Unreal engine driver communication
 

I thought it would be good to open a thread to solve the question of the Unreal engine driver communication.

The problem: Unreal engine is only accessible through UnrealScript, a proprietary scripting (hence interpreted) language that doesn't allow native C++ code communication - unless you buy a license from Unreal.

Two solutions so far:

1. - Use loopback network communication through a third party sockets library available to use for UnrealScript (slow)
2. - As suggested by botmeister, use local disk I/O access and reading/writing through a temporary file for inter-process communication.

*edit* a summary of the previous discussion can be found in this thread:
http://forums.bots-united.com/showthread.php?t=1299

Discussion:

Re: Unreal engine driver communication
 

Does unrealscript allow the address-of operator (&)?
If so, just make a global variable of a structure containing game data and write the address once to a file for reading by the c++ driver.

Once you have the address you should be able to use ReadProcessMemory and WriteProcessMemory on a similar structure ( with all offsets correct ) written in C or C++.

I have not done that much reading on unrealscript so I don't know if their virtual machine uses the actual addresses of objects or if it has it's own memory system.

I guess I'll install UT and check out some more options.

Re: Unreal engine driver communication
 

That is a nice idea... I'll check it out (gotta edit this post as soon as I have the answer)

*edit*
hmmm, visibly not... no pointers, no address referencing in UnrealScript.

UnrealScript overview (official doc): http://unreal.epicgames.com/UnrealScript.htm


*edit 2*
Crazy idea then...
tag this structure with an unique magic number (long enough to be REALLY unique), and have the bot core scan the OS memory for that fingerprint. Once it finds it, it knows the address of the struct.

Feasible ?

Anyway, the problem is still half-solved, because it'll only be a one-way communication.

Re: Unreal engine driver communication
 

That could work and you could also have two-way by doing something like this...

Force Unreal to load a helper dll.
Call GetModuleHandle( NULL ) from the unreal engine to get the program in memory.
Search for the structure ( with unique id at offset 0 ).
Using shared memory, give the pointer to the data to the c++ driver.

Virtual machines are useful and they have obviously done a nice job with UnrealScript, but forcing it on people is not the right way to go. It's too bad that we cannot use a regular dll.

Edit:
Where were you looking?
I saw what looks like an address-of operator somewhere, there was a function somewhere that had the & operator on a parameter.

Added:
There it is, I'm not sure but here & looks like an address-of operator.
If not, damn.

Re: Unreal engine driver communication
 

Damn interesting! But weird? What is the URL where you found that piece of code ? It *looks* like UnrealScript indeed...

How come I have seen that nowhere mentioned in the UnrealScript reference pages at epicgames.com ???

*edit*
hmm, no, to me it would rather look like a C++ piece of code from an Unreal game DLL...
UnrealScript doesn't know the keywod "void" AFAIK.
Somehow I wish I had an Unreal copy to install and toy around with. Botman or someone else may be able to tell us more than I presently can.

Re: Unreal engine driver communication
 

It is at the website you posted the link to, I just did a find for &.
Surprisingly, there were only a couple of hits despite the large amount of text which made it easy to find.

Edit:
Bah, I never saw that part where it mentioned it was C++ code.
I simply skipped over the line by mistake, I usually make my screen grey
when reading important text but I was probably too tired to think of it.

Looks like we'll have to inject some code to get the same result, shouldn't be too hard but the method I use only works on 2K/XP so another set of injection functions will have to be written.

Unless someone has a better idea...

Re: Unreal engine driver communication
 

UnrealScript doesn't have pointers to memory addresses. Thus you can't read/write to a memory buffer with UnrealScript.

Yes, the Touch() code Lazy posted is C++ native code which can't be compiled without all the engine .h header files (needed for the member variables and functions in the C++ classes) not to mention needing the .lib libraries to resolve engine functions.

If we plan on using UnrealScript to control a bot, I think the only external interface will be via a TCP/IP socket through the loopback interface to another application running on the same host.

The biggest disadvantage for Unreal will be not being able to get world geometry information (which would be needed to generate navigation meshes). You can do ray traces through the world using UnrealScript and you can search the world for nearby objects (like other players or weapons), but that's about the limit of what can be obtained about the world.

Navigation will probably have to depend on waypoints (which is what UT2k3/2k4 already uses, called PathNodes and NavigationPoints).

UT2k3 can be found for pretty cheap here in the USA...

http://www.walmart.com/catalog/produ...00000000624060

So you might want to pick yourself up a copy if you don't already have it. Once you install the latest patch (available from the Epic website), you won't be required to have the CD available to run the game.

I'll make a new thread with some Unreal coding links that I have found and maybe that will help people investigate it a little more.

botman

Re: Unreal engine driver communication
 

Have we concidered trying to find a way to reverse engineer the Unreal engine? I'm not sure if this is legal (probably not), but if it is, it could be useful.

Re: Unreal engine driver communication
 

Botman, can UnrealScript allocate memory buffers?

If so, then we could determine the address of the buffer by having Unreal populate it with a very unique pattern.

The external C++ driver can scan memory looking for the unique pattern, once found we'll have the address of the allocated memory buffer.

Some simple handshaking can be done to coordinate the process and confirm the memory location (using simple file sharing methods for example).

*edit*

Since Unreal cannot work with pointers, what I mean by "memory buffer" is the allocation of a character array or something similar.

Re: Unreal engine driver communication
 

Yes, that's exactly what I was saying. It would still leave one half of the problem unanswered, because it'll be a one-way means of communication (unless we do some real-time polling... I dunno... that would need to be tested but I'm perhaps not the guy to ask to, my coding experience in inter-process communication is near zero).

Re: Unreal engine driver communication
 

Heres what you would need to do...

- Define a global structure in unrealscript with members like searchkey, opcode, param1, param2, param3, param4.
- Every frame check the opcode and act on it.
- At the end of every frame zero-out the opcode and parameter members.

In the C++ driver...

- Find the address by injecting a dll and use it to find the searchkey.
- Using shared memory, tell the engine driver where the structure is loaded.
- Read/WriteProcessMemory your opcodes and parameters.

Maybe that would work?

Re: Unreal engine driver communication
 

UnrealScript can allocate objects on the fly, however, that memory won't be readable by external applications since UnrealScript can't change the page access flags to make it a global page table. The only way that I'm aware of to read that memory would be to have an application running at Ring-0 (the same access level as the Operating System, something like a virtual device driver).

If you could get the memory buffer working, you could probably use the TCP/IP stream to signal the UnrealScript code when there's something to be read and the UnrealScript code could send something back on the TCP/IP steam when there's something ready to be read by the external C++ application.

I wouldn't count on this method working until someone *ACTUALLY DOES IT*. When you have a working prototype that can send data back and forth, only then should you consider this a working alternative.

botman

Re: Unreal engine driver communication
 

Polling should OK since the driver only needs to kick in after Unreal updates each frame. The two way communications can be done through the shared memory buffer (assuming Unrealscript can create one).

Even if we can get two way communications to work, botman is indicating that the facilities provided by Unreal script may be too limiting.

For example, are we able to determine things such as if a bot has ammo left or not, what is a bots health, etc.

Re: Unreal engine driver communication
 

All this is possible with UnrealScript. The main limitation is access to the world's data. But this can be circumvented by interpreting the map files ourselves and build a world mesh in parallel to the engine, just like what I do in my bot with the navmesh, only more detailed.

Besides we already decided that we WERE sticking with the Unreal engine.

Who is doing this currently ?
I'm not yet decided to throw away €30 in order to buy an Unreal copy (just a matter of taste: I don't enjoy the game...)

Re: Unreal engine driver communication
 

Looks like I missed this part in your post, Lazy.
Could you tell us more ? How do you see things ? I'm a total n00b with code injection, but from what I hear it sounds very promising.

Re: Unreal engine driver communication
 

Code injection is basically what Hacks do to CS, Previously it was DLL 'hooking', now its injection. However, i'm not sure how legal this is, or if we would need function named from the header files to be able to do this.

And this will need to be made to work on Linux as well.

Re: Unreal engine driver communication
 

Code injection is not just used for hacks, basically you force a remote process to call LoadLibrary with your dll using CreateRemoteThread.

Once created, you call WaitForSingleObject on the remote thread and get the result of LoadLibrary with GetExitCodeThread.

Once the dll has been loaded by the remote process it becomes part of the application.
Calling GetModuleFilename in DllMain under DLL_PROCESS_ATTACH and displaying it with a message box will show the name of the application you injected the dll into.

Re: Unreal engine driver communication
 

obviously, i was using hacks as an example as to how companies arnt very happy with that method, the dont cancel accounts for the cheating, the do it for the modification of the engine.

Nice avatar btw Lazy :p

Re: Unreal engine driver communication
 

Well, I'm sure plenty of methods can be thought up.
The only problem is that posting them one at a time like this is very very slow.
An IRC meeting would be much faster and probably produce more ideas.

We may not have to use the injection method either, we have the problem solved with the structure keys.
We simply search through unreal's memory for a pre-defined key number.
When that is found we have the address of the structure in unreal and it can be casted into a similar C one and acted upon.

[Edit]
^^ Thanks, though I cannot make anymore. :(
After that one I forgot how to animate them properly.

Re: Unreal engine driver communication
 

The problem with IRC is that most of the stuff that is said there tends to be immediately forgotten.

About the memory method: is someone already working on it or do I need to fetch an ugly warez copy of Unreal over KaZaA (with the appropriate viruses) and pollute my computer with it to get my hands in it ?

I'm just reluctant on buying a game I don't enjoy playing.

Re: Unreal engine driver communication
 

I was thinking, The battlefield server manager uses something called 'Process Walking' to get control of Battlefield, i'm not sure if the same is possible with Unreal, but maybe it would be useful to check it out?

Re: Unreal engine driver communication
 

I don't know about Unreal, and i don't own it. The memory reading should be a method to go. Perhaps i can find one too. Do we talk about Unreal 2003 or 2004 here btw? Or is'nt there much difference between those engines?

I could probably send you some cd's PMB...

Re: Unreal engine driver communication
 

I'd enjoy that indeed. I didn't know that UT2004 existed. We'll take the version botman is the most experienced with, anyway... all we need is a proof of concept. Show the world that this thing can work.

Re: Unreal engine driver communication
 

I have UT 2k3 but my computer freezes every 10 minutes so theres not much I can do now.

It's all WinXP's fault, if only I could use Visual Studio under linux.
Win 2000 worked fine, its just this crappy os.

Re: Unreal engine driver communication
 

The UT2003 and UT2004 engine are virtually identicals. Most of the changes in UT2004 have to do with the vehicle physics and better network efficiency between the server and the client.

If a techinique works in UT2003, it will also work in UT2004.

botman

Re: Unreal engine driver communication
 

Process walking...

http://msdn.microsoft.com/library/de...ss_walking.asp

just my 2 cents :)

Re: Unreal engine driver communication
 

Thats the one i was talking about earlier :p