol's reference, so the same scanner keeps working across UE4 versions and across game updates without re-tuning.

In practice: feed it a UE4 game executable (or attach to a running process), get back a complete address table in seconds. The output drops straight into SDK generators or modding frameworks.

---

Quick start

Build

Requires Visual Studio 2019 or 2022 with the C++ desktop workload.

git clone https://github.com/patrickBakin/UE4-Function-Address-Finder.git
cd UE4-Function-Address-Finder

Open UnrealScan.vcxproj, build as Release | x64. Output is a single UnrealScan.exe.

Run

UnrealScan.exe <PathToGame.exe>

The scanner produces an address report and writes profile files for downstream SDK tooling (see ProfileGenerator/).

Heads-up: generated profile files emit symbol names in lowercase — many SDK generators expect the original casing, so a manual pass on the output is currently required. Fix is planned.

---

Supported UE4 versions

Engine version	Status
4.8 – 4.22	✅ Tested
4.23 – 4.27 (FNamePool era)	✅ Tested
UE5	⚠️ Not yet — see related

If your target version isn't in the list and you have a binary I can test against, open an issue.

---

How it works

1. Module load — opens the target binary or attaches to a running process; maps its .text and .rdata sections into the scanner.
2. Signature scan — runs a set of hand-tuned byte patterns (with ? wildcards for relocations and version drift) against the mapped sections.
3. Reference resolution — for each match, follows the relative-call / RIP-relative addressing to resolve the actual symbol address.
4. Validation pass — checks each resolved address against expected UE structure layouts before reporting it, so a bad match is caught before it ships into your SDK.
5. Profile emission — writes the results into the profile format consumed by common UE4 SDK generators.

The signatures themselves live in Headers/ — they're the part that took the longest to build and they're what makes the scanner version-resilient.

---

Repo structure

.
├── UnrealScan.cpp          Entry point + scanner driver
├── header.h                Shared types
├── Headers/                AOB signature definitions per UE version
├── ProfileGenerator/       Output-side: turns scan results into SDK profiles
├── ExampleImages/          Sample runs / output screenshots
└── UnrealScan.vcxproj      MSVC project file (VS2019/2022)

e.g.