@@ -1522,76 +1522,60 @@ DirectXResource<ID3D12Resource>* Texture::get_d3d12_resource_container() {
15221522 return *(DirectXResource<ID3D12Resource>**)((uintptr_t )this + *offset);
15231523 }
15241524
1525- spdlog::info (" Searching for Texture D3D12Resource offset" );
1525+ static constexpr size_t GET_TYPEINFO_FN_INDEX = 3 ;
1526+
1527+ spdlog::info (" Searching for Texture D3D12Resource offset (via.render.RenderResource bruteforce)" );
15261528
1527- // Scan through past offset 98 looking for pointers that contain
1528- // vtable pointer to either D3D12Core.dll or dxgi/d3d12.dll
15291529 for (size_t i = 0x98 ; i < 0x200 ; i += sizeof (void *)) try {
1530- if (offset) {
1531- break ;
1530+ const auto ptr = *(uintptr_t *)((uintptr_t )this + i);
1531+
1532+ if (ptr == 0 || IsBadReadPtr ((void *)ptr, sizeof (void *))) {
1533+ continue ;
15321534 }
15331535
1534- const auto potential_ptr = *(uintptr_t *)(( uintptr_t ) this + i) ;
1536+ const auto vtable = *(uintptr_t **)ptr ;
15351537
1536- if (potential_ptr == 0 ) {
1538+ if (vtable == 0 || IsBadReadPtr (( void *)vtable, sizeof ( void *)) ) {
15371539 continue ;
15381540 }
15391541
1540- // Make sure this has a valid vtable pointer
1541- const auto vtable_ptr = *(uintptr_t *)potential_ptr;
1542+ const auto get_typeinfo_fn = vtable[GET_TYPEINFO_FN_INDEX];
15421543
1543- if (vtable_ptr == 0 || ! utility::get_module_within (vtable_ptr )) {
1544+ if (get_typeinfo_fn == 0 || IsBadReadPtr (( void *)get_typeinfo_fn, sizeof ( void *) )) {
15441545 continue ;
15451546 }
15461547
1547- // Scan memory of this object looking for another pointer that contains a vtable pointer to d3d12.dll or D3D12Core.dll
1548- for (size_t j = 0 ; j < sizeof (RenderResource) + 0x18 ; j += sizeof (void *)) try {
1549- const auto inner_potential_ptr = *(uintptr_t *)(potential_ptr + j);
1550-
1551- if (inner_potential_ptr == 0 ) {
1552- continue ;
1553- }
1548+ if (!utility::get_module_within (get_typeinfo_fn)) {
1549+ continue ;
1550+ }
15541551
1555- const auto inner_vtable_ptr = *(uintptr_t *)inner_potential_ptr;
1552+ // Check if this is a mov rax, [rip+disp32] instruction
1553+ if (((uint8_t *)get_typeinfo_fn)[0 ] != 0x48 || ((uint8_t *)get_typeinfo_fn)[1 ] != 0x8B || ((uint8_t *)get_typeinfo_fn)[2 ] != 0x05 ) {
1554+ spdlog::info (" [Texture] Skipping offset {:x} because get_typeinfo_fn does not look like a mov rax" , i);
1555+ continue ;
1556+ }
15561557
1557- if (inner_vtable_ptr == 0 ) {
1558- continue ;
1559- }
1558+ using type_info_fn_t = sdk::RETypeCLR* (*)();
1559+ const auto type_info_fn = ( type_info_fn_t )get_typeinfo_fn ;
1560+ const auto type_info = type_info_fn ();
15601561
1561- const auto module = utility::get_module_within (inner_vtable_ptr);
1562+ if (type_info == nullptr || IsBadReadPtr (type_info, sizeof (void *))) {
1563+ continue ;
1564+ }
15621565
1563- if (module ) {
1564- const auto module_name = utility::get_module_pathw (*module );
1566+ if (type_info->name == nullptr || IsBadReadPtr (type_info->name , sizeof (void *))) {
1567+ continue ;
1568+ }
15651569
1566- if (!module_name.has_value ()) {
1567- continue ;
1568- }
1570+ const auto type_name = std::string_view{type_info->name };
15691571
1570- std::wstring module_name_lower = *module_name;
1571- std::transform (module_name_lower.begin (), module_name_lower.end (), module_name_lower.begin (), ::towlower);
1572-
1573- auto is_vtable_d3d = [](std::wstring_view module_path_lower) {
1574- return module_path_lower.ends_with (L" d3d11.dll" ) ||
1575- module_path_lower.ends_with (L" d3d12.dll" ) ||
1576- module_path_lower.ends_with (L" d3d12core.dll" ) ||
1577- module_path_lower.ends_with (L" dxgi.dll" ) ||
1578- module_path_lower.ends_with (L" d3d12sdklayers.dll" ) ||
1579- module_path_lower.ends_with (L" d3d11_1sdklayers.dll" ) ||
1580- module_path_lower.ends_with (L" d3d11_2sdklayers.dll" ) ||
1581- module_path_lower.ends_with (L" d3d11_3sdklayers.dll" ) ||
1582- module_path_lower.ends_with (L" d3d11on12.dll" );
1583- };
1584-
1585- // Standard path for semi-newer UE versions
1586- if (is_vtable_d3d (module_name_lower)) {
1587- spdlog::info (" Found Texture D3D12Resource at offset {:x}" , i);
1588- offset = i;
1589- return *(DirectXResource<ID3D12Resource>**)((uintptr_t )this + *offset);
1590- }
1591- }
1592- } catch (...) {
1593- continue ;
1572+ if (type_name == " via.render.RenderResource" ) {
1573+ spdlog::info (" [Texture] Found D3D12Resource container at offset {:x}" , i);
1574+ offset = i;
1575+ return *(DirectXResource<ID3D12Resource>**)((uintptr_t )this + *offset);
15941576 }
1577+
1578+ spdlog::info (" [Texture] Checked offset {:x}, type name: {}" , i, type_name);
15951579 } catch (...) {
15961580 continue ;
15971581 }
0 commit comments