The user is asking about UE4SS (a modding tool for Unreal Engine games) and Dumper-7 (a UE SDK dumper). Specifically, they're asking whether they can use the GObjects offset that Dumper-7 dumps, instead of finding the GUObjectArray AOB (array of bytes pattern) in UE4SS, referencing the UE4SS documentation page about fixing compatibility problems. Let me think about what I know about both tools: **Dumper-7 (Encryqed/Dumper-7):** - Dumper-7 is a tool that dumps Unreal Engine SDKs (headers) from running UE4/UE5 games - It locates GObjects (the global object array) and GNames (the global name array) inside the game's memory - When you run it, it prints offsets like: - `GObjects offset: 0x...` - `GNames offset: 0x...` - Actually it prints things like "GObjects : 0x12345678" and "AppendString : ..." etc. - Dumper-7 finds these by signature scanning the game binary and then outputs the offsets in its console/dump - Importantly, Dumper-7 finds the **module-relative offset** (RVA) for these globals — e.g., "GObjects: 0x7XXXXXXX" as an offset within the main executable module **UE4SS:** - UE4SS is a modding framework/tool for UE4 and UE5 games - It needs to find the GUObjectArray (which is the same thing as GObjects — `FUObjectArray GUObjectArray` global instance in the engine) to function - UE4SS normally finds GUObjectArray via AOB (Array of Bytes) pattern scanning (`GUObjectArray` related signatures in its compatibility files / `FindGUObjectArray` hook) - When UE4SS fails to find the pattern (e.g., new engine versions, obfuscated games), the docs page "Fixing Compatibility Problems" describes alternative ways: - Using `bUseUObjectArrayCache` - Actually, let me recall the actual doc. The UE4SS docs page "Fixing Compatibility Problems" describes enabling debug GUI / console and checking which patterns failed, e.g., "GUObjectArray" AOB. - There's a feature in UE4SS config: `[UObjectArray]` with `bUseUObjectArrayCache`, `FUObjectItemSize`, etc. - Actually in UE4SS there's an ini section for overriding offsets? Let me recall. Let me recall the actual UE4SS configuration options. UE4SS's `UE4SS-settings.ini` has sections: - General: `EnableDebugGUI`, `ConsoleEnabled`, etc. - `GuiConsoleEnabled`, `GuiConsoleVisible`... - `[Threads]` - `bHookProcessInternal`? - `ObjectCache`? Hmm, more precisely. UE4SS settings ini includes: ```ini [General] bUseUObjectArrayCache=True bUseBackendDllIsolation... ``` And: ```ini [UObjectArray] bUseCache=True (?) ``` Hmm, I need to recall. There are known UE4SS settings: ```ini [General] bUseUObjectArrayCache=true [UObjectArray] bUseSecondItemSize... ``` Actually, I remember UE4SS has `[UObjectArray]` section with `bUseSecondItemSize`, `FUObjectItemSize`, and... hmm. Let me think about what the "Fixing compatibility problems" doc says. The docs at docs.ue4ss.com/dev/guides/fixing-compatibility-problems.html — I believe it's a dev guide describing how to add patterns to the `ObjectArray` / `FindPattern` system, i.e., how to update UE4SS's compatibility for games where signatures fail. It describes the `Patterns` in `ObjectArray.cpp`? Hmm. Actually I recall the doc is about games that crash with UE4SS and how the fix involves... "Fixing compatibility problems" — maybe about games where GUObjectArray AOB fails and you need to supply a manual override? Let me think. I recall UE4SS supports a settings ini option to override `GUObjectArray` directly? There is `bUseManualOffsetOverride`? Hmm. Let me think about actual UE4SS settings: From UE4SS source (`SettingsDefaults.h` / `Settings.hpp`): ```cpp namespace UE4SS::Settings { ... } ``` Settings include: - `bUseUObjectArrayCache` (General) - `bDebugUIEnabled`? - `bHotReloadEnabled`? - `MaxNumberOfCaches`? - `ModDirectory`? There's a section `[UObjectArray]` with `bUseSecondItemSize` and `FUObjectItemSize`... Hmm, I think: ```ini [UObjectArray] bUse2ItemSize... ``` Actually I'm fairly sure the UE4SS settings ini has: ```ini [UObjectArray] bUseSecondItemSize=False FUObjectItemSize=24 (?) ``` Hmm, not sure. Let me instead think about what I know about how UE4SS finds GUObjectArray: 1. UE4SS scans for the `FUObjectArray::AllocateChunk` / `FUObjectItem` ... Actually it uses AOB patterns defined in `UE4SS/GUObjectArray...` hmm. In UE4SS source code, file `UE4SS-Core/src/ObjectArray.cpp`? The patterns are in `SupportiveFunctions.cpp`? I remember there's a `FindGUObjectArray` type function that scans for pattern `"\x48\x8B\x05" ...` — the classic pattern used to find GUObjectArray is: ``` 48 8D 0D ?? ?? ?? ?? 48 85 C0 ... ``` Hmm, or the pattern for `GUObjectArray` via `UObjectArray::UObjectArray` constructor call referencing the global. Common patterns used by tools like Dumper-7 and UE4SS to find GObjects: In `FUObjectArray::UObjectArray` or in `FUObjectArray::AllocateObjectSpace`, the global `GUObjectArray` is referenced with `lea rcx, [GUObjectArray]` or `mov rcx, [GUObjectArray]`. So a byte pattern like: ``` 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ... ``` Hmm anyway. The key question from the user: "Can I use the GObjects offset that's dumped from Dumper-7 instead of the GUObjectArray AOB in UE4SS?" — referencing the UE4SS docs page about fixing compatibility problems. So the answer should address: 1. Yes, in principle: GObjects in Dumper-7 == GUObjectArray in UE4SS (both refer to the same global `FUObjectArray GUObjectArray` instance; actually in UE4.23+ it's `F UObjectArray`... `FUObjectArray GUObjectArray` global variable). Dumper-7's "GObjects" offset is the RVA of this same variable in the main module. 2. How UE4SS consumes it: UE4SS finds GUObjectArray by AOB scanning at runtime; there is no (official) config option to supply a raw GUObjectArray address/offset directly... wait, is there? Let me think again. Hmm — I need to recall whether UE4SS has a settings option to override the GUObjectArray address. I don't believe there's a direct "set GUObjectArray offset" ini setting. The `[UObjectArray]` settings are about `FUObjectItem` size and cache behavior. Hold on. Actually, I now recall that UE4SS 3.0 does have `bUseManualOffsetOverride`? No... Let me think about what I genuinely know from the UE4SS source: `UE4SS-settings.ini` example: ```ini [General] bUseUObjectArrayCache=True bUseBackendDllIsolation=False (v3?) CachingThreshold... ConsoleEnabled... ... [ObjectArray] ... ``` Hmm. I remember reading the UE4SS Settings documentation page (docs.ue4ss.com/references/settings or similar) with entries like: - `bUseUObjectArrayCache` (General): "If true, UE4SS will cache... " - `bSecondItemSize` hmm. Actually! I recall now: UE4SS settings include: ```ini [UObjectArray] bUse2ItemSize=False bUse4ItemSize=False bUseSecondItemSize... ``` Hmm no. I think the actual settings are: From UE4SS repo, `UE4SS-settings.ini`: ```ini [General] bEnableDebugGUI=False bEnableConsole=False ... bUseUObjectArrayCache=True ... [UObjectArray] bUseSecondItemSize=False SecondItemSize=? ``` Hmm, I'm not confident. Alternatively maybe: ```ini [UObjectArray] bUseCache=True CacheSize=1048576 ``` I genuinely don't remember exact names. Let me think about what matters for answering the question. The question: "Can I use the GObjects offset dumped from Dumper-7 instead of the GUObjectArray AOB in UE4SS?" with a link to the "Fixing compatibility problems" dev guide. What does that dev guide say? I believe it's about games where UE4SS fails (crashes or doesn't find things), and it walks through debugging: e.g., using `bDebugGUI`... Hmm, or it's about "Fixing compatibility problems" for specific games like Palworld or Rust? Hmm. Actually, I recall the UE4SS dev guide "Fixing compatibility problems" is about `GUObjectArray` AOB patterns failing on some engine versions, and it explains how to use the `UObjectArray` "override" via... Hmm. Let me think about UE4SS's mechanism more concretely. In UE4SS source (I've seen the repo), there's a file `ObjectArray.cpp`? Or `GUObjectArray.cpp`? I remember `UE4SS/UE4SS-Core/src/GUObjectArray.cpp` maybe. And there's a `FindPattern` call with the AOB: ```cpp // Pattern for UE4: "48 8B 0D ? ? ? ? E8 ? ? ? ? EB" ... ``` I also recall UE4SS having a setting `bSecondItemSize`? Hmm hmm. OK here's another angle: What do I know FOR SURE about UE4SS settings related to UObjectArray? From UE4SS docs / settings ini in the repo: ```ini [General] bUseUObjectArrayCache=True ``` Yes — `bUseUObjectArrayCache` is a real UE4SS setting (General section). It controls whether UE4SS caches the entire UObject array into a contiguous vector at startup for fast lookups (`ObjectArray::GetByIndex` etc.), rather than traversing the chunked allocation (`FChunkedTables`). If the game uses `FUObjectItem`s of unusual size or a modified layout, this cache can be problematic; turning it off makes UE4SS read directly via chunk pointers. Also there's `bSecondItemSize`? Hmm... Actually! I remember: UE4SS has settings: ```ini [UObjectArray] bUseSecondItemSize=False (?) ``` No wait. I think I might be conflating with the `FMalloc` / `FChunkedTables`... Let me recall the UE4SS "Fixing compatibility problems" doc because the user linked it. What I remember about that page: It's a dev guide describing how to fix UE4SS incompatibility with games where the engine is modified (e.g., "Totally Accurate Battlegrounds"? no...). It describes: when UE4SS fails to find `GUObjectArray` via its patterns, you as a developer can add new patterns in `ObjectArray` / `GUObjectArray.cpp`... OR it describes adding the offset manually by hardcoding? Hmm. Actually, you know what — I remember the page! I'm fairly confident the docs page "Fixing compatibility problems" under "Dev guides" is about games that **crash** with UE4SS due to `GUObjectArray`/name-array lookup issues, and it explains how to use the **`bUseManualOffsetOverride`**... no. Let me try yet another angle: search my memory for "UE4SS FindGUObjectArray custom pattern". There is ` UE4SS-GUI`... hmm. OK, regardless of the exact doc content, the user's underlying need is clear: They want to avoid finding/validating the GUObjectArray AOB pattern themselves (as the dev guide presumably describes how patterns are added), and instead just take the GObjects offset that Dumper-7 already found and plug it into UE4SS somehow. Key technical facts to convey: 1. **They're the same variable.** Dumper-7's "GObjects" is `::GUObjectArray` (the `FUObjectArray`/`FReservedObjectArray`... actually `FUObjectArray GUObjectArray`) global instance. UE4SS's "GUObjectArray" is the same thing. So conceptually, yes — the offset Dumper-7 finds can be used. 2. **How UE4SS takes it in:** UE4SS does not ship a generic "set GUObjectArray = 0x..." ini option (as far as I know). The pattern-based lookup is in `UE4SS-Core` (`GUObjectArray.cpp`, function `GUObjectArray::FindGUObjectArray`?). Wait... hmm, actually hold on. I need to check whether UE4SS has an ini override. Hmm, I have a vague feeling that UE4SS 3.0+ added something like: ```ini [General] bEnableDebugGui... ``` No GUObjectArray offset override that I can recall. The `[UObjectArray]`... Hmm. Actually wait — I DO remember something now! UE4SS has settings: ```ini [UObjectArray] bUseSecondItemSize=False bUse4ItemSize... (?) ``` No... The actual ones I believe are: - `bUseUObjectArrayCache` (in [General]) — caches UObjectArray. - `bSecondItemSize`? Hmm, alternatively `FChunkedTables`... I'll stop trying to recall the exact ini keys for item sizes — it's tangential. What about the "AOB" for GUObjectArray: In the doc page linked ("fixing-compatibility-problems"), I believe it describes the process of: run the game with UE4SS, check the console for "Failed to find pattern" errors, and then use a tool (e.g., IDA/x64dbg + a signature scanner, or the `FindPattern` debug) to come up with new AOB patterns for `GUObjectArray` (and `FNamePool`/`GNames`... does UE4SS scan GNames? UE4SS uses `NamePool` signatures too? Actually UE4SS needs `FName::ToString`/`AppendString` function signatures? I recall UE4SS scans for `AppendString` (`FName::ToString`-like) and `GUObjectArray`, `StaticConstructObject`, `ProcessEvent`, `AddAttributedDefaultVariable`... etc. via AOB in its "pattern finder" module.) Yes — UE4SS uses several AOB patterns: `GUObjectArray`, `FName::ToString` (or `AppendString`), `StaticConstructObject`, `FNamePool` (for UE5 name pool? maybe not), `ProcessEvent`, etc. These live in `UE4SS-Core/src/PatternFinder...`? Something like `GUObjectArray` pattern in `UE4SS-Core` `Unreal...`. 3. **Practical answer:** Since UE4SS doesn't accept a raw offset in a config, to "use" Dumper-7's GObjects offset you'd have to modify UE4SS source: in the code that resolves GUObjectArray (e.g., `ObjectArray.cpp`'s `FindGUObjectArray()` or `GUObjectArray` pattern scanning code), add a branch: instead of scanning, do `*(uint64*)(moduleBase + dumpedOffset)`. I.e., `m_address = base + 0x7...` hmm wait. Wait, actually — Dumper-7's reported "GObjects offset" — is it the RVA of the global variable itself? Yes: Dumper-7 prints "GObjects" with the address (RVA in the main module) of the `GUObjectArray` global. So `&GUObjectArray = imagebase + RVA`. But note: for UE4.23+ chunked arrays, `GUObjectArray` is the `FUObjectArray` object (or `FUObjectItem* Objects`...). In UE4.23+, `FUObjectArray` contains `FChunkedTables ObjObjects` where `ObjObjects.Objects` points to a pointer table of chunks. Dumper-7 handles both layouts. So to use it in UE4SS, you'd compute `module base + GObjects RVA` and treat that as the `FUObjectArray*`. But hold on — is it that simple for UE4SS's internals? UE4SS's `GUObjectArray` pattern scanning finds the address of the global and then constructs its own `FChunkedTables` view. If you hardcode the address, it should work — UE4SS's `ObjectArray` class already handles chunked layout and `FUObjectItem` size variations based on engine version detection. Hmm wait, but actually — I should double check: does UE4SS *already* have a mechanism for this? Let me think hard... I have some memory of UE4SS supporting "custom AOB patterns" via ini? There's the `[Patterns]`... no. Hmm, actually I do NOT recall any ini-based pattern override. I recall GitHub issues where people with heavily modified games (e.g., multiversus? no...) were told to rebuild UE4SS with a modified pattern. Hmm, but WAIT. I now genuinely recall something relevant: **UE4SS 3.0 experimental** introduced something for such overrides? There was discussion of "UE4SS will try AOB, and if it fails, you can use `bUseManualOffsetOverride`"... I can't confirm. I'll be honest in the answer: stock UE4SS (as of the docs page referenced) uses AOB patterns and doesn't provide a config file option to supply the GUObjectArray address directly; you'd need to modify the source (the pattern-finding function) — which is exactly what the linked dev guide walks through (adding/fixing patterns, or you could hardcode the offset). Hmm, actually, let me reconsider. Let me try to remember the actual content of https://docs.ue4ss.com/dev/guides/fixing-compatibility-problems.html — I believe I've seen this page. I think it's about games that crash on launch with UE4SS due to incompatibilities, and describes: 1) determining which pattern failed using the debug console ("[Warning] FindPattern: Failed to find pattern for GUObjectArray"?), 2) using a debugger/IDA to find the correct offset, 3) adding a new AOB pattern to `UE4SS` source (specifically in `UE4SS-Core`'s `GUObjectArray.cpp`/`ObjectArray.cpp`) and rebuilding. Something like that. It might use "SpaceEngineers" or "Bombrush" or... hmm. Actually I think the example in that doc might be about the game "Bombrush"? Not sure. Or it describes fixing "FindObject" AOB? Honestly, I don't remember the page's specifics well. I should answer at a level I'm confident about and hedge on details. Also relevant: the user might be conflating "GUObjectArray AOB" — in UE4SS terminology, patterns are AOB (array of bytes). The docs guide teaches how to fix games where UE4SS can't find `GUObjectArray` etc. by coming up with new patterns. The user asks: instead of that AOB work, can I just use Dumper-7's GObjects offset? Answer outline: **Short answer:** Yes conceptually — they're the same global (`FUObjectArray GUObjectArray`; Dumper-7 calls it GObjects). But practically, stock UE4SS doesn't take a raw offset from config; it resolves the array at runtime by scanning. So "using Dumper-7's offset" means either (a) patching UE4SS source to use a fixed RVA instead of/after the pattern fails, or (b) using Dumper-7's offset to *help you build/verify the AOB* — e.g., disassemble at that address to craft the pattern UE4SS expects. **Important caveats:** 1. **Dumper-7 offsets are module-relative (RVA)** — e.g. "GObjects : 0x34A1548" for the main EXE. To convert to runtime address: `base + offset`. If you hardcode it into UE4SS, you must add the module base at runtime (don't use absolute addresses). Also if Dumper-7 was run on a different game version than the one you're modding, offsets must be re-dumped per game version/build. 2. **ASLR/encryption**: Some games (e.g., with Steam DRM or custom packing) — fine. 3. **What exactly Dumper-7 gives you**: Dumper-7 prints `GObjects`, `AppendString`, `GNames`, `ProcessEvent` etc. For UE4SS you might need more than GUObjectArray: UE4SS also needs other patterns (FName pool / AppendString, ProcessEvent, StaticConstructObject, etc.). Fixing only GUObjectArray may not be enough — if GUObjectArray AOB failed, check the log; other patterns may also fail. Hmm, but the question focuses on GUObjectArray. Wait, actually — does UE4SS scan for GNames/AppendString? UE4SS... For name resolution UE4SS uses `FName::ToString`/`AppendString` AOB? I believe yes: UE4SS patterns include `AppendString` and `GUObjectArray`... In UE4SS source `UE4SS-Core/src/UObject/NameTypes.cpp`... I do recall UE4SS having patterns for `AppendString`. And `ProcessEvent`, `StaticConstructObject_Internal`, `AddAttributedDefaultVariable`, `CreateDefaultObject`... These are used by the GUI object viewer etc. 4. **Validation**: After patching, verify UE4SS log shows it found the array with sane `NumObjects`/`MaxObjects` and `TotalObjects`? And that names resolve (no "None" garbage). Compare a couple of values against Dumper-7 output to confirm correctness. 5. **Alternative simpler route**: Instead of patching UE4SS, you can derive a *new AOB pattern* using Dumper-7's offset: open the game binary in IDA/Ghidra/x64dbg at `base + GObjectsOffset`, find references (`lea`/`mov` referencing `GUObjectArray`), craft a pattern with wildcards, then add it into UE4SS pattern list and rebuild — that's the approach the dev guide describes. This is more robust than hardcoding offsets (works across minor updates... well, an AOB also breaks across big changes, but generally more resilient). Wait — is there any way to just give UE4SS the pattern without rebuilding? I keep going back and forth. Let me settle: I strongly believe stock UE4SS requires source modification for custom patterns (there's no external patterns file). The linked doc is a "dev guide" — i.e., for people compiling UE4SS themselves — which supports this: fixing compatibility = changing patterns in source and rebuilding. So the answer: yes you can hardcode, but the guide's intended flow is add AOB to source; using Dumper-7's GObjects offset is a legit shortcut for locating the global to craft that pattern, or to hardcode. Where exactly in source? I believe the patterns are in `UE4SS/UE4SS-Core/src/...` hmm. Let me recall repo structure: `UE4SS` repo (UE4SS/UE4SS by UFO Real? by **«« Ovomid »»**? no — UE4SS is by **«Brian»**? It's by **Narknon**? No. UE4SS GitHub: `UE4SS-RE/RE-UE4SS`. Author: **«** ... The UE4SS project moved from `Yoqz/UE4SS`? Hmm, original author: **«iAmNifer»**? I think UE4SS was created by **«Nikolaj»**... I remember the maintainer GitHub handle **«Yomansam»**? Hmm not important. RE-UE4SS repo structure: `UE4SS/` (the injector GUI), `UE4SS-Core/` (core dll), `ZSTD/`, `UVTD` (UHT validation?), `Proxy Generator`... Inside `UE4SS-Core/src`: `GUI/`, `LuaMadeSimple/`, `Object/`, `UObject/` (`GUObjectArray.cpp`? hmm), `CrashReporter`... I recall `UE4SS-Core/src/UObject/` contains `CoreUObject.cpp`, `Event.cpp`, `NameTypes.cpp`, `Unreal.cpp`... and `UE4SS-Core/src/Mod.cpp`, `ObjectArray.cpp`? There's a file `UE4SS-Core/src/ObjectArray.cpp`?? Hmm. I remember `GUObjectArray` scanning might be in `UE4SS-Core/src/UObject/GUObjectArray.cpp`? Or maybe `UE4SS-Core/src/FindPattern.cpp`... I shouldn't state file paths I'm unsure about. I can say "the pattern is defined in the UE4SS-Core source (search for 'GUObjectArray' in the repo) and you can replace the scan result with a hardcoded base+offset". Actually — I recall in RE-UE4SS there's `UE4SS-Core/src/UObject/Unreal.hpp` with `Unreal::GUObjectArray` and resolution code in `UE4SS-Core/src/UObject/Unreal.cpp` using `FindPattern`. Something like `Unreal::GUObjectArray = ... FindPattern("48 8B ...")`. The details are fuzzy; better to phrase generically: "in UE4SS-Core, where the AOBs are defined (`Unreal.cpp` / `ObjectArray` code — search for `GUObjectArray`)". I'll hedge. Hmm, one more important consideration: **What data does UE4SS need besides the FUObjectArray pointer?** When UE4SS's GUObjectArray pattern fails, the doc suggests... Also note: UE4SS might handle the "static" UE4 (<4.23?) layout vs chunked (>= 4.23) layout. Dumper-7 supports both too (Dumper-7 calls them "chunked" via `FUObjectItem* Objects[...]` vs `TChunkedArray`). Fine. Another key caveat: **Dumper-7 must be run on the same game build** — offsets differ per build/update. Also worth mentioning: **UE4SS needs the engine version** — hmm, does UE4SS do engine version detection? I don't think UE4SS AOB-scans for engine version; it may use `FEngineVersion`? Not sure. Skip. Also: the user said "GOBject offset" — typo for GObjects. Also "dumper7" = Dumper-7. Now — is there any *simpler* supported path? Let me reconsider whether UE4SS added a settings-based override. Searching memory for "UE4SS-settings.ini" content: ```ini [General] bEnableDebugGUI=False bEnableHotReload=True (?) bUseUObjectArrayCache=True (?) MaxNumberOfCaches... ModDirectory=Mods ... [GuiConsole] bEnable=True bVisibleOnLaunch=True ... [Threads] bEnableMainThreadHook (?) ... ``` Hmm, and I recall something like: ```ini [UObjectArray] bUseUObjectArrayCache2 (?) ``` Honestly, I recall reading UE4SS settings docs listing: `bUseUObjectArrayCache`, `CachingThreshold`... hmm. Wait, I think I might remember the [UObjectArray]... no. OK. But hmm, actually — I now have a stronger memory: In the RE-UE4SS `UE4SS-settings.ini`, there's a section: ```ini [UObjectArray] bUseSecondItemSize=False bUseThirdItemSize... ``` No. I give up on that; I won't mention it. However! I should mention **`bUseUObjectArrayCache=False`** as a relevant troubleshooting toggle for weird games, since it changes how UE4SS walks the array (it's real, I'm fairly confident). But careful: is it relevant to this question? Marginally — only as "if UE4SS crashes even after correct GUObjectArray, try disabling the UObject array cache". Eh, optional. Might add one line. Hmm, but I'm not 100% sure of the exact setting name. I'll mention it hedged ("e.g. bUseUObjectArrayCache=False" ... ) Actually let me be careful: I'm quite sure `bUseUObjectArrayCache` exists in UE4SS settings (General). Yes — I've seen it in UE4SS-settings.ini shipped with releases. I'll mention it lightly. Now let me also think about **what Dumper-7 actually gives** and the conversion: Dumper-7 output (console) looks like: ``` [INFO] GObjects : 0x7FF64E29B380 (?) ``` Hmm no. Dumper-7 prints like: ``` [SUCCESS] GObjects : 0x34A1548 [SUCCESS] AppendString : 0x2D1BC40 [SUCCESS] GNames : 0x35E79C0 ``` Hmm, actually I recall it prints **absolute runtime addresses** OR offsets? Let me think. Dumper-7's console output: ``` * GObjects: 0x7FF... ``` Hmm. I remember Dumper-7's `Main.cpp` prints like: ``` std::cout << "GObjects: " << std::hex << Off::InSDK::GObjects << std::endl; ``` And `Off::InSDK::GObjects` is computed as `ImageBase + GObjectsRVA`? In Dumper-7, `Off::InSDK::GObjects` is stored as an **offset relative to image base** I believe, because the SDK generation uses it relative... Hmm. Dumper-7's pattern finder (`InitObjectArray`... in `ObjectDumpers/...`?) — the `Dumper` file `GObjects` finder: it scans `48 8B 05 ...` etc. then computes `GObjects = ImageBase + RVA`? I genuinely recall Dumper-7 printing offsets like "GObjects: 0x34B56E0" and people using these as offsets relative to module base when writing their own cheats/tools — i.e., RVA. But I also recall it printing full absolute addresses with high bits like 0x7FF6xxxxxxx — that would be ImageBase (ASLR) + RVA. Hmm. In Dumper-7 source, `InitGObjects`: ```cpp Off::InSDK::GObjects = ... FindPattern(...) + ...; ``` and the console prints: ``` std::cout << "GObjects : " << reinterpret_cast(...) << ... ``` I believe there's `Info::GObjects` and it prints something like: ``` [DEBUG] Using GObjects: 0x00412345678 ``` Hmm. I really do remember seeing full 64-bit-looking addresses in Dumper-7 output screenshots... e.g. "GObjects : 0x1C6F71C40"? And also Dumper-7 writes these into the dumped `SDK.hpp`? No — SDK dump contains class definitions, not offsets. But Dumper-7 does write a `DumpSpace`... no. Hmm, Dumper-7 also has a "Offsets" output? I remember `Dumper-7` prints "GObjects", "AppendString", "GNames", "GEngine"? Not GEngine. And there's a mode to print offsets in "InSDK" namespace used by the generated SDK's `Offsets.hh`? The generated SDK... no, Dumper-7 generates an SDK that uses `FindObject` at runtime? No — Dumper-7's generated SDK is static headers + `SDKdumpSpace`... OK here's the thing: I'm not 100% sure whether Dumper-7 prints RVA or absolute. I *believe* it prints the **RVA (image-relative offset)** in the console ("GObjects: 0x..."), hmm, wait. Let me think about a concrete memory: For FortKnight... no. For "Fortnite"? Dumper-7 README screenshot shows: ``` [INFO] GObjects : 0x34B2C70 (?) ``` Hmm. I also recall people posting Dumper-7 outputs like: ``` [SUCCESS] GObjects : 0x2CD3C880 ``` Those look like RVAs (fits in ~0x2C million range typical of large games ~ 46MB exe? eh). And I recall outputs like "GObjects : 0x7FF92AF0C890" in some tools (that's more like the **other** dumper, "Dumper-7" alternative "UE4Dumper"? or "Otis"?). Hmm, actually — I now recall more specifically: Dumper-7's main.cpp does: ```cpp std::cout << "[INFO] GObjects : " << std::hex << Info::GObjects << std::endl; ``` No wait. Ugh. Let me think about Dumper-7 codebase: `Dumper/Main.cpp` has: ```cpp // init if (!InitGObjects()) ... ``` and `InitGObjects` in `Dumper/Dumper.cpp`? It uses `FindPattern("48 8D 0D ? ? ? ? E8 ...")` hmm no... Actually Dumper-7 GObjects pattern (from `Dumper/Init.cpp`? or `Dumper/Dumper.cpp`): ```cpp /* GObjects */ if (auto v = FindPatternWithLength("\x48\x8D\x0D\x00\x00\x00\x00\xE8", ...)) ``` Hmm no. I remember Dumper-7 uses: ```cpp uint8_t* GObjectsPattern = "\x48\x8B\x05\x00\x00\x00\x00\x48\x8D\x0D\x00\x00\x00\x00\xE8"; ``` Not sure. Whatever — the precise internals of Dumper-7 don't matter much for the answer; what matters: - Dumper-7's GObjects == UE4SS's GUObjectArray (same global). - The value it reports needs base-relative handling. I should tell the user: check whether the number Dumper-7 printed is an RVA (add module base) or absolute (subtract base). If it's ~0x1xxxxxx-0x7xxxxxx (no high bits like 0x7FFxxxxxxxx), it's RVA. Actually many game exes are huge; still RVAs stay below ~0x10000000 for < 4GB... eh, RVAs can be large for 64-bit games with 100+ MB .text? Usually < 0x10000000 (256MB). Fine. Actually wait — I want to settle this: I'm now fairly confident **Dumper-7 prints offsets relative to the image base (RVA)**. Reason: I recall its README FAQ saying "GObjects offset is relative to the module base"... hmm, no memory. But I DO recall lots of threads "how to use Dumper-7 GObjects offset" where people answer "module base + offset". Yes — that matches my memory of usage. Also Dumper-7's `Info` struct is literally in namespace `Off::InSDK` = "In-SDK", meant to be used with base-relative addressing in the generated SDK's `Offsets`... Hmm, but actually the generated SDK from Dumper-7 doesn't need offsets — it's a full static SDK with `namespace SDK` and `FindObject` using... The generated `SDK.hpp`/`SDK-dumpspace`... I don't think offsets are embedded per-SDK... whatever. Decision: I'll say Dumper-7 reports it typically as a **module-relative offset (RVA)**, so runtime address = main module base + RVA. I'll note to double check (if it looks like an absolute 0x7FF... address with ASLR high bits, subtract the base). This hedged phrasing is safe and useful. Wait, actually — hmm, I want to reconsider once more, because getting this wrong could mislead. Let me try hard to recall an actual Dumper-7 console output: ``` [*] Dumper-7 [*] UE5.1.1 (?)... [INFO] GObjects: 0x37D3E890 (?) ``` I keep generating ~0x3xxxxxxx values — consistent with RVA. Also I recall the Dumper-7 README literally includes sample output: ``` [INFO] NamePool: 0x... ``` Hmm, can't retrieve. Fine, hedge it. Also Dumper-7 prints `AppendString` and `GNames` and "ProcessEvent"? It prints "PostRender"? No. It prints: "GObjects", "GNames"/"AppendString", "PostRender"? I recall "PostRender" is for hooking in generated SDK ("[INFO] PostRender: ...")? Hmm, Dumper-7 does print "PostRender" I think (used by its "IMPL" event hook?). Not needed for the answer. Also worth noting: **UE4SS needs more than GUObjectArray** — the doc page (fixing compatibility) probably covers patterns list. For UE4SS to fully work it needs: GUObjectArray, AppendString (FName::ToString), ProcessEvent, StaticConstructObject_Internal, AddAttributedDefaultVariable, CreateDefaultObject, GNames?/FNamePool?, FTLS?... The point: if you're fixing a broken game, GUObjectArray may be only one of several failed patterns; check the UE4SS console/log for which patterns failed ("Failed to find pattern: ..." warnings) and verify each. Hmm — actually does UE4SS scan for "GNames"? UE4SS uses `NamePool`? I believe UE4SS resolves names via `AppendString` AOB (FName::AppendString) rather than GNames scanning. Right — UE4SS's `NamePoolData`... no. OK I'll keep it generic: "GUObjectArray is one of several patterns UE4SS needs (FName/AppendString, ProcessEvent, etc.); check the log". Hmm wait, actually, I want to reconsider the question once more. "Can I using GObjects offset that dump from dumper7 instead of GUObjectArray aob in UE4SS — docs/dev/guides/fixing-compatibility-problems.html" So the linked doc — let me try once more to recall its content. I believe this guide exists and covers roughly: "Some games crash or fail with UE4SS. To fix: enable the console/debug GUI, look at what failed. If it's a pattern that couldn't be found, use [some tool] to find a new pattern and add it to UE4SS's source, then rebuild." I think there might also be mention of `GetEngineVersion`/`bUseSecondItemSize`... Hmm, you know, actually I think I might be conflating with the "UnrealContainers"... whatever. Alternatively the guide could be about UE4SS's `[Override]`... no. Let me just structure the answer around the general question and be appropriately hedged about the doc specifics. Also, one more relevant fact: **UE4SS is closed-... no, open source (RE-UE4SS)**, so hardcoding is feasible: find where `GUObjectArray` pattern resolution happens (I believe `UE4SS-Core/src/UObject/GUObjectArray.cpp` or `Unreal.cpp`) and add a fallback/override. Actually hmm — I recall specifically in RE-UE4SS: `UE4SS-Core/src/GUObjectArray.cpp`?? There IS a file I'm thinking of... `UE4SS/UE4SS-Core/src/GUObjectArray.cpp` — I think yes, there's a `GUObjectArray.cpp` with `FindGUObjectArray()` using `FindPattern` with patterns like: ```cpp // 48 89 5C 24 ?? 57 48 83 EC 20 8B F9 ... (no that's something else) ``` I can't recall the AOBs. Fine. Let me also think: is there an even more direct answer path — does **UE4SS's GUI/console have a way to input offsets**? No. Does **UE4SS support "custom" engines via config**? There's `EngineVersionOverride`? Hmm — I don't recall such setting either. UE4SS auto-detects... skip. OK also think about **why the AOB might fail while Dumper-7 succeeds**: Dumper-7's patterns differ from UE4SS's patterns. Dumper-7 scans for different signatures (it hooks into the running game and uses broader fallback logic, e.g., scanning `lea rcx, [GUObjectArray]` in `UObjectArray` ctor, plus "chunked" detection). So yes, it's common that Dumper-7 finds GObjects on a game where UE4SS's AOB fails. Hence using Dumper-7's offset to patch UE4SS is a reasonable workflow. Also mention: **UE4SS's "experimental" versions** sometimes add patterns; check `Zau...`... skip. Also mention: **the offset can drift between game updates**, so a source patch will break silently — validate at startup (e.g., check `ObjFirstGC`, `NumElements`/`MaxElements` sanity, and that GNames resolution yields valid strings). Now, how would the user practically patch UE4SS? Give a concrete snippet sketch: In UE4SS-Core, where the pattern scan resolves `Unreal::GUObjectArray` (the code that does something like `FindPattern(...)` and then reads the displacement), you can instead do: ```cpp // Hardcoded fallback for Game vX.Y build ZZZZ uint8_t* FindGUObjectArray() { if (auto gobj = (Unreal::FUObjectArray*)(ImageBase + 0x34A1548); sanity-check) return ...; // else fall back to AOB scan } ``` Rather than fabricating code that may not match the repo, I'll describe it generically: "in the function that scans for GUObjectArray (grep for 'GUObjectArray' / 'FindPattern' in UE4SS-Core), replace or augment with base + RVA, keeping the same return/struct the rest of the code expects (UE4SS expects the FUObjectArray/FUObjectItem* layout — the same thing Dumper-7 found)." Better: mention that UE4SS after finding the pattern also derives `m_ItemSize`/`FUObjectItem` stride? Hmm — UE4SS handles UE4.23+ chunked array with `FChunkedTables`: it reads `ObjFirstGC`, `ObjLastNonGC`, `MaxObjects`... and item size from the pattern context (it computes item size by checking instructions in the pattern region — e.g., `FChunkedTables` operations using `shr`/`lea` to compute index → item size = sizeof(FUObjectItem) derived from instructions). If we hardcode the array address, the rest (item size etc.) still comes from elsewhere... This is getting too deep into uncertain internals. Keep it at the conceptual level: "UE4SS expects to end up with the address of the global array + knowledge of the internal layout; if you patch in the address Dumper-7 found, the rest of the engine-version/layout logic is unchanged." Hmm, actually hmm, wait. I want to reconsider whether UE4SS truly has no config for this, because if it does, the answer changes completely. Let me enumerate UE4SS settings I can recall from `UE4SS-settings.ini` shipped with releases: ```ini [General] bEnableDebugGUI=false bEnableHotReload=true bUseUObjectArrayCache=true (?) bEnableHotReloadConfig (?) CachingThreshold... [GuiConsole] bEnable=true bVisibleOnLaunch=true bAutoFocusCursorToConsole=true (?) [GuiConsoleD3D12Bridge (?)] ... [ObjectCache (?)] bUseCache... [Threads] bCreateDefaultObjectCacheThread (?) ... [Overrides] bWriteAllChangesToINI (?) ``` I really can't recall a `GUObjectArray` offset setting. There IS `[UObjectArray]`? hmm hmm. I have weak memory of: ```ini [UObjectArray] bUseSecondItemSize=false (?) ``` Nope, can't confirm. I'll phrase: "as far as stock UE4SS goes, there's no INI option to hardcode the GUObjectArray address — the patterns are compiled in, which is why the doc is a dev guide (you edit the source and rebuild)". If the user is on a newer UE4SS with such an option, my phrasing "as far as I know / check your version's settings docs" hedges it. Actually, to be safe, I could phrase: "UE4SS doesn't load patterns/offsets from an external file (unlike some other tools); the AOBs are baked into UE4SS-Core. So to 'use' the offset you either rebuild with it hardcoded or use it to craft a new AOB." I think that's accurate for the doc page they linked (which is why that page is under "dev guides" — it requires modifying source). Let me now also recall how UE4SS *uses* the pattern result — because there's a subtlety: UE4SS's GUObjectArray AOB pattern typically finds a `lea rcx, [GUObjectArray]` or `mov` instruction and resolves the **absolute runtime address** of the global variable. The global variable IS the FUObjectArray struct (in UE4.23+ it's `FUObjectArray GUObjectArray;` whose first member is `FChunkedTables ObjObjects` containing `FUObjectItem** Objects` etc.). Dumper-7's GObjects offset → same address. So patch: `Unreal::GUObjectArray = (FUObjectArray*)(base + dumper_rva)` — hmm, but does UE4SS store it as pointer-to-struct or as the address of `Objects` pointer? In UE4.23+, `GUObjectArray` address = `&ObjObjects.Objects` basically (first field of FChunkedTables is `FUObjectItem** Objects` — with some padding/alignment; ObjObjects is first member of FUObjectArray). So same. For pre-4.23 (`TUObjectArray` with `FUObjectItem* Objects`), also first member. OK — the equivalence holds structurally; no need to dwell. One more thing: **UE4SS's `bUseUObjectArrayCache`**: when true, UE4SS copies the whole array into a contiguous cache at launch using the chunk pointers; on heavily modified games where the AOB-based *item-size derivation* could be off... eh. Skip detail; maybe one line: "if you get crashes/garbage objects after pointing UE4SS at the right array, also try `bUseUObjectArrayCache=false`". Hmm — wait, I need to double check this setting name. `bUseUObjectArrayCache`... I'm fairly confident it exists (General section, default true). Yes, I've definitely seen it in UE4SS-settings.ini. OK, include it briefly with hedge. Also relevant for the user: **Dumper-7 needs to run on the same game build** and requires being able to attach to the running game (some games' anti-cheat block this). But presumably they've already dumped. Another angle the user might appreciate: **how to turn Dumper-7's offset into an AOB for UE4SS** (the "proper" fix per the guide): 1. Open the game exe in IDA/Ghidra at `imagebase + GObjectsRVA`... actually the AOB is a *code* pattern referencing the data; so: find code xrefs to the global (`lea rcx, [GUObjectArray]` in e.g. `FUObjectArray::AllocateChunk`/`UObjectArray::UObjectArray` constructor or `FUObjectArray::AllocateUObjectIndex`), take ~20-40 bytes with wildcards for rip-relative displacement and call targets, then add as new pattern in UE4SS source (in `GUObjectArray.cpp`-ish file), rebuild. 2. Or simpler: since UE4SS resolves rip-relative displacements at runtime, a pattern like `48 8D 0D ?? ?? ?? ??` (lea rcx) followed by some stable opcode context is enough. But honestly the *simplest* practical answer for the user: **Yes — if UE4SS's GUObjectArray AOB fails on your game, you can hardcode/override using Dumper-7's GObjects offset by editing UE4SS source, or use that offset to build a new pattern.** And mention that both tools target the same global, so the value is directly transferable (mind RVA vs absolute). Also maybe mention: **Some forks** of UE4SS (e.g., specific game forks) added manual offset overrides. I believe some game-specific UE4SS forks add a "custom offset" ini. Not necessary. Also — **UE4SS experimental builds** update patterns for new engine versions (e.g., UE5.4/5.5). Suggest trying latest experimental UE4SS first — many "pattern not found" issues are just stale UE4SS versions. Good practical advice. Also, **verify the offset** — sanity checks: `NumElements`/`MaxElements` in FUObjectArray (UE4.23+: `FChunkedTables ObjObjects` → `MaxElements`, `NumElements` ints, `MaxChunks`, `NumChunks`) should look like a plausible number (tens of thousands to millions, not garbage). Dumper-7 prints object count too — compare. Also the **GNames** side: not asked. Skip. Now about the linked doc — I said I'd hedge. Let me phrase: "The page you linked walks through fixing games where the compiled-in patterns fail by finding new AOBs (and/or adjusting engine-version-specific behavior) and rebuilding UE4SS — it's a dev guide, so using Dumper-7's offset is consistent with that: you can either derive a new AOB from it or hardcode the RVA." Hmm, actually, let me reconsider — maybe that doc page is about something else entirely: "Fixing compatibility problems" could be about **UE4SS failing with certain games due to `bHookProcessInternal`/crashes**... or about **Fixing 'Failed to find UObjectArray' in games like 'Deep Rock Galactic'**... I'll keep references generic. Let me also double check terminology: "GUObjectArray aob" — yes, UE4SS console prints something like: ``` [Warning] Failed to find pattern for GUObjectArray (?) ``` or on success: ``` [Info] GUObjectArray found at 0x7FF... ``` I think UE4SS logs "Found GUObjectArray at ..." hmm. Fine. Now the **structure of my answer**: 1. **Direct answer**: Yes — they're the same thing (same global `FUObjectArray GUObjectArray`; Dumper-7 labels it "GObjects"). The offset Dumper-7 finds can be used instead of (or to derive) the AOB. But: stock UE4SS has no config option to enter a raw offset; the patterns are compiled into UE4SS-Core. So "using" it means editing the source (or crafting an AOB from it) and rebuilding — same category of work as the dev guide you linked. 2. **How the two correspond / conversion**: Dumper-7 prints it (usually) as an image-relative offset of the game exe → runtime address = module base + offset. Watch out for absolute vs relative. Sanity-check by reading `ObjObjects.NumElements` etc. Also: must be same game build. 3. **How to apply in UE4SS** (two options): a. **Hardcode/override in source**: find where UE4SS scans for GUObjectArray (grep `GUObjectArray` / `FindPattern` in UE4SS-Core), and where it would resolve the pattern to the address, return `module_base + RVA` instead (or as fallback when the scan fails). Rebuild. The rest of UE4SS (chunked-table layout, FUObjectItem size per engine version) is unchanged. b. **Derive a proper AOB** (what the guide intends): use the offset in IDA/x64dbg/Ghidra: go to `base+RVA` (the data global), find the referencing instruction(s) (`lea reg, [rip+disp]` / `mov`), grab surrounding bytes with wildcards, add that pattern to UE4SS source. More update-resilient than a hardcoded RVA. 4. **Caveats**: - GUObjectArray is only one of several patterns UE4SS needs (FName/AppendString, ProcessEvent, StaticConstructObject, etc.). Check the console/log for *which* patterns actually failed; fix all that fail. Dumper-7 can also give you AppendString (its `FName::ToString`-ish) and `GNames`, but UE4SS's needs don't map 1:1 to every Dumper-7 output. - Offsets break with every game update → re-dump per build; prefer AOB for resilience. - If UE4SS still crashes/misbehaves with the right address, try `bUseUObjectArrayCache=False` (hedge: if available in your version). - Try latest UE4SS experimental first — newer engine support/patterns may already fix the AOB failure without any manual work. - Also Dumper-7 supports UE4/UE5 variants (chunked vs pre-4.23) — ensure layout matches UE4SS expectations for the engine version. 5. Maybe a quick verification checklist: object count sane; names resolve in UE4SS GUI/object dumper; compare with Dumper-7's dump (e.g., same number of packages/classes). Also maybe note the difference in what each tool does with it: Dumper-7 uses it once to dump; UE4SS uses it continuously (caching, GUI watcher) — so correctness matters more, and a wrong address can crash the game rather than just produce a bad dump. Length/format: The user asked a fairly specific technical question, possibly non-native English speaker. A medium-length structured answer with headers/bullets and a short code sketch would be ideal. Not too long — maybe 300-500 words. Use markdown. Avoid over-hedging but flag the uncertain bits (config availability, exact file names) lightly. Maybe phrase file names as "grep for GUObjectArray in UE4SS-Core" rather than asserting specific paths. Actually, let me reconsider one more time whether UE4SS has an ini for offsets... I keep thinking about `[UObjectArray]`... Hmm, hmm. I have a faint memory of UE4SS settings: ```ini [UObjectArray] bUseUObjectArrayCache=False ``` Wait — maybe the cache setting is under [UObjectArray], not [General]? I genuinely can't pin it. To be safe, I'll just say "the UObject array cache setting (bUseUObjectArrayCache)" without asserting its section. And I will NOT claim there's definitely no offset-override ini; I'll say "UE4SS doesn't ship a config option for feeding in a raw GUObjectArray address (at least not in the docs/current releases) — patterns are compiled in", hedged with "as of current releases". Hmm, but actually — wait. Let me think about UE4SS 3.0b... In UE4SS 3.0, I recall a new settings section `[UObjectArray]`?? and "bEnableDebugGui"... no. OK whatever, hedge. Let me also reconsider: is `GUObjectArray` in UE (as UE4SS uses the term) the *FUObjectArray global*, and Dumper-7's "GObjects" the same? In UE source: `FUObjectArray GUObjectArray;` (global, declared in `UObjectArray.h`... actually in `UObject/ UObjectGlobals`? no — `CoreUObject`? It's in `UObjectArray.h` in newer UE: `extern COREUOBJECT_API FUObjectArray GUObjectArray;`). Dumper-7's GObjects → address of that same global. Yes. And pre-4.23: `TUObjectArray<...> GUObjectArray`? It was `FPrivateFoo`... older: `TUObjectAllocator` + `FChunkedArray`... The variable name was still `GUObjectArray`. Fine. Also note UE5: still `GUObjectArray` (FUObjectArray → with FChunkedTables). Dumper-7 supports UE5 (chunked). Good. So the identity claim is solid: GObjects (Dumper-7) ≡ GUObjectArray (UE4SS) ≡ `::GUObjectArray` global in the engine module. One more consideration on pattern vs offset: The user said "instead of GUObjectArray aob" — maybe they're following the guide and it says "find the GUObjectArray AOB signature for your game and add it". They want to skip that and just use Dumper-7's number. Answer: yes, with source patch; or simplest hybrid: UE4SS will try pattern first; if you add your hardcoded path you can bypass. Also note if the AOB *already works* (UE4SS finds it fine), you don't need Dumper-7's offset at all — it's only needed when the scan fails. Also worth one note: **the docs page linked** — maybe I should acknowledge what it does: "That page covers fixing games where UE4SS's baked-in AOB patterns don't match (modified engines), by debugging which pattern failed and adding new patterns in source — so what you're proposing (using Dumper-7's offset) fits right into that workflow." Keep generic. Draft the answer: --- **Short answer:** Yes. Dumper-7's "GObjects" and UE4SS's "GUObjectArray" are the same global (`FUObjectArray GUObjectArray` in the engine). If Dumper-7 can locate it on a game where UE4SS's pattern fails, you can use that address. The catch: UE4SS doesn't have a config field for a raw offset — the patterns are compiled into UE4SS-Core, so you use the Dumper-7 offset either by patching the source (like the dev guide you linked implies) or by using it to craft a new AOB. **Converting the offset:** - Dumper-7 reports it relative to the game's image base (RVA) → runtime address = module base + offset (check whether your printed value is RVA or absolute; if it has high ASLR bits, subtract base first). - Must be re-dumped for each game update/build. - It points at the global `FUObjectArray` struct (in 4.23+/UE5: the first members are the `FChunkedTables ObjObjects` — `Objects`, `MaxElements`, `NumElements`, `MaxChunks`, `NumChunks`). Sanity check: NumElements/MaxElements should be plausible (~10k–millions), and chunks pointer valid. **Two ways to apply it:** 1. Hardcode it in UE4SS source: find the GUObjectArray pattern resolution in UE4SS-Core (grep `GUObjectArray`/`FindPattern`), and where the scan result is turned into the array address, short-circuit it with `base + 0x` (ideally as fallback after the scan fails + sanity checks). Rebuild UE4SS. Sketch (pseudo): ```cpp // e.g. in the GUObjectArray pattern handling void* FindGUObjectArray() { if (auto* p = TryAOB()) return p; // existing scan return (void*)(GetImageBase("Game.exe") + 0x34A1548); // Dumper-7 RVA, this build only } ``` 2. Use it to build a new AOB (what the guide intends, more update-proof): open the exe at `base+RVA` in IDA/Ghidra/x64dbg, find the code that references it (`lea rcx,[rip+...]` in functions like `FUObjectArray::AllocateUObjectIndex`/`UObjectArray` ctor), copy ~15–40 bytes with `??` wildcards on the displacement/call targets, and add it as a pattern in UE4SS source. **Caveats:** - GUObjectArray is only one of several signatures UE4SS needs (AppendString/FName, ProcessEvent, StaticConstructObject...). Check the UE4SS console/log to see which patterns actually failed and fix all of them; Dumper-7's other outputs don't necessarily map 1:1. - Try the latest UE4SS **experimental** build first — pattern failures on newer engines are often already fixed there, no manual work needed. - If it still crashes with the correct address (modified engines), try disabling the UObject array cache (`bUseUObjectArrayCache=false`) — hmm hedge "if present in your version". - Validate: UE4SS runs the whole GUI watcher + caching on this array, so a wrong address = crash, not just bad dump. --- Hmm, also should I mention that UE4SS expects `FUObjectItem` size etc. and that these are engine-version derived, not from the pattern? In UE4SS, `FUObjectItem` size... UE4SS computes item size how? I believe it reads it from engine version detection... UE4SS knows engine version via `FEngineVersion`... hmm, actually how does UE4SS determine UE version? I think it scans for... it might use `GEngineVersion`? or infers from patterns. Honestly not sure; skip. Also: the doc page mentions "AOB" — the user wrote "aob" lowercase; fine. Also, maybe mention **GNames/AppendString from Dumper-7**: Dumper-7 prints "AppendString" and "GNames" — if UE4SS also fails FName patterns, those offsets could similarly be used. But UE4SS's FName resolution is via `FName::AppendString` function AOB → address of function; Dumper-7's "AppendString" is also the function offset (I believe Dumper-7 prints "AppendString" function). So same trick applies. I'll mention briefly. Wait — does UE4SS actually scan for AppendString? Hmm. UE4SS name resolution: `NameTypes.cpp`... I recall UE4SS having patterns for `AppendString` in `NamePoolData`... hmm, alternatively UE4SS might walk GNames via `FNameEntry` directly using GNames... I think UE4SS does use `AppendString` AOB (there were compatibility issues with it). Yes, I'm fairly confident UE4SS scans `FName::AppendString` — I recall UE4SS logs "AppendString" found / and bugs about AppendString pattern failing on some UE5 versions. OK, mention it but lightly ("e.g. AppendString"). Let me be careful about one more claim: "UE4SS doesn't have config option for raw offset" — final decision: state it as "UE4SS doesn't let you specify this via the settings INI (patterns are baked into the DLL — that's why the fix-it guide is a *dev* guide)" — I'm reasonably confident this is right for all released versions. Actually... let me do a final memory sweep for "UE4SS custom pattern ini": I recall GitHub issue discussions where Ovomod?/Yomansam? told users "you'd have to modify the pattern in source and compile" for e.g. "Palworld UE5.1 custom builds" — yes, I'm confident enough. Hedge with "as of current releases". Also note the general possibility: **the game might have multiple patterns failing**, and also **UE4SS needs engine handle**... skip. I think I should also briefly explain *why* they can't just paste the offset somewhere in UE4SS GUI/ini — i.e., the direct answer to "can I use it": "not as a drop-in config value, but yes as a source patch / pattern derivation." Format plan: - Opening line: direct answer (yes, same global; but UE4SS needs source change / new AOB, not a config field). - "What Dumper-7 gives you" — identity + RVA vs absolute + per-build. - "How to use it in UE4SS" — Option A hardcode (with tiny pseudo-code), Option B craft AOB from it (the guide's way). - "Gotchas / checklist" — other patterns, experimental builds, cache setting, sanity checks, updates break offsets. Keep it tight. Use headers and bullets. Maybe ~400-550 words. The user's English suggests simple, clear phrasing. Avoid excessive jargon without explanation. ## Short answer Yes — they're the **same global**. Dumper-7's `GObjects` and UE4SS's `GUObjectArray` both refer to the engine's `FUObjectArray GUObjectArray` global instance, so the offset Dumper-7 finds is directly usable for UE4SS. The catch: **UE4SS has no config field for a raw offset** (as far as current releases go — the AOB patterns are compiled into `UE4SS-Core`, which is why that page is a *dev guide*). So "using" Dumper-7's offset means one of two things: ## Option A — Hardcode it into UE4SS (rebuild) Find the GUObjectArray pattern resolution in UE4SS-Core (grep the source for `GUObjectArray` / `FindPattern`) and short-circuit it with the Dumper-7 offset, e.g. as a fallback: ```cpp void* FindGUObjectArray() { if (auto* fromAob = ExistingScan()) return fromAob; return (void*)(ImageBase + 0x34A1548); // Dumper-7 GObjects RVA, this build only } ``` Things to watch: - **RVA vs absolute:** Dumper-7 usually reports it relative to the game's image base → runtime address = `module base + offset`. If the printed value has high ASLR bits (e.g. `0x7FF...`), it's absolute and you must subtract the base first. Double-check which one your output is. - **Per-build:** the offset changes with every game update — re-dump each build, and add sanity checks (`NumElements`/`MaxElements` in the chunked tables should look like a plausible object count, chunk pointers valid), since UE4SS runs its GUI watcher/caching on this array continuously — a wrong address means a crash, not just a bad dump. ## Option B — Use it to craft a new AOB (what the guide intends) More resilient than hardcoding: 1. Open the game exe in IDA/Ghidra/x64dbg, go to `base + GObjectsRVA` (the data global). 2. Find the code that references it (`lea rcx, [rip+...]` etc., e.g. in the `FUObjectArray`/`UObjectArray` constructor or allocation functions). 3. Copy ~15–40 bytes with `??` wildcards on the rip-relative displacement and call targets → that's your new pattern to add to UE4SS source. ## Gotchas - **GUObjectArray may not be the only failure.** UE4SS also scans for other signatures (`AppendString`/FName, `ProcessEvent`, `StaticConstructObject`, …). Check the UE4SS console/log for *which* patterns actually failed and fix all of them — Dumper-7's other outputs (`AppendString`, `GNames`) don't map 1:1 to what UE4SS needs. - **Try the latest UE4SS experimental build first.** Pattern failures on newer engine versions are often already fixed upstream, no manual work needed. - If UE4SS finds the right array but still misbehaves on a modified engine, try disabling the UObject array cache (`bUseUObjectArrayCache=false`, if your version has it). To verify it worked: object count should be plausible, and names/classes shown in UE4SS's debug GUI (or `UE4SS.dll` object dump) should match Dumper-7's SDK output for the same build.

Reverse engineering