Unreal engine driver communication

[Pierre-Marie Baty]

I thought it would be good to open a thread to solve the question of the Unreal engine driver communication.

The problem: Unreal engine is only accessible through UnrealScript, a proprietary scripting (hence interpreted) language that doesn't allow native C++ code communication - unless you buy a license from Unreal.

Two solutions so far:

1. - Use loopback network communication through a third party sockets library available to use for UnrealScript (slow)
2. - As suggested by botmeister, use local disk I/O access and reading/writing through a temporary file for inter-process communication.

*edit* a summary of the previous discussion can be found in this thread:
http://forums.bots-united.com/showthread.php?t=1299

Discussion:

[Lazy]

Does unrealscript allow the address-of operator (&)?
If so, just make a global variable of a structure containing game data and write the address once to a file for reading by the c++ driver.

Once you have the address you should be able to use ReadProcessMemory and WriteProcessMemory on a similar structure ( with all offsets correct ) written in C or C++.

I have not done that much reading on unrealscript so I don't know if their virtual machine uses the actual addresses of objects or if it has it's own memory system.

I guess I'll install UT and check out some more options.

[Pierre-Marie Baty]

That is a nice idea... I'll check it out (gotta edit this post as soon as I have the answer)

*edit*
hmmm, visibly not... no pointers, no address referencing in UnrealScript.

UnrealScript overview (official doc): http://unreal.epicgames.com/UnrealScript.htm


*edit 2*
Crazy idea then...
tag this structure with an unique magic number (long enough to be REALLY unique), and have the bot core scan the OS memory for that fingerprint. Once it finds it, it knows the address of the struct.

Feasible ?

Anyway, the problem is still half-solved, because it'll only be a one-way communication.

[Lazy]

That could work and you could also have two-way by doing something like this...

Force Unreal to load a helper dll.
Call GetModuleHandle( NULL ) from the unreal engine to get the program in memory.
Search for the structure ( with unique id at offset 0 ).
Using shared memory, give the pointer to the data to the c++ driver.

Virtual machines are useful and they have obviously done a nice job with UnrealScript, but forcing it on people is not the right way to go. It's too bad that we cannot use a regular dll.

Edit:
Where were you looking?
I saw what looks like an address-of operator somewhere, there was a function somewhere that had the & operator on a parameter.

Added:

void Touch(class AActor* Other)
{
	FName N("Touch",FNAME_Intrinsic);
	struct {class AActor* Other; } Parms;
	Parms.Other=Other;
	ProcessEvent(N,&Parms);
}

There it is, I'm not sure but here & looks like an address-of operator.
If not, damn.

[Pierre-Marie Baty]

Damn interesting! But weird? What is the URL where you found that piece of code ? It *looks* like UnrealScript indeed...

How come I have seen that nowhere mentioned in the UnrealScript reference pages at epicgames.com ???

*edit*
hmm, no, to me it would rather look like a C++ piece of code from an Unreal game DLL...
UnrealScript doesn't know the keywod "void" AFAIK.
Somehow I wish I had an Unreal copy to install and toy around with. Botman or someone else may be able to tell us more than I presently can.

[Lazy]

It is at the website you posted the link to, I just did a find for &.
Surprisingly, there were only a couple of hits despite the large amount of text which made it easy to find.

Edit:
Bah, I never saw that part where it mentioned it was C++ code.
I simply skipped over the line by mistake, I usually make my screen grey
when reading important text but I was probably too tired to think of it.

Looks like we'll have to inject some code to get the same result, shouldn't be too hard but the method I use only works on 2K/XP so another set of injection functions will have to be written.

Unless someone has a better idea...

[botman]

UnrealScript doesn't have pointers to memory addresses. Thus you can't read/write to a memory buffer with UnrealScript.

Yes, the Touch() code Lazy posted is C++ native code which can't be compiled without all the engine .h header files (needed for the member variables and functions in the C++ classes) not to mention needing the .lib libraries to resolve engine functions.

If we plan on using UnrealScript to control a bot, I think the only external interface will be via a TCP/IP socket through the loopback interface to another application running on the same host.

The biggest disadvantage for Unreal will be not being able to get world geometry information (which would be needed to generate navigation meshes). You can do ray traces through the world using UnrealScript and you can search the world for nearby objects (like other players or weapons), but that's about the limit of what can be obtained about the world.

Navigation will probably have to depend on waypoints (which is what UT2k3/2k4 already uses, called PathNodes and NavigationPoints).

UT2k3 can be found for pretty cheap here in the USA...

http://www.walmart.com/catalog/produ...00000000624060

So you might want to pick yourself up a copy if you don't already have it. Once you install the latest patch (available from the Epic website), you won't be required to have the CD available to run the game.

I'll make a new thread with some Unreal coding links that I have found and maybe that will help people investigate it a little more.

botman

[FrostyCoolSlug]

Have we concidered trying to find a way to reverse engineer the Unreal engine? I'm not sure if this is legal (probably not), but if it is, it could be useful.

[botmeister]

UnrealScript doesn't have pointers to memory addresses. Thus you can't read/write to a memory buffer with UnrealScript.

Botman, can UnrealScript allocate memory buffers?

If so, then we could determine the address of the buffer by having Unreal populate it with a very unique pattern.

The external C++ driver can scan memory looking for the unique pattern, once found we'll have the address of the allocated memory buffer.

Some simple handshaking can be done to coordinate the process and confirm the memory location (using simple file sharing methods for example).

*edit*

Since Unreal cannot work with pointers, what I mean by "memory buffer" is the allocation of a character array or something similar.

[Pierre-Marie Baty]

Yes, that's exactly what I was saying. It would still leave one half of the problem unanswered, because it'll be a one-way means of communication (unless we do some real-time polling... I dunno... that would need to be tested but I'm perhaps not the guy to ask to, my coding experience in inter-process communication is near zero).