Unreal Engine 3
Unreal Engine 3 serves as the core engine for a number of AAA award winning games including the much beloved Batman Arkham series and Gears of War. Either loving or hating Batman as a character you can’t deny the huge impact this game had at it’s release, Gamers had long since given up on having a decent game published on their favourite bat themed vigilante. That was until the property was handed to the then unknown games studio Rocksteady.
Then they turned the entire industry on their heads by doing something unthinkable making it actually good. While I was writing this tutorial I had dig pretty far into the game’s design and code and one thing remains abundantly clear: the game was made by people who enjoyed what they were doing.
So join me as we delve into this great game and pry open it’s secrets. While this tutorial is focused on one game in particular you can apply these techniques to virtual any UE3 game. All you need is a bit of determination and some spare time!
Game: Batman: Arkham Asylum
Direct X Version: 9
Direct Input: Yes
Version: 1.1 (GOTY)
The Behemoth That Is UE3
Unreal 3 is a massive engine developed by a team of professionals. It can be daunting to attempt a reverse engineering something like this but know that it’s far from impossible. Just know that while certain things vary from game to game some things inevitably stay the same.
UE3 uses it’s own scripting language called UnrealScript which is “compiled” or “cooked” prior to a game being published. Luckily for us there’s an online SDK reference with a ton of useful information. You can find it here. If you’ve never touched UE3 from a developer perspective I strong recommend you read that entire SDK. I was extremely helpful while I was writing this tutorial especially for figuring out how UnrealScript Classes interact with each other.
You may also want to grab the UDK to play with while going through this tutorial, it will better help you understand how the Engine works and therefore make it easier for you to reverse engineer it. While it isn’t available on the main site anymore you can obtain the last public UDK from here.
The Directory Structure
Unreal 3 Games typically have the following directory structure:
It’s pretty self explanatory. Binaries are stored in the binaries folder and the game’s assets, scripts and other logic are contained within the XXGame directory (where XX is the short-name for your game). What might not be immediately obvious to you is that the config files inherit from one another. You should not modify the game’s config files directly instead modify the one’s stored inside your user profile.
You can think of the Unreal 3 Engine like a virtual machine similar to Java or the .NET framework. The human readable script is ‘compiled’ into a byte code steam which the virtual machine can execute. As with Java and .NET we can easily transform this data back into a human readable format.
We don’t have to perform this process manually because tools exist to make our life easier. Head over to this page and download the UE Explorer tool. This utility allows you to browse the contents of most compiled UnrealScript files in their (mostly) original format. While it won’t give you everything in it’s original format it does a damn good job on most files allowing you to examine the core game logic.
When I attempted to view the BmGame.u script it failed due to the file being compressed. The application will alert you to this and tell you to download another utility to decompress it. It’s a command line that you can just point at the file and it will decompress it for you.
Once I decompressed the entirety of the scripts I had no issues viewing the reverse engineered code.
Unfortunately you wont be able to modify the scripts and repackage them. You can only look through the code and examine the game’s logic (still incredibly useful and not something you can do in other engines!). However we can re-enable a cut down version of the game’s console and interact with them that way!
While I read all over the Internet that the developer functions were “patched out” when the game is set to release mode, my brain immediately heard oh boolean flag set to zero? However during my research I found that some people were able to re-enable teamspeak just by tweaking a config file. I have also found a way to re-enable the actual dev console (it is pretty barebones) but more on that later.
All you need to do is modify your BmInput.ini in your user directory to contain this:
Or if you’re lazy download the complete file here.
Now you can interact with the UnrealScripts inside the game. The console is fairly limited to modifying variables but it’s a start! You can change the key to whatever you like as long as it doesn’t conflict with another input.
Here’s a few variables you can modify and try out:
set engine.playercontroller bgodmode true
set pawn health 0001
set BmGame.RBMPawnAI bBatarangCanKill true
set bmgame.rgrapplegun maxgrappleheight 999999999
set rpawnplayerbm bUseDamageMeshes false
If you’re curious about modifying other variables jump back into UE Explorer and take a look around the various classes to see what other things you can change. You can also read through and see how modifying these variables will affect gameplay. See if you can figure out how to modify your current experience or health.
This is just the beginning of our journey through the Unreal 3 Engine. Now that we’ve configured Batman so we can interact with the variables directly it will make our lives easier for the next tutorial.
In the next tutorial we’re ditching the kid stuff and going in guns blazing. I’ll show you how to locate the game’s scripts in memory and dump them to a file. We’re also going to write a hook that will allow us to log every single call made in the game to further our reverse engineering efforts.
And that’s just to start! By the end of this series the game will be completely open to you and you’ll be able to interact with all the game’s objects just like you would through UnrealScript. Don’t miss out! If you want to follow along make sure you head over to my Patreon and throw in a $1 to get access. You’ll be helping support me continue writing these tutorials and you’ll gain access to everything else I’ve written just for the Patreonis!
Don’t forget to follow me on Twitter and share this article with your friends!