The Live Bridge between Unreal Engine Runtime and Cheat Engine.

UE5CEDumper is a interactive inspector toolchain. It provides a live window into the game's memory, allowing you to browse objects, find instances, and export CE-ready structures in real-time.

It's built for the active table maker. It bridges the gap between seeing an offset and actually using it in Cheat Engine.

UE5CEDumper is not meant to be a another dumper that extracts large amounts of data for analysis. Instead, it focuses on quickly finding UE structures and integrating with CE for live development. Think of it as a general-purpose UE tool rather than a specialized dumper.

Scope of use

Windows x64, single-player / offline only. This is an inspection and debugging tool for games you legally own, on your own machine. Do not use it in multiplayer, competitive or online modes — besides being unfair, that is where anti-cheat, account bans and legal exposure actually live. UE5CEDumper reads the memory of a running process; it does not redistribute any game code, assets or keys, and it does not touch pak/IoStore container encryption.

A quick look at what you can do with it — the full table-maker feature list is in docs/Features.md:

• Live memory inspection — browse objects, find every instance of a class, drill into struct / class layouts with live values.
• Value Search — CE-style First Scan / Next Scan over every UE property (numbers, strings, vectors, arrays / maps / sets), so you cheat without knowing offsets. A Group mode finds the object holding several values at once (e.g. Str + Def + Dex + Int), and an opt-in Deep mode reaches into nested containers.
• Teleport — 3 save/recall markers (BugItGo-style), teleport-to-cursor for top-down / 2.5D games, custom global hotkeys, and a read-only camera POV readout.¹
• Player tuning — Super Jump / Move Speed / Gravity sliders, God Mode, and Time Dilation (global or player-only slow-mo / freeze / fast-forward) — all reflection-forced and held against per-tick overwrites, so they survive respawns. Hotkeys or CE on/off records.
• Debug Camera — force the free-fly debug camera on/off, even on Shipping builds that normally get stuck.
• Console — discover and one-click invoke the fly / god / ghost / game-specific exec commands many games leave in.
• Live function profiler — record one in-game action (open a shop, dash) and see exactly which UFunctions fired, ranked with baseline-diff + noise filters. Behaviour-first, when name search can't.
• One-click CE export — pointer-chain XML, Structure Dissect (CSX), SDK headers, AA scripts, multi-row .CT batches.
• Dump Explorer — browse an exported "Dump All" .jsonl offline, one keyword search across classes + properties + functions.
• No Cheat Engine needed to inject — a version.dll proxy DLL, in-UI Inject into running game…, or the inject-ue.ps1 CLI (auto-elevates for admin games). Proxy Deploy suggests the right proxy per game.

¹ A few heavily-stripped Shipping builds (e.g. Titan Quest II) can't do cursor teleport — they remove the standard cursor / viewport / line-trace APIs and use a custom virtual cursor. See docs/teleport-spec.md.

Games grouped by UE version range. Per-game detail — layout quirks, proxy notes, verification — lives in docs/test-games.md. Satisfactory appears in two rows because its UE version moved across game versions.

*GNames uses .data pointer-scan fallback for 5.5+. **DynOff supports CasePreservingName (FName = 16 bytes) layout. ‡Needs the dxgi.dll proxy, not the default version.dll — its .exe never asks for version.dll by name, so that proxy loads in no way at all and leaves zero log. If a game connects but produces no log folder under %LOCALAPPDATA%\UE5CEDumper\Logs\, that is the symptom: switch proxy flavour. See docs/test-games.md. †Pre-4.23 has no FNamePool — GNames is the TNameEntryArray that FName::GetNames lazily allocates, and sparse delegates do not exist at all (they arrived in 4.23). UE 4.11 is the supported floor: 4.10 and below have no FUObjectItem and use an inline chunk table the scanner cannot express, so they are reported as unsupported rather than left to fail confusingly.

One row per feature — AOB scanning, DynOff, Live Walker, Value Search (single + group), Teleport, movement tuning + God Mode + Time Dilation, the Live function profiler, multi-format CE export, and the rest — in docs/Features.md.

1. Inject DLL: Run Cheat Engine, attach game process, load a save. Make sure game data is loaded first. Open UE5CEDumper.CT.
2. Enable Script: Enable init <== enable after process attached, then Inject DLL + Start Pipe Server. The DLL locates global engine pointers and detects the UE version/layout automatically.
3. Connect UI: Wait a few seconds for the scan to finish. Launch UE5DumpUI.exe and click Connect. Live data streams to the UI via Named Pipes (JSON-RPC).
4. Navigate & Analyze: Browse the UObject hierarchy, find a class, drill into containers, or paste an address from CE to reverse-lookup and export.

1. Place DLL: Copy version.dll (from build.ps1 -Target ProxyDLL) into the game's root folder (next to the .exe).
2. Launch Game: Start the game normally. The proxy DLL loads automatically and starts the pipe server.
3. Load a Save: Reach the main game world so UE objects are populated in memory.
4. Connect + Scan: Launch UE5DumpUI.exe, click Connect, then click Start Scan. The DLL performs the AOB scan and returns engine data to the UI.
5. Navigate & Analyze: Same workflow as Option A — browse objects, find instances, export CE structures.

Note: Do not use both methods simultaneously. If the proxy DLL is in the game folder, do not also inject UE5Dumper.dll via CE. The DLL detects duplicate instances and skips auto-start to prevent conflicts.

Which proxy DLL? Start with version.dll. If the game launches but the UI can't connect, its EXE doesn't import version.dll — use dxgi.dll (every D3D11/D3D12 UE game imports it), or winmm.dll as a spare when the dxgi / version filename is already taken by ReShade or another mod loader (dinput8.dll is a last resort). build.ps1 builds all four into dist\proxy\; the Proxy Deploy tab deploys the right one per game, and its Suggested proxy column remembers what worked. All names taken, or none load? Use Option C (inject).

Inject UE5Dumper.dll into an already-running game — the quickest path (no Cheat Engine, no pre-deployed proxy, no game restart). Two front-ends share one technique (CreateRemoteThread + LoadLibraryW) — the UI's Proxy Deploy tab is the easy path, with a command-line tool for scripting / headless use:

• From the UI: Proxy Deploy tab → Inject into running game… → pick the game in the process picker → Inject. The UI auto-connects. If the game runs as Administrator you get a UAC prompt to inject elevated — no manual restart.

• From the command line — inject-ue.ps1 (ships in dist\ next to UE5Dumper.dll):

  .\inject-ue.ps1                 # auto: inject the single running UE game
  .\inject-ue.ps1 -List           # list detected UE games
  .\inject-ue.ps1 -ProcessId 1234 # inject a specific PID

  Then launch UE5DumpUI.exe and Connect. On Access-Denied (an elevated game) the script auto-relaunches itself elevated (one UAC prompt).

x64 games only. See the scope note at the top of this README — like all injection, CreateRemoteThread may be flagged by anti-virus and is blocked/banned by kernel anti-cheat (EAC / BattlEye).

AOBMaker generates AOB patterns + CE AA scripts. Its CE DLL plugin lets UE5CEDumper one-click browse memory / code in CE, and emit dynamic GWorld-AOB AA scripts, CE memory records for UE types & fields, and Structure Dissect data. Entirely optional — the core features work without it.

build.cmd / build.ps1 locate MSVC automatically via vswhere, so any installed toolset is found without hardcoded paths. Older Visual Studio versions are not tested — the build has been on 2026 for a while now.

• Windows 10/11 x64
• Cheat Engine 7.6+ (for CE injection method) or Proxy DLL (no CE required)
• A running Unreal Engine 4 or 5 game process (x64)

• Custom Data Structures: In games like FF7 Rebirth, some critical data (e.g., HP) is stored in custom structures outside standard UObjects. The Live Walker can help investigate these regions, but direct discovery is not possible.
• GWorld Connectivity: GWorld traversal works in 100% of tested games (40 / 40) as of 2026-07-27, across every supported engine from UE 4.11 to UE 5.7. For a game that is not on the list, fall back to Object Tree or Instance Finder as the entry point.
• Proxy DLL caveat for EA-launcher games: Star Wars Jedi: Fallen Order (UE 4.21) starts through the EA app, which restricts where Windows looks for DLLs, so no proxy is ever loaded. Inject with Cheat Engine after the game is running instead — everything else behaves normally. Other EA-launched titles are likely the same; please open an issue if you find one.
• dxgi.dll proxy for games that import neither version.dll nor dinput8.dll: a few titles — The Adventures of Elliot (UE 5.4) and Echoes of Aincrad Demo (UE 5.4) among them — never load those two proxies at all. Pick dxgi.dll in the Proxy Deploy tab instead: every D3D11/D3D12 UE game imports it, so it loads reliably. Verified end to end on Elliot, Echoes of Aincrad Demo, Pionero Capital Demo (UE 5.7) and Star Trek Voyager – Across the Unknown (UE 5.6).
• winmm.dll proxy — the spare slot when dxgi or version is already taken: a proxy only works if its filename is free, and often it is not — ReShade commonly installs itself as dxgi.dll, and some games ship their own version.dll. Pick winmm.dll in the Proxy Deploy tab when that happens. Verified on The Adventures of Elliot (UE 5.4) and MOBILE SUIT GUNDAM SEED Battle Destiny Remastered (UE 4.27). ⚠ It reaches no game that dxgi cannot — choose it for slot availability, not for coverage.
• Games that pause when backgrounded: some titles — Persona 3 Reload (UE 4.27) among them — freeze their game thread whenever they are not the foreground window, so anything that calls into the game times out. The tool detects the stall and shows an amber "game thread stalled" banner rather than hanging, and the experimental Keep Foreground toggle works around it so those actions keep working while the game sits in the background.
• Container Limits: Array/Map/Set element reading respects a configurable limit to avoid excessive memory reads. Adjust the Array Limit slider in the Live Walker when working with large containers.

See CONTRIBUTING.md for guidelines on:

• Reporting detection failures — what logs and info to include (most helpful!)
• Submitting AOB patterns — for reverse engineers who want to contribute directly
• Code contributions — PR process and code style

Testing — thanks to Marc@OCT and SeryogaSK@OCT (OCT) for helping test this tool.

This project is developed with the assistance of Claude Code by Anthropic. The C++ DLL, C# Avalonia UI, build scripts, and documentation are collaboratively authored by the developer and Claude Code.

Sessions can hand bulk text work (large logs, dumps, translation drafts) to a local Ollama model, and a machine-wide hook keeps that model off a commercial game's GPU. It is installed once per machine from this repo; any other repo joins or leaves with one command and receives only a skill file that holds no machine or personal data. For a Claude Code session in another repo: read tools/llm/README.md and follow its last section.

py tools/llm/ollama_local.py install --model <tag>                 # once per machine, in this repo (the user names the tag)
py "$LOCALAPPDATA/claude-local-llm/ollama_local.py" join           # in any other repo; `leave` undoes it

License: MIT © 2026 bbfox0703