Cheat Engine Features

Memory Scanner

The core of Cheat Engine is the memory scanner. It lets you search a process’s memory for values that match what you type. You can scan for exact values, unknown initial value, decreased/increased value, and many more scan types. After the first scan you change the value in the game (e.g. take damage, spend gold), then run a “Next Scan” to narrow the list. Repeating this usually leaves you with one or a few addresses that hold the value you care about.

You can scan for different value types: 1–8 byte integers, floats, doubles, strings, and more. The scanner supports grouped scans (e.g. find a value that is between two other values) and custom Lua scripts for unusual types. Results can be added to the address list, where you can freeze a value (keep it from changing), change it manually, or attach a hotkey to toggle or set it.

Advanced options include scanning only specific memory regions, using a debugger to break when the address is accessed or written, and pointer scans so that the address still works after restarting the game.

Debugger

Cheat Engine includes a full debugger. You can set breakpoints on instructions or on memory access (read/write). When the breakpoint hits, execution stops and you can inspect registers, the stack, and memory. The debugger supports both 32-bit and 64-bit processes and works with kernel debugging when DBVM is loaded.

You can single-step (step into, step over), run until return, and use trace and “find out what writes/reads this address” to see which code touches a value. This is essential for finding the exact instruction that updates health, ammo, or money so you can replace it or inject your own code.

The debugger window shows disassembly, and you can edit instructions (Assembler), add new code (Auto Assembler scripts), or use the trace log to follow execution flow.

Disassembler and Assembler

The disassembler shows the machine code of the process in human-readable assembly (x86/x64). You can navigate by address, follow jumps and calls, and see which instructions reference a given address. When you find the code that writes to your value, you can replace it with your own instructions using the assembler.

The Auto Assembler is a scripting layer on top of this: you write assembly (with labels and directives like alloc, code injection, and AOB (array of bytes) search) and CE allocates memory, finds the bytes, and patches the game. Templates for common tasks (infinite health, no recoil, etc.) are available and can be customized. This is how most advanced cheats and trainers are built.

Speedhack

Speedhack changes the speed at which the target process runs. You can slow time down (useful for difficult sections or analysis) or speed it up (to grind faster in single-player games). The speed is controlled by a slider or by setting a multiplier. It works by hooking time-related APIs (e.g. GetTickCount, QueryPerformanceCounter) so that the game thinks less or more time has passed.

Speedhack only affects the attached process. It is intended for single-player use. In online games it can cause desync or detection and is not supported.

Trainer Maker

Once you have found addresses and optionally written Auto Assembler scripts, you can save them in a Cheat Table (.CT file). The Trainer Maker lets you turn a cheat table into a standalone trainer executable. The trainer can have a simple window with checkboxes and hotkeys so that users do not need to open Cheat Engine or load the table manually. You can customize the trainer’s appearance and behavior.

Trainers are often shared on the forum and elsewhere. Always download from trusted sources and inspect .CT files (they are XML) for malicious Lua or assembly before using them.

Lua Scripting

Cheat Engine has built-in Lua support. You can write scripts to automate scanning, modify the UI, create custom forms and dialogs, and interact with the address list and memory. Many extensions on the forum are written in Lua. The Lua API exposes process and memory functions, so you can read/write memory, allocate memory, enumerate modules, and call the debugger from script.

Lua is used for auto-attach scripts (automatically attach to a process when it starts), custom scan types, and complex trainers. Learning Lua basics and the CE Lua documentation on the wiki will let you build powerful tools on top of CE.

DBVM (Debugger Virtual Machine)

DBVM is a hypervisor that runs below the operating system. It extends the CPU instruction set so that usermode programs (like CE) can perform operations that normally require kernel access. This allows more powerful debugging and memory access, especially on 64-bit Windows where normal debuggers are more restricted.

With DBVM loaded, CE can use features like ultimap (trace execution), better breakpoints, and kernel-level memory access. Loading DBVM requires a compatible CPU and booting with the DBVM loader (e.g. UEFI). Right-click the CE logo and open “About” to see if your system supports DBVM and whether it is currently loaded.

DBVM uses a 160-bit key for security so that other software cannot abuse it. It is optional; most users use CE without DBVM.

Mono and .NET Support

Many games and applications are built with Unity (Mono) or .NET. Cheat Engine can enumerate Mono/.NET types, classes, and fields. The Mono Dissector and .NET Data Collector let you browse the in-memory object model and find fields (e.g. Player.health, GameManager.gold) by name instead of raw addresses. You can then add those fields to the address list or use them in scripts.

This makes it much easier to work with managed games. Lua and the Mono API can be used together to automate finding and watching classes and instances.

Pointer Scan

Addresses in games often change when you restart the process because of ASLR and dynamic allocation. A pointer is an address that contains another address that eventually points to your value. Pointer scan finds chains of pointers (e.g. base module + offset → pointer → offset → your value) that remain valid across restarts. You can then save a pointer in your table so the cheat works every time you open the game.

Pointer scans can be large and may take a while. Filtering by “must be readable” and limiting depth and level helps reduce false positives.

Other Tools

• Memory View: Browse and edit process memory in hex. Search for bytes, strings, or AOB patterns.
• Dissect data/structures: Define structures and overlay them on memory to interpret bytes as meaningful fields.
• Direct 3D manipulation: Tools for inspecting and modifying DirectX state (e.g. view matrix) in some games.
• Symbol handler: Load PDB or similar symbols for better disassembly labels when available.
• Process list: Attach to any running process (with appropriate permissions). Filter by name or PID.

Scan Options and Performance

The memory scanner has many options to tune speed and accuracy. You can limit the scan to specific regions (e.g. only the main module or writable regions), use “Fast scan” for a quicker but less exhaustive pass, and set the number of threads. For “Unknown initial value” on large processes, limiting the scan range can reduce time. The address list supports many thousands of entries; for pointer scan results, use filters (e.g. “Must be valid”) to narrow before rescanning. See the Tutorials page for practical advice.

Plugins and Extensions

Cheat Engine supports plugins (DLLs) that extend functionality. The forum has a plugins section where users share tools for specific games or general features. Lua scripts can also act as extensions: auto-attach, custom scan types, and UI additions. When using third-party plugins or scripts, only use sources you trust; they run with the same privileges as CE and can access process memory. The official wiki documents the plugin API and Lua API for developers.