Add AppendString signature and ProcessEvent fallback for Avowed (UE5.3) #482

Open

lmachens wants to merge 1 commit from The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection into main

lmachens commented

2026-02-28 22:43:06 +01:00

(Migrated from github.com)

Summary

Added new AppendString signature (E8 ? ? ? ? 48 8D ? ? ? 48 89 ? E8) for compilers that use mov+call instead of lea+call near the ForwardShadingQuality_ string reference
Added a ProcessEvent detection fallback that scans VTable functions for calls to the function containing "Accessed None", picking the one with the deepest call offset to avoid false positives

Context

Avowed (UE 5.3) uses different instruction encodings than what Dumper-7 currently expects:

AppendString: The compiler emits 48 89 (mov) instead of 48 8D/49 8B/48 8B (lea/mov) before the call, so none of the existing 6 signatures matched
ProcessEvent: The compiler uses mov eax, [reg+FunctionFlags]; test eax, 0x400 (register-based) instead of test [reg+FunctionFlags], 0x400 (memory-based), and the FUNC_HasOutParms (0x4000) test is optimized out entirely — so neither the primary pattern scan nor the existing FindNextFunctionStart fallback could find it

Test plan

Tested on Avowed (UE 5.3) — all offsets detected, ProcessEvent found at VTable index 0x4D, GameName/GameVersion resolved, SDK and .usmap generated successfully
Verify no regression on other UE games (existing signatures and primary ProcessEvent check are unchanged)

## Summary - Added new AppendString signature (`E8 ? ? ? ? 48 8D ? ? ? 48 89 ? E8`) for compilers that use `mov+call` instead of `lea+call` near the `ForwardShadingQuality_` string reference - Added a ProcessEvent detection fallback that scans VTable functions for calls to the function containing `"Accessed None"`, picking the one with the deepest call offset to avoid false positives ## Context Avowed (UE 5.3) uses different instruction encodings than what Dumper-7 currently expects: - **AppendString**: The compiler emits `48 89` (mov) instead of `48 8D`/`49 8B`/`48 8B` (lea/mov) before the call, so none of the existing 6 signatures matched - **ProcessEvent**: The compiler uses `mov eax, [reg+FunctionFlags]; test eax, 0x400` (register-based) instead of `test [reg+FunctionFlags], 0x400` (memory-based), and the `FUNC_HasOutParms` (0x4000) test is optimized out entirely — so neither the primary pattern scan nor the existing `FindNextFunctionStart` fallback could find it ## Test plan - [x] Tested on Avowed (UE 5.3) — all offsets detected, ProcessEvent found at VTable index 0x4D, GameName/GameVersion resolved, SDK and .usmap generated successfully - [ ] Verify no regression on other UE games (existing signatures and primary ProcessEvent check are unchanged)

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection:The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git switch The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git switch The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git rebase main

git switch main

git merge --ff-only The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git switch The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git rebase main

git switch main

git merge --no-ff The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection

git switch main

git merge --squash The-Hidden-Gaming-Lair/fix/appendstring-and-processevent-detection