About
 Top Next

This help file is intended to familiarize you with the basic features and usage of Cheat Engine. Some examples for various things are given, but a lot of the actual 'gamehacking' is out of the scope of this document. Please see elsewhere for practical game tutorials.

The contents of this document have been created mainly around v6.7 (the latest as of this date), although most of it should still apply even if your version differs.

Hopefully you will get used to Cheat Engine in no time and have fun using it!

For more help, check out the wiki at wiki.cheatengine.org

Credits to Psy for revising the initial version of the helpfile ending up into this


About Cheat Engine
 Previous Top Next

Cheat Engine is a powerful and feature-rich program designed primarily for modifying the rules in games. It has a simple, intuitive interface making it easy for beginners, but it also has a lot 'under the hood' making it ideal for advanced users as well. This program came into existence because at the time there weren't many free and easy-to-use modding programs. The ones that were free weren't very easy to use for a beginner, or they lacked essential features.

Also, I was used to cheating on games using the tool 'Gamehack'(and gamewizard in dos), but when I moved on to Win2000 I couldn't get it to work, so decided to make something that did work. This also have me a chance to learn programming while creating a real project.

Over time Cheat Engine has had a lot of improvements, additions of new features, and higher stability than the very first versions, and that's all thanks to the ideas and suggestions of people that sent me feedback. If you want to help make Cheat Engine better, send your ideas and suggestions to:
dark_byte@hotmail.com

Or you can download the source code, make changes yourself and send them to me (CE is written mainly in pascal, so it helps if you know that language before you try it).

Also, another way to motivate me to work on Cheat Engine, is to donate. You can donate whatever amount you wish through PayPal using the same email as above. If you make regular use of, or get a lot out of cheat engine, please consider donating to at least cover hosting costs for the website.


FAQ's

Note that this is only a small FAQ covering the more common questions. Please search the forum and see the website for solutions to any problems you have that aren't listed here. Oh, and make sure you check the rest of this help document too!

Q:When will there be a MAC version?
A:As soon as flying pigs have landed on the frozen plains of hell

Q:Have flying pigs landed on the frozen plains of hell?
A:Yes

Q:Will Cheat Engine work inonline games?
A:Most of the time, no

Q:Will Dark Byte help me with online games?
A:No

Q:If I do send dark byte an e-mail asking how to Cheat in an online game, what will he do?
A:He won't reply, or he replies in such way that it really pisses you off

Q:I tried editing my money in a online game and it showed on my screen that it worked. But when I bought sometimes with it my money was set back to what it used to be, minus what I just bought
A:That is because the server knows how much money you have. You just changed the display value

Q:Can I use Cheat Engine to hack, crack or unprotect other programs?
A:No, you may only use Cheat Engine for legal activities. If the license agreement of a game says to not disassemble it, then do not use CE's disassembler features (if you're scared)!

Q:Do I have to pay for Cheat Engine?
A:No, Cheat Engine is completely free.

Q:Can I have the sourcecode?
A:Sure, go to the download page and download it there

Q:I paid over $100 for Cheat Engine, and now I find out I can't use it on my online game. I demand a refund!!!
A:...stupid idiot...

Q:Why isn't Cheat Engine digitally signed? I'm too scared to download it now
A:Because I hate this mentality where everything has to be feared on the internet. If you don't want to download it, then don't, and go to a shrink to deal with your anxiety problems

Q:Can I send dark byte emails that aren't in English ?
A:Sure, but don't expect him to read beyond the first word before deleting it.

Q:Can I send dark byte emails that are translated to English by an automated translator ?
A:Can do of course you, expect don't reply any bedspread dark from byte.

Q:When the download finished my anti virus showed up it that is contained a virus! Am I going to die now?
A:Just add Cheat Engine to the ignore list, it's a false positive, or anti-virus vendors are just retards. Again, if you're too scared to run it, then don't.

Q:When will the next version of Cheat Engine come out?
A:Someday

Q:Will the next version of Cheat Engine be undetected for current anti-Cheat systems?
A:Most likely not

Q:I can't run a memory-scan or pointer-scan because CE can't allocate memory (or similar message). How can I fix this?
A:Try deleting the contents of your TEMP folder

Q:I've found a bug. Can I report this, and if so, how?
A:Feel free to submit bugs and suggestions to me via email or PM. Check out the bugtracker (from the main page) to see if it's already been noted though.

Q:I'm having 'xxx' issue with 'xxx' game and also 'xxx'. Can you tell me what to do?
A:No. Such questions are out of the scope of this guide, and have most likely been covered before anyway. The best thing to do is visit the forum and run a search there, or post.

Q:Can you make a 'xxx' hack for 'xxx' game for me?
A:No. And if it's for an online game, even more definitely no!


Main Interface

The main interface is the first screen; the first layout that you get when opening CE. This chapter will cover the various features and menus accessible from this view. If you are new to CE, then this chapter is of particular importance, as it will help to get you quickly up-to-speed with using it.


Standard menu
File:
Add scan tab | Add a new scan tab where you can start a new search which is independent from other searches in the other tabs
Clear list | Clears the addresslist
Save | Saves the current cheat table (.CT) to a location of your choice.
Load | Loads a previously saved cheat table (.CT) into cheat engine.
Save current scanresults | Save the current scan results in the selected tab. You can compare a value to the saved scan results when you are making an unknown value scan (similarly as comparing to fist scan results)
Quit | Close Cheat Engine

Edit:
Settings
Opens the cheat engine configuration window.

Table:
Show Cheat Table lua script | Brings up the lua script associated with the current table
Create Form | Creates a new form (a window) that you can design. You can also load an existing form if you like
<Formnames> | A list of forms that you can show or edit
Add File(s) | This lets you add binary files to your cheat table. You can access these files using lua fileTable objects

Process:
Open Process window | Opens the process list window. Just the same as using the Process Picker icon.
Create Process | Opens a windows explorer view, where you can specify a process to load (.EXE file).
From this menu you can also simply pick an enumerated process to load.

Tools:
You can access to the tools that you have specified in the settings. This option is not visible if there are no specified tools.

Help:
Cheat Engine Help | Launches this help file.
About | Shows CE's about box, containing credits and links.


Select process

The select window process (or sometimes known as 'Process Picker') can be accessed by clicking on the computer icon on the top left side of the main window.

This window holds a list of all the processes currently running. Double click on a entry and cheat engine will open this process for scanning (a process is a program or game running in windows).

If you click on the window button at the bottom you'll get to see all the windows, and the processes that own them, so if you don't know the process name you can use the window to find the process.

The process window also has the ability to attach the debugger the a running process, or to create a new process. The option to create a process will create the process, attach the debugger to it and break the process at the Entry Point for manual debugging.
The create process option is compatible with the windows debugger only.

If you have enabled the option to use the processwatcher in settings->extra you will have an option in the process window saying "Process watcher". Clicking that will open the process watcher window. It'll show you which processes have been created since the start of CE.

Open file will open a file for hex-editing


Memory scan settings

First scan
The "First Scan" is the first thing you do when you are scanning the memory. "First Scan" initializes the data structures inside cheat engine and reads the complete memory of the selected game. If you already know the value it will scan the memory while it's reading, and take less memory.

Next scan
The next scan processes the results of the previous scan. If you did a first scan before with a "Advanced" scantype, it wont have any results, but cheat engine does contain the memory of the game as it was when you did the scan the previous time. That way you can do a scan for a changed,unchanged value etc...
If you did get results from a previous scan the next scan will look at those results, and compare them to the scantype you selected, and remove those addresses that don't pass the test, making the list smaller and smaller till there are only a few or even 1 address left.

Undo scan
If you made a error while scanning, like searching for a increased value, while you had to search for a decreased value, you can click "Undo Scan" and Cheat Engine will restore the results back to the previous scan, allowing you to try again, instead of completely starting over.

New scan
The new scan wipes out all your results, and frees the memory, allowing you to start a new scan.

Scan types
In the scantype combobox you can select what type of scanning will be done.

Value types
In the value types combobox you can select what type of address you are looking for.
Normally (meaning in most cases) a given value is 4-bytes in windows. Sometimes it is different, or you are looking for something else, so in that case choose another value type. Usually when you draw a blank with a 4-byte scan choose another (such as 2-byte or even 1-byte for example).

Range to scan
Programs reside in memory, and store their addresses in various locations within this space. With the two value boxes you can increase/decrease the number of locations that Cheat Engine will look at for the address you need. This can dramatically increase your scanning speed, and improve the results, when used wisely.

If you've changed the scanning range and wish to reset it to it's default value, right-click on the range value and choose the "Reset range" option.

Read-Only
The readonly checkbox tells Cheat Engine, if you want to scan read-only memory or not. Normally games do not store important game information in read-only memory, but sometimes you may feel a need to scan that memory anyhow. (e.g. If you want to change some text in the game etc...)

Fast scan
The Fast Scan (aligned scan) checkbox tells CE to skip addresses that aren't located on a 32-bit aligned boundary. (Addresses divisible by 4 basically). In other words, addresses ending with 0, 4, 8 and C)
Most times you can get away with using this option ticked, as most variables in games get assigned to
these aligned locations. This will dramatically cut down on your scanning time!

Do not underestimate the use of this option. In many/most cases you can set this to on by default (see CE options) to speed up your work! For most users, under most situations, I recommend you set this to on.

The default alignment is 4 bytes but you are able to change it to a custom value (e.g: 8, which will cause ce to search for addresses dividable by 8 only)

If you use the "Last digits" option, CE will scan only for addresses where the last digit(s) match the given digit.
Note: To use a high digit value you must have a buffersize in settings to a value that is higher than the digits you're looking for

Enable Speedhack
Enables the Sp eedhack function. See here for more detailed information: Speedhack Info

Unrandomizer
This feature scans for and changes certain routines that are commonly used to generate random values, making them always return the same. You should be cautious though with this option, as there is a chance that CE will overwrite the wrong routines and potentially cause a crash. If the program uses an unknown random generator (IE. CE doesn't know about it) then this option will fail. For most users, during general use, don't touch this option.


Scan types

Unknown initial value: (Available on first scan only)
This scantype makes a copy of the game in memory, so it can be used later on. If you don't know the value of a variable in-game, then this scantype is usually the first step. It can take a while depending on the memory and cpu-intensity of the game and the spec of your PC.

Exact:
The "exact" scan will scan the memory for the value (or string) you've entered.

Bigger than
The "Bigger than" scantype scans for all the values that are higher than the value you've entered.

Smaller than
The "Smaller than" scantype scans for all the values that are smaller than the value you've entered.

Value between...
Scan for values that are within the specified interval.

The following scantypes are available only when doing a 'next scan':

Value between... at least xx%
Scan for values that are within the specified percentage interval compared to the last, first or saved scan result.

Increased
If the value of a address has increased it will be added to the list.

Increased by...
If the value of a address has increased with the specified amount it will be added to the list.

Increased by... at least xx%
If the value of an address has increased within the specified percentage interval, it will be added to the list.

Decreased
If the value of a address has decreased it will be added to the list.

Decreased by...
If the value of a address has decreased with the specified amount it will be added to the list.

Decreased by... at least xx%
If the value of an address has decreased within the specified percentage interval, it will be added to the list.

Changed
This scantype will check if the value of an address has changed or not. If it has changed it'll be added to the list.

Unchanged
This scantype will check if the value of an address has changed or not . If it has not it'll be added to the list

Compare to first/saved scan
This scantype isn't actually a scantype but when selected it will change the values you are comparing with with the values of a previously saved scan. This can be the first scan, but also a saved scan

Compare to previous scan
When you're currently comparing to old values you can use this to compare against the results of the last scan (back to normal behavior)

--
Not
This will do one of the above scans, but only returns addresses that do NOT adhere to the requirement


Value types

Binary
The binary scan is a slow but powerful scan.
It will scan between bytes for a value
Also, if you want to search for a array of bits that possible too, it even allows wildcard(?,*) instead of the normal 1's and 0's. This allows you to do a search like 1101?001, which will give the results of all addresses+bit that have either 11010001 or 11011001. (More wildcards in a string are allowed)

The range of a bitscan can be as long as you like. (as long as it fits in the memory)

If you're wondering if this is useful:
Lets say a program stores the following values as follow:
100=1001100100110110
200=1011001000101001
300=1100101100110110

also note that in normal binary notation the following values are:
100=1100100
200=11001000
300=100101100

now, if you look at the above example you'll notice that the binary value of 100 does apear in the binary that represents 100, but has a 1 as last bit, and the first few bits are random (read from right to left) , same for 200 and 300, with the binary scan you can scan for the binary representation of the values 100-200 or 300.

Byte (8-bits)
A byte is a value that can hold a number between 0 and 255 or -128 to 127. (The last one if it is a signed value )
1-byte values aren't used much except for 8-bit emulators, etc... Even though a 1-byte scan seems useless, it will normally find the value when you don't know for sure if the value is either 1-byte, 2-bytes, 4-bytes, or 8-bytes, that is because all those types are build from this base type.

Of course, the number of initial addresses you'll find doing a 1 byte scan is very big, and it will take a while to find the address you're looking for, but at least the change of finding it is higher.

2 bytes (16-bits / WORD)
a "2 Byte" value can hold a number between 0 and 65536 or -32768 to 32767 (The last one if it is a signed value )
"2 byte" values are used in old dos games, and other 16-bit applications.

4 bytes (32-bits / DWORD)
a "4 byte" value can hold a number between 0..4294967295 or -2147483648 and 2147483647 (The last one if it is a signed value )
"4 byte" values are the standard way of storing information in a windows system. So doing a 4-byte scan will normally give the best results.

8 bytes (64-bits / QWORD)
a "8 byte" value can hold a number between 9223372036854775808 and 9223372036854775807 (no need for unsigned values anymore)
"8 bytes" aren't used often because they take up a lot of space, and require extra processing. (except for 64-bit processors)
Some programs do use them though, and scanning for a "8-byte" value doesn't return many addresses, so finding the right one is easy then.

If the address you're looking for is smaller than 8 bytes, the chance that the scan has skipped that address is big.

Float/Single (32-bits) (IEEE standard)
a "Single" value can hold a number between 1.5 x 10^-45 and 3.4 x 10^38 .

This is one of the 2 standard floating-point value allocations. (IEEE) The other one is DOUBLE
A Single consists of 4 bytes, which is build up in a special way, which is VERY different from normal variables! (so normal byte scanning wont work)

Cheat Engine rounds values up/down till the number of digits you specify in the scan value box.
e.g.:if you scan for 12 it will find all values between 11.5 and 12.4 and 12.0 results in values between 11.95 and 12.04

Double (64-bits) (IEEE standard)
Basically the same as Single, except the data-length is longer (more precise) but the range is between 5.0 x 10^-324 and 1.7 x 10^308

Text
The "Text" scan value can be used to scan the memory of a game for text. E.g: if you know that 12 bytes after your name as a variable you need you can use that to recalculate the addresses each time a game restarts.
Text scans are in UTF-8 or UTF-16

Array of byte
Same as text, but uses a array of byte instead of characters, and supports wildcards.
input:
xx xx xx xx ...
xx ?? xx xx
xx ** xx xx

An array of byte (AoB) scan can be useful when you know that prior to the address you need is always a specific occurrence of bytes. (like: 66 66 66 10 10, and 4 bytes after that is your health which is stored as 1 byte. Scanning for 1 byte will take a lot longer than scanning for this string of bytes. Scanning for this string will probably only result 1 address, where as scanning for 1 byte will return thousands of addresses the first time)

All
A combination of byte, 2 bytes, 4 bytes, 8 bytes, single and double data-types (basically the numeric ones).

Custom
Lets you assign an lua or auto assembler script where you can fill in how certain bytes should be interpreted as a decimal value and the other way arround

To create a custom scan script, right-click on the value type box and select the option from the menu.

To delete or edit a custom scanscript, select it and press right-click. Then choose Edit or Delete from the menu.


Money type (divided by 100)
The following custom type script will handle values that need to be divided by 100 to get to the correct value
This type is used by some games like civilization 5 where the money and research technology is stored using this floating point type.

example:
100.35 gold would be stored in memory as 10013
103.89 gold would be stored in memory as 10389

with this script you'd be able to scan for 100 and 103 respectively, and if you wanted to change the value to 700 you'd just change the value to 700 instead of 70000

alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)

TypeName:
db 'Civ 5 Float',0

ByteSize:
dd 4

//The convert routine should hold a routine that converts the data to an nteger (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);

//Note: Keep in mind that this routine can be called by multiple threads at the same time.

ConvertRoutine:
[32-bit]
push ebp
mov ebp,esp
push ecx
mov ecx,[ebp+8]
[/32-bit]

//at this point ecx contains the address where the bytes are stored
//save the used registers
push edx //fun fact about ce's assembler, because push ebx does not exist in 64-bit it becomes the 64-bit push rdx automatically
push ebx

//put the bytes into the eax register
mov eax,[ecx] //second fun fact, addressing with 32-bit registers doesn't work in 64-bit, it becomes a 64-bit automatically (most of the time)

xor edx,edx
mov ebx,#100
div ebx //divide eax by 100 and put the result in eax (and leftover in edx)

pop ebx
pop edx
//and now exit the routine
[64-bit]
ret
[/64-bit]
[32-bit]
pop ecx
pop ebp
ret 4
[/32-bit]

//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
[32-bit]
push ebp
mov ebp,esp
push edx //save the registers
push ecx
mov edx,[ebp+0c]
mov ecx,[ebp+08]
[/32-bit]

//at this point edx contains the address to write the value to
//and ecx contains the value
push eax
push edx
push ecx

mov eax,ecx //eax gets the given value
xor edx,edx //clear edx
mov ecx,#100
mul ecx //multiply eax and put the results into edx:eax (edx is ignored for this routine)

pop ecx
pop edx
mov [edx],eax
pop eax

[64-bit]
//everything is back to what it was, so exit
ret
[/64-bit]

[32-bit]
//cleanup first
pop ecx
pop edx
pop ebp
ret 8
[/32-bit]


Old Flash (div 8)

Divide by 8 (old flash)
 Previous Top Next
This is just the money type adjusted to 8 (in case you didn't get it in the previous example)

alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)

TypeName:
db 'Civ 5 Float',0

ByteSize:
dd 4

//The convert routine should hold a routine that converts the data to an nteger (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);

//Note: Keep in mind that this routine can be called by multiple threads at the same time.

ConvertRoutine:
[32-bit]
push ebp
mov ebp,esp
push ecx
mov ecx,[ebp+8]
[/32-bit]

//at this point ecx contains the address where the bytes are stored
//save the used registers
push edx //fun fact about ce's assembler, because push ebx does not exist in 64-bit it becomes the 64-bit push rdx automatically
push ebx

//put the bytes into the eax register
mov eax,[ecx] //second fun fact, addressing with 32-bit registers doesn't work in 64-bit, it becomes a 64-bit automatically (most of the time)

xor edx,edx
mov ebx,#8
div ebx //divide eax by 8and put the result in eax (and leftover in edx)

pop ebx
pop edx
//and now exit the routine
[64-bit]
ret
[/64-bit]
[32-bit]
pop ecx
pop ebp
ret 4
[/32-bit]

//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
[32-bit]
push ebp
mov ebp,esp
push edx //save the registers
push ecx
mov edx,[ebp+0c]
mov ecx,[ebp+08]
[/32-bit]

//at this point edx contains the address to write the value to
//and ecx contains the value
push eax
push edx
push ecx

mov eax,ecx //eax gets the given value
xor edx,edx //clear edx
mov ecx,#8
mul ecx //multiply eax and put the results into edx:eax (edx is ignored for this routine)

pop ecx
pop edx
mov [edx],eax
pop eax

[64-bit]
//everything is back to what it was, so exit
ret
[/64-bit]

[32-bit]
//cleanup first
pop ecx
pop edx
pop ebp
ret 8
[/32-bit]


Big Endian 2 byte
This script will add the 2 byte Big Endian type support to cheat engine

alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)

TypeName:
db '2 Byte Big Endian',0

ByteSize:
dd 2

//The convert routine should hold a routine that converts the data to an integer (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);
//Note: Keep in mind that this routine can be called by multiple threads at the same time.
ConvertRoutine:
//jmp dllname.functionname
[64-bit]
//or manual:
//parameters: (64-bit)
//rcx=address of input
xor eax,eax
mov ax,[rcx] //eax now contains the bytes 'input' pointed to
xchg ah,al //convert to big endian

ret
[/64-bit]

[32-bit]
//jmp dllname.functionname
//or manual:
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//example:
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov ax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value
and eax,ffff //cleanup
xchg ah,al //convert to big endian

pop ebp
ret 4
[/32-bit]

//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
//jmp dllname.functionname
//or manual:
[64-bit]
//parameters: (64-bit)
//ecx=input
//rdx=address of output
//example:
xchg ch,cl //convert the little endian input into a big endian input
mov [rdx],cx //place the integer the 4 bytes pointed to by rdx

ret
[/64-bit]

[32-bit]
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
//example:
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx

//convert the value to big endian
xchg ah,al

mov [ebx],ax //write the value into the address
pop ebx
pop eax

pop ebp
ret 8
[/32-bit]


Big Endian 4 byte
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)

TypeName:
db '4 Byte Big Endian',0

ByteSize:
dd 4

//The convert routine should hold a routine that converts the data to an integer (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);
//Note: Keep in mind that this routine can be called by multiple threads at the same time.
ConvertRoutine:
//jmp dllname.functionname
[64-bit]
//or manual:
//parameters: (64-bit)
//rcx=address of input
xor eax,eax
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
bswap eax //convert to big endian

ret
[/64-bit]

[32-bit]
//jmp dllname.functionname
//or manual:
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//example:
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value

bswap eax

pop ebp
ret 4
[/32-bit]

//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
//jmp dllname.functionname
//or manual:
[64-bit]
//parameters: (64-bit)
//ecx=input
//rdx=address of output
//example:
bswap ecx //convert the little endian input into a big endian input
mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx

ret
[/64-bit]

[32-bit]
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
//example:
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx

//convert the value to big endian
bswap eax

mov [ebx],eax //write the value into the address
pop ebx
pop eax

pop ebp
ret 8
[/32-bit]


(Un)Signed value(s)

In short, a value can hold a negative value if it is a signed value.
This is done by inverting all the bits. All 0's become 1's and 1's become 0's. Then the resulting value is incremented by 1.

example:
12 = 00001100
invert = 11110011
-12 = 11110100 (notice that if this was an unsigned value this would be 244; because 256-12=244)


Found address list

The found list is the list on the left side of the window, under the Select Process button.

All of the results of your memory scanning are dumped here. You can adjust the max number of addresses shown here in CE's options. If your results number is below or equal to the amount set in the options then they will be displayed here, otherwise you will simply see a numeric value to the right of this list.

If you double click an address, drag it to the list at the bottom, or select some addresses and click the red arrow, the addresses will be added to the memory watch list at the bottom

Right-clicking on an address in the results will offer the following options:
· Browse this memory region: Open the memory viewer and jump to the address in the hex view.
· Disassemble this memory region: Open the memory viewer and jump to the address in the disassembler view.
· Remove selected address: Remove the address from the results.
· Select all items: Select all addresses in the list.


Address/Cheat list

The address list is the place where all the addresses will go that you think are usable.

The list can be navigated by using the keyboard and mouse. There are 2 ways to change a value in the list, by either double-clicking the value, or by selecting it and pressing enter. For all the other items in the list just double click on it and it will open up a new window allowing you to change it.

The check boxes allow you to freeze and unfreeze the address. If you freeze a address the address will not change until you unfreeze it. The value does change but Cheat Engine will restore the value to it's frozen state every few milliseconds (The number of milliseconds can be changed in the settings window).

There are 3 types of freezing: Normal (=),Allow Increase Only (+), and Allow Decrease Only (-). You can change the type of freezing by clicking on the symbol right of the check box. The allow positive and negative can be set also by keyboard's numeric + and - keys.

Also, when you right-click on one or more addresses a pop-up window will show with additional options.
· Delete this record: Remove the selected values, pointers or scripts from the table.
· Change record: Change the description, address, type and value for the selected records.
· Browse this memory region: Open the memory viewer and jump to the address in the hex view.
· Show as hexadecimal/show as decimal: Display the selected records in hexadecimal or in decimal again.
· Change color: Change the color of the selected records.
· Set/Change hotkeys: Set or change a hotkey to freeze or change a value in any way or to toggle a script on/off. Hotkeys are saved with your table.
· Toggle selected entries: Freeze/unfreeze selected addresses and toggle scripts on/off.
· Change script: Edit the selected script.
· Pointer scan for this address: Open the pointer scanner to search for pointers.
· Find out what accesses this address: Use the debugger to show codes that are accessing to the address.
· Find out what writes to this address: Use the debugger to show codes that are writing to the address.
· Recalculate new addresses: Recalculated the addresses according to the given parameters.
· Force recheck symbols: Recheck symbols in the table.
· Cut, Copy, Paste: Using the clipboard.
· Create Header: Create Headers to organize your records in groups.

The following keys can be used when the address list has focus:
ENTER | Change Value
Ctrl+Enter | Change Description
Ctrl+Alt+Enter | Change Address
Alt+Enter | Change Type
Shift+Ctrl+Alt+Enter | Change address Complex
Space | Freeze
Grey Keypad Plus | Freeze but allow increase
Grey Keypad Minus | Freeze but allow decrease
Delete | Delete Address
Ctrl+Alt+A | Open the auto assembler

You can make additions to the list either by adding them from the found list or by clicking the
'Add address manually' button. Here you type the exact address, a description for it and it's datatype.
You can also opt to create a pointer-path here on this same dialog.

As of Cheat Engine 6 you can re-arrange items in the list by dragging them and even attach entries to other entries as well

You can use the addresslist to change values of memory records.
There are a few special values you can enter that have a special effect.
If you enclose a value by parenthesis ( ) and th value is the name of an addresslist entries description, the new value will be that of that specific addresslist entry.
Example:
You have two entries. One named "Health" and the other named "Max Health" with the value 100
If you change the value of Health to "(Max Health)" Health will get the value 100

Tip: If you first freeze a record and then set the value to "(Max Health)" cheat engine will constantly write the current value of "Max Health" to "Health"

Another special notation that the change value field supports is enclosing the new value by square brackets [ ]
The value between the backets will be calculated by lua as if it would do a "return <valuebetweenbrackets>"
For example [10+12] would return 22, but you can also do more advanced scripting like [readInteger(12345678)*2]


Table Extras

The "Table Extras" button on the bottom right of the cheat engine window opens the "Table Extras" window. The comments tab can be used to store extra information in your cheat tables. You can for example use it to leave notes on how you found a address, or other stuff, like your name.

This is especially handy if you will be distributing your table to someone else as you can detail here exactly how and when to enable certain hacks. Sometimes it may be necessary to time exactly when you activate a cheat, and no-one will know unless you tell them. This is ideal for that purpose.

The Lua tab can be used to execute a lua script which has been saved in the table. Lua scripts that are stored in this window can be executed automatically if the user is allowing it to be executed.

If the Comments or Lua Script window has some content, the Table Extras button is shown with bold letters.


Speedhack

The speedhack of cheat engine replaces some commonly used functions in games to keep the speed constant with it's own routine that goes faster or slower.

Speedhack has just one parameter: Speed. It let's you pick the speed with a slider, OR you can type in the speed you want yourself and then you must click apply.


Unrandomizer

The unrandomizer is a feature designed to replace certain routines commonly used in games to produce random values. At a very simple level then, for an example, there may be a game that uses a randomizer routine to decide on a player's turn. Enabling the unrandomizer would then cause CE to try and stop this random occurrence, and try to fix the outcome (for example to force a particular players turn).

The unrandomizer won't work in all cases. It will only handle routines that it knows about. In most cases and for most users, this will not be used, as it's more of an advanced/experimental feature.


Advanced options

You can find the advanced options box at the bottom-left of Cheat Engine's main screen. The box is small but named 'Advanced options' so it's easy to locate. This area of CE contains several features, some of which are used regularly by a lot of users, some not so often. They are:

· Pause the process
· The 'Code list'

They are each explored in this help document in this section. So read on..


Pause

You can pause the process you are cheating on, by clicking on the 'Advanced options' box from the main window and then clicking on the pause icon. This requires the debugger to be attached to the process (you will be prompted for this if you aren't already attached).

You can assign a hotkey to this feature in the settings (see the settings section in this help document for how to do this). This process can help dramatically when memory scanning, as the target game won't be eating into your CPU-cycles while paused. This process happens automatically if you have checked the box to 'Pause game during scan' from the main interface.


Code list

The code list contains snippets of gamecode which you may have elected to replace with NOP's from the memory view window's disassembler or just added the code because they can be used later on (basically, an alternative to notepad).

You can safely close and re-open the advanced options pane without worrying about any changes to the code; it will all remain exactly as you've left it, so you can get rid of it to remove clutter if you need too.

Right-clicking on a code will bring up the following options:
· Open the disassembler at this location: It will open the memory view's disassembler at the code's location.
· Replace with code that does nothing: It will replace the selected codes with NOPs, so the code(s) will do nothing.
· Restore with original code: Restore the original code after you have replaced it.
· Find out what addresses this code accesses: Use the debugger to find out what addresses are accessed by the code.
· Find out what addresses this code writes to: Use the debugger to find out what addresses are written by the code.
· Rename: Rename the code in the list.
· Remove from list: Remove the selected codes from the list.
· Replace all: Replace all codes with NOPs.


Memory Viewer

Cheat Engines memory viewer is a more advanced and feature-rich component of the software. While many users will only ever use the main GUI that is first presented to them, some will move into the memory viewer.

When first visiting the memory viewer screen, you will see various menus, a disassembly view area and a hex-editor pane at the bottom. This chapter in the help document will cover the areas of the program here. It contains many features which are very effective in the hands of experience gamehackers, such as script-engines, an auto-assembler engine, debugging tools and memory-enumeration features.


Memory view

Memory view (Disassembly View)
 Previous Top Next
Overview

 The memory view can be reached by clicking on the memory view in the main cheat engine window.

The memory view contains several tools and functions for advanced game hackers like the autoassembler engine, a codecave scanner, a thread generator, a memory allocator, a code dissector, a DLL injector, debugger options, a disassembler, an assembler, a hex viewer and more.

Manipulation

To change assembler code just stand on the address you want to edit and type in your now code.
To edit the value of some bytes directly in memory just click on a byte and start typing in the new values.

Hotkeys

There are also some hotkeys, like CTRL+G to jump which will pop-up a box where you can fill in the new address you want to go to and ctrl+f in the hex view to do a simple scan
If you have a jmp or call selected you can press SPACE to follow that address. BACKSPACE will go back.

Also, pressing CTRL+SPACE when either the disassembler is focused, or the hexview is focused, will set the other object's location to the same as the selected one.

Layout

You can access the various menus along the top of the window, you can see a registers and flags pane to the right of the screen when a breakpoint has been hit (which can be modified while debugging; also note the arrow-button allowing access to FPU information), and you can make use of the hex-view pane at the bottom of the window.

You can perform binary copies/pastes, force regions to be writeable, make general edits and search memory in this view by right-clicking and choosing the corresponding option from the menu that appears. You can also change the display type to different settings to make it that much more legible. Along the top edge of this pane you will see module information, such as AllocBase, Size and protection

Disassemblerview:
Right-clicking on a code in the disassembler view will bring up the following options:
· Go to address: Go to the given address.
· Replace with code that does nothing: It will replace the selected codes with NOPs, so the code(s) will do nothing. The replaced codes will be added to the code list automatically, so you can track your changes easily.
· Add to the code list: Add the code to the code list.
· Copy to clipboard: Copy the selected area to the clipboard.
· Change register at this location: You can change the value of the registers whenever this code is executed. This feature is using the debugger.
· Toggle breakpoint: Set/delete a breakpoint on the code.
· Break and trace instructions: Set a breakpoint and trace the instructions when this code is executed. You can set a trace count and also set a condition to stop the tracing.
· Find out what addresses this instruction accesses: Use the debugger to find out what addresses are accessed by the code.
· Set/Change break condition: You can set/change the break condition on existing breakpoints.
· Select current function: This option will select the current function and jump to the start of the function in the disassembler view.

Hexview
Right-clicking on a value in the hex view will bring up the following options:

· Edit: Edit the value on the address.
· Go to address: Go to the specified address.
· Search memory: Search in the memory for text or an array of bytes.
· Copy to clipboard, Paste from clipboard: Copy and paste using the clipboard.
· Display type: Select a display type for the values.
· Separators: Set the number and range of separators.
· Lock current rowsize: Locking the rowsize will fix the size even if the window is resized.
· Link with other hexview: Link the window with another hexview so You can navigate in the windows together, instead of controlling them separately.
· Unlink from other hexview: Remove the link with the other hexview.
· Show difference: Show the difference between the choosen memory viewer.
· Add this address to the list: Add the address to the cheat list.
· Make page writable: Give permission to write in a readable area.
· Data breakpoint: Set a data breakpoint on the address.
· Data breakpoint->Break on Write: Break when the address is written by a code.
· Data breakpoint->Break on Access: Break when the address is accessed by a code.
· Data breakpoint->Break and trace: Set a write or access breakpoint and trace the instructions when this address is written or accessed. You can set a trace count and also set a condition to stop the tracing.
· Find out what accesses this address: Use the debugger to show codes that are accessing to the address.
· Find out what writes to this address: Use the debugger to show codes that are writing to the address.


Menus and Features

The File menu gives you access to some simple save/load-type options:

New Window will allow you to create multiple disassembly view instances; good for viewing many spots of code at once. You can access the same menus from these new windows with the exception of the Debug menu which is exclusive to the original window.

Save disassembled output allows you to save a range of memory in this format, which is good for using as code-snippets to post online or illustrate certain concepts to others. It outputs as a plain text .txt file.

Save/Load memory region gives you the ability to dump a memory region to file and then load it back in later. It saves as a Cheat Engine memory file (with an optional CE header). Not an option for standard users.

The Search menu will reveal two options for traversing through a program:

Find memory will allow you to run a scan for either text (ASCII or Unicode) or an array of bytes, between a memory region of your choosing.

Find assembly code is similar to the above, but will allow you to specifically chose a game instruction to locate. For example I could search for:
MOV [ESI+000007E8],EAX
All of the results (if any) will be displayed in the box. You can then double-click these entries to go to that spot in memory. This is a great feature for quickly updating cheats to a new version of a game. You have to be fairly specific or you could end up with several hundred results to trawl through depending on the target.

The View menu will give you a bunch of options relating to how you 'see into' the game:

You can view a list of breakpoints, process threads and debug strings here. You can also view the heaplist and a memory region window, which allows you to quickly see details about areas in memory (such as location, protection, size and type).

You can click on Enumerate DLLs and Symbols to show a list of loaded modules and their respective symbol names.

You can toggle the display of user-mode, kernel-mode and user-defined symbols here, which can be very useful for creating game hacks from, because you can easily locate and manipulate certain structures. See the website tables section for some examples of this. A good example of a symbol-fanatic in game-training is the user: Recifense :-)

Show module addresses will toggle how the address column is displayed in the memory viewer. Instead of showing an exact virtual address, it will display the location in base+offset notation. This is especially useful in games that code-shift; that is when game's allocate their modules (.dll's etc) to different spots in memory on a new restart or level load. This will allow you to find the right spot every time despite this 'shifting' process. You can use the base+offset notation in a cheat engine script. It will parse it fine, so long as the game (and module) is loaded and you have picked the process in CE.

An example could be as follows (the number is hex):
20468042 => client.dll+468042

From this we can deduce that client.dll is actually loaded at 0x20000000 by performing a simple subtraction. You can also see this information in the hex view windows however, which is tagged along to the bottom of the memory view pane. Along with 'AllocationBase' you will also find 'Image Protection', 'Image Size' and (optionally) 'Physical Address'.

The next time the game is ran, client.dll may be mapped to 0x32000000 and so by taking this address and adding our previous offset of 0x468042 we can arrive at the right code spot.

The Debug menu gives us access to our debugging controls:

If you haven't yet attached the debugger to the target, then you will be prompted to do so when you try to use any of these options. You can toggle a breakpoint (F5) at a certain point in code and break on a chosen program thread (you will be prompted for which thread; main thread or otherwise if there are more).

With the former option, a few more options open up once you have 'broke' on an opcode. You can simply choose to run (F9) and continue execution, or you can step in (F7) or step over (F8) certain instructions. For quick code tracing you would generally use step over (F8), but stepping in can be great for investigation certain CALL's should the need arise. Finally you have the option to run till (F4) user return, which is handy for breaking on certain message boxes, prompts and other events which are tricky to reach using other methods.

The Tools menu gives us access to the main powerful features of CE:

Allocate Memory allows the user to add a custom amount of extra memory to the current process (in KB).

Scan for codecaves helps to find (likely) unused areas of memory to use as a code cave for cheats. You can specific the range of memory to search within and whether or not to include read-only memory (not advised).

Fill Memory can be used to fill a specific region of memory with a certain byte value or sequence (hex).

Create Thread will allow you to create a remote program thread which runs independently of the main program thread/execution but still has access to the target processes memory space. (Advanced)

The Dissect options allow you to map out various structures in memory and make them easier to interpret. For example the class of TPlayer could contain a pointer to TWeapon which could then be expanded further like a tree. You can also dissect windows and change caption text (which can be useful for simple anti-cheat evasion) and you can view basic PE Info of a file.

Pointer Scan will reveal CE's pscan engine interface, which allows you to automatically find a 'path' through memory to a specific variable. You can then use this resultant path or 'pointer' in the future, as it's end location will always be the same; your variable! It's used extensively as a method of bypassing DMA (dynamic memory allocation) in more difficult games, or cheat-protected games, or by beginner users who aren't accustomed to code-injection methods.

Find static addresses will get CE to trawl through memory (of your choice) in an attempt to locate all static addresses residing in that memory space. This can be useful for locating static base pointers for your otherwise broken pointer paths. It is also useful when hacking emulated game targets when there is no obvious base address.

Inject DLL is a generic DLL injection feature (surprise, surprise) which will prompt you for the DLL to inject and then do so into the current process.

Auto Assemble is one of the most powerful and frequently used features of CE. It will allow you to create your own code injection scripts and then make the modifications to memory at the click of a button. Scripts created here will be added to the main cheat list, which can then be named. Scripts can also be saved from this box.

LUA Console will reveal an interface into the lua-script engine, allowing to create lua-scripts and run them.

The Kernel tools menu is only available if you have chosen to use kernelmode debugging routines instead of the original windows versions (see the settings). It contains a selection of advanced and specialized features which are beyond the scope of this help file, and will never be utilized by most users.


Auto Assembler help

Auto assemble allows you to write assembler code at different locations using a script. It can be found in the 'memory view' part of cheat engine under extra.

There are 3 special commands you can give it, ALLOC , LABEL and FULLACCESS. With LABEL you can give a address a name by declaring it before you use it. ALLOC is basicaly the same as LABEL but allocates some memory for you.
Usage:
LABEL(labelname) //Enables the word labelname to be used as a address
ALLOC(allocname,sizeinbytes, preferedregion OPTIONAL) //same as label, but allocates the memory it points to itself
DEALLOC(allocname) //Deallocates a block of memory allocated with alloc. It always gets executed last, no matter where it is positioned in the code, and only actually frees the memory when all allocations have been freed. only usable in a script designed as cheattable. (e.g used for the disable cheat)
FULLACCESS(address,size) //makes a memory region at the specified address and at least "size" bytes readable, writable and executable

REGISTERSYMBOL(symboname) //adds the symbol to the userdefined symbol list so cheattables and the memory browser can use that name instead of a address (The symbol has to be declared in the script when using it)
UNREGISTERSYMBOL(symbolname) //removes the symbol from the userdefined symbol list. It won't give a error if it isn't found

DEFINE(name,whatever) :Will replace all tokens with the specified name with the text of whatever
INCLUDE(filename) :includes another auto assembler file at that spot
LOADBINARY(address,filename) :Will load a binary file at the specified address
CREATETHREAD(address) :Will spawn a thread in the process at the specified address
LOADLIBRARY(filename) :Will inject the specified dll into the target process
READMEM(address,size) :Will write the addresses at address at the location this instruction is placed

GLOBALALLOC(name,size) : Will allocate a certain amount of memory and registers the specified name. Using GlobalAlloc in other scripts will then not allocate the memory again, but reuse the already existing memory. (Or allocate it anyhow if found it was not allocated yet)

ASSERT(address, array of byte) : Will check the memory address for the given address. If the memory is not what is defined by the array of byte given, the auto assemble script will not execute.
AOBSCAN(name, array of byte) : Will scan the memory for the given array of byte (Wildcards are supported) and replaces all tokens with the specified name with the address the array of byte was found. If it's not found, the auto assemble script will not execute
AOBSCANMODULE(name, modulename, array of byte): Will scan the specific module for the given AOB
AOBSCANREGION(name, startaddress, stopaddress, array of byte): Will scan the specific range for the given AOB

STRUCT / ENDSTRUCT: With STRUCT you can define an internal structure in your auto assembler script. This can be used to keep your code clear.
Example:
STRUCT stackview
returnaddress: DD ?
param1:
DD ?
param2: DB ? ? ? ?
ENDSTRUCT

mov eax,[EBP+stackview.param1]
mov ebx,[EBP+param2]

{$LUA}/{$ASM} : Code between {$LUA} and {$ASM} (separate lines) will execute that lua script. If it returns a string, the result will be handled as an auto assembler commands.
Note: The lua code is executed before anything else of the auto assembler is parsed.

Value notation:
Normally everything is written as hexadecimal in auto assembler, but there are ways to override this so you can input decimal values, and even floating point values.
for example, a integer value of 100 can be written in hex as 64, but you can also write it as #100, or as (int)100
for floating point value like 100.1 you can use (float)100.1

and for a double, you could use (double)100.1

Basic Example:
00451029:
jmp 00410000
nop
nop
nop

00410000:
mov [00580120],esi
mov [esi+80],ebx
xor eax,eax
jmp 00451031

Example using LABEL:
label(mylabel)

00451029:
jmp 00410000
nop
nop
nop
mylabel:

00410000:
mov [00580120],esi
mov [esi+80],ebx
xor eax,eax
jmp mylabel

Example using ALLOC:
alloc(memloc1,4)

00451029:
jmp 00410000
nop
nop
nop

00410000:
mov [alloc1],esi
mov [esi+80],ebx
xor eax,eax
jmp 00451031

Example using ALLOC and LABEL
alloc(alloc1,4)
label(mylabel)

00451029:
jmp 00410000
nop
nop
nop
mylabel:

00410000:
mov [alloc1],esi
mov [esi+80],ebx
xor eax,eax
jmp mylabel

Example using FULLACCESS
FULLACCESS(00400800,4) //00400800 is usually read only non executable data, this makes it writeable and executable
00451029:
jmp 00410000
nop
nop
nop

00410000:
mov [00400800],esi
mov [esi+80],ebx
xor eax,eax
jmp 00451031

Example using DEFINE
DEFINE(clear_eax,xor eax,eax)
00400500:
clear_eax

ReadMem example
alloc(x,16)
alloc(script,2048)

script:
mov eax,[x]
mov edx,[x+c]
ret

x:
readmem(00410000,16) //place the contents of address 00410000 at the address of X

The absolute best way to learn these is by practical use. So for a start, follow the tutorial program all the way through and then apply it to some games. The more you use it, the quicker and more capable you will become with it. It looks daunting at first sight (like a coding language), but if you're serious about gamehacking, this will soon become your new best friend!


Script engine
List of CE specific functions and variables:

TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)
process : A variable that contains the main modulename of the currently opened process
MainForm: The main ce gui
AddressList: The address list of the main ce gui

getCEVersion(): Returns a floating point value specifying the version of cheat engine

activateProtection(): Prevents basic memory scanners from opening the cheat engine process
enableDRM() : Prevents normal memory scanners from reading the Cheat Engine process (kernelmode)

fullAccess(address,size): Changes the protection of a block of memory to writable and executable

loadTable(filename, merge OPTIONAL): Loads a .ct or .cetrainer. If merge is provided and set to true it will not clear the old table
loadTable(stream ,merge OPTIONAL, ignoreluascriptdialog BOOLEAN): Loads a table from a stream object
saveTable(filename, protect OPTIONAL): Saves the current table. If protect is provided and set to true and the filename has the .CETRAINER extension, it will protect it from reading normally

note: addresses can be strings, they will get interpreted by ce's symbolhandler

copyMemory(sourceAddress: integer, size: integer, destinationAddress:integer SEMIOPTIONAL, Method:integer OPTIONAL):
Copies memory from the given address to the destination address
If no destinationAddress is given(or nil), CE will allocate a random address for you

Method can be:
nil/0: Copy from target process to target process
1: Copy from target process to CE Memory
2: Copy from CE Memory to target process
3: Copy from CE Memory to CE Memory

Returns the address of the copy on success, nil on failure

readBytes(address,bytecount, ReturnAsTable ) : returns the bytes at the given address. If ReturnAsTable is true it will return a table instead of multiple bytes
Reads the bytes at the given address and returns a table containing the read out bytes

writeBytes(address, x,x,x,x,...) : Write the given bytes to the given address from a table
writeBytes(address, table) : Write the given bytes to the given address from a table

readSmallInteger(address) : Reads a 16-bit integer from the specified address
readInteger(address) : Reads a 32-bit integer from the specified address
readQword(address): Reads a 64-bit integer from the specified address
readPointer(address): In a 64-bit target this equals readQword, in a 32-bit target readInteger()
readFloat(address) : Reads a single precision floating point value from the specified address
readDouble(address) : Reads a double precision floating point value from the specified address
readString(address, maxlength, widechar OPTIONAL) : Reads a string till it encounters a 0-terminator. Maxlength is just so you won't freeze for too long, set to 6000 if you don't care too much. Set WideChar to true if it is encoded using a widechar formatting
writeSmallInteger(address,value) : Writes a 16-bit integer to the specified address. Returns true on success
writeInteger(address,value) : Writes a 32-bit integer to the specified address. Returns true on success
writeQword(address, value): Write a 64-bit integer to the specified address. Returns true on success
writeFloat(address,value) : Writes a single precision floating point to the specified address. Returns true on success
writeDouble(address,value) : Writes a double precision floating point to the specified address. Returns true on success
writeString(address,text, widechar OPTIONAL) : Write a string to the specified address. Returns true on success

readBytesLocal(address,bytecount, ReturnAsTable) : See readBytes but then it's for Cheat engine's memory
readSmallIntegerLocal(address) : Reads a 16-bit integer from the specified address in CE's memory
readIntegerLocal(address) : Reads a 32-bit integer from the specified address in CE's memory
readQwordLocal(address) : Reads a 64-bit integer from the specified address in CE's memory
readPointerLocal(address) : ReadQwordLocal/ReadIntegerLocal depending on the cheat engine build
readFloatLocal(address) : Reads a single precision floating point value from the specified address in CE's memory
readDoubleLocal(address) : Reads a double precision floating point value from the specified address in CE's memory
readStringLocal(address, maxlength, widechar OPTIONAL)
writeSmallIntegerLocal(address,value) : Writes a 16-bit integer to the specified address in CE's memory. Returns true on success
writeIntegerLocal(address,value) : Writes a 32-bit integer to the specified address in CE's memory. Returns true on success
writeQwordLocal(address,value) : Writes a 64-bit integer to the specified address in CE's memory. Returns true on success
writeFloatLocal(address,value) : Writes a single precision floating point to the specified address in CE's memory. Returns true on success
writeDoubleLocal(address,value) : Writes a double precision floating point to the specified address in CE's memory. Returns true on success
writeStringLocal(address,string, widechar OPTIONAL)
writeBytesLocal(address, x,x,x,x,...) : See writeBytes but then it's for Cheat Engine's memory
writeBytesLocal(address, table, , count) : See writeBytes but then it's for Cheat Engine's memory

readSmallInteger, readInteger, readSmallIntegerLocal, readIntegerLocal
can also have second boolean parameter. If true, value will be signed.

wordToByteTable(number): {} - Converts a word to a bytetable
dwordToByteTable(number): {} - Converts a dword to a bytetable
qwordToByteTable(number): {} - Converts a qword to a bytetable
floatToByteTable(number): {} - Converts a float to a bytetable
doubleToByteTable(number): {} - Converts a double to a bytetable
stringToByteTable(string): {} - Converts a string to a bytetable
wideStringToByteTable(string): {} - Converts a string to a widestring and converts that to a bytetable

byteTableToWord(table): number - Converts a bytetable to a word
byteTableToDword(table): number - Converts a bytetable to a dword
byteTableToQword(table): number - Converts a bytetable to a qword
byteTableToFloat(table): number - Converts a bytetable to a float
byteTableToDouble(table): number - Converts a bytetable to a double
byteTableToString(table): string - Converts a bytetable to a string
byteTableToWideString(table): string - Converts a bytetable to a widestring and convets that to a string

bOr(int1, int2) : Binary Or
bXor(int1, int2) : Binary Xor
bAnd(int1, int2) : Binary And
bShl(int, int2) : Binary shift left
bShr(int, int2) : Binary shift right
bNot(int) : Binary not

writeRegionToFile(filename, sourceaddress,size) : Writes the given region to a file. Returns the number of bytes written
readRegionFromFile(filename, destinationaddress)

resetLuaState(): This will create a new lua state that will be used. (Does not destroy the old one, so memory leak)

createRef(...): integer - Returns an integer reference that you can use with getRef. Useful for objects that can only store integers and need to reference lua objects. (Component.Tag...)
getRef(integer): ... - Returns whatever the reference points out
destroyRef(integer) - Removes the reference

encodeFunction(function): string - Converts a given function into an encoded string that you can pass on to decodeFunction
decodeFunction(string): function - Converts an encoded string back into a function. Note that the string must be made on the same architecture as it is currently running. 32-bit can onyl load 32-bit, 64-bit can only load 64-bit. So either have two scripts ready, or limit to only one architecture. (Like .EXE trainers)

reloadSettingsFromRegistry(): This will cause cheat engine to reload the settings from the registry and apply them

getTranslationFolder(): Returns the path of the current translation files. Empty if there is no translation going on
loadPOFile(path): Loads a .PO file used for translation
translate(string): Returns a translation of the string. Returns the same string if it can't be found
translateID(translationid: string, originalstring: string OPTIONAL): Returns a translation of the string id

ansiToUtf8(string): Converts a string in Ansi encoding to UTF8
utf8ToAnsi(string): Converts a string in UTF8 encoding to Ansi
Note: GUI components mainly show in UTF8, some other functions use Ansi, try to find out which ones...

enumModules(processid OPTIONAL):
Returns a table containing information about each module in the current process, or the specified processid
Each entry is a table with fields
Name : String containing the modulename Address: Integer representing the address the module is loaded
Is64Bit: Boolean set to true if it's a 64-bit module
PathToFile: String to the location this module is loaded

md5memory(address, size): Returns a md5 sum calculated from the provided memory.
md5file(pathtofile): Returns a md5 sum calculated from the file.
getFileVersion(pathtofile): returns the 64-bit file version, and a table that has split up the file version into major, minor, release and build

getFileList(Path:string, searchMask:string OPTIONAL, SearchSubDirs: boolean OPTIONAL, DirAttrib: integer OPTIONAL): Returns an indexed table with filenames
getDirectoryList(Path:string, SearchSubDirs: boolean OPTIONAL): Returns an indexed table with directory names

getAddress(string, local OPTIONAL): returns the address of a symbol. Can be a modulename or an export. set Local to true if you wish to querry the symboltable of the ce process
getSymbolInfo(symbolname): Returns a table as defined by the SymbolList class object (modulename, searchkey, address, size)
getModuleSize(modulename): Returns the size of a given module (Use getAddress to get the base address)
reinitializeSymbolhandler(waittilldone: BOOLEAN OPTIONAL, default=TRUE): reinitializes the symbolhandler. E.g when new modules have been loaded
reinitializeDotNetSymbolhandler(modulename OPTIONAL): Reinitializes only the DotNet part of the symbol list. (E.g After an ILCode has been JITed) (6.4+)

errorOnLookupFailure(state): If set to true (default) address lookups in stringform will raise an error if it can not be looked up. This includes symbolnames that are not defined and pointers that are bad. If set to false it will return 0 in those cases
(Useful for pointers that don't work 100% of the time)
6.4+:Returns the original state

generateAPIHookScript(address, addresstojumpto, addresstogetnewcalladdress OPT) : Generates an auto assembler script which will hook the given address when executed
autoAssemble(text, targetself OPTIONAL, disableInfo OPTIONAL) : runs the auto assembler with the given text. Returns true on success, with as secondary a table you can use when disabling (if targetself is set it will assemble into Cheat Engine itself). If disableInfo is provided the [Disable] section will be handled
autoAssemble(text, disableInfo OPTIONAL)

autoAssembleCheck(text, enable, targetself) : Checks the script for syntax errors. Returns true on succes, false with an error message on failure

registerExeTrainerFeature(FeatureName:String, function():table): adds a new feature to the exe trainer generator window, and calls your function when the user builds an .exe trainer. The function should return a table with table entries: PathToFile and RelativePath.
example output:
[1]:
PathToFile=c:\cefolder\autorun\mycode.lua
RelativePath="autorun\"

[2]:
PathToFile=c:\cefolder\autorun\dlls\mycode.lua
RelativePath="autorun\mylib.dll"

registerAutoAssemblerCommand(command, function(parameters, syntaxcheckonly)): Registers an auto assembler command to call the specified function. The command will be replaced by the string this function returns when executed. The function can be called twice. Once for syntax check and symbol lookup(1), and the second time for actual execution by the assembler(2) if it has not been removed in phase1.
Note: The callback function can return multiple values
Nil, <String>: Will raise an error with the given string
MultilineString: Replaces the line in the script with the given strings.

If the function returns nil, and as secondary parameter a string, this will make the auto assembler fail with that error

unregisterAutoAssemblerCommand(command)

registerSymbolLookupCallback(function(string):integer, location): ID 6.4+
Registers a function to be called when a a symbol is parsed
Location determines at what part of the symbol lookup the function is called
slStart: The very start of a symbol lookup. Before tokenization
slNotInt: Called when it has been determined it's not a hexadecimal only string. Before tokenization
--The following locations can be called multiple times for one string as they are called for each token and appended token
slNotModule: Called when it has been determined the current token is not a modulename
slNotUserdefinedSymbol: Called when it has been determined it's not a userdefined symbol
slNotSymbol: Called when it has been determined it's not a symbol in the symbollist
slFailure: Called when it has no clue what the given string is

Note: slNotSymbol and slFailure are similar, but failure comes only if there's no token after the current token that can be concatenated. Else slNotSymbol will loop several times till all tokens make up the full string

Return an Integer with the corresponding address if you found it. Nil or 0 if you didn't.

unregisterSymbolLookupCallback(ID): Removes the callback

registerAddressLookupCallback(function(integer):string): ID
Registers a function to be called when the name of an address is requested

unregisterAddressLookupCallback(ID): Removes the callback

registerStructureDissectOverride(function(structure, baseaddress): table):
same as onAutoGuess, but is called by the structure dissect window when the user chooses to let cheat engine guess the structure for him.
Use the structure object to fill it in
Return true if you have filled it in, or false or nil if you did not

Tip: Use inputQuery to ask the user the size if your function doesn't do that automatically

unregisterStructureDissectOverride(ID)

registerStructureNameLookup(function(address): name, address OPTIONAL):
Registers a function to be called when dissect data asks the user for the name of a new structure define. If you have code that can look up the name of a structure, and perhaps also the real starting point, you can use this to improve the data dissection.

unregisterStructureNameLookup(ID)

registerAssembler(function(address, instruction):bytetable)
Registers a function to be called when the single line assembler is invoked to convert an instruction to a list of bytes
Return a bytetable with the specific bytes, or nil if you wish to let another function, or the original x86 assembler to assemble it

unregisterAssembler(ID): Unregisters the registered assembler

registerAutoAssemblerPrologue(function(script, syntaxcheck), postAOB:boolean=false)
Registers a function to be called when the auto assembler is about to parse an auto assembler script. The script you get is after the [ENABLE] and [DISABLE] tags have been used to strip the script to the according one, but before comment stripping and trimming has occured

script is a Strings object which when changed has direct effect to the script

unregisterAutoAssemblerPrologue(ID)

registerAutoAssemblerTemplate(name, function(script: TStrings; sender: TFrmAutoInject): id - Registers an template for the auto assembler. The script parameter is a TStrings object that has a direct connection to the current script. (All script parsing is up to you...). Returns an ID
unregisterAutoAssemblerTemplate(ID)

generateCodeInjectionScript(script: Tstrings, address: string): Adds a default codeinjection script to the given script
generateAOBInjectionScript(script: Tstrings, symbolname: string, address: string): Adds an AOB injection script to the given script
generateFullInjectionScript(script: Tstrings, address: string): Adds a Full Injection script to the given script

showMessage(text) : shows a messagebox with the given text
inputQuery(caption, prompt, initialstring): Shows a dialog where the user can input a string. This function returns the given string, or nil on cancel CE6.4+
messageDialog(text, type, buttons...) : pops up a messagebox with a specific icon/sound with the specified buttons (mbok, mbyes, ....)
sleep(milliseconds): pauses for the number of specified milliseconds (1000= 1 sec...)

getProcesslist(Strings): Fills a Strings inherited object with the processlist of the system. Format: %x-pidname
getProcesslist(): Returns a table with the processlist (pid - name )
getWindowlist(Strings): Fills a Strings inherited object with the top-window list of the system. Format: %x-windowcaption
getWindowlist(): Returns a table with the windowlist (pid - window caption )

getThreadlist(List): fills a List object with the threadlist of the currently opened process. Format: %x

function onOpenProcess(processid):
If this function is defined it will be called whenever cheat engine opens a process.
Note: The the same process might be opened multiple times in a row internally
Note 2: This function is called before attachment is fully done. You can call reinitializeSymbolhandler() to force the open to complete, but it will slow down process opens. Alternatively, you could launch a timer which will run when the opening has finished

getOpenedProcessID() : Returns the currently opened process. If none is open, returns 0
getProcessIDFromProcessName(name) : returns a processid
openProcess(processid) : causes cheat engine to open the given processid
openProcess(processname): causes cheat engine to find and open the given process
openFileAsProcess(filename,is64bit): causes cheat engine to open the file with memory access as if it's a process
saveOpenedFile(filename OPTIONAL): Saves the changes of the opened file, set filename if you want a different file
setPointerSize(size): Sets the size cheat engine will deal with pointers in bytes. (Some 64-bit processes can only use 32-bit addresses)
setAssemblerMode(int): 0=32-bit, 1=64-bit
pause() : pauses the current opened process
unpause(): resumes the current opened process

getCPUCount(): Returns the number of CPU's

getPixel(x,y) : returns the rgb value of the pixel at the specific screen coordinate
getMousePos: returns the x,y coordinates of the mouse
setMousePos(x,y): sets the mouse position

isKeyPressed(key) : returns true if the specified key is currently pressed
keyDown(key) : causes the key to go into down state
keyUp(key) :causes the key to go up
doKeyPress(key) : simulates a key press

mouse_event(flags, x OPTIONAL, y OPTIONAL, data OPTIONAL, extra OPTIONAL) - The mouse_event windows API. Check MSDN for information on how to use

shortCutToText(shortcut): Returns the textual representation of the given shortut value (integer) (6.4+)
textToShortCut(shortcutstring): Returns an shortcut integer that the given string represents. (6.4+)

convertKeyComboToString(key1,...): Returns a string representation of the given keys like the hotkey handler does
convertKeyComboToString({key1,...}): ^

outputDebugString(text): Outputs a message using the windows OutputDebugString message. You can use tools like dbgview to read this. Useful for testing situations where the GUI freezes

shellExecute(command, parameters OPTIONAL, folder OPTIONAL, showcommand OPTIONAL): Executes a given command

getTickCount() : Returns the current tickcount since windows was started. Each tick is one millisecond
processMessages() : Lets the main eventhandler process the new messages (allows for new button clicks)
inMainThread(): Returns true if the current code is running inside the main thread (6.4+)
integerToUserData(int): Converts a given integer to a userdata variable
userDataToInteger(UserDataVar): Converts a given userdata variable to an integer

synchronize(function(...), ...): Calls the given function from the main thread. Returns the return value of the given function
queue(function(...),...): calls the given function from the main thread. Does not wait for the result
checkSynchronize(): Calls this from an infinite loop in the main thread when using threading and synchronize calls. This will execute any queued synchronize calls

writeToClipboard(text): Writes the given text to the clipboard
readFromClipboard(): Reads the text from the clipboard

speedhack_setSpeed(speed) : Enables the speedhack if needed and sets the specific speed
speedhack_getSpeed(): Returns the last set speed

injectDLL(filename): Injects a dll, and returns true on success
executeCode(address, parameter OPTIONAL, timeout OPTIONAL) : address - Executes a stdcall function with 1 parameter at the given address in the target process and wait for it to return. The return value is the result of the function that was called
executeCodeLocal(addres, parameter OPTIONAL): address - Executes a stdcall function with 1 parameter at the given address in the target process. The return value is the result of the function that was called

loadPlugin(dllnameorpath): Loads the given plugin. Returns nil on failure. On success returns a value of 0 or greater

loadFontFromStream(memorystream) : Loads a font from a memory stream and returns an id (handle) to the font for use with unloadLoadedFont
unloadLoadedFont(id)

onAutoGuess(function) :
Registers an function to be called whenever autoguess is used to predict a variable type
function override (address, ceguess): Return the variable type you want it to be. If no change, just return ceguess

closeCE() : just closes ce
hideAllCEWindows() : makes all normal ce windows invisible (e.g trainer table)
unhideMainCEwindow() : shows the main cheat engine window

getAutoAttachList(): returns the AutoAttach StringList object. It can be controlled with the stringlist_ routines (it's not recommended to destroy this list object)

AOBScan(x,x,x,x,...):
scans the currently opened process and returns a StringList object containing all the results. don't forget to free this list when done
Bytevalue of higher than 255 or anything not an integer will be seen as a wildcard
AOBScan(aobstring): see above but here you just input one string

Regarding eventhandlers. You can initialize them using both a string of a functionname or the function itself.
If initialized using a function itself it won't be able to get saved in the table

allocateMemory(size): Allocates some memory into the target process

allocateSharedMemory(name, size):
Creates a shared memory object of the given size if it doesn't exist yet. If size is not given and there is no shared region with this name then the default size of 4096 is used
It then maps this shared memory block into the currently targeted process. It returns the address of mapped region in the target process

getForegroundProcess() : Returns the processID of the process that is currently on top

findWindow(classname OPTIONAL, caption OPTIONAL): windowhandle - Finds a window with the given classname and/or windowname
getWindow(windowhandle, command) : windowhandle - Gets a specific window based on the given window (Check MSDN getWindow for the command description)
getWindowCaption(windowhandle) : string - Returns the caption of the window
getWindowClassName(windowhandle): string - Returns the classname of the window
getWindowProcessID(windowhandle): processid - Returns the processid of the process this window belongs to
getForegroundWindow() - windowhandle : Returns the windowhandle of the topmost window

sendMessage(hwnd, msg, wparam, lparam): result - Sends a message to a window. Those that wish to use it, should know how to use it (and fill in the msg id's yourself)
hookWndProc(hwnd, function(hwnd, msg, wparam, lparam), ASYNC: BOOL) - Hooks a window's wndproc procedure. The given function will receive all functions. Return 0 to say you handled it. 1 to let the default windows handler deal with it. Or anything else, to let the original handler deal with it. Besides the return value, you can also return hWnd, Msg, lParam and wParam, modified, or nil for the original value. Set ASYNC to true if you don't want to run this in the CE GUI. (faster, but you can't touch gui objects)
unhookWndProc(hwnd) - call this when done with the hook. Not calling this will result in the process window behaving badly when you exit CE

cheatEngineIs64Bit(): Returns true if CE is 64-bit, false if 32-bit
targetIs64Bit(): Returns true if the target process is 64-bit, false if 32-bit

getCheatEngineDir(): Returns the folder Cheat Engine is located at

disassemble(address): Disassembles the given address and returns a string in the format of "address - bytes - opcode : extra"
splitDisassembledString(disassembledstring): Returns 4 strings. The address, bytes, opcode and extra field

getInstructionSize(address): Returns the size of an instruction (basically it disassembles the instruction and returns the number of bytes for you)
getPreviousOpcode(address): Returns the address of the previous opcode (this is just an estimated guess)

beep() : Plays the fabulous beep/ping sound!
playSound(stream, waittilldone OPTIONAL): Plays the given memorystream containing a .WAV formatted memory object. If waittilldone is true the script will stop executing till the sound has stopped
playSound(tablefile, waittilldone OPTIONAL) : Takes the memorystream from the tablefile and plays it.
There are two tablefiles predeclared inside cheat engine "Activate" and "Deactivate" . You are free to use or override them

speak(text, waittilldone OPTIONAL): Speaks a given text. If waitTillDone is true the thread it's in will be frozen till it is done
speak(text, flags): Speaks a given text using the given flags. https://msdn.microsoft.com/en-us/library/speechplatform_speakflags.aspx
speakEnglish(text, waittilldone OPTIONAL) - will try the English voice by wrapping the given text into an XML statement specifying the english voice. Will not say anything if no Egnlish language is present. Do not use SPF_IS_NOT_XML flag and SPF_PARSE_SSML won't work in this situation

getUserRegistryEnvironmentVariable(name): string - Returns the environment variable stored in the user registry environment
setUserRegistryEnvironmentVariable(name, string) - Sets the environment variable stored in the user registry environment
broadcastEnvironmentUpdate() : Call this when you've changed the environment variables in the registry. This will cause at least the shell to update so you don't have to reboot. (It's always recommended to reboot though)

stringToMD5String(string): Returns an md5 hash string from the provided string

getFormCount() : Returns the total number of forms assigned to the main CE application
getForm(index): Returns the form at the specific index

registerFormAddNotification(function(form)): Registers a function to be called when a form is attached to ce's form list. This is useful for extentions that add new functionality to certain existing forms. It returns an object you can use with unregisterFormAddNotification
unregisterFormAddNotification(Object)

getSettingsForm(): Returns the main settings form
getMemoryViewForm() : Returns the main memoryview form class object which can be accessed using the Form_ class methods and the methods of the classes it inherits from. There can be multiple memory views, but this will only find the original/base
getMainForm() : Returns the main form class object which can be accessed using the Form_ class methods and the methods of the classes it inherits from
getLuaEngine() : Returns the lua engine form object (Creates it if needed)
getApplication() : Returns the application object. (the titlebar)
getAddressList() : Returns the cheat table addresslist object
getFreezeTimer() : Returns the freeze timer object
getUpdateTimer() : Returns the update timer object

setGlobalKeyPollInterval(integer): Sets the global keypoll interval. The interval determines the speed of how often CE checks if a key has been pressed or not. Lower is more accurate, but eats more cpu power
setGlobalDelayBetweenHotkeyActivation(integer): Sets the minimum delay between the activation of the same hotey in milliseconds. Affects all hotkeys that do not set their own minimum delay

getXBox360ControllerState(ControllerID OPTIONAL) : table - Fetches the state of the connected xbox controller. Returns a table containing the following fields on success:
ControllerID : The id of the controller (between 0 and 3)
PacketNumber : The packet id of the state you see. (use to detect changes)
GAMEPAD_DPAD_UP : D-PAD Up (boolean)
GAMEPAD_DPAD_DOWN: D-PAD Down (boolean)
GAMEPAD_DPAD_LEFT: D-PAD Left (boolean)
GAMEPAD_DPAD_RIGHT: D-PAD Right (boolean)
GAMEPAD_START: Start button (boolean)
GAMEPAD_BACK: Back button (boolean)
GAMEPAD_LEFT_THUMB: Left thumb stick down (boolean)
GAMEPAD_RIGHT_THUMB: Right thumb stick down (boolean)

GAMEPAD_LEFT_SHOULDER: Left shoulder button (boolean)
GAMEPAD_RIGHT_SHOULDER: Right shoulder button (boolean)

GAMEPAD_A: A button (boolean)
GAMEPAD_B: B button (boolean)
GAMEPAD_X: X button (boolean)
GAMEPAD_Y: Y button (boolean)

LeftTrigger: Left trigger (integer ranging from 0 to 255)
RightTrigger: Right trigger (integer ranging from 0 to 255)

ThumbLeftX: Horizontal position of the left thumbstick (-32768 to 32767)
ThumbLeftY: Verital position of the left thumbstick (-32768 to 32767)
ThumbRightX: Horizontal position of the right thumbstick (-32768 to 32767)
ThumbRightY: Vertical position of the right thumbstick (-32768 to 32767)

setXBox360ControllerVibration(ControllerID, leftMotor, rightMotor) - Sets the speed of the left and right vibrating motor inside the controller. Range (0 to 65535 where 0 is off)

connectToCEServer(hostname,port) - Connects to the given host and port. On success, most commands subsequent will be handled by the server. Like processlist, memory reading, etc...

undefined property functions. Not all properties of all classes have been explicitly exposed to lua, but if you know the name of a property of a specific class you can still access them (assuming they are declared as published in the pascal class declaration)
getPropertyList(class) : Returns a stringlist object containing all the published properties of the specified class (free the list when done) (Note, not all classed with properties have 'published' properties. E.g: stringlist)
setProperty(class, propertyname, propertyvalue) : Sets the value of a published property of a class (Won't work for method properties)
getProperty(class, propertyname) : Gets the value of a published property of a class (Won't work for method properties)
setMethodProperty(class, propertyname, function): Sets the method property to the specific function
getMethodProperty(Class, propertyname): Returns a function you can use to call the original function

registerSymbol(symbolname, address, OPTIONAL donotsave): Registers a userdefined symbol. If donotsave is true this symbol will not get saved when the table is saved
unregisterSymbol(symbolname)

getNameFromAddress(address): Returns the given address as a string. Registered symbolname, modulename+offset, or just a hexadecimal string depending on what address
inModule(address) : returns true if the given address is inside a module
inSystemModule(address) : returns true if the given address is inside a system module
getCommonModuleList: Returns the commonModuleList stringlist. (Do not free this one)

AOBScan("aobstring", protectionflags OPTIONAL, alignmenttype OPTIONAL, alignmentparam HALFOPTIONAL):
protectionflags is a string.
X=Executable W=Writable memory C=Copy On Write. Add a + to indicate that flag MUST be set and a - to indicate that that flag MUST NOT be set. (* sets it to don't care)
Examples:
+W-C = Writable memory exluding copy on write and doesn't care about the Executable flag
+X-C-W = Find readonly executable memory
+W = Finds all writable memory and don't care about copy on write or execute
"" = Find everything (is the same as "*X*C*W" )

alignmenttype is an integer:
0=No alignment check
1=Address must be dividable by alignmentparam
2=Address must end with alignmentparam
alignmentparam is a string which either holds the value the addresses must be dividable by or what the last digits of the address must be

-debugging

debug variables
EFLAGS
32/64-bit: EAX, EBX, ECX, EDX, EDI, ESI, EBP, ESP, EIP
64-bit only: RAX, RBX, RCX, RDX, RDI, RSI, RBP, RSP, RIP, R8, R9, R10, R11, R12, R13, R14, R15 : The value of the register

Debug related routines:
function debugger_onBreakpoint():
When a breaking breakpoint hits (that includes single stepping) and the lua function debugger_onBreakpoint() is defined it will be called and the global variables EAX, EBX, .... will be filled in
Return 0 if you want the userinterface to be updated and anything else if not (e.g: You continued from the breakpoint in your script)

createProcess(path, parameters OPTIONAL, debug OPTIONAL, breakonentrypoint OPTIONAL) : Creates a process. If debug is true it will be created using the windows debugger and if breakonentry is true it will cause a breakpoint to occur on entrypoint

debugProcess(interface OPT): starts the debugger for the currently opened process (won't ask the user) Optional interface: 0=default, 1=windows debug, 2=VEHDebug, 3=Kerneldebug

debug_isDebugging(): Returns true if the debugger has been started
debug_getCurrentDebuggerInterface() : Returns the current debuggerinterface used (1=windows, 2=VEH 3=Kernel, nil=no debugging active)
debug_canBreak(): Returns true if there is a possibility the target can stop on a breakpoint. 6.4+
debug_isBroken(): Returns true if the debugger is currently halted on a thread
debug_getBreakpointList(): Returns a lua table containing all the breakpoint addresses

debug_addThreadToNoBreakList(threadid): This will cause breakpoints on the provided thread to be ignored
debug_removeThreadFromNoBreakList(threadid): removed the threadid from the list

debug_setBreakpoint(address, size OPTIONAL, trigger OPTIONAL, breakpointmethod OPTIONAL, functiontocall() OPTIONAL) : sets a breakpoint of a specific size at the given address. if trigger is bptExecute then size is ignored. If trigger is ignored then it will be of type bptExecute, which obviously also ignores the size then as well
debug_setBreakpoint(address, size OPTIONAL, trigger OPTIONAL, functiontocall() OPTIONAL)
debug_setBreakpoint(address, functiontocall() OPTIONAL)
debug_removeBreakpoint(address) : if the given address is a part of a breakpoint it will be removed
debug_continueFromBreakpoint(continueMethod) : if the debugger is currently waiting to continue you can continue with this. Valid parameters are :co_run (just continue), co_stepinto(when on top of a call, follow it), co_stepover (when on top of a call run till after the call)
debug_getXMMPointer(xmmregnr) :
Returns the address of the specified xmm register of the thread that is currently broken
This is a LOCAL Cheat Engine address. Use Local memory access functions to read and modify
xmmregnr can be 0 to 15 (0 to 7 on 32-bit)

The following routines describe last branch recording. These functions only work when kernelmode debugging is used and using windows XP (vista and later work less effective or not at all because the operating system interferes. Might also be intel specific. A dbvm upgrade in the future might make this work for windows vista and later)
debug_setLastBranchRecording(boolean): When set the Kernel debugger will try to record the last branch(es) taken before a breakpoint happens
debug_getMaxLastBranchRecord() : Returns the maximum branch record your cpu can store (-1 if none)
debug_getLastBranchRecord(index): Returns the value of the Last Branch Record at the given index (when handling a breakpoint)

function debugger_onModuleLoad(modulename, baseaddress) :
this routine is called when a module is loaded. Only works for the windows debugger
return 1 if you want to cause the debugger to break

Changing registers:
When the debugger is waiting to continue you can change the register variables. When you continue those register values will be set in the thread's context

If the target is currently stopped on a breakpoint, but not done through an onBreakpoint function. The context won't be set.
You can get and set the context back with these functions before execution continues"
debug_getContext(BOOL extraregs) - Fills the global variables for the regular registers. If extraregs is true, it will also set FP0 to FP7 and XMM0 to XMM15
debug_setContext(BOOL extraregs)
debug_updateGUI() - Will refresh the userinterface to reflect the new context if the debugger was broken

detachIfPossible() : Detaches the debugger from the target process (if it was attached)

getComment(address) : Gets the userdefined comment at the specified address
setComment(address, text) : Sets a userdefined comment at the specifried address. %s is used to display the autoguess value if there is one
getHeader(address) : Gets the userdefined header at the specified address
setHeader(address) : Sets the userdefined header at the specified address

registerBinUtil(config) Registers a binutils toolset with CE (for assembling and disassembling in other cpu instruction sets)
config is a table containing several fields that describe the tools, and lets you specify extra parameters

Name : The displayed name in the binutils menu in memview
Description: The description for this toolset
Architecture: used by the objdump -m<architecture> (required)
ASParam : extra parameters to pass on to AS (optional)
LDParam : extra parameters to pass on to LD
OBJDUMPParam: extra parameters to pass on to OBJDUMP
OnDisassemble: a lua function that gets called each time an address is disassembled. The return value will be passed on to OBJDUMP
Path: filepath to the binutils set
Prefix: prefix (e.g: "arm-linux-androideabi-")
DisassemblerCommentChar: Depending on which target you're disassembling, the comment character can be different. (ARM=";" x86='#' )

class helper functions
inheritsFromObject(object): Returns true if given any class
inheritsFromComponent(object): Returns true if the given object inherits from the Component class
inheritsFromControl(object): Returns true if the given object inherits from the Control class
inheritsFromWinControl(object): Returns true if the given object inherits from the WinControl class

createClass(classname): Creates an object of the specified class (Assuming it's a registered class and has a default constructor)
createComponentClass(classname, owner): Creates an object of the specified component inherited class

Class definitions
Object class: (Inheritance: )
Properties:
ClassName: String - The name of class (Read only)
Methods:
getClassName(): Returns the classname
fieldAddress(fieldname: string): Returns the address of the specific field
methodAddress(methodname: string)
methodName(address: integer)
destroy(): Destroys the object

Component Class: (Inheritance: Object)
properties
ComponentCount: Integer - Number of child components . Readonly
Component[int]: Component - Array containing the child components. Starts at 0. Readonly
ComponentByName[string]: Component - Returns a component based on the name. Readonly
Name: string - The name of the component
Tag: integer - Free to use storage space. (Useful for id's)
Owner: Component - Returns the owner of this object. Nil if it has none

methods
getComponentCount() : Returns the number of components attached to his component
getComponent(index) : Returns the specific component
findComponentByName(name) : Returns the component with this name
getName() : Return the name
setName(newname) : Changes the name
getTag() : Sets an integer value. You can use this for ID's
setTag(tagvalue) : Get the tag value
getOwner() : Returns the owner of this component

Control Class: (Inheritance: Component->Object)
properties:
Caption: string - The text of a control
Top : integer - The x position
Left : integer - The y position
Width : integer - The width of the control
Height : integer - The height of the control
ClientWidth: integer - The usable width inside the control (minus the borders)
ClientHeight: integer - The usable height the control (minus the borders)
Align: AlignmentOption - Alignment of the control
Enabled: boolean - Determines if the object is usable or greyed out
Visible: boolean - Determines if the object is visible or not
Color: ColorDefinition/RGBInteger - The color of the object. Does not affect the caption
Parent: WinControl - The owner of this control
PopupMenu: PopupMenu - The popup menu that shows when rightclicking the control
Font: Font - The font class associated with the control
OnClick: function - The function to call when a button is pressed

methods:
getLeft()
setLeft(integer)
getTop()
setTop(integer)
getWidth()
setWidth(integer)
getHeight()
setHeight()
setCaption(caption) : sets the text on a control. All the GUI objects fall in this category
getCaption() : Returns the text of the control
setPosition(x,y): sets the x and y position of the object base don the top left position (relative to the client array of the owner object)
getPosition(): returns the x and y position of the object (relative to the client array of the owner object)
setSize(width,height) : Sets the width and height of the control
getSize() : Gets the size of the control
setAlign(alignmentoption): sets the alignment of the control
getAlign(alignmentoption): gets the alignment of the control
getEnabled() : gets the enabled state of the control
setEnabled(boolean) : Sets the enabled state of the control
getVisible() : gets the visible state of the control
setVisible(boolean) : sets the visible state of the control
getColor() : gets the color
setColor(rgb) : Sets the color
getParent() : Returns nil or an object that inherits from the Wincontrol class
setParent(wincontrol) : Sets the parent for this control
getPopupMenu()
setPopupMenu()
getFont(): Returns the Font object of this object
setFont(): Assigns a new font object. (Not recommended to use. Change the font object that's already there if you wish to change fonts)
repaint(): Invalidates the graphical area of the control and forces and update
update() : Only updates the invalidated areas
setOnClick(functionnameorstring) : Sets the onclick routine
getOnClick(): Gets the onclick function
doClick(): Executes the current function under onClick
bringToFront(): Changes the z-order of the control so it'd at the top
sendToBack(): Changes the z-order of the control so it'd at the back
screenToClient(): Converts screen x,y coordinates to x,y coordinates on the control
clientToScreen(): Converts control x,y coordinates to screen coordinates

GraphicsObject : (GraphicsObject->Object)

Region Class : (Region->GraphicsObject->Object)
createRegion(): Created an empty region

properties
-
methods
addRectangle(x1, y1, x2, y2): Adds a rectangle to the region
addPolygon(tablewithcoordinates): Adds an array of 2D locations. (example : {{0,0},{100,100}, {0,100}} for a triangle )

WinControl Class: (Inheritance: Control->Component->Object)
properties
Handle: Integer - The internal windows handle
DoubleBuffered: boolean - Graphical updates will go to a offscreen bitmap which will then be shown on the screen instead of directly to the screen. May reduce flickering
ControlCount : integer - The number of child controls of this wincontrol
Control[] : Control - Array to access a child control
OnEnter : function - Function to be called when the WinControl gains focus
OnExit : function - Function to be called when the WinControl loses focus

methods
getControlCount() Returns the number of Controls attached to this class
getControl(index) : Returns a WinControl class object
getControlAtPos(x,y): Gets the control at the given x,y position relative to the wincontrol's position
canFocus(): returns true if the object can be focused
focused(): returns boolean true when focused
setFocus(): tries to set keyboard focus the object
setShape(Region): Sets the region object as the new shape for this wincontrol
setShape(Bitmap):
setOnEnter(function) : Sets an onEnter event. (Triggered on focus enter)
getOnEnter()
setOnExit(function) : Sets an onExit event. (Triggered on lost focus)
getOnExit()
setLayeredAttributes(Key, Alpha, Flags) : Sets the layered state for the control if possible (Only Forms are supported in in windows 7 and earlier)
flags can be a combination of LWA_ALPHA and/or LWA_COLORKEY
See msdn SetLayeredWindowAttributes for more information

MenuItem class(Inheritance: Component->Object)
createMenuItem(ownermenu) : Creates a menu item that gets added to the owner menu

properties
Caption : String - Text of the menu item
Shortcut : string - Shortcut in textform to trigger the menuitem
Count : integer - Number of children attached to this menuitem
Menu: Menu - The menu this item resides in
Parent: MenuItem - The menuitem this item hangs under
MenuIndex: integer - The position this menu item is in it's parent
Item[] : Array to access each child menuitem
[] : Item[]
OnClick: Function to call when the menu item is activated

methods
getCaption() : Gets the caption of the menu item
setCaption(caption) : Sets the caption of the menu item
getShortcut(): Returns the shortcut for this menu item
setShortcut(shortcut): Sets the shortcut for this menuitem. A shortcut is a string in the form of ("ctrl+x")
getCount()
getItem(index) : Returns the menuitem object at the given index
add(menuitem) : Adds a menuItem as a submenu item
insert(index, menuitem): Adds a menuItem as a submenu item at the given index
delete(index)
setOnClick(function) : Sets an onClick event
getOnClick()
doClick(): Executes the onClick method if one is assigned

Menu Class: (Inheritance: Component->Object)
properties
Items : MenuItem - The base MenuItem class of this menu (readonly)
methods
getItems() : Returns the main MenuItem of this Menu

MainMenu Class: (Inheritance: Menu->Component->Object)
createMainMenu(form)
The mainmenu is the menu at the top of a window

PopupMenu Class: (Inheritance: Menu->Component->Object)
createPopupMenu(owner)
The popup menu is the menu that pops up when showing the (rightclick) context of an control

Strings Class: (Inheritance : Object) (Mostly an abstract class)
properties
Text : String - All the strings in one string
Count: Integer - The number of strings in this list
String[]: String - Array to access one specific string in the list
[] = String[]

methods
clear() : Deletes all strings in the list
add(string) : adds a string to the list
delete(index) : Deletes a string from the list
getText() : Returns all the strings as one big string
setText() : Sets the strings of the given strings object to the given text (can be multiline)
indexOf(string): Returns the index of the specified string. Returns -1 if not found
insert(index, string): Inserts a string at a specific spot moving the items after it

getCount(): Returns the number is strings in the list
remove(string); Removes the given string from the list
loadFromFile(filename) : Load the strings from a textfile
saveToFile(filename) : Save the strings to a textfile

getString(index) : gets the string at the given index
setString(index, string) : Replaces the string at the given index
beginUpdate() : Stops updates from triggering other events (prevents flashing)
endUpdate(): call after beginUpdate

Stringlist Class: (Inheritance : Strings->Object)
createStringlist() : Creates a stringlist class object (for whatever reason, lua strings are probably easier to use)

properties
Sorted : boolean - Determines if the list should be sorted
Duplicates : DuplicatesType - Determines how duplicates should be handled when the list is sorted
CaseSensitive: boolean - Determines if the list is case sensitive or not.

methods
getDuplicates() : returns the duplicates property
setDuplicates(Duplicates) : Sets the duplicates property (dupIgnore, dupAccept, dupError)
getSorted() : returns true if the list has the sorted property
setSorted(boolean) : Sets the sorted property
getCaseSensitive() : Returns true if the case sensitive property is set
setCaseSensitive(boolean): Sets the case sensitive property

Application Class: (Inheritance: CustomApplication->Component->Object)
properties
Title: The title of cheat engine in the bar
Icon: The icon of Cheat Engine inn the bar

methods
bringToFront(): Shows the cheat engine app
processMessages()
terminate()
minimize()

Form Class: (Inheritance: ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)
properties
AllowDropFiles: boolean - Allows files to be dragged into the form
ModalResult: integer - The current ModalResult value of the form. Note: When this value gets set the modal form will close
Menu: MainMenu - The main menu of the form

OnClose: function(sender) - The function to call when the form gets closed
OnDropFiles: function(sender, {filenames}) - Called when files are dragged on top of the form. Filenames is an arraytable with the files

methods
centerScreen(); : Places the form at the center of the screen
hide() : Hide the form
show() : show the form
close(): Closes the form. Without an onClose this will be the same as hide
bringToFront(): Brings the form to the foreground
showModal() : show the form and wait for it to close and get the close result
isForegroundWindow(): returns true if the specified form has focus
setOnClose(function) : function (sender) : Return a CloseAction to determine how to close the window
getOnClose() : Returns the function
getMenu() : Returns the mainmenu object of this form
setMenu(mainmenu)

setBorderStyle( borderstyle): Sets the borderstyle of the window
getBorderStyle()

printToRasterImage(rasterimage): Draws the contents of the form to a rasterimage class object
dragNow(): Call this on mousedown on any object if you wish that the mousemove will drag the whole form arround. Useful for borderless windows (Dragging will stop when the mouse button is released)

CEForm Class: (Inheritance: Form->ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)
createForm(visible OPT): creates a CEForm class object(window) and returns the pointer for it. Visible is default true but can be changed
createFormFromFile(filename): Returns the generated CEform

properties
DoNotSaveInTable: boolean - Set this if you do not wish to save the forms in the table
methods
saveToFile(filename): Saves a userdefined form
getDoNotSaveInTable(): Returns the DoNotSaveInTable property
setDoNotSaveInTable(boolean): Sets the DoNotSaveInTable property
saveCurrentStateAsDesign() : Sets the current state of the form as the state that will be saved when the table is saved

GraphicControl Class: (Inheritance: Control->Component->Object)
properties
Canvas: Canvas - The canvas for rendering this control

methods
getCanvas() : Returns the Canvas object for the given object that has inherited from customControl

PaintBox class: (Inheritance: GraphicControl->Control->Component->Object)
createPaintBox(owner): Creates a Paintbox class object

Label Class: (Inheritance: GraphicControl->Control->Component->Object)
createLabel(owner): Creates a Label class object which belongs to the given owner. Owner can be any object inherited from WinControl

Splitter Class: (Inheritance: CustomControl->WinControl->Control->Component->Object)
createSplitter(owner): Creates a Splitter class object which belongs to the given owner. Owner can be any object inherited from WinControl

Panel Class: (Inheritance: CustomControl->WinControl->Control->Component->Object)
createPanel(owner): Creates a Panel class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Alignment: alignment
BevelInner: panelBevel
BevelOuter: panelBevel
BevelWidth: Integer
FullRepaint: boolean
methods
getAlignment() : gets the alignment property
setAlignment(alignment) : sets the alignment property
getBevelInner()
setBevelInner(PanelBevel)
getBevelOuter()
setBevelOuter(PanelBevel)
getBevelWidth()
setBevelWidth(BevelWidth)
getFullRepaint()
setFullRepaint(boolean)

Image Class: (Inheritance: GraphicControl->Control->Component->Object)
createImage(owner): Creates an Image class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Canvas: Canvas - The canvas object to access the picture of the image
Transparent: boolean - Determines if some parts of the picture are see through (usually based on the bottomleft corner)
Stretch: boolean - Determines if the picture gets stretched when rendered in the image component
Picture: Picture - The picture to render

methods
loadImageFromFile(filename)
getStretch()
setStretch(boolean)
getTransparent()
setTransparent(boolean)
getCanvas()
setPicture(picture)
getPicture() : Returns the Picture object of this image

Edit Class: (Inheritance: WinControl->Control->Component->Object)
createEdit(owner): Creates an Edit class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Text: string - The current contents of the editfield
SelText: string - The current selected contents of the edit field (readonly)
SelStart: number - The starting index of the current selection (zero-indexed, readonly)
SelLength: number - The length of the current selection. (readonly)
OnChange: function - The function to call when the editfield is changed
OnKeyPress: function - The function to call for the KeyPress event.
OnKeyUp: function - The function to call for the KeyUp event.
OnKeyDown: function - The function to call for the KeyDown event.

methods
clear()
copyToClipboard()
cutToClipboard()
pasteFromClipboard()
selectAll()
select(start, length OPTIONAL)
selectText(start, length OPTIONAL) : Set the control's current selection. If no length is specified, selects everything after start.
clearSelection()
getSelText()
getSelStart()
getSelLength()
getOnChange()
setOnChange(function)
getOnKeyPress()
setOnKeyPress(function)
getOnKeyUp()
setOnKeyUp(function)
getOnKeyDown()
setOnKeyDown(function)

Memo Class: (Inheritance: Edit->WinControl->Control->Component->Object)
createMemo(owner): Creates a Memo class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Lines: Strings - Strings object for this memo
WordWrap: boolean - Set if words at the end of the control should go to the next line
WantTabs: Boolean - Set if tabs will add a tab to the memo. False if tab will go to the next control
WantReturns: Boolean - Set if returns will send a event or not
Scrollbars: Scrollstyle - Set the type of ascrollbars to show (ssNone, ssHorizontal, ssVertical, ssBoth,
ssAutoHorizontal, ssAutoVertical, ssAutoBoth)

methods
append(string)
getLines() : returns a Strings class
getWordWrap()
setWordWrap(boolean)
getWantTabs()
setWantTabs(boolean)
getWantReturns()
setWantReturns(boolean)
getScrollbars()
setScrollbars(scrollbarenumtype) :
Sets the scrollbars. Horizontal only takes affect when wordwrap is disabled
valid enum types:
ssNone : No scrollbars
ssHorizontal: Has a horizontal scrollbar
ssVertical: Has a vertical scrollbar
ssBoth: Has both scrollbars
ssAutoHorizontal: Same as above but only shows when there actually is something to scroll for
ssAutoVertical: " " " " ...
ssAutoBoth: " " " " ...

ButtonControl Class: (Inheritance: WinControl->Control->Component->Object)

Button Class: (Inheritance: ButtonControl->WinControl->Control->Component->Object)
createButton(owner): Creates a Button class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
ModalResult: ModalResult - The result this button will give the modalform when clicked

methods
getModalResult(button)
setModalResult(button, mr)

CheckBox Class: (Inheritance: ButtonControl->WinControl->Control->Component->Object)
createCheckBox(owner): Creates a CheckBox class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Checked: boolean - True if checked
AllowGrayed: boolean - True if it can have 3 states. True/False/None
State: checkboxstate - The state. (cbUnchecked=0, cbChecked=1, cbGrayed=2)
OnChange: function - Function to call when the state it changed

methods
getAllowGrayed()
setAllowGrayed(boolean)
getState(): Returns a state for the checkbox. (cbUnchecked, cbChecked, cbGrayed)
setState(boolean): Sets the state of the checkbox
onChange(function)

ToggleBox Class: (Inheritance: CheckBox->ButtonControl->WinControl->Control->Component->Object)
createToggleBox(owner): Creates a ToggleBox class object which belongs to the given owner. Owner can be any object inherited from WinControl

GroupBox Class: (Inheritance: WinControl->Control->Component->Object)
createGroupBox(owner): Creates a GroupBox class object which belongs to the given owner. Owner can be any object inherited from WinControl

RadioGroup class: (Inheritance: GroupBox->WinControl->Control->Component->Object)
createRadioGroup(owner): Creates a RadioGroup class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Items: Strings - Strings derived object containings all the items in the list
Columns: Integer - The number of columns to split the items into
ItemIndex: Integer - The currently selected item
OnClick: Called when the control is clicked

methods
getRows(): Returns the number of rows
getItems(): Returns a Strings object
getColumns(): Returns the nuber of columns
setColumns(integer)
getItemIndex()
setItemIndex(integer)
setOnClick(function)
getOnClick()

ListBox Class: (Inheritance: WinControl->Control->Component->Object)
createListBox(owner): Creates a ListBox class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
MultiSelect: boolean - When set to true you can select multiple items
Items: Strings - Strings derived object containings all the items in the list
Selected[] - Returns true if the given line is selected. Use Items.Count-1 to find out the max index
ItemIndex: integer - Get selected index. -1 is nothing selected
Canvas: Canvas - The canvas object used to render on the object

methods
clear()
clearSelection() : Deselects all items in the list
selectAll(): Selects all items in the list
getItems(): Returns a strings object
setItems(Strings): sets a strings object to the listbox
getItemIndex()
setItemIndex(integer)
getCanvas()

Calendar Class: (Inheritance: WinControl->Control->Component->Object)
createCalendar(owner): Creates a Calendar class object which belongs to the given owner. Owner can be any object inherited from WinControl. Valid date is between "September 14, 1752" and "December 31, 9999"

properties
Date: string - current date of the Calendar, format: yyyy-mm-dd
DateTime: number - days since December 30, 1899

methods
getDateLocalFormat - returns current date of the Calendar, format: ShortDateFormat from OS local settings

ComboBox Class: (Inheritance: WinControl->Control->Component->Object)
createComboBox(owner): Creates a ComboBox class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Items: Strings - Strings derived object containings all the items in the list
ItemIndex: integer - Get selected index. -1 is nothing selected
Canvas: Canvas - The canvas object used to render on the object

methods
clear()
getItems()
setItems()
getItemIndex()
setItemIndex(integer)
getCanvas()

ProgressBar Class: (Inheritance: WinControl->Control->Component->Object)
createProgressBar(owner): Creates a ProgressBar class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Min: integer - The minimum positionvalue the progressbar can have (default 0)
Max: integer - The maximum positionvalue the progressbar can have (default 100
Position: integer - The position of the progressbar
Step: integer- The stepsize to step by when stepIt() is called

methods
stepIt() - Increase position with "Step" size
stepBy(integer) - increase the position by the given integer value
getMax() - returns the Max property
setMax(integer) - sets the max property
getMin() - returns the min property
setMin(integer)- sets the min property
getPosition() - returns the current position
setPosition(integer) - sets the current position
setPosition2(integer) - sets the current position; without slow progress animation on Win7 and later

TrackBar Class : (Inheritance: WinControl->Control->Component->Object)
createTrackBar(owner): Creates a TrackBar class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Min: integer - Minimal value for the trackbar
Max: integer - Maximum value for the trackbar
Position: integer - The current position
OnChange: function - Function to call when

methods
getMax()
setMax(integer)
getMin(trackbar)
setMin(trackbar, integer)
getPosition(progressbar)
setPosition(progressbar, integer)
getOnChange()
setOnChange(function)

CollectionItem Class: (Inheritance: Object)
Base class for some higher level classes. Often used for columns

properties
ID: integer
Index: integer - The index in the array this item belong to
DisplayName: string

methods
getID()
getIndex()
setIndex()
getDisplayName()
setDisplayName()

ListColumn class: (Inheritance: CollectionItem->Object)
properties
AutoSize: boolean
Caption: string
MaxWidth: integer
MinWidth: integer
Width: integer
Visible: boolean
methods
getAutosize()
setAutosize(boolean)
getCaption()
setCaption(caption)
getMaxWidth()
setMaxWidth(width)
getMinWidth()
setMinWidth(width)
getWidth()
setWidth(width)

Collection Class: (Inheritance: Object)

properties
Count: integer

methods
clear(collection)
getCount(collection)
delete(collection, index)

ListColumns class : (Inheritance: Collection->Object)
properties
Columns[]: Array to access a column
[] = Columns[]

methods
add(): Returns a new ListColumn object
getColumn(index): Returns a ListColum object;
setColumn(index, listcolumns): Sets a ListColum object (not recommended, use add instead)

ListItem Class : (Inheritance: TObject)
properties
Caption: boolean - The text of this listitem
Checked: boolean - Determines if the checkbox is checked (if it has a checkbox)
SubItems: Strings - The Strings object that hold the subitems
Selected: boolean - Returns true if selected
Index: integer - The index in the Items object of the owner of this listitem (readonly)
Owner: ListItems - The ListItems object that owns this ListItem (readonly)

methods
delete()
getCaption() : Returns the first columns string of the listitem
setCaption(string) : Sets the first column string of the listitem
getChecked() : Returns true if the listitem is checked
setChecked(boolean): Sets the checkbox of the listbox to the given state
getSubItems(): Returns a Strings object
makeVisible(partial): Scrolls the listview so this item becomes visible (Cheat Engine 6.4 and later)

ListItems class : (Inheritance: TObject)
properties
Count : Integer - The number of ListItems this object holds (Normally read only, but writable if OwnerData is true in the listview)
Item[]: ListItem[] - Array to access each ListItem object
[] = Item[]
methods
clear()
getCount()
getItem(integer) : Return the listitem object at the given index
add(): Returns a new ListItem object

Listview Class : (Inheritance: WinControl->Control->Component->Object)
createListView(owner): Creates a ListView class object which belongs to the given owner. Owner can be any object inherited from WinControl

properties
Columns: ListColumns - The Listcolumns object of the listview (Readonly)
Items: ListItems - The ListItems objects of the listview
ItemIndex: integer - The currently selected index in the Items object (-1 if nothing is selected)
Selected: ListItem - The currently selected listitem (nil if nothing is selected)
Canvas: Canvas - The canvas object used to render the listview (Readonly)
AutoWidthLastColumn: Boolean - When set to true the last column will resize when the control resizes
HideSelection: Boolean - When set to true the selection will not hide when the focus leaves the control
RowSelect: Boolean - When set to true the whole row will be selected instead of just the first column
OwnerData: Boolean - When set to true the listview will call the onData function for every line being displayed. Use Items.Count to set the number of virtual lines

OnData: function(sender, ListItem) - Called when a listview with OwnerData true renders a line

OnCustomDraw: function(Sender, {Top, Left, Bottom, Right}, DefaultDraw Optional): NewDefaultDraw
OnCustomDrawItem: function(Sender, ListItem, {cdsSelected=true/false(nil), cdsGrayed=true/false(nil), cdsDisabled, cdsChecked, cdsFocused, cdsDefault, cdsHot, cdsMarked, cdsIndeterminate}, DefaultDraw Optional): NewDefaultDraw
OnCustomDrawSubItem: function(Sender, ListItem, SubItemIndex, {cdsSelected=true/false(nil), cdsGrayed=true/false(nil), cdsDisabled, cdsChecked, cdsFocused, cdsDefault, cdsHot, cdsMarked, cdsIndeterminate}, DefaultDraw Optional): NewDefaultDraw

methods
clear()
getColumns() : ListColumns - Returns a ListColumns object
getItems(): ListItems - Returns a ListItems object
getItemIndex(): integer - Returns the currently selected index in the Items object
setItemIndex(index: integer)- Sets the current itemindex
getCanvas() : Canvas - Returns the canvas object used to render the listview
beginUpdate() - Tells the listview to stop updating while you're busy
endUpdate() - Applies all updates between beginUpdate and endUpdate

TreeNode class : (Inheritance: TObject)
properties
Text: string - The text of the treenode
Parent: Treenode - The treenode this object is a child of. (can be nil) (ReadOnly)
Level: Integer - The level this node is at
HasChildren: boolean - Set to true if it has children, or you wish it to have an expand sign
Expanded: boolean - Set to true if it has been expanded
Count : Integer - The number of children this node has
Items[]: Treenode - Array to access the child nodes of this node
[] = Items[]
Index: Integer - The index based on the parent
AbsoluteIndex: Integer - The index based on the TreeView's Treenodes object (Items)
Selected: Boolean - Set to true if currently selected
MultiSelected: Boolean - Set to true if selected as well, but not the main selected object
Data: Pointer - Space to store 4 or 8 bytes depending on which version of CE is used
methods
delete()
deleteChildren()
makeVisible()
expand(recursive:boolean=TRUE OPTIONAL) : Expands the given node
collapse(recursive:boolean=TRUE OPTIONAL) : collapses the given node
getNextSibling(): Returns the treenode object that's behind this treenode on the same level
add(text:string): Returns a Treenode object that is a child of the treenode used to create it

TreeNodes class : (Inheritance: TObject)
properties
Count : Integer - The total number of Treenodes this object has
Item[]: TreeNode - Array to access each node
[] = Item[]
methods
clear()
getCount()
getItem(integer) : Return the TreeNode object at the given index (based on the TreeView's Treenodes)
add(text:string): Returns a new root Treenode object
insert(treenode, string): Returns a new treenode object that has been inserted before the given treenode
insertBehind(treenode, string): Returns a new treenode object that has been inserted after the given treenode

Treeview Class : (Inheritance: CustomControl->WinControl->Control->Component->Object)
createTreeView(owner)

properties
Items: TreeNodes - The Treenodes object of the treeview (ReadOnly)
Selected: TreeNode - The currently selected treenode

methods
beginUpdate()
endUpdate()
getItems()
getSelected()
setSelected()
fullCollapse() : Collapses all the nodes, including the children's nodes
fullExpand() : Expands all the nodes and all their children
saveToFile(filename): Saves the contents of the treeview to disk

Timer Class : (Inheritance: Component->object)
createTimer(owner OPT, enabled OPT):
Creates a timer object. If enabled is not given it will be enabled by default (will start as soon as an onTimer event has been assigned)
Owner may be nil, but you will be responsible for destroying it instead of being the responsibility of the owner object)

properties
Interval: integer - The number of milliseconds (1000=1 second) between executions
Enabled: boolean
OnTimer: function(timer) - The function to call when the timer triggers

methods
getInterval()
setInterval(interval) : Sets the speed on how often the timer should trigger. In milliseconds (1000=1 second)
getOnTimer()
setOnTimer(function(timer))
getEnabled()
setEnabled(boolean)

CustomControl class (CustomControl->WinControl->Control->Component->Object)
properties
Canvas : The canvas object for drawing on the control/. Readonly
OnPaint: an OnPaint event you can assign to do some extra painting
methods
getCanvas() : Returns the Canvas object for the given object that has inherited from customControl

Canvas Class : (Inheritance: CustomCanvas->Object)
properties
Brush: Brush - The brush object
Pen: Pen - The pen object
Font: Font - The font object
Width: integer - Width of the canvas
Height: integer - Height of the canvas

methods
getBrush(): Returns the brush object of this canvas
getPen(): Returns the pen object of this canvas
getFont(): Returns the font object of this canvas
getWidth()
getHeight()
getPenPosition()
setPenPosition(x,y)
clear() - Clears the canvas
line(sourcex, sourcey, destinationx, destinationy)
lineTo(destinationx, destinationy)
rect(x1,y1,x2,y2)
fillRect(x1,y1,x2,y2)
textOut(x,y, text)
getTextWidth(text)
getTextHeight(text)
getPixel(x,y)
setPixel(x,y,color)
floodFill(x,y, color OPTIONAL default=brush.Color, filltype OPTIONAL default=fsSurface): Fills the picture till/with a color.
filltype can be
fsSurface: fill till the color (it fills all except this color)
fsBorder: fill this color (it fills only connected pixels of this color)

ellipse(x1,y1,x2,y2)
gradientFill(x1,y1,x2,y2, startcolor, stopcolor, direction) : Gradient fills a rectangle. Direction can be 0 or 1. 0=Vertical 1=Horizontal
copyRect(dest_x1,dest_y1,dest_x2,dest_y2, sourceCanvas, source_x1,source_y1,source_x2,source_y2) : Draws an image from one source to another. Useful in cases of doublebuffering
draw(x,y, graphic) : Draw the image of a specific Graphic class
getClipRect() : Returns a table containing the fields Left, Top, Right and Bottom, which define the invalidated region of the graphical object. Use this to only render what needs to be rendered in the onPaint event of objects

Pen Class : (Inheritance: CustomPen->CanvasHelper->Object)
properties
Color: Integer - The color of the pen
Width: integer - Thickness of the pen
methods
getColor()
setColor(color)
getWidth()
setWidth(width)

Brush Class : (Inheritance: CustomBrush->CanvasHelper->Object)
properties
Color : Integer
methods
getColor()
setColor()

Font Class : (Inheritance: CustomFont->CanvasHelper->Object)
createFont(): Returns a font object (default initialized based on the main ce window)

properties
Name: string
Size: integer
Height: integer
Orientation: integer
Pitch: string - 'fpDefault', 'fpVariable', 'fpFixed'
Color: integer
CharSet: integer
Quality: string - 'fqDefault', 'fqDraft', 'fqProof', 'fqNonAntialiased', 'fqAntialiased', 'fqCleartype', 'fqCleartypeNatural'
Style: string set - ['fsBold', 'fsItalic', 'fsStrikeOut', 'fsUnderline']

methods
getName(): Gets the fontname of the font
setName(string): Sets the fontname of the font
getSize(): Gets the size of the font
setSize(integer): Sets the size of the font
getColor(): Gets the color of the font
setColor(integer): Sets the color of the font
assign(font): Copies the contents of the font given as parameter to this font

Graphic Class : (Inheritance: Object) : Abstract class
properties
Width: integer
Height: integer
Transparent: boolean

methods
getWidth(graphic): Gets the current width in pixels of this graphics object
setWidth(graphic, width): Sets thw width in pixels
getHeight(graphic)
setHeight(graphic, height)

RasterImage class: (Inheritance: Graphic->Object) : Base class for some graphical controls
properties
Canvas: Canvas
PixelFormat: PixelFormat - the pixelformat for this image. Will clear the current image if it had one. Supported pixelformats: pf1bit, pf4bit, pf8bit, pf15bit, pf16bit, pf24bit, pf32bit (recommended)
TransparentColor: integer

methods
getCanvas(): Returns the Canvas object for this image
getPixelFormat(): Returns the current pixelformat
getPixelFormat(pixelformat): Sets the pixelformat for this image. Will clear the current image if it had one. Supported pixelformats: pf1bit, pf4bit, pf8bit, pf15bit, pf16bit, pf24bit, pf32bit (recommended)
setTransparentColor(integer): Sets the color that will be rendered as transparent when drawn
getTransparentColor(): Returns the color set to be transparent

Bitmap class: (Inheritance: CustomBitmap->RasterImage->Graphic->Object) : Bitmap based Graphic object
createBitmap(width, height) - Returns a Bitmap object

PortableNetworkGraphic Class: (Inheritence: CustomBitmap->RasterImage->Graphic->Object)
createPNG(width, height) - Returns a PortableNetworkGraphic object

JpegImage Class: (Inheritence: CustomBitmap->RasterImage->Graphic->Object)
createJpeg(width, height) - Returns a Jpeg object

Icon Class: (Inheritence: CustomBitmap->RasterImage->Graphic->Object)
createIcon(width, height) - Returns an Icon object

Picture Class : (Inheritance: Object) : Container for the Graphic class
createPicture() : Returns a empty picture object

properties
Graphic
PNG
Bitmap
Jpeg
Icon

methods
loadFromFile(filename)
saveToFile(filename)
loadFromStream(stream, originalextension OPTIONAL) : Loads a picture from a stream. Note that the stream position must be set to the start of the picture
assign(sourcepicture)

GenericHotkey Class : (Inheritance: Object)
createHotkey(function, keys, ...) : returns an initialized GenericHotkey class object. Maximum of 5 keys
createHotkey(function, {keys, ...}) : ^

properties
DelayBetweenActivate: integer - Interval in milliseconds that determines the minimum time between hotkey activations. If 0, the global delay is used
onHotkey: The function to call when the hotkey is pressed

methods
getKeys()
setKeys(key, ....)
setOnHotkey(table)
getOnHotkey

CommonDialog class:
properties
OnShow: function(sender)
OnClose: function(sender)
Title: string - The caption at top of the dialog
methods
Execute() : Shows the dialog and return true/false depending on the dialog

FindDialog Class: (Inheritance: CommonDialog->Component->Object)
properties
FindText: String - The text the user wishes to find
Options: Enum - Find Options
{ frDown, frFindNext, frHideMatchCase, frHideWholeWord,
frHideUpDown, frMatchCase, frDisableMatchCase, frDisableUpDown,
frDisableWholeWord, frReplace, frReplaceAll, frWholeWord, frShowHelp,
frEntireScope, frHideEntireScope, frPromptOnReplace, frHidePromptOnReplace }
OnFind: function (sender) - Called when the find button has been clicked
OnHelp: function (sender) - Called when the help button is visible (see Options) and clicked
methods

FileDialog Class: (Inheritance: CommonDialog->Component->Object)
properties

DefaultExt: string - When not using filters this will be the default extention used if no extension is given
Files: Strings - Stringlist containing all selected files if multiple files are selected
FileName: string - The filename that was selected
Filter: string - A filter formatted string
FilterIndex: integer - The index of which filter to use

InitialDir: string - Sets the folder the filedialog will show first
methods

OpenDialog Class: (Inheritance: FileDialog->CommonDialog->Component->Object)
createOpenDialog(owner) : Creates an opendialog object

properties
Options: String
A string formatted as "[param1, param2, param3]" to set OpenDialogs options
Valid parameters are:
ofReadOnly,
ofOverwritePrompt : if selected file exists shows a message, that file will be overwritten
ofHideReadOnly : hide read only file
ofNoChangeDir : do not change current directory
ofShowHelp : show a help button
ofNoValidate
ofAllowMultiSelect : allow multiselection
ofExtensionDifferent
ofPathMustExist : shows an error message if selected path does not exist
ofFileMustExist : shows an error message if selected file does not exist
ofCreatePrompt
ofShareAware
ofNoReadOnlyReturn : do not return filenames that are readonly
ofNoTestFileCreate
ofNoNetworkButton
ofNoLongNames
ofOldStyleDialog
ofNoDereferenceLinks : do not expand filenames
ofEnableIncludeNotify
ofEnableSizing : dialog can be resized, e.g. via the mouse
ofDontAddToRecent : do not add the path to the history list
ofForceShowHidden : show hidden files
ofViewDetail : details are OS and interface dependent
ofAutoPreview : details are OS and interface dependent

methods
-

SaveDialog Class: (Inheritance: OpenDialog->FileDialog->CommonDialog->Component->Object)
createSaveDialog(owner)

SelectDirectoryDialog Class: (Inheritance: OpenDialog->FileDialog->CommonDialog->Component->Object)
createSelectDirectoryDialog(owner)

Stream Class

properties
Size: integer
Position: integer

methods
copyFrom(stream, count) - Copies count bytes from the given stream to this stream
read(count): bytetable - Returns a bytetable containing the bytes of the stream. This increases the position
write(bytetable, count OPTIONAL)- Writes the given bytetable to the stream

MemoryStream Class (Inheritance: Stream->Object)
createMemoryStream()

properties
Memory: Integer - The address in Cheat Engine's memory this stream is loaded (READONLY, tends to change)

methods
loadFromFile(filename) : Replaces the contents in the memory stream with the contents of a file on disk
saveToFile(filename) : Writes the contents of the memory stream to the specified file

FileStream Class (Inheritance: HandleStream->Stream->Object)
createFileStream(filename, mode)

StringStream Class (Inheritance: Stream->Object)
createStringStream(string)

properties
DataString: The internal string

TableFile class (Inheritance: Object)
findTableFile(filename): Returns the TableFile class object for the saved file
createTableFile(filename, filepath OPTIONAL): TableFile - Add a new file to your table. If no filepath is specified, it will create a blank file. Otherwise, it will read the contents from disk.

properties
Name: string
Stream: MemoryStream

methods
delete() : Deletes this file from your table.
saveToFile(filename)
getData() : Gets a MemoryStream object

xmplayer class
The xmplayer class has already been defined as xmplayer, no need to create it manually

properties
IsPlaying : boolean - Indicator that the xmplayer is currently playing a xm file
Initialized: boolean - Indicator that the xmplayer is actually actively loaded in memory

methods
setVolume(int)
playXM(filename, OPTIONAL noloop)
playXM(tablefile, OPTIONAL noloop)
playXM(Stream, OPTIONAL noloop)
pause()
resume()
stop()

CheatComponent Class: (Inheritance: WinControl->Control->Component->Object)
The cheatcomponent class is the component used in Cheat Engine 5.x trainers
Most people will probably want to design their own components but for those that don't know much coding and use the autogenerated trainer this will be used

properties
Color: Integer - background color
Textcolor: integer - text color
Activationcolor: integer - The textcolor to show when activated is true
Activated: boolean - Toggles between the ActivationColor and the TextColor
Editleft:integer - The x position of the optional edit field
Editwidth: integer - the width of the optional edit field
Editvalue:string - The string of the optional edit field
Hotkey:string read - The hotkeypart of the cheat line
Description:string - Description part of the cheat line
Hotkeyleft: integer - The x position of the hotkey line
Descriptionleft:integer - The x position of the Description line

ShowHotkey: boolean - Decides if the hotkey label should be shown
HasEditBox: boolean - Decides if the editbox should be shown
HasCheckbox: boolean - Decides if the checkbox should be shown
Font: Font - The font to use to render the text

methods
-

MemoryRecordHotkey Class: (Inheritance: object)
The memoryrecord hotkey class is mainly readonly with the exception of the event properties to be used to automatically create trainers
Use the generic hotkey class if you wish to create your own hotkeys

properties
Owner: MemoryRecord - The memoryrecord this hotkey belongs to (ReadOnly)
Keys: Table - Table containing the keys(combination) for this hotkey
action: integer - The action that should happen when this hotkey triggers
mrhToggleActivation(0): Toggles between active/deactive
mrhToggleActivationAllowIncrease(1): Toggles between active/deactive. Allows increase when active
mrhToggleActivationAllowDecrease(2): Toggles between active/deactive. Allows decrease when active
mrhActivate(3): Sets the state to active
mrhDeactivate(4): Sets the state to deactive
mrhSetValue(5): Sets a specific value to the value properyy (see value)
mrhIncreaseValue(6): Increases the current value with the value property (see value)
mrhDecreaseValue(7): Decreases the current value with the value property (see value)
value: string - Value used depending on what kind of hotkey is used
ID: integer - Unique id of this hotkey (ReadOnly)
Description: string - The description of this hotkey
HotkeyString: string - The hotkey formatted as a string (ReadOnly)
ActivateSound: string - Tablefile name of a WAV file inside the table which will get played on activate events
DeactivateSound: string - Tablefile name of a .WAV file inside the table which will get played on deactivate events
OnHotkey: function(sender) - Function to be called when a hotkey has just been pressed
OnPostHotkey: function(sender) - Function to be called when a hotkey has been pressed and the action has been performed

methods
doHotkey: Executes the hotkey as if it got triggered by the keyboard

MemoryRecord Class:
The memoryrecord objects are the entries you see in the addresslist

properties
ID: Integer - Unique ID
Index: Integer - The index ID for this record. 0 is top. (ReadOnly)
Description: string- The description of the memory record
Address: string - Get/set the interpretable address string. Useful for simple address settings.
OffsetCount: integer - The number of offsets. Set to 0 for a normal address
Offset[] : integer - Array to access each offset
OffsetText[] : string - Array to access each offset using the interpretable text style

CurrentAddress: integer - The address the memoryrecord points to
Type: ValueType - The variable type of this record. See vtByte to vtCustom
If the type is vtString then the following properties are available:
String.Size: Number of characters in the string
String.Unicode: boolean
String.Codepage: boolean

If the type is vtBinary then the following properties are available
Binary.Startbit: First bit to start reading from
Binary.Size : Number of bits

If the type is vtByteArray then the following properties are available
Aob.Size : Number of bytes

CustomTypeName: String - If the type is vtCustomType this will contain the name of the CustomType
Script: String - If the type is vtAutoAssembler this will contain the auto assembler script
Value: string - The value in stringform.
Selected: boolean - Set to true if selected (ReadOnly)
Active: boolean - Set to true to activate/freeze, false to deactivate/unfreeze
Color: integer
ShowAsHex: boolean - Self explanatory
ShowAsSigned: boolean - Self explanatory
AllowIncrease: boolean - Allow value increasing, unfreeze will reset it to false
AllowDecrease: boolean - Allow value decreasing, unfreeze will reset it to false
Collapsed: boolean - Set to true to collapse this record or false to expand it. Use expand/collapse methods for recursive operations.
IsGroupHeader: boolean - Set to true if the record was created as a Group Header with no address or value info. (ReadOnly)
IsReadable: boolean - Set to false if record contains an unreadable address. NOTE: This property will not be set until the value property is accessed at least once. (ReadOnly)

Count: Number of children
Child[index] : Array to access the child records
[index] = Child[index]

HotkeyCount: integer - Number of hotkeys attached to this memory record
Hotkey[] : Array to index the hotkeys

OnActivate: function(memoryrecord,before,currentstate):boolean - The function to call when the memoryrecord will change (or changed) Active to true. If before is true, not returning true will cause the activation to stop.
OnDeactivate: function(memoryrecord,before,currentstate):boolean - The function to call when the memoryrecord will change (or changed) Active to false. If before is true, not returning true will cause the deactivation to stop.
OnDestroy: function() - Called when the memoryrecord is destroyed.
OnGetDisplayValue: function(memoryrecord,valuestring):boolean,string - This function gets called when rendering the value of a memory record. Return true and a new string to override the value shown
DontSave: boolean - Don't save this memoryrecord and it's children

methods
getDescription()
setDescription()
getAddress() : Returns the interpretable addressstring of this record. If it is a pointer, it returns a second result as a table filled with the offsets
setAddress(string) : Sets the interpretable address string, and if offsets are provided make it a pointer

getOffsetCount(): Returns the number of offsets for this memoryrecord
setOffsetCount(integer): Lets you set the number of offsets

getOffset(index) : Gets the offset at the given index
setOffset(index, value) : Sets the offset at the given index

getCurrentAddress(): Returns the current address as an integer (the final result of the interpretable address and pointer offsets)

appendToEntry(memrec): Appends the current memory record to the given memory record

getHotkey(index): Returns the hotkey from the hotkey array
getHotkeyByID(integer): Returns the hotkey with the given id

reinterpret()
createHotkey({keys}, action, value OPTIONAL): Returns a hotkey object

disableWithoutExecute(): Sets the entry to disabled without executing the disable section

global events
function onMemRecPreExecute(memoryrecord, newstate BOOLEAN):
If above function is defined it will be called before action* has been performed.
Active property is about to change to newState.
function onMemRecPostExecute(memoryrecord, newState BOOLEAN, succeeded BOOLEAN):
If above function is defined it will be called after action*.
Active property was supposed to change to newState.
If 'succeeded' is true it means that Active state has changed and is newState.
newState and succeeded are read only.
*action can be: running auto assembler script (ENABLE or DISABLE section), freezing and unfreezing.

Addresslist Class: (Inheritance: Panel->WinControl->Control->Component->Object)
properties
Count: Integer - The number of records in the table
SelCount: integer- The number of records that are selected
SelectedRecord: MemoryRecord - The main selected record
MemoryRecord[]: MemoryRecord - Array to access the individial memory records
[] = MemoryRecord - Default accessor

CheckboxActiveSelectedColor: color
CheckboxActiveColor: color
CheckboxSelectedColor: color
CheckboxColor: color
SelectedBackgroundColor: color
SelectedSecondaryBackgroundColor: color
ExpandSignColor: color
IncreaseArrowColor: color
DecreaseArrowColor: color

OnDescriptionChange: function(addresslist,memrec):boolean - called when the user initiates a description column change on a record. Return true if you handle it, false for normal behaviour
OnAddressChange: function(addresslist,memrec):boolean - called when the user initiates an address column change on a record. Return true if you handle it, false for normal behaviour
OnTypeChange: function(addresslist,memrec):boolean - called when the user initiates a type column change on a record. Return true if you handle it, false for normal behaviour
OnValueChange: function(addresslist,memrec):boolean - called when the user initiates a value column change on a record. Return true if you handle it, false for normal behaviour

methods
getCount()
getMemoryRecord(index)
getMemoryRecordByDescription(description): returns a MemoryRecord object
getMemoryRecordByID(ID)
createMemoryRecord() : creates an generic cheat table entry and add it to the list

getSelectedRecords(): Returns a table containing all the selected records

doDescriptionChange() : Will show the GUI window to change the description of the selected entry
doAddressChange() : Will show the GUI window to change the address of the selected entry
doTypeChange() : Will show the GUI window to change the type of the selected entries
doValueChange() : Will show the GUI window to change the value of the selected entries

getSelectedRecord() : Gets the main selected memoryrecord
setSelectedRecord(memrec) : Sets the currently selected memoryrecord. This will unselect all other entries

disableAllWithoutExecute(): Disables all memory records without executinbg their [Disable] section

MemScan Class (Inheritance: Object)
getCurrentMemscan() : Returns the current memory scan object. If tabs are used the current tab's memscan object
createMemScan(progressbar OPTIONAL) : Returns a new MemScan class object

properties
OnScanDone: function(memscan) - Set a function to be called when the scan has finished
OnGuiUpdate: function(memscan, TotalAddressesToScan, CurrentlyScanned, ResultsFound) - Called during the scan so you can update the interface if needed
FoundList: FoundList - The foundlist currently attached to this memscan object
OnlyOneResult: boolean - If this is set to true memscan will stop scanning after having found the first result, and written the address to "Result"
Result: Integer - If OnlyOneResult is used this will contain the address after a scan has finished

methods

firstScan(scanoption, vartype, roundingtype, input1, input2 ,startAddress ,stopAddress ,protectionflags ,alignmenttype ,"alignmentparam" ,isHexadecimalInput ,isNotABinaryString, isunicodescan, iscasesensitive);
Does an initial scan.
memscan: The MemScan object created with createMemScan
scanOption: Defines what type of scan is done. Valid values for firstscan are:
soUnknownValue: Unknown initial value scan
soExactValue: Exact Value scan
soValueBetween: Value between scan
soBiggerThan: Bigger than ... scan
soSmallerThan: smaller than ... scan

vartype: Defines the variable type. Valid variable types are:
vtByte
vtWord 2 bytes
vtDword 4 bytes
vtQword 8 bytes
vtSingle float
vtDouble
vtString
vtByteArray
vtGrouped
vtBinary
vtAll

roundingtype: Defined the way scans for exact value floating points are handled
rtRounded : Normal rounded scans. If exact value = "3" then it includes 3.0 to 3.49999999. If exact value is "3.0" it includes 3.00 to 3.0499999999
rtTruncated: Truncated algorithm. If exact value = "3" then it includes 3.0 to 3.99999999. If exact value is "3.0" it includes 3.00 to 3.099999999
rtExtremerounded: Rounded Extreme. If exact value = "3" then it includes 2.0000001 to 3.99999999. If exact value is "3.0" it includes 2.900000001 to 3.099999999

input1: If required by the scanoption this is a string of the given variable type
input2: If requires by the scanoption this is the secondary input

startAddress : The start address to scan from. You want to set this to 0
stopAddress : The address the scan should stop at. (You want to set this to 0xffffffffffffffff)

protectionflags : See aobscan about protectionflags
alignmenttype : Scan alignment type. Valid options are:
fsmNotAligned : No alignment check
fsmAligned : The address must be dividable by the value in alignmentparam
fsmLastDigits : The last digits of the address must end with the digits provided by alignmentparam

alignmentparam : String that holds the alignment parameter.

isHexadecimalInput: When true this will handle the input field as a hexadecimal string else decimal
isNotABinaryString: When true and the varType is vtBinary this will handle the input field as a decimal instead of a binary string
isunicodescan: When true and the vartype is vtString this will do a unicode (utf16) string scan else normal utf8 string
iscasesensitive : When true and the vartype is vtString this check if the case matches

nextScan(scanoption, roundingtype, input1,input2, isHexadecimalInput, isNotABinaryString, isunicodescan, iscasesensitive, ispercentagescan, savedresultname OPTIONAL);
Does a next scan based on the current addresslist and values of the previous scan or values of a saved scan
memscan: The MemScan object that has previously done a first scan
scanoption:
soExactValue: Exact Value scan
soValueBetween: Value between scan
soBiggerThan: Bigger than ... scan
soSmallerThan: smaller than ... scan
soIncreasedValue: Increased value scan
soIncreasedValueBy: Increased value by scan
soDecreasedValue: Decreased value scan
soDecreasedValueBy: Decreased value by scan
soChanged: Changed value scan
soUnchanged: Unchanged value scan

roundingtype: Defined the way scans for exact value floating points are handled
rtRounded : Normal rounded scans. If exact value = "3" then it includes 3.0 to 3.49999999. If exact value is "3.0" it includes 3.00 to 3.0499999999
rtTruncated: Truncated algoritm. If exact value = "3" then it includes 3.0 to 3.99999999. If exact value is "3.0" it includes 3.00 to 3.099999999
rtExtremerounded: Rounded Extreme. If exact value = "3" then it includes 2.0000001 to 3.99999999. If exact value is "3.0" it includes 2.900000001 to 3.099999999

input1: If required by the scanoption this is a string of the given variable type
input2: If requires by the scanoption this is the secondary input

isHexadecimalInput: When true this will handle the input field as a hexadecimal string else decimal
isNotABinaryString: When true and the varType is vtBinary this will handle the input field as a decimal instead of a binary string
isunicodescan: When true and the vartype is vtString this will do a unicode (utf16) string scan else normal utf8 string
iscasesensitive : When true and the vartype is vtString this check if the case matches
ispercentage: When true and the scanoption is of type soValueBetween, soIncreasedValueBy or soDecreasedValueBy will cause CE to do a precentage scan instead of a normal value scan
savedResultName: String that holds the name of a saved result list that should be compared against. First scan is called "FIRST"

newScan() : Clears the current results
waitTillDone() : Waits for the memscan thread(s) to finish scanning. Always use this
saveCurrentResults(name) : Save the current scanresults to a unique name for this memscan. This save can be used to compare against in a subsequent next scan
getAttachedFoundlist() : Returns a FoundList object if one is attached to this scanresults. Returns nil otherwise

setOnlyOneResult(state): If set to true before you start a scan, this will cause the scanner to only return one result. Note that it does not work with a foundlist
getOnlyResult(): Only works if returnOnlyOneResult is true. Returns nil if not found, else returns the address that was found (integer)
getProgress(): returns a table with fields: TotalAddressesToScan, CurrentlyScanned, ResultsFound

FoundList
The foundlist is an object that opens the current memscan's result file and provides an interface for reading out the addresses

createFoundList(memscan)

properties
Count: integer;
Address[index]
Value[index]

methods
initialize() : Call this when a memscan has finished scanning. This will open the results for reading
deinitialize() : Release the results
getCount()
getAddress(index) : Returns the address as a string
getValue(index) : Returs the value as a string

Memoryview class: (Inheritance: Form->ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)
createMemoryView() - Creates a new memoryview window. This window will not receive debug events. Use getMemoryViewForm() function to get the main memoryview window
properties
DisassemblerView: The disassemblerview class of this memoryview object
HexadecimalView: The hexadecimalview class of this memoryview object
methods
-

DisassemblerviewLine class: (Inheritance: Object)
properties
Address: The current address of this line
Owner: The Disassemblerview that owns this line

methods
-

Disassemblerview class: (Inheritance: Panel->CustomControl->WinControl->Control->Component->Object)
The visual disassembler used on the memory view window
properties
SelectedAddress: integer - The currently selected address in the disassemblerview
SelectedAddress2: integer - The secondary selected address in the disassemblerview
TopAddress: Integer - The first address to show
ShowJumplines: boolean - Determines if the jumplines should be shown
OnSelectionChange: function(sender, address, address2) - Function to call when the selection has changed
OnExtraLineRender: function(sender, Address, AboveInstruction, Selected): RasterImage OPTIONAL, x OPTIONAL, y OPTIONAL
Function to call when you wish to provide the disassembler view with an extra image containing data you wish to show.
This function is called once to get an image to show above the instruction, and once to get an image to show under the instruction and optional comments.
The image for both calls must be different objects as rendering will only be done when both calls have been completed

Sender is a DisassemblerviewLine object
If no coordinates are given the image will be centered above/below the instruction

methods
-

Hexadecimal class: (Inheritance: Panel->CustomControl->WinControl->Control->Component->Object)
The visual hexadecimal object used on the memory view window
properties
OnAddressChange(hexadecimalview, function): function(hexadecimalview, address)
OnByteSelect(hexadecimalview, function): function(hexadecimalview, address, address2)

methods
-

Thread Class: (Inheritance: Object)
createNativeThread(function(Thread,...), ...) :
Executes the given function in another thread using the systems thread mechanism
The function returns the Thread class object
function declaration: function (Thread, ...)

createNativeThreadSuspended(function(Thread,...), ...) :
Same as createNativeThread but it won't run until resume is called on it

properties
name: string - This name will be shown when the thread terminated abnormally
Finished: boolean - Returns true if the thread has reached the end. Do not rely on this if the thread is freeOnTerminate(true) (which is the default)
Terminated: boolean - Returns true if the Terminate method has been called

methods
freeOnTerminate(state) :
When set to true the thread object will free itself when the function ends (default=true)
Note: Use this only from inside the thread function as the thread might have already terminated and freed itself when called

synchronize(function(thread, ...), ...) :
Called from inside the thread. This wil cause the tread to get the main thread to execute the given function and wait for it to finish.
Usually for GUI access
Returns the return value of the given function

waitfor() :
Waits for the given thread to finish (Not recommended to call this from inside the thread itself)

suspend() :
Suspend the thread's execution

resume() :
Resume the thread;s executionmm

terminate() :
Tells the thread it should terminate. The Terminated property will become true

CriticalSection class: (Inheritance: Object)
createCriticalSection(): Returns a critical section object

properties
-

methods
enter()
leave()
tryEnter(): Returns true if entered, false if not

Event class: (Inheritance: Object)
createEvent(ManualReset, InitialState): Returns an event object

properties
-

methods
resetEvent()
setEvent()
waitFor(timeout): Waits for the event to be set. Returns wrSignaled(0), wrTimeout(1), wrAbandoned(2) or wrError(3);

Semaphore class: (Inheritance: Object)
createSemaphore(count): Returns an semaphore object
properties
-

methods
acquire()
release()

MultiReadExclusiveWriteSynchronizer class: (Inheritance: Object)
createMultiReadExclusiveWriteSynchronizer(): Returns a createMultiReadExclusiveWriteSynchronizer

properties
-

methods
beginWrite()
endWrite()
beginRead()
endRead()

StructureFrm class:
createStructureForm(address)
properties:
Column[index]: structColumn - Fetches a structColumn object from the structure form
Group[index]: structGroup - Fetches a structGroup object from the structure form

methods:
structChange() : Forces a refresh
addColumn(): Adds a new column in the currently focuses group and returns it's structColumn object
addGroup(): Adds a new group and returns the structGroup object

structColumn class:
properties:
Address: integer - The current address
AddressText: string - Gets/sets the visual address
Focused: boolean - Gets/sets the focused state

methods:
focus(): focuses the current column

structGroup class:
properties:
name: string - gets the current name
box: Groupbox - Gets the groupbox object
columnCount: integer- Gets the number of columns in the group
columns[index]: structColumn - Returns the specific structColumn object

methods:
addColumns(): Adds a new columns to the specific group and returns it's structColumn objecy

Structure class related functions:
getStructureCount(): Returns the number of Global structures. (Global structures are the visible structures)
getStructure(index): Returns the Structure object at the given index
createStructure(name): Returns an empty structure object (Not yet added to the Global list. Call structure.addToGlobalStructureList manually)

structure class: (Inheritance: Object)
Properties:
Name: String - The name of the structure
Size: Integer - The number of bytes between the last element and the start. ReadOnly
Count: Integer - Number of elements in the structure. ReadOnly
Element[]: structureElement - Returns the structure element at the given index. Readonly
Methods:
getName(): Returns the name
setName(name): Sets the name
getElement(index): Returns a structureElement object (Changing offsets can change the index)
getElementByOffset(offset): Returns a structureElement object where the specified offset is at least the requested offset
addElement(): Adds a new blank structureElement and returns it
autoGuess(baseaddresstoguessfrom, offset, size)
fillFromDotNetAddress(address, changeName): Fills the structure with the layout gathered from querying .NET. If changeName is true, the structure will take the name of the .NET class. (6.4+)

beginUpdate(): Call this when you want to make multiple updates to a structure. It will speed up the update process
endUpdate(): Call this when done
addToGlobalStructureList(): Add this to the list of structures for the user to select from. (Global structures will get saved to the table)
removeFromGlobalStructureList(): Remove from the list of structures.

StructureElement class: (Inheritance: Object)
Properties:
Owner: structure - The structure this element belongs to. Readonly
Offset: integer - The offset of this element
Name: string - The name of this element
Vartype: integer - The variable type of this element
ChildStruct: structure - If not nil this element is a pointer to the structure defined here
ChildStructStart: integer - The number of bytes inside the provided childstruct. (E.g: It might point to offset 10 of a certain structure)
Bytesize: integer - The number of bytes of this element. Readonly for basic types, writable for types that require a defined length like strings and array of bytes

Methods:
getOwnerStructure(): Returns the structure this element belongs to
getOffset(): Returns the offset of this element
setOffset(offset): Sets the offset of this element
getName(): Returns the name of this element
setName(name): Sets the name of this element (tip: Leave blank if you only want to set the name of the variable)
getVartype(): Returns the variable type of this element (check Variable types in defines.lua)
setVartype(vartype)
getChildStruct()
setChildStruct(structure)
getChildStructStart()
setChildStructStart(offset)
getBytesize(): Gets the bytesize of the element. Usually returns the size of the type, except for string and aob
setBytesize(size): sets the bytesize for types that are affected (string, aob)

supportCheatEngine(attachwindow, hasclosebutton, width, height, position ,yoururl OPTIONAL, extraparameters OPTIONAL, percentageshown OPTIONAL):
Will show an advertising window which will help keep the development of Cheat Engine going.
If you provide your own url it will be shown Up to 75% of the time.

attachwindow: Type=Form : The form that the ad is attached to
hasclosebutton: Type=boolean : If true the window will have a border an a close button at top
width, height: Type=integer :
The client width and height of the window.
Prefered formats are : 120x600 , 160x600, 300x250, 468x60, 728x90 ,But you are free to use different formats

Position: Type=integer/enum: The place of the window
0=Top, 1=Right, 2=Bottom, 3=left

Yoururl: Type=string: The url you want to show. When given instead of showing CE's ads 100% it will show your url up to 75%.
You can use it for your own income, or for updating users about new versions of your trainer or whatever you feel like

Extraparameters: Type=String : are url request parameters you can add to the default parameters (e.g trainername=mytrainer for tracking purposes)

PercentageShown: You can change the default of 75% to a smaller value like 50%

fuckCheatEngine() : Removes the ad window if it was showing

Following are some more internal functions for Cheat Engine

dbk_initialize() : Returns true if the dbk driver is loaded in memory. False if it failed for whatever reason (e.g 64-bit and not booted with unsigned driver support)
dbk_useKernelmodeOpenProcess() : Switches the internal pointer of the OpenProcess api to dbk_OpenProcess
dbk_useKernelmodeProcessMemoryAccess() : Switches the internal pointer to the ReadProcessMemory and WriteProcessMemory apis to dbk_ReadProcessMemory and dbk_WriteProcessMemory
dbk_useKernelmodeQueryMemoryRegions() : Switches the internal pointer to the QueryVirtualMemory api to dbk_QueryVirtualMemory
dbk_getPEProcess(processid) : Returns the pointer of the EProcess structure of the selected processid
dbk_getPEThread(threadid) : Gets the pointer to the EThread structure

dbk_readMSR(msr): Reads the msr
dbk_writeMSR(msr, msrvalue): Writes the msr
dbk_executeKernelMemory(address, parameter) :
Executes a routine from kernelmode (e.g a routine written there with auto assembler)
parameter can be a value or an address. It's up to your code how it's handled

dbvm_initialize(offloados OPTIONAL) : Initializes the dbvm functions (dbk_initialize also calls this) offloados is a boolean that when set will offload the system onto dbvm if it's not yet running (and only IF the dbk driver is loaded)
dbvm_readMSR(msr): See dbk_readMSR
dbvm_writeMSR(msr, value): See dbk_writeMSR

dbk_getCR0(): Returns Control Register 0
dbk_getCR3(): Returns Control Register 3 of the currently opened process
dbk_getCR4(): Returns Control Register 4
dbk_getPhysicalAddress(address): Returns the physical address of the given address
dbk_writesIgnoreWriteProtection(state): Set to true if you do not wish to initiate copy-on-write behaviour

dbvm_getCR4(): Returns the real Control Register 4 state

allocateKernelMemory(size) : Allocates a block of nonpaged memory and returns the address
freeKernelMemory(address) : Frees the given memory region

mapMemory(address, size, frompid OPTIONAL, topid OPTIONAL): maps a specific address to the usermode context from the given PID to the given PID. If the PID is 0 or not specified, the cheat engine process is selected. This functions returns 2 results. Address and MDL. The MDL you will need for unmapMemory()
unmapMemory(address, mdl)

onAPIPointerChange(function): Registers a callback when an api pointer is changed (can happen when the user clicks ok in settings, or when dbk_use*** is used. Does NOT happen when setAPIPointer is called)

setAPIPointer(functionid, address): Sets the pointer of the given api to the given address. The address can be a predefined address set at initialization by Cheat Engine, or an address you got from an autoassembler script or injected dll (When Cheat Engine itself was targeted)

functionid:
0: OpenProcess
Known compatible address defines:
windows_OpenProcess
dbk_OpenProcess

1: ReadProcessMemory
Known compatible address defines:
windows_ReadProcessMemory
dbk_ReadProcessMemory
dbk_ReadPhysicalMemory
dbvm_ReadPhysicalMemory

2: WriteProcessMemory
Known compatible address defines:
windows_WriteProcessMemory
dbk_WriteProcessMemory
dbk_WritePhysicalMemory
dbvm_WritePhysicalMemory

3: VirtualQueryEx
Known compatible address defines:
windows_VirtualQueryEx
dbk_VirtualQueryEx
VirtualQueryExPhysical

Extra variables defined:
dbk_NtOpenProcess : Address of the NtOpenProcess implementation in DBK32

The dbvm_ addresses should only be used with auto assembler scripts injected into Cheat Engine
dbvm_block_interrupts : Address of function dbvm_block_interrupts : DWORD; stdcall;
dbvm_raise_privilege : Address of function dbvm_raise_privilege : DWORD; stdcall;
dbvm_restore_interrupts: Address of function dbvm_restore_interrupts : DWORD; stdcall;
dbvm_changeselectors : Address of function dbvm_changeselectors(cs,ss,ds,es,fs,gs: dword): DWORD; stdcall;

D3DHOOK class:
The d3dhook functions provide a method to render graphics and text inside the game, as long as it is running in directx9, 10 or 11

createD3DHook(textureandcommandlistsize OPTIONAL, hookmessages OPTIONAL)
Hooks direct3d and allocates a buffer with given size for storage of for the rendercommand list

hookmessages defines if you want to hook the windows message handler for the direct3d window. The d3dhook_onClick function makes use of that

If no size is provided 16MB is used and hookmessages is true

Note: You can call this only once for a process

It returns a d3dhook object

properties
Width: Integer : The width of the screen (readonly)
Height: integer: The height of the screen (readonly)
DisabledZBuffer: boolean : Set this to true if you don't want previously rendered walls to overlap a newly rendered object (e.g map is rendered first, then the players are rendered)
WireframeMode: boolean : Set this to true if you don't want the faces of 3d objects to be filled
MouseClip: boolean : Set this if to true if you have one of those games where your mouse can go outside of the gamewindow and you don't want that.
OnClick: function(d3dhook_sprite, x, y)
A function to be called when clicked on an sprite (excluding the mouse)
x and y are coordinates in the sprite object. If sprites overlap the highest zorder sprite will be given. It does NOT care if a transparent part is clicked or not

Note: If you set this it can cause a slowdown in the game if there are a lot of sprites and you press the left button a lot

OnKeyDown: function(virtualkey, char)
function(vkey, char) : boolean
A function to be called when a key is pressed in the game window (Not compatible with DirectInput8)
Return false if you do not wish this key event to pass down to the game

methods
beginUpdate() : Use this function when you intent to update multiple sprites,textcontainers or textures. Otherwise artifacts may occur (sprite 1 might be drawn at the new location while sprite 2 might still be at the old location when a frame is rendered)
endUpdate() : When done updating, call this function to apply the changes
enableConsole(virtualkey): Adds a (lua)console to the specific game. The given key will bring it up (0xc0=tilde)
createTexture(filename) : Returns a d3dhook_texture object
createTexture(picture, transparentColor OPTIONAL): Returns a d3dhook_texture object
if the picture is not a transparent image the transparentcolor parameter can be used to make one of it's colors transparent

createFontmap(font) : Returns a d3dhook_fontmap object created from the given font
createSprite(d3dhook_texture): returns a d3dhook_sprite object that uses the given texture for rendering
createTextContainer(d3dhook_fontmap, x, y, text): Returns a d3dhook_textContainer object

D3DHook_Texture Class (Inheritance: Object)
This class controls the texture in memory. Without a sprite to use it, it won't show

properties
Height: integer (ReadOnly)
Width: integer (ReadOnly)
methods
loadTextureByPicture(picture)

D3DHook_FontMap Class (Inheritance: D3DHook_Texture->Object)
A fontmap is a texture that contains extra data regarding the characters. This class is used by the textcontainer
Current implementation only supports 96 characters (character 32 to 127)

properties
-
methods
changeFont(font): Changes the fontmap to the selected font
getTextWidth(string): Returns the width of the given string in pixels

D3DHook_RenderObject Class (Inheritance: Object)
The renderobject is the abstract class used to control in what manner objects are rendered.
The sprite and TextContainer classed inherit from this

properties
X: Float - The x-coordinate of the object on the screen
Y: Float - The y-coordinate of the object on the screen
CenterX: Float - X coordinate inside the object. It defines the rotation spot and affects the X position
CenterY: Float - Y " "
Rotation: Float - Rotation value in degrees (0 and 360 are the same)
Alphablend: Float - Alphablend value. 1.0 is fully visible, 0.0=invisible
Visible: boolean - Set to false to hide the object
ZOrder: integer - Determines if the object will be shown in front or behind another object
methods
-

D3DHook_Sprite Class (Inheritance: D3DHook_RenderObject->Object)
A d3dhook_sprite class is a visible texture on the screen.

properties
Width: Integer - The width of the sprite in pixels. Default is the initial texture width
Height: Integer - The height of the sprite in pixels. Default is the initial texture height
Texture: d3dhook_texture - The texture to show on the screen

methods
-

D3Dhook_TextContainer Class (Inheritance: D3DHook_RenderObject->Object)
A d3dhook_sprite class draws a piece of text on the screen based on the used fontmap.
While you could use a texture with the text, updating a texture in memory is slow. So if you wish to do a lot of text updates, use a textcontainer

properties
FontMap : The D3DHook_FontMap object to use for rendering text
Text : The text to render
methods
-

Disassembler Class (Inheritance: Object)

createDisassembler() - Creates a disassembler object that can be used to disassemble an instruction and at the same time get more data
getDefaultDisassembler() - Returns the default disassembler object used by a lot of ce's disassembler routines
getVisibleDisassembler() - Returns the disassembler used by the disassemblerview. Special codes are: {H}=Hex value {R}=Register {S}=Symbol {N}=Nothing special {C######}=RGB color , {B######}=Background RGB color were ###### is 0xBBGGRR

registerGlobalDisassembleOverride(function(sender: Disassembler, address: integer, LastDisassembleData: Table): opcode, description): Same as Disassembler.OnDisassembleOverride, but does it for all disassemblers, including newly created ones. Tip: Check the sender to see if you should use syntax highlighting codes or not
This function returns an ID you can pass on to unregisterGlobalDisassembleOverride() 6.4+

unregisterGlobalDisassembleOverride(id)

properties
LastDisassembleData : Table
OnDisassembleOverride: function(sender: Disassembler, address: integer, LastDisassembleData: Table): opcode, description
OnPostDisassemble: function(sender: Disassembler, address: integer, LastDisassembleData: Table, result: string, description: string): result, description
syntaxhighlighting: boolean : This property is set if the syntax highlighting codes are accepted or not

Methods
disassemble(address): Disassembles the given instruction and returns the opcode. It also fills in a LastDisassembleData record
decodeLastParametersToString() : Returns the unedited "Comments" information. Does not display userdefined comments
getLastDisassembleData() : Returns the LastDisassembleData table.
The table is build-up as follow:
address: integer - The address that was disassembled
opcode: string - The opcode without parameters
parameters: string - The parameters
description: string - The description of this opcode
bytes: table - A table containing the bytes this instruction consists of (1.. )

modrmValueType: DisAssemblerValueType - Defines the type of the modrmValue field (dvtNone=0, dvtAddress=1, dvtValue=2)
modrmValue: Integer - The value that the modrm specified. modrmValueType defines what kind of value

parameterValueType: DisAssemblerValueType
parameterValue: Integer - The value that the parameter part specified

isJump: boolean - Set to true if the disassembled instruction can change the EIP/RIP (not ret)
isCall: boolean - Set to true if it's a Call
isRet: boolean - Set to true if it's a Ret
isConditionalJump: boolean - Set to true if it's a conditional jump

DissectCode class: (Inheritance: Object)
getDissectCode() : Creates or returns the current code DissectCode object

properties:
methods:
clear() : Clears all data
dissect(modulename) : Dissects the memory of a module
dissect(base,size) : Dissect the specified memory region

addReference(fromAddress, ToAddress, type, OPTIONAL isstring):
Adds a reference. Type can be jtCall, jtUnconditional, jtConditional, jtMemory
In case of jtMemory setting isstring to true will add it to the referenced strings list

deleteReference(fromAddress, ToAddress)

getReferences(address) : Returns a table containing the addresses that reference this address and the type
getReferencedStrings(): Returns a table of addresses and their strings that have been referenced. Use getReferences to find out which addresses that are
getReferencedFunctions(): Returns a table of functions that have been referenced. Use getReferences to find out which callers that are

saveToFile(filename)
loadFromFile(filename)

RIPRelativeScanner class: (Inheritance: Object)
createRipRelativeScanner(startaddress, stopaddress, includejumpsandcalls OPTIONAL):
createRipRelativeScanner(modulename, includejumpsandcalls OPTIONAL): Creates a RIP relative scanner. This will scan the provided module for RIP relative instructions which you can use for whatever you like
properties:
Count: integer - The number of instructions found that have a RIP relative address
Address[]: integer - An array to access the results. The address is the address of the RIP relative offset in the instruction

methods:
-

LuaPipe class: (Inheritance: Object)
Abstract class that LuaPipeServer and LuaPipeclient inherit from. It implements the data transmission methods

properties
Connected: boolean: True if the pipe is connected

methods
lock() : Acquire a lick on this pipe till unlock is called. If lock can not be acquired, wait. Recursive calls are allowed
unlock()
writeBytes(ByteTable, size OPTIONAL): Writes the provided byte table to the pipe. if size is not provided, the whole table is sent. Returns the number of bytes sent, or nil on failure
readBytes(size: integer): returns a byte table from the pipe, or nil on failure

readDouble(): Read a double from the pipe, nil on failure
readFloat(): Read a float from the pipe, nil on failure
readQword(): Read an 8 byte value from the pipe, nil on failure
readDword(): Read a 4 byte value from the pipe, nil on failure
readWord(): Read a 2 byte value from the pipe, nil on failure
readByte(): Read a byte from the pipe, nil on failure

readString(size: integer): Reads a string from the pipe, nil on failure. (Can support 0-byte chars)
readWideString(size: integer): Reads a widestring from the pipe, nil on failure

writeDouble(v: double): Writes a double to the pipe. Returns the number of bytes sent, nil on failure
writeFloat(v: single): writes a float to the pipe. Returns the number of bytes sent, nil on failure
writeQword(v: qword): writes an 8 byte value to the pipe. Returns the number of bytes sent, nil on failure
writeDword(v: dword): writes a 4 byte value to the pipe. Returns the number of bytes sent, nil on failure
writeWord(v: word): writes a word to the pipe. Returns the number of bytes sent, nil on failure
writeByte(v: byte): writes a byte to the pipe. Returns the number of bytes sent, nil on failure

writeString(str: string; include0terminator: boolean OPTIONAL); Writes a string to the pipe. If include0terminator is false or not provided it will not write the 0 terminator byte. Returns the number of bytes written, or nil on failure
writeWideString(str: widestring; include0terminator: boolean OPTIONAL); Writes a widestring to the pipe. If include0terminator is false or not provided it will not write the 0 terminator bytes. Returns the number of bytes written, or nil on failure

LuaPipeClient class: (Inheritance: LuaPipe>Object)
Class implementing a client that connects to a pipe

connectToPipe(pipename,timeout OPTIONAL): Returns a LuaPipeClient connected to the given pipename. Nil if the connection fails. Timeout is number of milliseconds before it disconnects on read/write operations. 0 or nil means never

properties:
methods:
-

LuaPipeServer Class: (Inheritance: LuaPipe>Object)
Class launching the server side of a pipe

createPipe(pipename, inputsize OPTIONAL, outputsize OPTIONAL) : Creates a LuaPipeServer which can be connected to by a pipe client. InputSize and Outputsize define buffers how much data can be in the specific buffer before the writer halts. Default input and output size is 4096 for both

properties
valid: boolean - Returns true if the pipe has been created properly. False on failure (e.g wrong pipename)

methods
acceptConnection() - Waits for a client to connect to this pipe (Warning: Freezes the thread this is executed in)

openLuaServer(Name):
Opens a pipe with the given name. The LuaClient dll needs this name to connect to ce

LuaClient.dll functions: (STDCALL calling machanic)
BOOL CELUA_Initialize(char *name) : Initializes
UINT_PTR CELUA_ExecuteFunction(char *luacode, UINT_PTR parameter)
This function executes a lua function with parameters (parameter) and with the luacode as body Parameter will be treated as an integer
In short:
function(parameter)
<luacode>
end

the return value of this function is the return value of the lua function (integer)

UINT_PTR CELUA_ExecuteFunctionAsync(char *luacode, UINT_PTR parameter)
See CELUA_ExecuteFunction but runs in the server thread instead of passing it to the main GUI and then wait for it's return

integer CELUA_GetFunctionReferenceFromName(char *functionname): Returns a reference ID you can pass on to CELUA_ExecuteFunctionByReference
UINT_PTR CELUA_ExecuteFunctionByReference(int refid, int paramcount, PVOID *parameters, BOOL async):
This functions executes the function specified by reference id. If async is true, the code will run in a seperate thread instead of the main thread
paramcount is the number of parameters to pass on to the function
parameters is a pointer to a list of integers. 32-bit in 32-bit targets, 64-bit in 64-bit targets

Settings class
This class can be used to read out and set settings of cheat engine and of plugins, and store your own data

global functions
getSettings(path Optional): Settings - Returns a settings object. If path is nil it will points to the Cheat Engine main settings (Registry) . If name is provided the settings currently accessed will be the one at the subkey provided
Note: Keep in mind that it returns a new object each call, even if he same name is used multiple times

properties
Path: string - Gets/Sets the current subkey (nil if main)
Value[]: A table access into the settings. e.g: Value["Count"]=12

methods

SymbolList class
This class can be used to look up an address to a symbolname, and a symbolname to an address
It can also be registered with the internal symbol handler of cheat engine

This class makes use of a special "Symbol" table construction that contains size and optionally other data
Symbol Table:
modulename: string
searchkey: string
address: integer
symbolsize: integer

Global functions
createSymbolList() : Creates an empty symbollist

Properties
Methods
clear()
getSymbolFromAddress(address) : Searches the list for the given address. The address does not have to match the exact address. As long as it falls withing the range
getSymbolFromString(searchkey)
addSymbol(modulename, searchkey, address, symbolsize, skipAddressToSymbolLookup OPTIONAL, extradata OPTIONAL)
Adds a symbol to the symbollist
extradata is a table which can be used to fill in a return type and parameters for function calls. It has the following fields:
returntype: string
parameters: string

deleteSymbol(searchkey)
deleteSymbol(address)
register() : Registers the current symbol list with the symbol handler
unregister(): Unregisters the current symbol list from the symbol handler

Pagecontrol Class (WinControl->Control->Component->Object)
This is an object that can hold multiple pages

global functions
createPageControl(owner)
properties
ShowTabs: boolean - Shows the tabs
TabIndex: integer - Gets and sets the current tab
ActivePage: TabSheet - Returns the current tabsheet.
PageCount: integer - Gets the number of pages
Page[]: TabSheet - Get a specific page (TabSheet)
methods
addTab() : TabSheet - Creates a new TabSheet

TabSheet class (WinControl->Control->Component->Object)
Part of a page control. This object can contain other objects
properties
TabIndex: integer - the current index in the pagelist of the owning pagecontrol
methods

Internet class (Object)
global functions
getInternet(string) - Returns an internet class object

properties
Header : string - the additional header to be sent with the next getURL request
methods
getURL(path) - returns a string containing the contents of the url. nil on failure
postURL(path, urlencodeddata) - posts the given data to the path and returns the results

CustomType class (Object)
The custom type is an convertor of raw data, to a human readable interpretation.

global functions
registerCustomTypeLua(typename, bytecount, bytestovaluefunction, valuetobytesfunction, isFloat)
Registers a Custom type based on lua functions
The bytes to value function should be defined as "function bytestovalue (b1,b2,b3,b4)" and return an integer as result
The value to bytes function should be defined as "function valuetobytes (integer)" and return the bytes it should write

returns the Custom Type object

registerCustomTypeAutoAssembler(script)
Registers a custom type based on an auto assembler script. The script must allocate an "ConvertRoutine" and "ConvertBackRoutine"

returns the Custom Type object

getCustomType(typename) : Returns the custom type object, or nil if not found

properties
name: string
functiontypename: string
CustomTypeType: TCustomTypeType - The type of the script
script: string - The custom type script
scriptUsesFloat: boolean - True if this script interprets it's user side values as float

methods
byteTableToValue({bytetable},Address Optional)
valueToByteTable(value, Address Optional)

----SQL Classes----
CustomConnection class (Inheritance: Component->Object)
properties
Connected: Boolean - Gets the current connection state, and lets you connect as well
LoginPrompt: Boolean
AfterConnect: function(sender)
AfterDisconnect: function(sender)
BeforeConnect: function(sender)
BeforeDisconnect: function(sender)
methods
close(forceClose:Boolean Optional)
open()

Database Class (Inheritance: CustomConnection->Component->Object)
properties
Connected: Boolean
DatabaseName: string
KeepConnection: Boolean
Params: Strings
TransactionCount: integer readonly

methods

SQLConnection Class (Inheritance: Database->CustomConnection->Component->Object)
properties
Password: String
UserName: string
Transaction: SQLTransaction - SQLTransaction object. Needs to be set
CharSet: string
HostName: string
Options: string set - [scoExplicitConnect, scoApplyUpdatesChecksRowsAffected]

methods
startTransaction()
endTransaction()
executeDirect(sql)
getTableNames() : Returns a counted table with all tablenames

SQLite3Connection class(Inheritance: SQLConnection->Database->CustomConnection->Component->Object)
createSQLite3Connection(owner) - creates an SQLite3Connection object
setSQLiteLibraryName(pathwithdllname)- Lets you set the path to the sqlite3.dll in case it's not .\win*\sqlite3.dll

properties
methods
createDB()
dropDB()
getInsertID(): integer

ODBCConnection class(Inheritance: SQLConnection->Database->CustomConnection->Component->Object)
createODBCConnection(owner) - creates an ODBCConnection object
properties
Driver: string
FileDSN: string

methods

DBTransaction class (Inheritance: Component->Object)
properties
Active: boolean
DataBase: Database
methods
closeDataSets()

SQLTransaction class (Inheritence: DBTransaction->Component->Object)
createSQLTransaction(owner): Creates an SQLTransaction object
properties
SQLConnection: SQLConnection
Params: StringList
Options: string - set of [stoUseImplicit, stoExplicitStart]
Action: string - options between caNone, caCommit, caCommitRetaining, caRollback,
caRollbackRetaining

methods
commit()
commitRetaining()
rollback()
rollbackRetaining()
startTransaction()
endTransaction()

Param class (Inheritence: CollectionItem->Object))
properties
Name: string
Value: something
DataType: string
AsBoolean
AsByteTable
AsInteger
AsNumber
AsString
Text
Size
Precision
IsNull: boolean

methods

Params class (Inheritence: Collection->Object)
properties
Items[index]: Param

methods
AddParam(Param)

Field class (Inheritance: Component->Object)
properties
FieldName: string
Index: integer
Value: something
DataType: string
AsBoolean
AsByteTable
AsInteger
AsNumber
AsString
Text
Size
IsNull: boolean
methods

Fields class (Inheritence: Object)
properties
Count: integer
Fields[index]: Field
methods
add(Field)
clear()
fieldByName(name): Field
fieldByNumber(integer): Field
indexOf(field): integer

Dataset class (Inheritance: Component->Object)
properties
BlockReadSize: integer
BOF: boolean; READONLY
CanModify: boolean READONLY
DefaultFields: boolean READONLY
EOF: boolean; READONLY
FieldCount: integer; READONLY
Fields: Fields READONLY
Found: boolean READONLY
Modified: boolean READONLY
IsUniDirectional: boolean READONLY
RecordCount: integer READONLY
RecNo: integer
FieldValues[fieldname]: something
Filter: string
Filtered: boolean
FilterOptions: set of [foCaseInsensitive, foNoPartialCompare]
Active: boolean
AutoCalcFields: boolean

methods
append()
appendRecord({values})
cancel()
checkBrowseMode()
clearFields()
close();
controlsDisabled(): boolean
cursorPosChanged;
delete;
disableControls;
edit;
enableControls;
fieldByName(fieldname): Field
findField(fieldname): Field
findFirst() boolean
findLast()
findNext()
findPrior()
first()
insert()
isEmpty()
last()
locate(KeyFields, KeyValues, options:"[loCaseInsensitive, loPartialKey]"): boolean
lookup(keyfields, KeyValues, ResultFields): something
moveBy(distance)
next()
open()
post()
prior()
refresh()
updateCursorPos()
updateRecord()

DBDataset class (Inheritance: Dataset->Component->Object)
properties
DataBase: Database
Transaction: DBTransaction

methods
-

CustomBufDataset class (Inheritance: DBDataset->Dataset->Component->Object)
properties
FileName: string
PacketRecords: integer
UniDirectional: boolean
IndexName: string
MaxIndexesCount: integer
ChangeCount: integer
ReadOnly: boolean

methods
applyUpdates(MaxErrors Optional)
cancelUpdates()
loadFromStream(stream)
saveToStream(stream)
loadFromFile(filename)
saveToFile(filename)
createDataset()

CustomSQLQuery class (Inheritance: CustomBufDataset->DBDataset->Dataset->Component->Object)
properties
prepared: boolean READONLY
SQLConnection: SQLConnection
SQLTransaction: SQLTransaction

methods
prepare()
unprepare()
execSQL()
rowsAffected()
paramByName(paramname): Param

SQLQuery class (Inheritance: CustomSQLQuery->CustomBufDataset->DBDataset->Dataset->Component->Object)
createSQLQuery(owner)
properties
Database: Database

SchemaType: string READFONLY - can be: stNoSchema, stTables, stSysTables, stProcedures, stColumns, stProcedureParams, stIndexes, stPackages, stSchemata, stSequences
StatementType: string READONLY - can be :stUnknown, stSelect, stInsert, stUpdate, stDelete,
stDDL, stGetSegment, stPutSegment, stExecProcedure,
stStartTrans, stCommit, stRollback, stSelectForUpd

Params: Params object
ParamCheck: Boolean
ParseSQL: Boolean
UpdateMode: string - can be :upWhereAll, upWhereChanged, upWhereKeyOnly
UsePrimaryKeyAsKey: boolean
ReadOnly: boolean

SQL: string
InsertSQL: stringlist
UpdateSQL: stringlist
DeleteSQL: stringlist
RefreshSQL: stringlist
Options: string - set of [sqoKeepOpenOnCommit, sqoAutoApplyUpdates, sqoAutoCommit,
sqoCancelUpdatesOnRefresh, sqoRefreshUsingSelect]

methods


Find out what addresses this instruction accesses
This option will set a breakpoint on the code and open a new window. You will see every address that is accessed by the code when the program is running.

The address field contains the address which is accessed by the code. The value field is containing the value of the address at the moment. You can choose the displayed value type from the dropdown menu. The count number shows how many times did the code access to that address.

Right-clicking on an address will offer some new options.
Show register states: This will show the value of the registers that were logged when the address has been accessed by the code the first time. In the register window, you can click on F to see the FPU registers and S to see a snapshot from the stack.

Browse this memory region will open the memory view at the address and Show as hexadecimal will display the value in hexadecimal.

You can stop the debugger with the Stop button.


Find out what writes/accesses this address
This option will set a breakpoint on the address and open a new window. You will see every instructions that are accessing to the address while the program is running.

You can see a counter to display how many times has the instruction accessed to the address and you can see the instruction.

The following options are available for the selected instruction.
Replace: Replace the code with NOPs and also add it to the code list.

Show disassembler: Open the disassembler and jump to the code.

Add to the code list: Add the selected addresses to the code list.

More information: Show the code along with the register values that were logged after the code has accessed to the address. You can open the FPU window with F and the Stack View with S.

You can stop the debugger with the Stop button.


Dissect code
This simple option will analyze the code of the target process and place useful information in the disassembler view. When you see a code, it will be displayed if the code is a destination for call or jump instructions. Of course it will also display the source of the call or jump.


Dissect data/structures
This option is a fine tool to examine or compare data in similar memory regions or structures. It can be used if you wish to compare your charachter's structure with the enemy's structure in an FPS or strategy game, but of course it can be used for other purposes too.

File->New window: This option will open a new dissect window.
File->Import: Import a structure.
File->Export: Export a structure.
File->Save values: Save the content of the window in a file.
File->Add extra address: Add a slot for an extra address for comparing.

View->Change colors: Customize the colors of this tool.
View->Update interval: Customize the value update interval.

Structures: Create a new structure with Define new structure, then give a name and a size for the structure. If you have more than one structure, you can choose the one that you need from here.

Commands: Rename and Delete structure will rename and delete the currently used structure.
Automatically guess offset types will allow CE to guess the type of values in the structure.

If you have added one or more addresses to the window, you can right-click on an address and sort them into groups. This is very useful because you can compare the values in every structure and also see if the values are the same in the same group, or they are different inside the group too (e.g. you can add 2 enemy unit and 2 friendly unit in an RTS game and place the enemies in a different group, thus you will see what is common between friendly units and what is common between enemy units)

If you right-click on an entry in the window, some additional options will be available, such as Memory browse this address, Memory browse this pointer and Add to address list.


Pointer scan
You can open the pointer scanner with Memory View->Tools->Pointer scan, or by right-clicking on an address in the address list and choose "Pointer scan for this address".

If you use the first method, you can use File->Open to open a saved pointer list or you can use the Pointer scanner->Scan for pointer option.
If you start a pointer scan, a new window will appear where you can customize the parameters of the scan.

At the top of the window, you can choose to find pointer for an address or for a value. Searching for an address is much faster, so this is the default method.
Below that, you can set the parameters of the scan. Usually you don't need to change the upper part at all, especially if you have no idea what it does.

At the bottom part of the window, there are other options that you may need to change sometimes. The number of scanning threads is working fine with single and dual core processors but you may increase it if you have a better CPU. The maximum offset value should be changed only if you suspect that any of the offsets will be larger than 2048 bytes (e.g. an offset like eax+1F48 or similar, which is not so common for most of the values that cheaters are looking for). The max level of the pointer path is 5 by default, but some programs are using even longer pointer paths, so if you didn't find what you were looking for, probably you need to increase the max level.

If you have typed in the address, checked the options and clicked on ok, you will have to choose a name for the pointer list that will be created. Then wait for the scan to finish the job.

If the scanning is done, you will get a huge list of possible pointer paths, but not all of them will work for you if the address will be changed. For now, you have a saved pointer list which can be opened later from the File menu in the Pointer scan window.

Now make sure to change the address of the value, which usually means die in the game, restart your level or restart your game.
Find the value again by scanning for it and you will have the new address.
If your pointer scan window was closed, open the saved pointerlist. Now probably you have noticed that many of the found pointers are pointing to wrong addresses, which means we have to remove the wrong ones.

Now you can use the Pointer scanner->Rescan memory option.
Type in the new address, choose a name for the new pointerlist and CE will filter out the pointers that are pointing to the wrong address.
Now you should have much less pointers in the list but at least they are correct.

It may happen that some of the pointers will fail to work from time to time, in this case, you need to filter them again, until you find reliable pointers which are working for you in every case. Keep rescanning the pointers until you have found one that is perfect for you.

If you wish to add a pointer to the address list, all you need to do is double-click on it in the pointer list and it will be added to your table as a new pointer.


Break and trace
If you have used the Break and trace option in CE 5.x, you will notice that this option has been improved to be a much more advanced feature in CE 6. First you are able to use break and trace with data breakpoints too. Furthermore, you can set a breaking condition and stopping condition for the trace and you also have the option to log the stack to a certain level (4096 bytes are used to make the stack snapshots).
If you see a trace log, you will notice additional, very important changes.
The trace log is displayed as a tree, so you can see calls and returns easily. This way the log is also a structured map of the traced code, which is undoubtedly a huge improvement compared to the previous logs. It will not only help you to navigate, but you can also see where is your code in the tree and how "deep" is the function where it is used. Advanced users will probably appreciate this. Right-clicking in the log will offer the collapse and expand tree options.
There are a few additional options like saving the log and searching in the log (which was not possible in earlier versions). Also an improvement that the values on the addresses in the codes are shown.
Clicking on the F button will bring up the FPU register window, and the S button will show the Stack View window. If You right-click in the stack view, you can change the offset display between ebp+* and esp+* which is very useful when you are tracing values in the stack.


Structure spider
The structure spider is like the structure dissect a useful tool in finding common values and differences between structures.
The structure spider goes a bit further in that it automatically follows all possible pointer paths.

When doing a scan, you can give two base pointers and tell the scanner that the values should be the same, or different

Another use of the structure spider is that it can focus on stringscans, which is useful for heavily scripted games. For example, if a script engine changes the value of a variable named "ammo" you could do a structure scan for the text "ammo" . This will show all paths to that variablename.
De a rescan a few times to filter out the paths that are wrong, and you'll have a pretty stable pointerpath you can use in a code injection to see if the script engine is going to change ammo, or something else


Plugin system

Cheat Engine comes with a plugin system so developers can add extra functions and features to ce without having to code in Delphi (Any language that can create standard DLL's with normal exports can make plugins for ce), or having to share their sourcecode.

To make use of the plugin system you need to create a dll that exports 3 functions:
GetVersion, DisablePlugin, and InitializePlugin

Note: Unless stated otherwise, all function calls use the stdcall calling mechanism.

Cheat Engine comes with some example plugins. They generally make use of a common SDK file. Currently, there is a version for Delphi and a version for C available


GetVersion
The GetVersion routine is a routine that will get called when the dll is queried for the first time.

BOOL GetVersion(
PPluginVersion pv, //pointer to structure you have to fill in
int sizeofpluginversion //size of pluginversion
);

Parameters
pv
Pointer to a PluginVersion struct that you'll have to fill in.

sizeofpluginversion
Size of the PluginVersion struct provided in the pv parameter. You can use this to make sure that your plugin version is compatible with the current implementation of Cheat Engine's plugin system.
Currently, it should be 8.

Return Value
Return value has to be TRUE


DisablePlugin
The DisablePlugin routine is a routine that will get called when Cheat Engine closes or when the user deselects the plugin in settings.

BOOL DisablePlugin(void)

Return Value
Return value has to be TRUE


InitializePlugin
The InitializePlugin routine is called when Cheat Engine is started and the plugin is enabled in the registry, or when the user enables it in settings and clicks ok.

BOOL InitializePlugin(
PExportedFunctions ef ,
int pluginid
);

Parameters
ef
Address to a copy of CE's ExportedFunctions struct . Make a copy of this structure before returning from the InitializePlugin function.

pluginid
The pluginid for your plugin for as long as it is active. This ID is used to register callbacks.

Return Value
Return value has to be TRUE

It is recommended to register the callback functions in this routine and save ExportedFunctions for later usage. For more information about the callbacks see the relevant help topics


PluginVersion
The PluginVersion lets you specify for which plugin version the dll was developed and what the name of that plugin is.

typedef struct _PluginVersion
{
  unsigned int version;
  char *pluginname;
} PluginVersion, *PPluginVersion;

Members

version
Set this to the plugin version this dll is expecting. Cheat Engine will then try to provide your plugin with a compatible pointer/functionlists on initializePlugin.

pluginname
Set this to a 0-terminated string containing the name of the plugin shown to the user in the plugin menu in settings. Make sure this string is NOT stored on the stack as this pointer can be used at random times after return of the GetVersion function call.


ExportedFunctions
The ExportedFunctions structure contains several pointers to usefull functions in CE, and pointers to the pointers of specific functions that might be worth hooking.

typedef struct _ExportedFunctions
{
int sizeofExportedFunctions;
CEP_SHOWMESSAGE ShowMessage;
CEP_REGISTERFUNCTION RegisterFunction;
CEP_UNREGISTERFUNCTION UnregisterFunction ;
PULONG OpenedProcessID ;
  PHANDLE OpenedProcessHandle ;

CEP_GETMAINWINDOWHANDLE GetMainWindowHandle;
CEP_AUTOASSEMBLE AutoAssemble;
CEP_ASSEMBLER Assembler;
CEP_DISASSEMBLER Disassembler ;
  CEP_CHANGEREGATADDRESS ChangeRegistersAtAddress ;
CEP_INJECTDLL InjectDLL ;
CEP_FREEZEMEM FreezeMem;
CEP_UNFREEZEMEM UnfreezeMem;
CEP_FIXMEM FixMem;
CEP_PROCESSLIST ProcessList;
CEP_RELOADSETTINGS ReloadSettings;
  CEP_GETADDRESSFROMPOINTER GetAddressFromPointer ;

//pointers to the address that contains the pointers to the functions
//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
PVOID ReadProcessMemory;
PVOID WriteProcessMemory;
PVOID GetThreadContext;
PVOID SetThreadContext;
PVOID SuspendThread;
PVOID ResumeThread;
PVOID OpenProcess;
PVOID WaitForDebugEvent;
PVOID ContinueDebugEvent;
PVOID DebugActiveProcess;
PVOID StopDebugging;
PVOID StopRegisterChange;
PVOID VirtualProtect;
PVOID VirtualProtectEx;
PVOID VirtualQueryEx;
PVOID VirtualAllocEx;
PVOID CreateRemoteThread;
PVOID OpenThread;
PVOID GetPEProcess;
PVOID GetPEThread;
PVOID GetThreadsProcessOffset;
PVOID GetThreadListEntryOffset;
PVOID GetProcessnameOffset;
PVOID GetDebugportOffset;
PVOID GetPhysicalAddress;
PVOID ProtectMe;
PVOID GetCR4;
PVOID GetCR3;
PVOID SetCR3;
PVOID GetSDT;
PVOID GetSDTShadow;
PVOID setAlternateDebugMethod;
PVOID getAlternateDebugMethod;
PVOID DebugProcess;
PVOID ChangeRegOnBP;
PVOID RetrieveDebugData;
PVOID StartProcessWatch;
PVOID WaitForProcessListData;
PVOID GetProcessNameFromID;
PVOID GetProcessNameFromPEProcess;
PVOID KernelOpenProcess;
PVOID KernelReadProcessMemory;
PVOID KernelWriteProcessMemory;
PVOID KernelVirtualAllocEx;
PVOID IsValidHandle;
PVOID GetIDTCurrentThread;
PVOID GetIDTs;
PVOID MakeWritable;
PVOID GetLoadedState;
PVOID DBKSuspendThread;
PVOID DBKResumeThread;
PVOID DBKSuspendProcess;
PVOID DBKResumeProcess;
PVOID KernelAlloc;
PVOID GetKProcAddress;
PVOID CreateToolhelp32Snapshot;
PVOID Process32First;
PVOID Process32Next;
PVOID Thread32First;
PVOID Thread32Next;
PVOID Module32First;
PVOID Module32Next;
PVOID Heap32ListFirst;
PVOID Heap32ListNext;
//^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

PVOID mainform;
PVOID memorybrowser;

CEP_GENERATEAPIHOOKSCRIPT sym_nameToAddress;
CEP_ADDRESSTONAME sym_addressToName ;
  CEP_NAMETOADDRESS sym_generateAPIHookScript;

  CEP_LOADDBK32 loadDBK32;
  CEP_LOADDBVMIFNEEDED loaddbvmifneeded;
  CEP_PREVIOUSOPCODE previousOpcode;
  CEP_NEXTOPCODE nextOpcode;
  CEP_DISASSEMBLEEX disassembleEx;
  CEP_LOADMODULE loadModule;
  CEP_AA_ADDCOMMAND aa_AddExtraCommand;
  CEP_AA_DELCOMMAND aa_RemoveExtraCommand;

  CEP_CREATETABLEENTRY createTableEntry;
  CEP_GETTABLEENTRY getTableEntry;
  CEP_MEMREC_SETDESCRIPTION memrec_setDescription;
  CEP_MEMREC_GETDESCRIPTION memrec_getDescription;
  CEP_MEMREC_GETADDRESS memrec_getAddress;
  CEP_MEMREC_SETADDRESS memrec_setAddress;
  CEP_MEMREC_GETTYPE memrec_getType;
  CEP_MEMREC_SETTYPE memrec_setType;
  CEP_MEMREC_GETVALUETYPE memrec_getValue;
  CEP_MEMREC_SETVALUETYPE memrec_setValue;
  CEP_MEMREC_GETSCRIPT memrec_getScript;
  CEP_MEMREC_SETSCRIPT memrec_setScript;
  CEP_MEMREC_ISFROZEN memrec_isfrozen;
  CEP_MEMREC_FREEZE memrec_freeze;
  CEP_MEMREC_UNFREEZE memrec_unfreeze;
  CEP_MEMREC_SETCOLOR memrec_setColor;
  CEP_MEMREC_APPENDTOENTRY memrec_appendtoentry;
  CEP_MEMREC_DELETE memrec_delete;

  CEP_GETPROCESSIDFROMPROCESSNAME getProcessIDFromProcessName;
  CEP_OPENPROCESS openProcessEx;
  CEP_DEBUGPROCESS debugProcessEx;
  CEP_PAUSE pause;
  CEP_UNPAUSE unpause;

  CEP_DEBUG_SETBREAKPOINT debug_setBreakpoint;
  CEP_DEBUG_REMOVEBREAKPOINT debug_removeBreakpoint;
  CEP_DEBUG_CONTINUEFROMBREAKPOINT debug_continueFromBreakpoint;

  CEP_CLOSECE closeCE;
  CEP_HIDEALLCEWINDOWS hideAllCEWindows;
  CEP_UNHIDEMAINCEWINDOW unhideMainCEwindow;
  CEP_CREATEFORM createForm;
  CEP_FORM_CENTERSCREEN form_centerScreen;
  CEP_FORM_HIDE form_hide;
  CEP_FORM_SHOW form_show;
  CEP_FORM_ONCLOSE form_onClose;

  CEP_CREATEPANEL createPanel;
  CEP_CREATEGROUPBOX createGroupBox;
  CEP_CREATEBUTTON createButton;
  CEP_CREATEIMAGE createImage;
  CEP_IMAGE_LOADIMAGEFROMFILE image_loadImageFromFile;
  CEP_IMAGE_TRANSPARENT image_transparent;
  CEP_IMAGE_STRETCH image_stretch;

  CEP_CREATELABEL createLabel;
  CEP_CREATEEDIT createEdit;
  CEP_CREATEMEMO createMemo;
  CEP_CREATETIMER createTimer;
  CEP_TIMER_SETINTERVAL timer_setInterval;
  CEP_TIMER_ONTIMER timer_onTimer;
  CEP_CONTROL_SETCAPTION control_setCaption;
  CEP_CONTROL_GETCAPTION control_getCaption;
  CEP_CONTROL_SETPOSITION control_setPosition;
  CEP_CONTROL_GETX control_getX;
  CEP_CONTROL_GETY control_getY;
  CEP_CONTROL_SETSIZE control_setSize;
  CEP_CONTROL_GETWIDTH control_getWidth;
  CEP_CONTROL_GETHEIGHT control_getHeight;
  CEP_CONTROL_SETALIGN control_setAlign;
  CEP_CONTROL_ONCLICK control_onClick;

  CEP_OBJECT_DESTROY object_destroy;
  CEP_MESSAGEDIALOG messageDialog;
  CEP_SPEEDHACK_SETSPEED speedhack_setSpeed;

} ExportedFunctions, *PExportedFunctions;


sizeofExportedFunctions
int sizeofExportedFunctions;

As you might have guessed, it contains the size of the structure CE has sent to your plugin.
You can check if it's what you expected or add in some checks to make sure you don't go over it. Or if sizeof is too hard to use use that instead when copying the memory block to your own region of memory. (As said before, ExportedFunctions you get in initializefunctions is a copy and will be invalidated when the function returns, so copy is crucial)


ShowMessage
ShowMessage will display a small popup window containing a text message.
Useful for testing that the plugin works, and for debug purposes

ShowMessage(
char * message //pointer to a 0-terminated string
);


RegisterFunction
This function will register a callback function that gets called when a certain event happens and in some cases also creates a extra menu item.

functiondefinition:
int RegisterFunction(int pluginid, PluginType functiontype, PVOID init);

pluginid has to be the pluginid that you got from InitializePlugin
functiontype defines what type of function you want to register (See PluginType )
init holds a pointer to a structure that is dependant on the type of function.


UnregisterFunction
This function will remove a previously registered callback function

functiondefinition:
BOOL UnregisterFunction(int pluginid, int functionid);

pluginid: The pluginid you got at InitializePlugin
functionid: The result of RegisterFunction

Returns TRUE if the functionid was found and removed for this plugin


OpenedProcessID
A pointer to the processid of the currently opened process.
Just the processid, but it is prefered to have both ID and HANDLE to point to the same process


OpenedProcessHandle
A pointer to the handle of the currently opened process.
This handle is used by almost all functions. Take good care to make it valid, or at least valid to the functions that use it.


GetMainWindowHandle
This function will remove a previously registered callback function
functiondefinition:
HANDLE GetMainWindowHandle();

Returns the window handle of the main window. For some basic widnow manipulations. For more advanced window manipulation it is recommended to write the DLL in Delphi 7 Enterprise, where you have access to the TFORM object of the main window


AutoAssemble
This function will allow you to give it an auto assemble script and it will automatically inject it in the currently opened process

functiondefinition:
BOOL AutoAssemble(char *script);

script: A pointer to a 0 terminated string buffer that contains the auto assembler script.

Returns TRUE if the assemblage and injection was successfull


Assembler
This function will allow you to give it single assembler instruction and the address it should be put at, and it'll return you the generated bytes in a buffer you specify and the ammount of bytes it generated

functiondefinition:
BOOL Assembler(ULONG address, char* instruction, BYTE *output, int maxlength, int *returnedsize);

address: The address the instruction is supposed to be written. Usefull in cases of jumps and calls...
instruction: A pointer to a 0 terminated string that contains the assembler instruction you want to assemble
output: a pointer to the buffer the assembled bytes will be put in
maxlength: maximum size of the buffer receiving the assembled bytes
returnedsize: a pointer to the integer that gets how many bytes where used

Returns TRUE if the instruction was valid and there was enough space. Doesn't return why it fails, so it is recommended to always give at least 32 bytes space


Disassembler
This function will allow you to give it a address and it'll return you with the disassembled output.

functiondefinition:
BOOL Disassembler(ULONG address, char* output, int maxsize);

address: The address of the instruction you want to disassemble
output: pointer to the buffer the disassembled string will be put in
maxsize: maximum size the string can be

Returns TRUE if there was enough memory to store the string.
The returned string is build up as "Address - bytes - instruction"


ChangeRegistersAtAddress

hangeRegistersAtAddress
This function will set a breakpoint at the address you specify and automatically change the registers in the way you want.

functiondefinition:
BOOL ChangeRegistersAtAddress(ULONG address, PREGISTERMODIFICATIONINFO changereg);

address: The address of the instruction you want to break on
changereg: a pointer to a REGISTERMODIFICATIONINFO structure that holds all the changes you want to do

Returns TRUE if everything went as planned.


InjectDLL
This function will allow you to inject a dll using ce's injection engine.

functiondefinition:
BOOL InjectDLL(char *dllname, char *functiontocall);

dllname: the name of the dll to inject.
functiontocall: name of the function to call after injection. Can be NULL if you don't want to

Returns TRUE if the injection was successful


FreezeMem
This function will freeze the memory of a specific address.

functiondefinition:
int FreezeMem(ULONG address, int size);

address: Address to freeze
size: Size in bytes of the address to freeze

Returns the ID of the freeze sop you can later unfreeze it.
Warning: If the process changes the freeze will still be active. It is recommended in this case to hook OpenProcess and watch for changes and unfreeze when a new process is selected


UnfreezeMem
This function will stop the freezing of a earlier freeze operation

functiondefinition:
int UnfreezeMem( int freezeID);

freezeID: Id returned by a previous FreezeMem instruction

Returns TRUE if the ID was found and unfrozen


FixMem
This function will scan the memory of CE itself for changes and fix them when possible. (Only works when the user also has the option enabled to fix memory in settings)

functiondefinition:
BOOL FixMem();

Returns TRUE if it didn't crash


ProcessList
This function will return the processlist in a buffer you provide

functiondefinition:
BOOL ProcessList( char *listbuffer, int listsize);

listbuffer: Pointer to buffer that will receive the processlist
listsize: Size in bytes of the buffer

Returns TRUE if there was enough memory to fill the list.


ReloadSettings
This function will reload the settings from the registry and apply them to ce

functiondefinition:
BOOL ReloadSettings();

Returns TRUE


GetAddressFromPointer
This function converts a baseaddress + offsets to a final address.

functiondefinition:
DWORD GetAddressFromPointer(ULONG baseaddress, int offsetcount, int* offsets);

Returns the address the pointer is pointing to. If part of the pointerpath is unreadable, the result is 0


sym_nameToAddress
This function converts a string to a dword

functiondefinition:
BOOL sym_nameToAddress ( char *name, DWORD *address);

Returns TRUE if the text was successfully translated into a working address, and will fill in the specified address in the provided pointer


sym_addressToName

sm_addressToName
This function converts a dword representing an address to a readable string

functiondefinition:
BOOL sym_addressToName (DWORD address, char *name, int maxnamesize);

Returns TRUE if the address was converted to a textual representation.
The output will be stored in "name"
maxnamesize defines the maximum length the string may be.


s ym_generateAPIHookScript;
This function takes several strings and convert it into a working autoassembler script.

functiondefinition:
BOOL sym_addressToName (
char *address,
char *addresstojumpto,
char *addresstogetnewcalladdress,
char *script,
int maxscriptsize
);

address=The address you want to hook. (e.g "00401234", "somegamemod.dll+1234" or "apidll!functionname")

addresstojumpto=Address of the routine you want to jump to. (e.g "mydll!myhook" or just an static address like "12345678" )

addresstogetnewcalladdress=Address to store the address of the routine in so you can call it without the hook. (Useful when you want to call the original routine from your own hook)

script=Output. A pointer to a buffer where you want the script in.
maxscriptsize makes sure the script won't go over it.

Returns TRUE if the script was properly generated and there was enough space. script will be filled with the script you can feed to the auto assembler


loadDBK32
This function will make cheat engine load dbk32.dll and initialize some of it's functions

functiondefinition:
void loadDBK32 (void );


loaddbvmifneeded
This will launch dbvm if your system supports it. The user will get a popup asking if he wants to launch it

functiondefinition:
BOOL loaddbvmifneeded (void );

returns true if dbvm has been properly loaded or is already loaded


previousOpcode
This function will return the previous instruction of the given address

functiondefinition:
DWORD previousOpcode( ULONG address);


nextOpcode
This instruction will retrieve the next address of the given address

functiondefinition:
DWORD nextOpcode( ULONG address);


disassembleEx
A more extended disassembler

functiondefinition:
BOOL Disassembler(ULONG address, char* output, int maxsize);

address: Pointer to the address of the instruction you want to disassemble. On return address contains the address of the next instruction
output: pointer to the buffer the disassembled string will be put in
maxsize: maximum size the string can be

Returns TRUE if there was enough memory to store the string.
The returned string is build up as "Address - bytes - instruction"


loadModule
Loads any module into memory. Can be a normal dll, but can also be a driver. Works in 64-bit

functiondefinition:
BOOL loadModule ( char *modulepath, char *exportlist, int *maxsize);

If the function succeeds exportlist will receive the list of all the exports in the loaded module. (Name Address)


aa_AddExtraCommand
Makes it so that the auto assembler window will recognize new instructions and marks them bold when you type them

functiondefinition:
void aa_AddExtraCommand(char *command);


aa_RemoveExtraCommand
Removes an extra auto assembler command

functiondefinition:
void aa_RemoveExtraCommand(char *command);


PluginType
The plugin system supports 9 different plugin callback types:

0: Address list rightclick menu plugin ( ptAddressList )
1: Memory view menu plugin ( ptMemoryView )
2: Debug event plugin ( ptOnDebugEvent )
3: Process watcher event plugin ( ptProcesswatcherEvent )
4: Functionpointer change notification event ( ptFunctionPointerchange )
5: Main menu plugin menu ( ptMainMenu )
6: Disassembler rightclick context menu, entry and popup ( ptDisassemblerContext )
7: Disassembler render routine on a per line basic plugin ( ptDisassemblerRenderLine )
8: Auto assembler plugin ( ptAutoAssembler )

You create a callback by calling RegisterFunction. (Located in the ExportedFunctions structure)


0: ptAddressList
With this plugintype you create a new plugin menu on the rightclick menu of the addresslist.
When the user clicks the menu item your callback routine will get information about the selected record if one is selected and will give you the ability to change the address, and description.

callback definition:
typedef BOOL ( __stdcall *CEP_PLUGINTYPE0)( struct PLUGINTYPE0_RECORD *SelectedRecord);

return TRUE if you edited the description or address

definition of PLIGINTYPE0_RECORD:
struct PLUGINTYPE0_RECORD
{
char *interpretedaddress; //pointer to a 255 bytes long string (0 terminated)
ULONG address; //this is a read-only representaion of the address. Change interpretedaddress if you want to change this
BOOL ispointer; //readonly
int countoffsets; //readonly
ULONG *offsets; //array of dwords ranging from 0 to countoffsets-1 (readonly)
char *description; //pointer to a 255 bytes long string
char valuetype; //0=byte, 1=word, 2=dword, 3=float, 4=double, 5=bit, 6=int64, 7=string
char size; //stringlength or bitlength;
};

Pointer to structure of init you have to pass:
struct PLUGINTYPE0_INIT
{
char * name; //0 terminated string describing the name for the user's menu item
CEP_PLUGINTYPE0 callbackroutine; //pointer to a callback routine of the type 0 plugin
};


1: ptMemoryView

: ptMemoryView
With this plugintype you create a new plugin menu at the top of the memoryview window.
When the user clicks the menu item your callback routine will get pointers to the address of the disassembler window, the address of the currently selected line in the disassembler, and the address of the hexadecimal view at the bottom. You can change these pointers to anything you like

callback definition:
typedef BOOL ( __stdcall *CEP_PLUGINTYPE1)(ULONG *disassembleraddress, ULONG *selected_disassembler_address, ULONG *hexviewaddress);

return TRUE if you changed any of the pointers so the memoryview will execute an update

Pointer to structure of init you have to pass:
typedef struct _PLUGINTYPE1_INIT
{
  char * name;
  CEP_PLUGINTYPE1 callbackroutine;
  char * shortcut; //string to a interpretable shortcut
} PLUGINTYPE1_INIT, MEMORYVIEWPLUGIN_INIT, *PPLUGINTYPE1_INIT, *PMEMORYVIEWPLUGIN_INIT;


2: ptOnDebugEvent
With this plugintype you will get notified whenever a debug event happens in the default windows debugger. Your callback routine gets called right after the WaitForDebugEvent returns true with the pointer to the DebugEvent structure.

callback definition:
typedef int ( __stdcall *CEP_PLUGINTYPE2)(LPDEBUG_EVENT DebugEvent);

return 0 if you want to let ce or other plugins handle the debug event as well
reutrn 1 if you don't want anything else to handle this event. You will have to call ContinueDebugEvent yourself

Pointer to structure of init you have to pass:
struct PLUGINTYPE2_INIT
{
CEP_PLUGINTYPE2 callbackroutine; //pointer to a callback routine of the type 2 plugin
};

NOTE: This event happens in a thread that is NOT the main thread. GUI specific calls (like showmessage) will not work properly.


3: ptProcesswatcherEvent
With this plugintype you will get notified when the processwatcher is used and it sees a new process has been created. Your callback routine gets the processid and the PEProcess address.

callback definition:
typedef void ( __stdcall *CEP_PLUGINTYPE3)(ULONG processid, ULONG peprocess, BOOL Created);

Doesn't need a return value.

Pointer to structure of init you have to pass:
struct PLUGINTYPE3_INIT
{
CEP_PLUGINTYPE3 callbackroutine; //pointer to a callback routine of the type 3 plugin
};

NOTE: This event happens in a thread that is NOT the main thread. GUI specific calls (like showmessage) will not work properly.


4: ptFunctionPointerschange
With this plugintype you will get notified when one or more of the pointers get changed due to user actions. (Other plugins that change the pointers excluded) This is usefull in cases you want to hook a api.

callback definition:
typedef void ( __stdcall *CEP_PLUGINTYPE4)(int reserved);

reserved: Contains the section in which a change happened. Not usefull at all...

Pointer to structure of init you have to pass:
struct PLUGINTYPE4_INIT
{
CEP_PLUGINTYPE4 callbackroutine; //pointer to a callback routine of the type 4 plugin
};


5: ptMainMenu

ptMainMenu
With this plugintype you create a new plugin menu at the top of the main window.
When the user clicks the menu item your callback routine will get called and allows you to do whatever you like.

callback definition:
typedef void ( __stdcall *CEP_PLUGINTYPE5)( void );

returns nothing

Pointer to structure of init you have to pass:
typedef struct _PLUGINTYPE5_INIT
{
char * name;
CEP_PLUGINTYPE5 callbackroutine;
char * shortcut;
} PLUGINTYPE5_INIT, MAINMENUPLUGIN_INIT, *PPLUGINTYPE5_INIT, *PMAINMENUPLUGIN_INIT


6: ptDisassemblerContext

ptDisassemblerContext
With this plugintype you create a new entry in thecontext menu of the disassembler.
When the user pops up the menu, or clicks the menu item, the apropriate callback routine will be called

callback definition:
typedef BOOL ( __stdcall *CEP_PLUGINTYPE6ONPOPUP)(ULONG selectedAddress, char **addre ssofname);
typedef BOOL (__stdcall *CEP_PLUGINTYPE6)(ULONG *selectedAddress);

returns nothing

Pointer to structure of init you have to pass:
typedef struct _PLUGINTYPE6_INIT
{
char * name; //0 terminated string describing the name for the user's menu item
CEP_PLUGINTYPE6ONPOPUP callbackroutineOnPopup;
CEP_PLUGINTYPE6 callbackroutine;
char * shortcut; //0 terminated string containing the shortcut in textform. CE will try it's best to parse it to a valid shortcut
} PLUGINTYPE6_INIT, DISASSEMBLERCONTEXT_INIT, *PPLUGINTYPE6_INIT, *PDISASSEMBLERCONTEXT_INIT;


7: ptDisassemblerRenderLine

ptDisassemblerRenderLine
With this plugintype you get a callback each time a line is being rendered on the disassembler view. You then get the option to change the text and color of what is being displayed

callback definition:
typedef void ( __stdcall *CEP_PLUGINTYPE7)(ULONG address, char **addressStringPointer, char **bytestringpointer, char **opcodestringpointer, char **specialstringpointer, ULONG *textcolor);

returns nothing

Pointer to structure of init you have to pass:
typedef struct _PLUGINTYPE7_INIT
{
CEP_PLUGINTYPE7 callbackroutine; //pointer to a callback routine of the type 7 plugin
} PLUGINTYPE7_INIT, DISASSEMBLERLINEPLUGIN_INIT, *PPLUGINTYPE7_INIT, *PDISASSEMBLERLINEPLUGIN_INIT;


8: ptAutoAssembler

ptAutoAssembler
With this plugintype you get a callback when an auto assembler script is about to be executed, for each line on the first stage, and for each line on the second stage and when the auto assembler is finished.

Because the auto assembler can be called from multiple threads, you will have to make sure that you keep all allocated variables separated (e.g by the hand of threadid)

callback definition:
typedef void ( __stdcall *CEP_PLUGINTYPE8)( char **line, AutoAssemblerPhase phase, int aaID);

returns nothing

Phase can be one of the following:
0: aaInitialize - When the auto assembler is about to start. Use this to initialize your internal structures
1: aaPhase1 - First stage when the syntax is being checked. Use this to configure whatever declarations the script requires you to save
2: aaPhase2 - When the code is actually being assembled into instructions
3: aaFinalize - When the auto assembler is finished, either with an error or not.

If you replace 'line' with an empty line it will not be handled in phase2. This is useful for internal commands.

aaID is an unique ID identifying the auto assembler script script currently being executed. This can come in handy when an auto assembler script launches another auto assembler script

Pointer to structure of init you have to pass:
typedef struct _PLUGINTYPE8_INIT
{
  CEP_PLUGINTYPE8 callbackroutine; //pointer to a callback routine of the type 8 plugin
} PLUGINTYPE8_INIT, AUTOASSEMBLERPLUGIN_INIT, *PPLUGINTYPE8_INIT, *PAUTOASSEMBLERPLUGIN_INIT;


REGISTERMODIFICATIONINFO
The REGISTERMODIFICATIONINFO structure is used by the ChangeegistersAtAddress function.

typedef struct _REGISTERMODIFICATIONINFO
{
ULONG address; //addres to break on
BOOL change_eax;
BOOL change_ebx;
BOOL change_ecx;
BOOL change_edx;
BOOL change_esi;
BOOL change_edi;
BOOL change_ebp;
BOOL change_esp;
BOOL change_eip;
BOOL change_cf;
BOOL change_pf;
BOOL change_af;
BOOL change_zf;
BOOL change_sf;
BOOL change_of;
ULONG new_eax;
ULONG new_ebx;
ULONG new_ecx;
ULONG new_edx;
ULONG new_esi;
ULONG new_edi;
ULONG new_ebp;
ULONG new_esp;
ULONG new_eip;
BOOL new_cf;
BOOL new_pf;
BOOL new_af;
BOOL new_zf;
BOOL new_sf;
BOOL new_of;
} REGISTERMODIFICATIONINFO, *PREGISTERMODIFICATIONINFO;


Settings

The settings window allows you to change several aspects of Cheat Engine ranging from how it looks to how it scans. These options will be explored in greater detail in this section.

On any page of the settings interface you can click to view the CE about box in the bottom-right of the window. Once you have made any changes you should click on the 'OK' button at the bottom. Clicking on the 'Cancel' button will disregard any changes you have made in the settings window. All CE settings are committed to the windows registry for the current user account.


General settings

General/GUI options:

Show undo button: This will present you with an undo button on the main interface to use for stepping-back after a memory scan. Useful if you accidentely clicked twice on next scan for example.

Update the list of found addresses even after scanning: This will cause the found address list to periodically update regardless of whether or not the user actually initiated a scan. Good for seeing which addresses are changing for filtering purposes. Eats into CPU-cycles, but nothing major at all. You can change the update interval at the bottom of this settings window.

Ask to run lua scripts from tables: If a cheat table is containing a lua script, you will be prompted to choose if you wish to execute the script or not when you open the table. You can also select to always enable the execution of lua scripts.

Center Cheat Engine when bringing to front: This will cause Cheat Engine to snap into the center of the screen when you forceably bring it to the front of view.

Hide some/all windows instead of trying to bring Cheat Engine to front: With this option you can elect to hide certain windows to maximize your view as opposed to trying to force the main GUI to the front. You can customize which windows are involved in this process by clicking on the 'More...' button.

Pointer adding: Append pointerline instead of insert: This can be very useful, but is disabled by default. This is only relevent if using multi-level pointer paths. This will cause new entries to drop below the existing entry, thus retaining the previous offset. If left disabled you will need to re-enter your pointer offsets starting from the first, and it is easy to lose track.

Save window positions: This will cause the current positions of windows in CE to be saved to the registry. When you next open it, they will be where you left them. Good for strategically placing your windows while hacking a windowed-game for example, or using some messenger software on the side.

Show main menu: Unchecking this will cause the standard tooltip menu to disappear. Not recommended.

Get process icons for processlist: This will attempt to extract icons from the processes enumerated in the processlist, which overall makes the list nicer to look at, and easier to locate specific processes. If a process doesn't have an icon, it will still be displayed, just in standard text form. You can elect to hide processes that don't have an icon by checking the sub-option below this one.

Address list specific options:

Show values as if they are signed: This will display unsigned values as signed in the cheat list. Not needed unless you have a specific reason to do so, such as wanting to work with negatives.

Simple paste: Instead of showing a window when copy/pasting it will just copy/paste without asking

Process attaching & address-list updating:

Automatically attach to processes named <type here>: This will cause CE to scan for an automatically attach to processes in this field so long as it is running. This can save a lot of tedious clicking if you are working on a gamehacking project and keep crashing the game (thus having to reattach each time this happens).

Even autoattach when another process has been selected: Use this to make CE attach to a process designated in this list even if the user has already picked another process before this has happened.

Update interval <type here>: Allows you to change the time (in ms) that elapses before CE updates the values etc in the address/cheat list.

Found address list update interval <type here>: Allows you to change the delay between updates of the found address list (when memory scanning). This list can be quite large, so keeping this delay fairly high is wise, otherwise you may find that your CPU is getting thrashed unnecessarily.

Freeze interval <type here>: The delay used between updates of a frozen memory address. This can be set lower than the above option, but again, set it too low and you'll find that your CPU take a bit of a hit.

Finally, there is a Tools sub-section under general. This screen will allow you to enable the tools menu (which will appear next to the File, Edit, Process, Help text in the main interface), and assign various custom applications to this menu. You can also set shortcut keys to entries in this menu after adding them, for fast access at any time while using CE. You may want to assign windows calculator to this menu, or notepad, or maybe even a hex editor or web browser. Your choice! Make it your own.


Hotkeys

The hotkeys window will allow you to assign custom keypresses to various Cheat Engine functions. For example you could assign a hotkey of CTRL+0 to toggle on and off the speedhack feature. You can clear an assigned hotkey at any time by clicking on the 'clear' button.

This is especially useful for scanning in games that make alt-tabbing in and out very difficult, or have some other strange effect when you are trying to move in and out of it's focus for memory scans.

Make certain that any hotkey sequence you choose will not have unwanted effects in-game though. You wouldn't want to load your previous save for example with F7 while simply wanting to do a 'next scan' :-)


Unrandomizer

Here you can change the default return value for the Unrandomizer feature, which can be accessed from the main interface while attached to a process. You can also check to use an incremental value here. (Advanced users)


Scan settings

For a lot of users, this will be the config screen that they are most accustomed to seeing and using, as it relates directly to the memory-searching process. Let's take a look..

Size of scanbuffer (KB): <type here>: This allows you to override the default buffer value used when scanning memory. Raising this to 1024 or perhaps even 2048 is good for most modern systems, and will speed up your scanning process a bit. Raising it too high though will yield a negative effect (which is why it's low in the first place to accommodate for most users).

Fast scan on as default: You can check this box to make all of your memory searches aligned, unless you state otherwise in the main interface. This will cause all memory scans to only return addresses aligned to a 32-bit boundary (or ending in 0,4,8,C / divisible by 4). This will dramatically speed up memory scans, and is good for 99% of cases. Rarely though, you may miss key addresses with this turned on.

Don't scan memory that is protected with the No Cache option: Mainly a useful consideration if you are experience strange crashes/lockups while scanning memory. Checking this will prevent Cheat Engine from scanning memory regions which are protected with 'no cache'. Usually these areas are used by graphics and other hardware drivers, and I have never seen a case where games store variables here. Basically leave it off unless you have an issue, in which case give this a whirl.

Custom types will be included in the ALL scan variabletype: Custom scan scripts will be used along with other default variable types when you are using ALL as a variable type for scanning.

Don't store the temporary scanfiles in the windows tempdir: Specify a new location where cheat engine should store the temporary files.

MEM_PRIVATE: Will allow CE to scan 'private' memory. Leave it on in most cases.
MEM_IMAGE: ...scan memory that is mapped into the view of an image section. Leave it on also.
MEM_MAPPED: ...scan memory that is mapped into view of a section (file-mapping). Off by default. Slow!

Thread priority <Choose option>: Here you can assign a priority to the scan thread used by CE when searching through memory. It is best left on it's default of Higher or one-down on Normal. Setting it too low can cause scans to become very slow, and too high can cause the system to become unresponsive.


Plugins

Here you can load new plugins to use with CE. Plugins you select will be added to the list. You can then selectively delete these plugins should you wish.

See here for a description of the Plugin System .


Debugger options

This page will give you access to some options relating to how the handling of instructions works in disassembly view.

Use Hardware breakpoints (Max 3): Opts to use debug registers as the method of breakpointing. This is the default choice, and is the most compatible, although you can only set a max of 4 breakpoints this way. Leave it as this unless you have a specific reason to do so.

Use int3 instructions for breakpoints (Unlimited): This is the other options available for breakpointing. int3 bytes are used extensively by standalone debuggers such as OllyDBG for breaking on code. There is no limit to how many of these BP's you can set. Although some targets may detected a debugger this way.

Replace incomplete opcodes with nops: NOP stands for No-Operation, and is an assembly command which simply does nothing. When program flow reaches a NOP it simply passes over it as if it wasn't there. NOP's are used to remove code which may, for example, reduce player health in a game. If you modify an instruction and it has a smaller/larger length than the one you replaced, then CE can replace the leftover/broken bytes with these NOP's. Should always be on just for safety purposes.

Ask for replace with nop: Also on by default. This will cause CE to ask you if you want it to replace the leftover bytes with NOP's or whether to leave the broken instruction for you to deal with. You can uncheck this option, which will cause CE to automatically clean-up leftover bytes itself, without prompt.

Debugger methods:

Use VEHdebugger: Use this debugger option to avoid debugger detection in some games that are otherwise closing/crashing if you attach the standard windows debugger to them.

· Poll for threads: The only implemented option so far.

Use windows debugger: Use the default windows debugger.

· Try to prevent detection of the debugger will cause CE to hook the IsDebuggerPresent API, which is commonly used as an anti-debug technique. It will cause the function to always return zero, as so as far as the debugged program is concerned, it;s not been debugged. This will take place once you have attached the debugger for the first time (attaching to a process and clicking yes). It does not guarantee success though, as there are many, many ways to detect a debugger!

Use kernelmode debugger: This will use CE kernel routines for debugging as opposed to the standard windows ones. This is good for hacking a particularly stubborn game which detects a debugger when using conventional means

· Use Global Debug routines: This will cloak the debug registers (DRs), and is therefore good if you are sure that a target is detecting a change in these debug registers.
· Ability to step through kernel code: When stepping and entering kernel code the single stepping will usually get disabled so it continues till you're back in usermode. With this option enabled the stepping will continue. It currently doesn't seem possible to continue from stepping through kernelcode so se it like a one try only option

If you use kernelmode debugger options, you need to run the kernelmoduleunloader before you can use other type of debuggers (windows or VEHdebugger). Or you can simply restart your computer. If you use Global Debug routines, you have to restart your computer before you could use other debuggers.


Extra (Advanced)

This page is an advanced settings page, and care should be taken before altering anything here. This is the page of most interest to those using CE againt online targets and thus anti-cheat systems, due to the kernelmode and stealth features available here.

Query memory region routines: This will have CE try and 'work out' how memory is allocated in the game. This is needed on some unorthodox targets, particularly online games, or games protected with an anti-cheat system.

Read/Write Process Memory: Forces read and write access to the target processes memory space. This is needed on some targets that are protected as above. It's also a special point of note with some emulators such as PCSX2 for PS2 games running on a Vista/Win7 host machine. You'll need this on to come up with any results at all.

Open Process: This will open a handle to the current process. This is needed for the process watcher and kernelmode debug routines to work (and will get enabled along with those if not already on).

Enable the use of the Process Watcher: Enable this if you can't find a target process in the list. Enable this and then start the game. Choose the process when you see it appear. It uses kernelmode to do this, so requires the below option. It's handy therefore, for cheat-protected titles.


Tutorials

This section contains a collection of all useful, mainly user-submitted, tutorials originally posted on the cheat engine forum. This is only a small selection of what is available. There are many more, graphic-rich tutorials on the website on on the rest of the web, that are just not appropriate for this help file. Please search :-)


ASM and Hexing Theory

These tutorials cover assembly and gamehacking basics, and theoretical knowledge that is needed to better reverse games. They are generic and don't apply to any specific tool or game.


Basic assembler

Originally posted by Dark Byte + addition by Smidge204

Most people think assembler is very difficult, but in fact it's very easy.
In this tutorial i'll try to explain how some basic assembler works

The processor works with memory and registers. The registers are like memory but a lot faster than memory. Registers are EAX,EBX,ECX,EDX,ESP,EBP,ESI,EDI, and the segment registers. (There's also EIP, wich is the Instruction Pointer. It points to the instruction that is about to be executed)

Some examples:

sub ebx,eax (ebx=00000005,eax=00000002)
Lets take it apart in it's most basic elements:
opcode param1,param2

The opcode is the instruction telling the processor what to do, in this case decrease the value stored in register ebx with the value stored in register eax.

In this case ebx=5 and eax=2 so ebx would be after this instruction 3. (5-3)

Also note that whever you see a opcode with 2 parameters: The first parameter is the target of the instruction. The 2nd is the source

sub [esi+13],ebx (ebx=00000003,esi=008AB100)
In this case you see the first parameter is between brackets. This indicates that instead of registers a memorylocation is being used.
The memorylocation is pointed at by whats in between the brackets, in this case esi+13 (Note that the 13 is in hexadecimal)

ESI=008AB100 so the address pointed at is 008AB113.
This instruction would decrease the value stored at location 008AB113 with the value stored in ebx(wich is 3).

If the value at location 008AB113 was 100 then the value stored at 008AB113 after this instruction would be 97.

sub [esi+13],63 (esi=008AB100)
This is almost the same as above but instead of using a register it uses a direct value.

Note that 63 is actually 99 because the instruction is always written using hexadecimal.

Lets say the value at 008ab113 is 100 (wich is 64 in hexadecimal) then the value at 008ab113 after execution would be 1 (100-99)

sub ebx,[esi+13] (ebx=00000064 esi=008ab100)
This instruction decreases the value stored in ebx with the value stored at location 008ab113. (esi+13=008ab100+13=008ab113, in case you forgot)

Up until now i've only used SUB as instruction, but there are lots and lots of other instructions the procesor knows.

Lets take a look at MOV, one of the most often used instructions
although it's name sugests that it moves data, it just COPYs data from one spot to another.

MOV works exactly the same as sub. first parameter is the destination, and second parameter is the source.

examples:
MOV eax,ebx eax=5,ebx=12
Copies the value stored in ebx into eax

So, if this instruction would be executed eax would be 12. (and ebx would stay 12)

MOV [edi+16],eax eax=00000064, edi=008cd200)
This instruction will place the value of eax(64hex=100 decimal) at the location of edi+16 (008cd200+16=008cd216).
So after instruction the value stored at 008cd216 will be 100 (64 hex)

As you see, it works just like the SUB instruction.

Then there are also those instructions that only have 1 parameter like inc and dec.
example:
inc eax :increase the value at eax with 1
dec ecx: decrease the value of ecx with 1
dec [ebp]: Decrease the value stored at the address pointed to by ebp with 1.

Right now i've only shown the 32-bit registers (eax, ebx ecx....) but there are also 16-bit register and 8-bit registers that can be used.
the 16 bit registers are: AX,BX,CX,DX,SP,BP,SI,DI
the 8 bit register are: AH,AL,BH,BL,CH,CL,DH,DL

Note that when changing ah or al you'll also change AX, and if you change AX you'll also change EAX, same goes for bl+bh+bx+ebx,ch+cl+cx+ecx,dh+dl+dx+edx

You can use them almost the same with the instructions for 32 bit but they will only change 1 (8 bit) or 2(16-bit) bytes, instead of 4 (32-bit) bytes.

example:
dec al :decreases the 8 bit register al
sub [esi+12],al :decreases the 1-byte value stored at the location esi+12 points at with the value of al
mov al,[esi+13]:places the 1-byte value stored at the location esi+13 points in the al register.

Note that it is IMPOSSIBLE to use a 16 or 8 bit register for instructions that point to an address. eg: mov [al+12],0 will NOT work.

There are also 64 and 128 bit registers, but I wont discuss them since they are hardly ever used, and cant be used with the other instructions that also work with 32 bit)

Then there are the JUMPS, LOOPS, and CALLS:
JMP:
The JMP instruction is the easiest it changes the Instruction Pointer (EIP) to the location the JMP instruction points at and continues from there.

There are also conditional jumps that will only change the instruction pointer if a special condition has met. (for example set using the compare instruncion (CMP))

JA=Jump if Above
JNA=Ju,p if not above
JB=Jump if below
JE=Jump if equal
JC=Jump if carry
and LOTS of other conditional jump

LOOP:
The loop instruction also points just like the JMP to a memory location, but only jumps to that location if the ECX register is not 0.

and of course, there are also special contitional loops:
LOOPE:Loop while ecx is not 0 AND the zero flag is not set
LOOPZ:same as LOOPE.
LOOPNE:Loop while ECX is not 0 AND the zero flag is set.
LOOPNZ:Same as LOOPNE

I gues I should also explain what flags are, they are bits in the processor that can be used to check the condition of a previous instruction like 'cmp al,12' if al=12 then the zero flag (ZF) will be set to true, else the Zero flag(ZF) will be set to false.

CALL:
Call is the same as JMP except it uses the stack to go back.

Explenation of the stack:
The stack is a location on memory pointed at by the ESP register.
You can put values in it using the PUSH command, and take out it using the POP command. If you use PUSH it will decrease the ESP register and place the value at the location of ESP. If you use POP it will place the value pointed at by pop into the location pointed at by the parameter of POP and increase the value of ESP. In short: The last thing you push in the stack will be the first thing you pop from the stack, the 2nd last item in will be the 2nd item out.

RET:
After CALL has pushed the location of the next instruction onto the stack it jumps to that location. (sets the instruction pointer to that location)

After a while it will encounter a RET instruction, and will then jump to the location that is stored in the stack. (Call pushed the location in the stack, ret pops it out again and jumps to that location)

And thats the tutorial on the basics of assembler, if you have questions about assembler and stuff just ask and I'll try to answer.

Nice file to check out if you want more info:
http://podgoretsky.com/ftp/Docs/Hardware/Processors/Intel/24547111.pdf

note: It's really usefull to understand how those values between brackets work, because then you can make the most use of the pointer stuff in CE 4.1 (It will remove for most games the Dynamic Memory Allocation problem for most games, if you know how how to look at the assembler code that accesses the values you found)

------------------------------------------------------------------

The "flags" are a set of bits stored in a special register. If the bit is "1" the flag is said to be set, and if it's "0" then the flag said to be "clear". Collectively, the flags tell you all about the processor's internal status and gives more information about the results of previous instructions.

There are three types of flags: Status flags that tell you about the results of the last instruction, Control flags that tell you how the processor will behave, and System flags that tell you about the environment your program is executing it.

The flag register is 32 bits: (S=Status flag, C=Control flag, X=System flag)

Code:
0 S Carry
1 (Reserved)
2 S Parity
3 (Reserved)
4 S Auxiliary Carry
5 (Reserved)
6 S Zero
7 S Sign
8 X Trap
9 X Interrupt Enable
10 C Direction
11 S Overflow
12 X I/O Privilage (bits 12&13)
13 X
14 X Nested Task
15 (Reserved)
16 X Resume
17 X Virtual 8086
18 X Alignment Check
19 X Virtual Interrupt
20 X Virtual Interrupt Pending
21 X Identification
22
23 |
24 |
25 |
26 |_ (Reserved)
27 |
28 |
29 |
30 |
31 /

Let's go over the status flags, since those are used most often.

Overflow:
When an operation (Addition, subtraction, multiplication, etc) produces a result that is too big to fit in the register (or memory location) used, the Carry flag is set. (If not, it's cleared automatically) For example, if you're using a 16 bit register and your operation produces a value that won't fit in 16 bits, the carry flag is set.

Sign:
Set if the result is negative, cleared if positive. This is typically a mirror of MSB (most significant bit) of a value.

Zero:
Set if result is 0.

Auxiliary Carry:
Similar to Carry, but it will treat the register/memory location as 3-bits instead of 8, 16 or 32. This is used for BCD (Binary coded decimal) stuff and it generally pretty useless otherwise.

Carry:
The carry flag is set if the bit one past the lmit of the register/memory location would have been set. For example, mov al, 0xFF then add al, 1 will cause a carry because the 9th bit would have been set. Also note that the overflow and zero flags would be set and sign flag cleared, too!


What is the difference in bytetype

Originally posted by emperor:

2 Byte means: 00 00 to FF FF this allows only up to 65535, obviously.
4 byte means: 00 00 00 00 to FF FF FF FF (allows up to 4294967295).
Now for example you can miss 2 byte values with 4 byte scans:
example: value in game is 300 stored in game's memory as 012C
If you search for 12C as 2 Byte it will be in your results.
If you search for 12C as 4 byte the 2 Bytes before the 012C matter as well.
For example the 012C would be after an FF FF.
Meaning: FF FF 01 2C is in the memory 01 2C being what you are searching for. However seen as 4 Byte this is not 01 2C (300) but it's FF FF 01 2 C (4294902060) .
To my mind for exact value scans you should use the smallest appopirate byte type (for ex if it doesn't rise over 65000 use 2 byte). However since most games multiply it with a certain factor exact value scans are hardly any useful...when doing an unknown value scan it's up to you to chose the correct bytesize...most commonly used is 4 byte after all. It's nothing new to me seeing games showing a stat up to like 2000-3000 as 4 Byte in a huge number over serveral hundret thousands..however how much a certain game multiplies,adds or substracts, or tries to hide it depends on the game, is therefore sort of unknown therefore i think in many cases the bytesize is also sort of unknown although 4 Byte is always likely. Note doing increase/decrease value scans wouldn't fail even if there were some other bytes before it: for ex
FF FF 01 2C is increased by one...
---> FF FF 01 2D increased would still be okay as unknown initial.
But if the FF FF also changes
to like FE FE then it would screw up the scan.


ASM Basics 1

Authored by DABhand

The Basics

Opcodes
=====

Ok whats opcodes? An opcode is an instruction the processor can understand. For example

SUB and ADD and DIV

The sub instructions subtracts two numbers together. Most opcodes have operands

SUB destination,source like the following

SUB eax, ecx

SUB has 2 operands. In the case of a subtraction, a source and a destination. It subtracts the source value to the
destination value and then stores the result in the destination. Operands can be of different types: registers,
memory locations, immediate values.

So basically that instruction is this, say for example eax contained 20 and ecx contained 10

eax = eax - ecx
eax = 20 - 10
eax = 10

Easy that bit huh

Registers
======

Ahhh here is the main force of asm, Registers contain values and information which is used in a program to keep
track of things, and when new to ASM it does look messy but the system is practically efficient. It is honestly

Lets take a look at the main Register used, its eax. Say it contains the value FFEEDDCCh (the h means hexidecimal)
when working later with softice u will see hex values alot so get used to it now

Ok Ill show how the registers are constructed

EAX FFEEDDCC
AX DDCC
AH DD
AL CC

ax, ah, al are part of eax. EAX is a 32-bit register (available only on 386+), ax contains the lower 16 bits (2 bytes)
of eax, ah contains the high byte of ax, and al contains the low byte of ax. So ax is 16 bit, al and ah are 8 bit.
So, in the example above, these are the values of the registers:

eax = FFEEDDCC (32-bit)
ax = DDCC (16-bit)
ah = DD (8-bit)
al = CC (8-bit)

Understand? I know its alot to take in, but thats how registers work Heres some more examples of opcodes and the
registers used...

mov eax, 002130DF mov loads a value into a register
mov cl, ah move the high byte of ax (30h) into cl
sub cl, 10 substract 10 (dec.) from the value in cl
mov al, cl and store it in the lowest byte of eax.

So at start..

eax = 002130DF

at end

eax = 00213026

Did you follow what happened? I hope so, cause im trying to make this as easy as I can

Ok lets discuss the types of registers, there is 4 types used mainly (there is others but will tell about them later)

General Purpose Registers
=================

These 32-bit (and their 16bit and 8bit sub registers) registers can be used for anything, but their main purpose is
shown after them.

eax (ax/ah/al) Accumulator
ebx (bx/bh/bl) Base
ecx (cx/ch/cl) Counter
edx (dx/dh/dl) Data

As said these are hardly used nowadays for their main purpose and is used to ferry arround information within programs
and games (such as scores, health value etc)

Segment Registers
============

Segment registers define the segment of memory that is used. You'll probably won't need them with win32asm, because
windows has a flat memory system. In dos, memory is divided into segments of 64kb, so if you want to define a memory
address, you specify a segment, and an offset (like 0172:0500 (segment:offset)). In windows, segments have sizes
of 4gig, so you won't need segments in win. Segments are always 16-bit registers.

CS code segment
DS data segment
SS stack segment
ES extra segment
FS (only 286+) general purpose segment
GS (only 386+) general purpose segment

Pointer Registers
===========

Actually, you can use pointer registers as general purpose registers (except for eip), as long as you preserve their
original values. Pointer registers are called pointer registers because their often used for storing memory addresses.
Some opcodes (and also movb,scasb,etc.) use them.

esi (si) Source index
edi (di) Destination index
eip (ip) Instruction pointer

EIP (or IP in 16-bit programs) contains a pointer to the instruction the processor is about to execute. So you can't
use eip as general purpose registers.

Stack Registers
==========

There are 2 stack registers: esp & ebp. ESP holds the current stack position in memory (more about this in one of the
next tutorials). EBP is used in functions as pointer to the local variables.

esp (sp) Stack pointer
ebp (bp) Base pointer

MEMORY
=====

How is the memory used within ASM and the layout of it? Well hopefully this will answer some questions. Bear in mind
there is more advanced things than what is explained here, but hell you lot arent advanced, so start from the basics

Lets look at the different types..

DOS
===

In 16-bit programs like for DOS (and Win 3.1), memory was divided in segments. These segments have sizes of 64kb.
To access memory, a segment pointer and an offset pointer are needed. The segment pointer indicates which segment
(section of 64kb) to use, the offset pointer indicates the place in the segment itself.

Take a look at this

----------------------------MEMORY--------------------------------
|SEGMENT 1 (64kb)|SEGMENT 2 (64kb)|SEGMENT 3 (64kb)|etc...........|

Hope that shows well

Note that the following explanation is for 16-bit programs, more on 32-bit later (but don't skip this part, it is
important to understand 32-bits).

The table above is the total memory, divided in segments of 64kb. There's a maximum of 65536 segments. Now take one
of the segments:

-------------------SEGMENT 1(64kb)----------------------
|Offset 1|Offset 2|Offset 3|Offset 4|Offset 5|etc.......|

To point to a location in a segment, offsets are used. An offset is a location inside the segment. There's a maximum of
65536 offsets per segment. The notation of an address in memory is:

SEGMENT:OFFSET

For example:

0145:42A2 (all hex numbers remember )

This means: segment 145, offset 42A2. To see what is at that address, you first go to segment 145, and then to offset
42A2 in that segment.

Hopefully you remembered to read about those Segment Registers a while ago on this thread.

CS - Code segment
DS - Data Segment
SS - Stack Segment
ES - Extra Segment
FS - General Purpose
GS - General Purpose <<< Them remember

The names explain their function: code segment (CS) contains the number of the section where the current code that is
being executed is. Data segment for the current segment to get data from. Stack indicates the stack segment
(more on the stacks later), ES, FS, GS are general purpose registers and can be used for any segment (not in win32 though).

Pointer registers most of the time hold an offset, but general purpose registers (ax, bx, cx, dx etc.) can also be
used for this. IP (Pointer register) indicates the offset (in the CS (code segment)) of the instruction that is
currently executed. SP (Stack register) holds the offset (in the SS (stack segment)) of the current stack position.

Phew and you thought 16bit memory was hard huh

Sorry if thats all confusing, but its the easiest way to explain it. Reread it a few times it will eventually sink
into your brain on how memory works and how it is accessed to be read and written too

Now we move to

32-bit Windows
==========

You have probably noticed that all this about segments really isn't fun. In 16-bit programming, segments are essential.
Fortunately, this problem is solved in 32-bit Windows (9x and NT).

You still have segments, but don't care about them because they aren't 64kb, but 4 GIG. Windows will probably even crash
if you try to change one of the segment registers.

This is called the flat memory model. There are only offsets, and they now are 32-bit, so in a range from 0 to 4,294,967,295.
Every location in memory is indicated only by an offset.

This is really one of the best advantages of 32-bit over 16-bit. So you can forget the segment registers now and focus
on the other registers.

Oh the madness of it all, wow 4 gig bits to work with

The Fun Part begins!!!

Its

THE OPCODES
=========

Here is a list of a few opcodes you will notice alot of when making trainers or cracking etc.

1. MOV

This instruction is used to move (or actually copy) a value from one place to another. This 'place' can be a register,
a memory location or an immediate value (only as source value of course). The syntax of the mov instruction is:

mov destination, source

You can move a value from one register to another (note that the instruction copies the value, in spite of its name
'move', to the destination).

mov edx, ecx

The instruction above copies the contents of ecx to edx. The size of source and destination should be the same, this
instruction for example is NOT valid:

mov al, ecx ; NOT VALID

This opcode tries to put a DWORD (32-bit) value into a byte (8-bit). This can't be done by the mov instruction
(there are other instructions to do this). But these instructions are allowed because source and destination don't
differ in size, like for example...

mov al, bl
mov cl, dl
mov cx, dx
mov ecx, ebx

Memory locations are indicated with an offset (in win32, for more info see the previous page). You can also get a
value from a certain memory location and put it in a register. Take the following table as example:

offset 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42
data 0D 0A 50 32 44 57 25 7A 5E 72 EF 7D FF AD C7

(each block represents a byte)

The offset value is indicated as a byte here, but it is a 32-bit value. Take for example 3A
(which isn't a common value for an offset, but otherwise the table won't fit...), this also is a
32-bit value: 0000003Ah. Just to save space, some unusual and low offsets are used. All values are hexcodes.

Look at offset 3A in the table above. The data at that offset is 25, 7A, 5E, 72, EF, etc. To put the value at
offset 3A in, for example, a register you use the mov instruction, too:

mov eax, dword ptr [0000003Ah] ... but.......

You will see this more commonly in programs as

mov eax, dword ptr [ecx+45h]

This means ecx+45 will point to the memory location to take the 32 bit data from, we know its 32bit because of
the dword in the instruction. To take say 16bit of data we use WORD PTR or 8bit BYTE PTR, like the following examples..

mov cl, byte ptr [34h] cl will get the value 0Dh (see table above)
mov dx, word ptr [3Eh] dx will get the value 7DEFh (see table above, remember that the bytes are reversed)

The size sometimes isn't necessary:

mov eax, [00403045h]

because eax is a 32-bit register, the assembler assumes (and this is the only way to do it, too) it should take
a 32-bit value from memory location 403045.

Immediate numbers are also allowed:

mov edx, 5006

This will just make the register edx contain the value 5006. The brackets, [ and ], are used to get a value from
the memory location between the brackets, without brackets it is just a value. A register as memory location is
allowed to (it should be a 32-bit register in 32-bit programs):

mov eax, 403045h ; make eax have the value 403045 hex.
mov cx, [eax] ; put the word size value at the memory location EAX (403045) into register CX.

In mov cx, [eax], the processor first looks what value (=memory location) eax holds, then what value is at that
location in memory, and put this word (16 bits because the destination, cx, is a 16-bit register) into CX.

Phew

2. ADD,SUB,MUL and DIV

These are easy to understand Good old maths, im sure everyone can add and subtract and multiply and divide

Anyways on with the info

The add-opcode has the following syntax:

add destination, source

The calculation performed is destination = destination + source. The following forms are allowed:

Destination Source Example
Register Register add ecx, edx
Register Memory add ecx, dword ptr [104h] / add ecx, [edx]
Register Immediate value add eax, 102
Memory Immediate value add dword ptr [401231h], 80
Memory Register add dword ptr [401231h], edx

This instruction is very simple. It just takes the source value, adds the destination value to it and then puts
the result in the destination. Other mathematical instructions are:

SUB destination, source (destination = destination - source)
MUL destination, source (destination = destiantion * source)
DIV source (eax = eax / source, edx = remainer)

Its easy peasy aint it Or is it

Substraction works the same as add, multiplication is just dest = dest * source. Division is a little different.
Because registers are integer values (i.e. round numbers, not floating point numbers) , the result of a division
is split in a quotient and a remainder. For example:

28 / 6 --> quotient = 4, remainder = 4
30 / 9 --> quotient = 3, remainder = 3
97 / 10 --> quotient = 9, remainder = 7
18 / 6 --> quotient = 3, remainder = 0

Now, depending on the size of the source, the quotient is stored in (a part of) eax, the remainder in (a part of) edx:

Source size Division Quotient stored inRemainder Stored in...
BYTE (8-bits) ax / source AL AH
WORD (16-bits) dx:ax* / source AX DX
DWORD (32-bits) edx:eax* / source EAX EDX

* = For example: if dx = 2030h, and ax = 0040h, dx: ax = 20300040h. dx:ax is a dword value where dx represents the
higher word and ax the lower. Edx:eax is a quadword value (64-bits) where the higher dword is edx and the lower eax.

The source of the div-opcode can be:

an 8-bit register (al, ah, cl,...)
a 16-bit register (ax, dx, ...)
a 32-bit register (eax, edx, ecx...)
an 8-bit memory value (byte ptr [xxxx])
a 16-bit memory value (word ptr [xxxx])
a 32-bit memory value (dword ptr [xxxx])

The source can not be an immediate value because then the processor cannot determine the size of the source operand.

3. BITWISE OPS

These instructions all take a destination and a source, exept the 'NOT' instruction. Each bit in the destination is
compared to the same bit in the source, and depending on the instruction, a 0 or a 1 is placed in the destination bit:

Instruction AND OR XOR NOT
Source Bit |0 0 1 1|0 0 1 1|0 0 1 1|0 1|
Destination Bit |0 1 0 1|0 1 0 1|0 1 0 1|X X|
Output Bit |0 0 0 1|0 1 1 1|0 1 1 0|1 0|

AND sets the output bit to 1 if both the source and destination bit is 1.
OR sets the output bit if either the source or destination bit is 1
XOR sets the output bit if the source bit is different from the destination bit.
NOT inverts the source bit.

An example:

mov ax, 3406
mov dx, 13EAh
xor ax, dx

ax = 3406 (decimal), which is 0000110101001110 in binary.
dx = 13EA (hex), which is 0001001111101010 in binary.
Perform the XOR operation on these bits:

Source 0001001111101010 (dx)
Destination 0000110101001110 (ax)
Output 0001111010100100 (new dx)

The new dx is 0001111010100100 (7845 decimal, 1EA5 in hex) after the instruction.

Another example:

mov ecx, FFFF0000h
not ecx

FFFF0000 is in binary 11111111111111110000000000000000 (16 1's, 16 0's)

If you take the inverse of every bit, you get:
00000000000000001111111111111111 (16 0's, 16 1's), which is 0000FFFF in hex.

So ecx is after the NOT operation 0000FFFFh.

The last one is handy for serial generating, as is XOR. Infact XOR is used more for serials than any other instruction,
widely used for serial checking in Winzip, Winrar, EA Games, Vivendi Universalis

I WONT TELL YOU HOW TO MAKE KEYGENS SO DONT ASK :)

4. INC/DEC(REMENTS)

There are 2 very simple instructions, DEC and INC. These instructions increase or decrease a memory location or
register with one. Simply put:

inc reg -> reg = reg + 1
dec reg -> reg = reg - 1
inc dword ptr [103405] -> value at [103405] will increase by one.
dec dword ptr [103405] -> value at [103405] will decrease by one.

Ahh easy one to understand So is the next one

5. NOP

This instruction does absolutely nothing. This instruction just occupies space and time. It is used for filling purposes
and patching codes.

6. BIT rotation and shifting

Note: Most of the examples below use 8-bit numbers, but this is just to make the picture clear.

Shifting functions

SHL destination, count
SHR destination, count

SHL and SHR shift a count number of bits in a register/memlocation left or right.

Example:

; al = 01011011 (binary) here
shr al, 3

This means: shift all the bits of the al register 3 places to the right. So al will become 00001011. The bits on the left
are filled up with zeroes and the bits on the right are shifted out. The last bit that is shifted out is saved in the
carry-flag. The carry-bit is a bit in the processor's Flags register. This is not a register like eax or ecx that you
can directly access (although there are opcodes to do this), but it's contents depend on the result of the instruction.
This will be explained later, the only thing you'll have to remember now is that the carry is a bit in the flag register
and that it can be on or off. This bit equals the last bit shifted out.

shl is the same as shr, but shifts to the left.

; bl = 11100101 (binary) here
shl bl, 2

bl is 10010100 (binary) after the instruction. The last two bits are filled up with zeroes, the carry bit is 1, because
the bit that was last shifted out is a 1.

Then there are two other opcodes:

SAL destination, count (Shift Arithmetic Left)
SAR destination, count (Shift Arithmetic Right)

SAL is the same as SHL, but SAR is not quite the same as SHR. SAR does not shift in zeroes but copies the MSB
(most significant bit - The first bit if 1 it moves 1 in from the left, if 0 then 0's will be placed from left). Example:

al = 10100110
sar al, 3
al = 11110100
sar al, 2
al = 11111101

bl = 00100110
sar bl, 3
bl = 00000100

This one you may have problems to get to grips with

Rotation functions

rol destination, count ; rotate left
ror destination, count ; rotate right
rcl destination, count ; rotate through carry left
rcr destination, count ; rotate through carry right

Rotation looks like shifting, with the difference that the bits that are shifted out are shifted in again on the other side:

Example: ror (rotate right)

Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Before 1 0 0 1 1 0 1 1
Rotate count 3 1 0 0 1 1 0 1 1 (Shift out)
Result 0 1 1 1 0 0 1 1

As you can see in the figure above, the bits are rotated, i.e. every bit that is pushed out is shift in again on the
other side. Like shifting, the carry bit holds the last bit that's shifted out. RCL and RCR are actually the same as
ROL and ROR. Their names suggest that they use the carry bit to indicate the last shift-out bit, which is true,
but as ROL and ROR do the same, they do not differ from them.

7. Exchange

Quite Straightforward this, I wont go into major details, it just swaps the values of two registers about
(values, addresses). Like example..

eax = 237h
ecx = 978h
xchg eax, ecx
eax = 978h
ecx = 237h

Anyways end of day 1, if you learn this into your head the following days will get easier than harder. This is the basics
ive taught you. Learn em well.


ASM Basics 2

Authored by DABhand

FLOATS
======

Ok whats a Float all about, well its simple, a float uses REAL values, what is a REAL value?

A REAL value is a number which is not an integer, i.e. it contains numbers after a decimal
point, like for example a float opcode can work out 5 divided by 4 and give the answer 1.25,
also a REAL value can contain NEGATIVE numbers also like -3.567

An integer with the same math problem will report 1 as the quotient with a remainder of 1. So
you can see Floats are very usefull indeed :)

Why are we talking about floats? Some games and indeed applications will use float values to
either work out monetary values or even in a game like percentage values and so forth.

Both my latest trainers for Act of War and Settlers 5 (Die Siedler 5) use float values.

FLOAT OPCODES
=============

Here is a list of opcodes and what they do :)

FLD [source] Pushes a Float Number from the source onto the top of
the FPU Stack.

FST [destination] Copies a Float Number from the top of the FPU Stack
into the destination.

FSTP [destination] Pops a Float Number from the top of the FPU Stack
into the destination.

FLDZ Pushes +0.0 on top of FPU Stack

FLD1 Pushes +1.0 on top of FPU Stack

FLDPI Pushes PI on the top of FPU Stack

FILD [source] Pushes an integer from the source to the top of the
FPU Stack.

FIST [destination] Copies an integer from the top of the FPU Stack to
the destination.

FISTP [destination] Pops an integer from the top of FPU Stack into the
destination.

FCHS Compliments the sign-bit of a float value located on
the top of the FPU Stack or ST(0) Register.

FNOP Performs no FPU Operation.[It's a 2 byte instruction
unlike that of NOP which is a 1 byte instruction.]

FABS Replaces the float value on the top of the stack with
it's absolute value.

FADD [operand] Adds the value of the operand with the value located
on the top of the FPU Stack and store the result on
the top of the FPU Stack.

FCOS/FSIN Replaces the value on the top of the FPU Stack with
it's cosine/sine value.

FDIV [operand] Divide the value on the top of the FPU Stack with the
operand and store the result on the top of FPU Stack.

FMUL [operand] Multiply the value on the top of the FPU Stack with
the operand and store the result on top of FPU Stack.

FSUB [operand] Subtract operand value from the value on top of FPU
Stack and store the result on top of FPU Stack.

FXCHST (index) Exchanges values between top of FPU Stack and the
ST(index) register.

FCOM Compares the float value located on top if FPU Stack
with the operand located in memory or the FPU Stack.

FCOMP Same as FCOM but pops the float value from the top of
the FPU Stack.

FNSTSW AX Store FPU Status Word in AX. (Used for Conditions)

Hope thats explanatory enough :)

Before I show an example or two, lets talk about Stacks. What are they?

STACKS
======

Well a stack is used for a temporary location for values, a game or application may
want to use a register for something else but want to keep the previous value for
future reference, so the program will PUSH a value onto the stack for later
retrieval.

The stack is 8 small stacks in the 1, so look at it as a small filing
cabinet in a way. Any of these values can be retrieved by calling for the stack and
its position, like the following

st(0) - always the top of the stack
st(1) - next after top
st(2) - 2nd from the top
..
st(7) - Bottom of the stack

So when you want to get a value you can if you know where it is stored, it does
become a little complicated if you keep PUSH'ing values to the top of the stack as
the previous value is moved down 1. So to take a value we just POP it back.

So remember

PUSH - Places a value on a stack
POP - Removes a value from the stack

But those opcodes are handy for integer values, what about floats?

The next section will show you.

FLOAT EXAMPLES
==============

OK how to PUSH and POP values from the stack, its not difficult, heres a few
examples :)

Example 1

Say we have a value in a known address which is a REAL value (so float) and want
to add a value to it? For arguments sake lets say the register EAX contains the
address 450000h which contains money in a game and we want to add a value from
revenue which resides in an address contained in register EBX at 450008h and
then send back to the original address?

Here is how

FLD [eax] - This opcode PUSH's the value at the address 450000h contained in
EAX and pushes it to the top of the stack

FADD [ebx] - This then adds the value at the address 450008h contained in EBX
with the value at the top of the stack, then replaces the value
at the top of the stack with the new value from the FADD opcode.

FSTP [eax] - This then POP's the value on top of the stack to the address 450000h
contained in the register EAX, where your old money value was and
replaces with new one.

Example 2

Say now we want to calculate a Health Points value after taking damage, but wait!
The damage is a float value but health is integer :o So how does this work out??
Its not difficult ill show you how :) Again we will use the last registers for
this example, EAX (450000h) contains our Health integer value and and EBX (450008h)
contains our damage float value.

Here it is

FILD (EAX) - This opcode PUSH's an integer value to the top of the stack from the
address 450000h contained in EAX.

FSUB (EBX) - This subtracts the value at address 450008h (float) contained in EBX
from the value at the top of the stack.

FISTP (EAX) - This opcode POP's an integer value from the the top of the stack to
the address 450000h contained in EAX. If the REAL value was 1.50 or
higher it will send as an integer of 2, if 1.49 or lower then it will
send as 1.

Great huh :) See its not that difficult to understand :)

Example 3

This one is a toughy, we have a game but one of the addresses in the EAX register is
needed for later on, but we also need the EAX register to work out a new ammo value,
and no other register is free to send the address to, omg what to do what to do!!

Dont worry, believe in the stacks :) The following will contain POP and PUSH command :)

So for this example, EAX contains the value 800000h, the ammo value is contained
at the address 450000h and the EBX contains the address 450008h which contains the
either positive or negative number to be added to the ammo amount, if negative a shot
was fired, if positive then a reload of the weapon or ammo picked up.

PUSH EAX - This opcode PUSH's the value of EAX (notice without the [ ] it moves
the value in EAX to the stack but if it had the [ ] it would move
the value contained at the address of the value in EAX). In this
case 800000h is PUSH'd on top of the stack.

MOV EAX, 450000h - This opcode moves the value 450000h into the register EAX, which
replaces the old 800000h value.

FILD [EAX] - This opcode as you know will PUSH the value at the address contained
in the register EAX, see the difference its using the [ ] so the
game will look at the address 450000h and take the value there, and
the PUSH to the top of the stack.

FADD [EBX] - This again is self explanatory now, it adds the value at address
450008h with the value on the stack, if it was a negative number it
will decrease the value, if positive increase it, just basic maths :)

FISTP [EAX] - Again this POP's an integer value from top of stack to the memory
location contained in EAX, which is 450000h.

CALL 46AEFF - What the hell is this??? I hear you say, wait a bit ill tell you
just after :)

POP EAX - This opcode POP's the original 800000h back into the register EAX, so
the game hasnt lost that value.

OK, the CALL opcode, its a handy opcode for the fact that if your program or game uses
a routine to work out something but is always used it would be messy code if we were to
keep manually typing it out not to mention a much bigger file.

The CALL opcode, calls the opcodes at a certain address to work out the same function
it does later on, so you only need to have that 1 set of opcodes for the entire program
or game, you just CALL it, saves time and space.

At the end of these opcodes from a CALL will be an opcode call RET (return) it will make
the program or game go back to where it left off, in this case to the POP EAX opcode.

Thats end of day 2 :)

Hope you understood and it helped you see how things work.

Any questions just post and ill answer when available :)

Next time I will talk about different Jumps and Compares :)

After that Ill show you how to code inject to make a trainer :D But as I said learn these
well and you will understand what im talking about when code injecting ;)


ASM Basics 3

Authored by DABhand

CONDITIONALS AND JUMPS
======================

Ok this will be the last one for a while to show you, as they get more and more advanced.

Learning the 3 days very well, should well be enough to do easy and simple trainers and
how to find the values.

First I want to talk about Flags, what the hell are flags???

Well its not that difficult to understand.

Flag registers
==============

The flag register has a set of flags which are set/unset depending on calculations or
other events. Here is the more important ones.

ZF (Zero flag)
This flag is set when the result of a calculation is zero (compare is actually a substraction
without saving the results, but setting the flags only).

SF (Sign flag)
If set, the resulting number of a calculation is negative.

CF (Carry flag)
The carry flag contains the left-most bit after calculations.

OF (Overflow flag)
Indicates an overflow of a calculation, i.e. the result does not fit in the destination.

There is other flags some which you will never use so I wont talk about them.

Jumps
=====

Heres a list of the Opcodes for Jumps

Opcode Meaning Condition
JA Jump if above CF=0 & ZF=0
JAE Jump if above or equal CF=0
JB Jump if below CF=1
JBE Jump if below or equal CF=1 or ZF=1
JC Jump if carry CF=1
JCXZ Jump if CX=0 register CX=0
JE (is the same as JZ) Jump if equal ZF=1
JG Jump if greater (signed) ZF=0 & SF=OF
JGE Jump if greater or equal (signed) SF=OF
JL Jump if less (signed) SF!=OF
JLE Jump if less or equal (signed) ZF=1 or SF!=OF
JMP Unconditional Jump -
JNA Jump if not above CF=1 or ZF=1
JNAE Jump if not above or equal CF=1
JNB Jump if not below CF=0
JNBE Jump if not below or equal CF=1 & ZF=0
JNC Jump if not carry CF=0
JNE Jump if not equal ZF=0
JNG Jump if not greater (signed) ZF=1 or SF!=OF
JNGE Jump if not greater or equal (signed) SF!=OF
JNL Jump if not less (signed) SF=OF
JNLE Jump if not less or equal (signed) ZF=0 & SF=OF
JNO Jump if not overflow (signed) OF=0
JNP Jump if no parity PF=0
JNS Jump if not signed (signed) SF=0
JNZ Jump if not zero ZF=0
JO Jump if overflow (signed) OF=1
JP Jump if parity PF=1
JPE Jump if parity even PF=1
JPO Jump if paity odd PF=0
JS Jump if signed (signed) SF=1
JZ Jump if zero ZF=1

As you can see, jumps have conditions set to them from a previous calculation, test or compare.

Look at this example

TEST EAX,EBX
JE 004822FFh
MOV EAX,EBX
JMP 004822FFh

This little example basically tests two values to see if they are equal, if so the program
will move the value 1 into the Zero Flag (ZF), thus allowing the conditional jump (JE) to
goto a memory location to execute opcodes there.

Now if it wasnt equal, the program will move 0 into ZF, and will skip the JE instruction, then
move the value in the EBX register to the EAX register, forcing to be equal then doing an
unconditional jump (JMP) to the same memory location.

Games can use this, some games have a real address for values and a (what I like to call)
ghost address, the ghost address is where the value to be shown on the game is used, but
if a check like above exists, no matter what you force into that address will revert back
to the real one.

Im sure anyone trying to scan memory addresses for a game may have came up against this at
one point.

Other opcode that can be used is

CMP register, register/value - Compare two values and move 0 or 1 into appropriate
Flags.

Ok thats enough for now, ive taught you basic ASM opcodes, floats and Conditional Jumps.

This should be all you need to train a game :)


Cheat Engine specific

These are tutorials that are specific to Cheat Engine. That is, they all tell you how to go about doing something within Cheat Engine. These are good for finding tips about how to better use the software, and good for first-timers learning their way around it.


Remote desktop instead of network version

Originally posted by Zhoul:

*Pre-Req!!! Windows XP Professional - (Not Home) - Upgraded to SP2. Worry not, hacked TCPIP DLL's are talked about below.*

When I first started using cheat engine, I thought it was fantastic! I hated to have to alt+tab, and am usually using 2 PC's anyhow, so I loved the fact that it came with a network client.

The problem(s)? The network client didn't do as good a job, because when I tried to do things like 'See what writes to this value', It would usually end up crashing my game, mostly the very first time I tried doing it. The network client also had more bugs and lacked the newer features.

I fiddled with the settings *a lot*, trying to see if it was something I was doing wrong, or a config option that wasn't set properly. To no avail.

I then launched a massive search for another software/debugger that had a network client, but stumbled upon something I think is a lot better.

Basically, Microsoft messed around with giving us concurrent remote desktop + console sessions. Meaning: The ability to be logged into the console, and still connect remotely, without logging the console session out. They scrapped the idea later, because of licensing. They had released termserv.dll in a beta version of SP2, and of course, it was preserved by techies everywhere.

I quickly installed the new termserv.dll, grinning from ear to ear, rebooted my PC, then tried to login remotely.

Ack! Console session was logged out! Ahh!!! I get it... the same user cannot login twice. So I created a 2nd admin account, and that solved *that* problem.

I then loaded up a game on my main PC and remote desktop'd to it, and loaded up cheat engine on the other.

ACK!! User wasn't allowed to debug?!

I quickly loaded up gpedit.msc and navigated its non-logical tree structure and finally found an option that lets you specify who has rights to debug programs (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs). Gave my new user rights to debug then tried again.

ACK! I still wasn't allowed to 'connect' to my game, as microsoft does not allow us to 'peek' into a process that was run by another user.

Yet another hurdle I soon passed over, by using a command known as "RunAs". I had to run Cheat Engine.exe AS the console user. I figured this out quite quickly, because I already use it to run internet explorer as a 'guest' account (I'll tell ya, doing that beats out any spyware/virus scanner I've ever used.)

---------------------------------------------------------------------
To sum up what is needed:

- Windows XP PROFESSIONAL with SP2 installed (this is a must. I didn't want to go to SP2, but had to. This termserv.dll will *NOT* work with XPSP1).
- Install the termserv.dll which is linked at the bottom of this post, or find an installer version of it via google.
- Make sure the service "Fast User Switching" is enabled. Usually is by default, but some of us like to slim down XP to essential processes, and this is notoriously disabled by folks like us (and notoriously the reason people can't get concurrent terminal services working).
- Create a 2nd administrator account and MAKE SURE to login as that user locally, before you try to do it via remote desktop. New users aren't entirely 'created' until their first login.
- Load gpedit.msc (from start>run), and give your new user access to debug programs. (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs).
- Login via remote desktop, as your new user.
- Create an icon for cheat engine, that does something like this...
runas.exe /savecred /profile /user:"MyConsoleSession" "J:EngineEngine.exe"
---------------------------------------------------------------------

Of course, replace "MyConsoleSession" with the username that you use to login to the console with. In my case, Zoultan was the console/original username, Zoultan2 was the remote desktop session, so I would put Zoultan where MyConsoleSession is.

Also, change the path to cheat engine.exe

The good thing about runas, is the /savecred switch. The first time you run it, you will be prompted for the password. This will be saved and not asked for again.

I run things as other users a lot, so I created a batch file to do so, then placed it in C:. You don't need this to use cheat engine, but I'll pass it out for those who are interested in it.

------------ START - Cut below this line but not the line itself ------------
@echo off
set Uname=Zoultan

set Arg=%1
SHIFT

:parseArgs
if "%1" == "" goto RunAz
set Arg=%Arg% %1
SHIFT
goto parseArgs

:RunAz
If NOT DEFINED Arg (
echo.
echo No program or paramaters were specified.
echo.
goto End
)

rem The following 2 lines were placed here, to handle .msc's as if they were EXE's. I was tired of having to run mmc.exe <whatever.msc>.
set ArgPart=%Arg:"=%
set ArgPart=%ArgPart:~-3%
if "%ArgPart%" == "msc" set Arg=%windir%.exe %Arg%

echo.
echo.
echo.
echo Running [ %Arg% ] As [ %Uname% ]
echo Command: runas.exe /savecred /profile /user:"%Uname%" "%Arg%"
runas.exe /savecred /profile /user:"%Uname%" "%Arg%"|rem
echo.
echo.
if NOT "%errorlevel%" == "0" echo There has been an error while trying to run %Arg% as %UName%
goto End

:END
set Arg=
set ArgPart=
set Uname=
ping -n 5 127.0.0.1|rem
------------ END - Cut above this line but not the line itself ------------

Of course, you would change the set Uname=Zoultan line to match the user you want to runas. It could even be changed to accept the username via command line, but this was written specifically to launch as 1 user (and I created 2 other batch files for my other users).

All my CE icons are setup like so...
Z.bat "J:Engine 1engine.exe"
Z.bat "J:Engine 2engine.exe"
etc... etc... etc...

Another reason I setup this .bat is so I could run things like task manager from my remote desktop session. Even though a remote admin can kill another admins processes, they can't do things like "Set Affinity", etc. So when I'm disallowed the ability to do something, I just use z <command> to launch the program, and voila'

You can also run things like regedit.exe , from console, as your remote desktop user, if you're g33ky enough to want to change other users settings without having to login as that user.

Lastly: If you're curious why the .bat file pings 127.0.0.1 (local host)... XP didn't come with a wait or sleep command. Therefore, in my batch files, I use ping and re-direct its output to rem (null essentially). What this does, is leaves the dos window up for 5 seconds, so I can catch the success/error messages, without having to use pause.

Remote Desktop Terminal Services Hack:
http://sig9.com/articles/concurrent-remote-desktop

If this link doesn't work in the future, then use google, and search for...
xp sp2 terminal services hack
There is hella-documentation on this ... undocumented feature =)

- Zhoul


Searching Tip

Originally posted by Smidge204

When searching for a value in memory using the scan, here are a few pointers to find the value quickly:

1) If the value is known, but the format is not (ie: Byte, 2 Bytes, 4 Bytes...) search for the smallest type that will hold the data.

For example, if the value you want is 60, search for bytes. If the value is 1224, search for 2 Byte values, etc. The idea being that if the actual format is larger (You searched for 2 byte values but it's actually a 4 byte values) then the other bytes would be 0 anyway and the value would still be found.

But if you search for a 4 byte value when it's really less, you might never find it because you're reading nearby bytes as well that might screw up your search!

2) If the value is unknown, use the "Unknown initial value" scan along with method 1 (ie: always use bytes unless you happen to know it's size). Then do something that changes it's value.

Once the value has changed, repeat the scan using "Changed values". This will filter out all the crap.

Now go back into the game and do a bunch of stuff that DOESN'T change the value, if possible. Now repeat the scan for "Unchanged values". This will filter out stuff like position values, timers and counters.

Keep repeating until you've widdled down the searches to a managable amount, then add all the results to your list and keep an eye on them as the game runs. Remove anything that changes when it logically shouldn't. Anything that's left, try plugging in random values and see if something happens!

3) If you've found a bunch of good values, and youre looking for information that is somewhat related (Such as Lives and money, or whatever) , try restricting your search range to within a few kilobytes of the known value either way. This is especially powerful when looking for values in tables (High score list, for example) since they tend to be right next to eachother.

4) Use "Bigger than" and "Smaller than" as often as possible, especially after scans for changed or unchanged values. This can generally wittle down the results pretty fast.

5) Use arrays to peek at multiple byte values at once. Useful for detecing patterns!

6) Sometimes string values are not stored as ASCII strings, so the "Text" search doesn't work. For example, "A" might be stored as 0x01 instead of 41. If that's the case, and you have control over the value in-game (character name?) then try these steps:

-Set the character name
-Search for "Unknown initial value"
-Change name
-Search for "Changed values"
(Repeat above two steps to eliminate as much junk as possible. See also tip #2)
-Change name to all the same characters. ie: "AAAAAAA". Try to max out the space you're given.
-Search one more time for changed values. If you've increased the number of displayed results enough to get a list, scroll down and see if you have a bunch of consecutive memory locations that have the same value. (Should be the same as the length of the string!)
-Add the first address to your list as an array equal to the length of the string you entered.
-Change name to an easily identifiable pattern. ie: "ABCDEFG"
-See if the bytes in your array changed to a similar pattern. If so, start mapping the characters to their values and you're done!

Once you have the character map, you can use it to "translate" other text you couldn't find before. Simply search for an array of bytes and enter in the expected values of each letter in order.

Hope that helps!
=SMidge=


Code Injection and the auto assembler

Originally posted by scribly:

Lets say you've found the code that decreases your health
Problem is that it seems to also affect the health of your opponents, and somehow you can't seem to find the basepointer.
In those cases doing some code injection using CE's auto assembler is the easiest solution

There are several ways code injection can help solve this problem.
One method is finding another code that accesses your health, but does it only for your own health. (e.g the code that is used to display your current health)
There inject some code that stores the address of your health to a address you can find back again (more on that later)
Then in the code that decreases your health inject some code that checks if the address changes is the address stored by the other routine, if it is, skip the code, otherwhise, just decrease the health, or even create a instant kill cheat by decreasing the health of opponents by a really big value.

Now for the auto assemble script part:
lets say that at 00405000 is the code that reads your health: mov eax,[esi+ecx*4]
and at 00421000 is the code that decreases the health of enemies: mov [esi+ecx*4],edx

First allocate some memory to place your code in, and to allocate space for variables, use alloc(name,size) for that.
Alloc allocates a region of memory with read,write and execute access. (be aware, this wont work in windows me, 98 or 95 so please upgrade if you are using those ancient os's)
So:
Code:

alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes
alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management
alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 bytes)

Now, write your injecthealthreader routine to store the address, and place a jump to your original code as well. dont forget that when placing a jump to your code cave keep in mind that if the instruction was larger than a jump to nop the remaining bytes, and in case of the jump being bigger than the instruction also save the other instruction, AND nop incomplete bytes. Jumps are 5 bytes.
So in the case of "mov eax,[esi+ecx*4]" the bytecode is 8b 04 8e (3 bytes) so you'll also need to save the instruction after it. Let's say it's followed by a "mov ecx,[esi+edx*4+4]" , bytecode=8b 4c 8e 04 (4 bytes), so now we have 7 bytes to place our jump, thats more than enough. So we'll have to place 2 nops after the jump (7-5=2)

Code:

00405000:
jmp InjectHealthAddress //jump to the codecave
nop //nops for the lost space
nop
returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....)

injectHealthReader:
push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers
lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax
mov [playerhealthaddress],eax
pop eax //restore the register, again, not needed here, but good habbit to do

originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here
mov eax,[esi+ecx*4] //read health
mov ecx,[esi+edx*4+4] //read something else, my gues, armor

jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash...

As you see to specify a exact address just type it in ended with a ':' . Everything you type in after that will get assembled on and after that address (the jump and nops in this case, and the definition of the returnHealthReader:, which is in it's own turn also a address specifier, but doesn't change the current address)

This code introduces labels, they are basicly identifiers specifying a address where thay have been placed.
you can't just use a label though, you'll first have to declare it using the label(labelname) function. I usually declare labels right after the part where I alloc memory.

so, right after the alloc I have this code to get the code above working:
Code:

label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out
label(originalhealthreadercode) //same as above

now when you run the game the address of your health will get stored into the location of playerhealthaddress.
You can already use this with cheat engine, because the auto assembler will tell you the address, but the allocation will change each time, so making a table for other people won't work, they'd have to fill in the address each time themselves. (I dont find that a problem but somehow some people do....)

So, let's automate it a little further and use the knowledge of your healthaddress to make yourself invulnerable, but not your oponents.
Just like the injection for the code that reads your health you can do the same for that that decreases health.
And you can put it in the same script as the injection for the reader, as you saw in the alloc part where I already allocated space for the injection for the health decreaser (so you dont have to edit the address the other script allocated)

so, write scriptcode that places a jump over the code that decreases your health, in this case "mov [esi+ecx*4],edx" which has bytecode 89 14 8e (3 bytes), too small, so find a instruction before or after thats also suitable, in this case there's a sub edx,eax just before this instruction, its bytecode is 29 c2 (2 bytes) so a perfect fit (5 bytes, so no need to nop), and even easier to make a code injection for (else I'd have to use a label between the 2 instructions to just skip the original line, but this sub edx,eax line is used to decrease as well, and doesn't change any of the locator addresses, and useless for the rest, so it doesn't hurt to skip it as well)

so to inject your routine that checks if this is your health or not and if so, dont decrease do:
Code:

00421000:
jmp injectHealthWriter
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005

injectHealthWriter:
//do a check if esi+ecx*4 matches the address stored in playerhealthaddress
//if it matches, skip the original code, if it doesn't just execute it

//save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless
//it's to read something(like parameters), in which case you'll have to adjust the offset
//also, dont change the registers that you use to find the address
push eax
push ebx
mov eax,[playerhealthaddress]
lea ebx,[esi+ecx*4]
cmp eax,ebx

je itstheplayer

//not the player
pop ebx //I think I could have doen this before the je, but better safe than sorry
pop eax
jmp originaldecreasehealthcode

itstheplayer:
pop ebx //restore the registers, keep in mind to restore the registers in reverse order
pop eax
jmp returnHealthWriter //dont execute the original code, return imeadiatly

originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter

again, I used a few labels to make it easier for me
but, that also means I'd have to declare them, else the assembler will complain it doesn't recognize them
so:
Code:

label(returnHealthWriter)
label(itstheplayer)
label(originaldecreasehealthcode)

and I prefer adding declarations at the top.

So, the complete auto assembler script would look like:
Code:

alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes
alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management
alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 bytes)
label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out
label(originalhealthreadercode) //same as above
label(returnHealthWriter)
label(itstheplayer)
label(originaldecreasehealthcode)

//----------------------------------------
// Healthreader
//----------------------------------------
00405000:
jmp InjectHealthAddress //jump to the codecave
nop //nops for the lost space
nop
returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....)

injectHealthReader:
push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers
lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax
mov [playerhealthaddress],eax
pop eax //restore the register, again, not needed here, but good habbit to do

originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here
mov eax,[esi+ecx*4] //read health
mov ecx,[esi+edx*4+4] //read something else, my gues, armor

jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash...

//----------------------------------------
// Health decreaser
//----------------------------------------

00421000:
jmp injectHealthWriter //overwrite the original code with a jump.
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005

injectHealthWriter:
//do a check if esi+ecx*4 matches the address stored in playerhealthaddress
//if it matches, skip the original code, if it doesn't just execute it

//save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless
//it's to read something(like parameters), in which case you'll have to adjust the offset
//also, dont change the registers that you use to find the address
push eax
push ebx
mov eax,[playerhealthaddress]
lea ebx,[esi+ecx*4]
cmp eax,ebx

je itstheplayer

//not the player
pop ebx //I think I could have doen this before the je, but better safe than sorry
pop eax
jmp originaldecreasehealthcode

itstheplayer:
pop ebx //restore the registers, keep in mind to restore the registers in reverse order
pop eax
jmp returnHealthWriter //dont execute the original code, return imeadiatly

originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter

Please be aware that I havn't tested this in ce yet, I've been writing this in notepad on a pc that doesnt have ce installed, so there may be a few syntax errors, and some of the code I've written can surely be optimised, but I hope you get the general idea.

Also, there's a bug in ce 5.0 where you can't use small identiers that can apear in the name of another identifier. (e.g weirdmemlocxxx and memloc can't be used at the same time, because memloc fits in weirdmemlocxxx)
But if you use normal names for identifiers this wont couse a problem, and I recommend identifiers of more than 4 characters, else it may happen you get the name of a assembler instruction and accidentally overwrite that when used.

_____________________

The other method of using code injection is finding if there are differences between the player data and opponent data.
Lets say that if it's the player [esi+ecx*4+14] contains a 1 otherwhise a 0. you can then do a check if that is set or not, if so, skip, otherwhise, decrease health

Code:

alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management
label(returnHealthWriter)
label(itstheplayer)
label(originaldecreasehealthcode)

//----------------------------------------
// Health decreaser
//----------------------------------------

00421000:
jmp injectHealthWriter //overwrite the original code with a jump.
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005

injectHealthWriter:
push eax
mov eax,[esi+ecx*4+14]
cmp eax,1
je itstheplayer

//not the player
pop eax
jmp originaldecreasehealthcode

itstheplayer:
pop eax //restore the register
jmp returnHealthWriter //dont execute the original code, return imeadiatly

originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter


Find out what addresses are accessed by a piece of code

Originally posted by Dark Byte

Sometimes when you've found a address and the code to change that address is also used to change other addresses (like that of the enemy) the following function will be usefull:

When you've found the code that accesses the address you've found you can save that and use it to find the address you are looking for, so you don't have to go through the slow scanning routine again. (unless of course scanning for it is a lot faster than this, like finding a piece of text and then recalculating the rest)

Go to the advanced window, rightclick the code and choose "Find out what addresses this code writes to" (or reads from depending on what kind of code it is, and can sometimes be a write instead of a read but that doesn't matter) and play the game. after a while the list will be filled up with all the addresses that that code used. (enemy's energy including if it is also used to handle the enemy)

Only downside is that this (currently) only works for instructions that have a [...] part. So instructions like "rep movsb" won't work, but that is a instruction thats useless to cheating anyhow)


3D pinball for windows (pointer+code)

Originally posted by me. (no not me, but the user called me)

this is to try answer the most common questions from people new to cheat engine

using 3d pinball for windows space cadet as an example,,,
it might be an idea to print this and other tuts so its easier to work through them,,,

( this game gives you some free balls so be on the look out for that during this tut )

start 3D PINBALL FOR WINDOWS ,, and wait for the first ball to deploy
start cheat engine
click on the flashing icon in the top left of cheat engine
in the bottom of process list window
double click on PINBALL.EXE to attache the game to cheat engine
in the value box type in 3
go into the pinball game and lose a ball
wait for the next ball to be deployed
go back into cheat engine
type 2 into the value box
click on the next scan button
I got the address A9FEE6 yours may be different

ok

I'll double click on the found address A9FEE6 to add it to the bottom pane
click on the checkbox to freeze this address
go back into the PINBALL GAME
lose some balls to see if its the right address
if you have got it right you'll have infinite balls

-------------------------------------------------------------------------------
now to find the code that changes the number of balls
-------------------------------------------------------------------------------

go back into cheat engine
(if you want you can double click on the value part of the address in the bottom pane and change it back to 3 or 4 balls)
In the bottom pane again right click on the address A9FEE6 and choose
FIND OUT WHAT WRITES TO THIS ADDRESS

you will then get the debugger window
go back into pinball and lose another ball
in the debugger window you should see the address of the code that changes the number of balls

I got 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax
click on this to highlight the code,, and click on the ADD TO CODELIST button
a box called CHEAT ENGINE CODE will pop up
name balls
and hit the OK button

a window called ADVANCED OPTIONS WILL pop up with balls in it
you can right click it and choose REPLACE WITH CODE THAT DOES NOTHING
to show that the code has been nopped out the name will turn red
you can hit the ok button to close the advanced options window then the stop and close button to exit the debugger
then save your table,,,, but for now
just hit the ok button to close the advanced options window

in the debugger window look at the code 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax
now with the code highlighted click on the MORE INFORMATION button
the EXTRA INFO box will pop up
in this box under copy memory you will see the sentance

THE VALUE OF THE POINTER NEEDED TO FIND THIS ADDRESS IS PROBABLY 00A9FDA0

this is the address held in the ESI register below this you can see all the values that the registers held at the instant you lost a ball,,
as you can see ESI=00A9FDA0
and highlighted in red you can see

01015F02 - mov [ esi + 00000146 ],eax

this is all in hexadecimal
so the ESI register holds 00A9FDA0 therefore
[esi + 00000146] = [ 00A9FDA0 + 00000146 ]
00A9FDA0 + 146 = 00A9EEF6

the first address I found when I started scanning at the start of the game

so note down the address 00A9FDA0
and the offset 146

close the EXTRA INFO window
in the main cheat engine window ,,,hit the new scan button
next to the value box theres a hex checkbox ,, check it so you can enter a hex value
put in our address without the zeros in front of it A9FDAO
and hit the first scan button

you will get a couple of hundred results
i'll try the first address on the list 009A4356

click on the add address manually button
click on the poiter checkbox and you will see the ADD ADDRESS window change

where it says ADDRESS OF POINTER type in our address 9A4356
and in the OFFSET [HEX] box type in 146 ,,,,,,,,, remember [esi + 00000146]
and hit the ok button

hopefully a new address with should look like this in the bottom pane
No description P->00A9FEE6 4 bytes 0x00000003
or how ever many balls you got left
you can freeze the number of balls from this pointer now,,,,,
in games that use Dynamic Memory Allocation ,,, DMA
and use the same code to change things for you and the enemies,,
pointers are usfull

------------------------------------
ok a couple of things

1) this game don't use dma ,, but its an easy game to practice on
2) Its free and most people have it
3) so for newcomers it gives an idea of how to use the basic search / pointer / and advanced options

well as they say thats my two cents


Basic packet editing
Basic Packet editing with Cheat Engine

This is just an example tutorial describing how to do basic packet editing with Cheat Engine. It's main purpose is to show that you don't have to use other tools when packet editing. (Sure, it helps and is easier, but CE can do it as well)

Let's say you want to change in outgoing packet data the word "hello" with the word "idiot".
First gather all needed information and discuss some basic api calling mechanics:
Packet data is sent using ws2_32.dll's send api . To target this api's location you have to use ws2_32!send as name, else ce will pick winsock32's send export, which is not what you want
Next you have to know that the 2nd parameter contains the pointer to the buffer that is being sent.
Let's first get into windows api calling mechanics. Parameter passing is done by pushing the parameters in reverse order on the stack, followed by a call to the send api., which pushes the next instruction's address on the stack as well.
Because each push decreases esp with 4 bytes, the parameters will actually appear in the correct order, making it [esp] point to the return address, [esp+4] holds the first parameter (socket), [esp+8] holds the 2nd parameter (pointer to buffer containing data), [esp+c] holds the length of that buffer, etc...

To packet edit you'll have to hook the send api and inspect and manipulate the parameters and buffers sent.
In short, code injection at ws2_32!send, get the address of the send buffer, get the length, scan that buffer for the word hello, and if found, replace that with the word idiot

The following code snipet is an example of basic packet editing. (Nothing fancy, but does the job)
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
label(repeat)
label(repeat2)
label(nomatch)
label(nomatch2)
label(endofroutine)
alloc(texttoscan,5) //non 5.4.4
alloc(texttoreplacewith,5)

define(stringlength,5)
texttoscan:
db 'hello'

texttoreplacewith:
db 'idiot'

ws2_32!send:
jmp newmem
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

//start off with a stackframe
push ebp
mov ebp,esp

//lets save the used registers
push eax
push ecx
push esi
push edi

mov esi,[ebp+0c] //buffer (I might have said esp+8 in the post, but due to the added stackframe(push ebp), it's all shifted 4 bytes)
mov edi,texttoscan
mov ecx,[ebp+10] //length of buffer
cmp ecx,stringlength
jl endofroutine

sub ecx,stringlength-1

repeat:
//edit: because 5.4 doesn't support cmp byte [esi],'t' I have to do it different than in 5.4.4
push ecx
mov ecx,stringlength-1
repeat2:
/*
sure, it compares from the back to front, but as long as it checks it's a match
I don't care
*/
mov al,[esi+ecx]
cmp al,[edi+ecx]
jne nomatch2
loop repeat2

//still here, so a match
push esi
push edi
mov edi,esi //I want the found buffer to be the destination, not source
mov esi,texttoreplacewith
mov ecx,stringlength
rep movsb //move the byte stored at [esi] into [edi] ecx times (so move texttoreplacewith to the found string
pop edi
pop esi

nomatch2:
pop ecx

nomatch:
inc esi
loop repeat

endofroutine:

//undo any register change
pop edi
pop esi
pop ecx
pop eax

/*
undo stackframe. Ok, in this situation the stackframe of the original function
could have been used, but I try to keep it understandable to readers.
*/
mov esp,ebp
pop ebp

originalcode:
mov edi,edi
push ebp
mov ebp,esp

exit:
jmp returnhere

Note: Instead of editing the actual buffer you might want to create a new buffer and pass that on to the send api. That'll allow for longer texts, and won't mess up if the program actually uses read-only buffers for the send api


Percentage scans and compare to saved results
Originally posted by Geri

Open the CE tutorial and proceed to Step 2.
Open CE and attach it to the tutorial.

Now You have 100 health. We will find this value by using the percentage scan in CE.

Start an unknown initial value scan.
Now click on the hit me button and you loose some health. I have 96 health now.

Click on the Scan type dropdown menu and choose the last option, "Compare to first scan". This means that in the next searches, the values will not be compared to the last search result, but always to the first scan result, which is in our case 100 for our value.

The next step is to choose "Value between..." search and click on the between % checkbox. What will this option do exactly? It will check all values which are x-y% of the value that we use for comparing. At the moment, this means it will scan for values which are x-y% of the first scan result.
Why is this good for us?
We have made the first scan when our value was 100. This value is the 100%. Our value at the moment is 96. It isn't hard to calculate that our value is the 96% of the first scan result.

To find our value, we type in 95 and 97 in the fields so CE will find all values that are 95-97% of the first scan result. Hit next scan and You can see that we have only a few results. Probably You can see that the value is in the list, but just for fun, repeat the process again. Click on "Hit me" a few times.

Now I have 78 health. I need to find the value. 78 is obviously 78% of the first scan result which was 100. So I make a scan with "Value between...", between% and I type in 77 and 79.

Awesome I have found my value already. This example was easy because we have seen the value and we knew that it is not multiplied with any number. You may think this was a stupid example. But wait a minute. What happens if the value is stored in some tricky way, like when it is multiplied with 8 for flash games? Well of course since we have searched for x-y% of the value, it doesn't matter if the values are multiplied, you will find them easily using this method.
With a flash game, it would have worked this way (not in all flash games, but in some of them).
You have 100 health and it is stored like 800 in the memory.
You do a first scan.
Then your health is decreasing to 96 (which is in fact 768 in the memory).
You search for 96% (95-97%).
Then you loose some health again and you see you have 78 health (which is in fact 624 in the memory).
You search for 78% (77-79%) and bingo. You have found your value. Did you know it is multiplied? No. Did you find it just by searching for x percentage of the first scan result which was 100%? Yes, you have found it easily and it would have worked even if the value is multiplied with 200, 1000 or even 4748 in the memory.

I hope you realize that this feature is VERY useful when you don't know if a value is multiplied or not and you have no idea what is the multiplier value. In many cases, this will help to find timers and other tricky values which are usually multiplied.

And now, we will check what happens if we don't see the exact value that we are looking for.
Proceed to Step 3 in the Tutorial.
You can see a health bar only, but you don't know the exact number. What you see however, is that the health bar is full. This means that the health bar is filled to 100% at the moment.

Now start an unknown initial value search.
Click on Hit me a few times and You loose some health.
Now choose Compare to first scan again, then choose "Value between..." and between %.
Look at your health bar. You have lost some health, try to guess how much % health do you have from the full bar. My bar is filled to about 85-95% so I have about 85-95% of the full health.
Ok, I search for 85-95%.
Click on Hit me again a few times to loose health.
Ok now my health bar is somewhere between 60 and 80%.
I search for 60-80%.
Bingo.

I have found my value already, but if you don't have it yet, continue searching until you find it.

Why is this useful when you could just simply use increased/decreased search? If you have ever tried to find a graphically displayed timer or a progress bar in some game, where you did not have the option to stop the value and all you could do is to keep searching for decreased value all the time, then think about how easy would have been to just search for the progress bar this way.

As a final word, I need to mention that a decreasing health bar or progress bar doesn't mean that the value is decreasing. It may happen that it is constantly increasing until it will reach a certain value. But even in this case, you can still use the % scan, just be a bit clever. Utilize this feature when you are stuck with increased/decreased changed/unchanged value searches, because this will save you many times.
Probably this feature is one of the most useful options in CE 6 for beginners and advanced users alike.


About the debugger

You will sometimes read about the debugger of cheat engine, this is a thread that has access to the opened process, and handles all debugging events, like creating threads, handling exceptions, etc...
A thread is a part of the program that runs separately from the rest of the program, but still has access to the memory of the main program.

You will be prompted to attach the debugger to the current process if you try and use debugging options (such as 'find what accesses/writes to this address') unless you are already attached or using kernelmode debug routines.

The standard debugger may be detected by certain targets. One way around this is to hook the IsDebuggerPresent API currently used in such detections. CE has a feature which automatically perform this step after attaching to a process. It is called 'Try to prevent detection of the debugger' and you can find it in the options. It's not a guarantee though!


Network versions

Older versions of Cheat Engine (pre-5.4) come with a separate Client and Server version.

There are a few games that give no possibility to switch between programs (It either closes, crashes, or takes down your whole pc when you switch to something else). In those cases the Network versions of Cheat Engine come in handy (Assuming you have 2 computers or a friend over internet willing to help).

Load the server program on the computer that will run the game and start the server.
Then run the game on that computer and start the client part of Cheat Engine on another computer.
Make a connection with the client to the computer that runs the server. When a connection is established the Cheat Engine user interface will show up on the client side. With that you can open the process of the game on the server and scan the memory as if you're local.

To get them, download Cheat Engine 5.3 or earlier.


Contact and feedback
 Previous Top

Cheat Engine contains a lot of features and has many uses. A large amount of these simply cannot be covered in this help document, and there are limited examples. If think you have anything to contribute (such as explanations, examples, tutorials, etc) then please feel free to send them along. Suggestions and useful feedback is always welcome to! Throw them my way:

dark_byte@hotmail.com


Cheat Engine help

A memory address is a specific spot in memory which holds something of interest.


Cheat Engine help

Assembly (or ASM) is a low-level language. At the lowest level is binary, which is what the processor ultimately interprets. However, one level up we have assembly which the numeric representation of this binary code. This is what a reverser is presented with when reversing a game (or application).


Cheat Engine help

A code cave is an empty or unused area of memory (usually filled with blank 00 bytes) that a reverser can use to place their own code.


Cheat Engine help

Cheat Engine is the popular memory hacking tool you are reading about.


.topic 0

A process is a program or game running in windows. These processes are what CE targets in memory in order to be able to cheat with them.

.topic 1048

Cheat Engine is the popular memory hacking tool you are reading about.

.topic 1049

Gamehacking is the art of cheating or in some way modifying a game to achieve a desired effect. This can be anything from memory editing with the aim of making a trainer (with options such as God mode, Infinite Ammo and Super Speed), through to creating graphics hooks (for wallhacks, chams etc) and even resource extraction. It's a growing scene, and is closely linked to general application reversing.

.topic 1050

A trainer is a program written to modify certain memory locations in order to achieve certain hacks. They usually come with instructions on how/when to use it, and they tend to have hotkeys to activate the hacks in-game. Cheat Engine has a built-in trainer maker tool.

.topic 1051

A memory address is a specific spot in memory which holds something of interest.

.topic 1052

A variable is something that changes which is hackable. An example is player health or ammo.

.topic 1053

In gamehacking, debugging is basically the process of finding interesting gamecode.

.topic 1054

A memory scanner/searcher is a tool, such as Cheat Engine, used to trawl game memory for useful addresses.

.topic 1055

An opcode is really just another name for an assembly instruction, such as
'MOV [ESI+4D8],EAX'. These are what gamehackers will attempt to locate and manipulate to change the way the game runs.

.topic 1056

A hexer is another name for a gamehacker. Despite how it sounds, a hexer is not just someone who hex-edits files (that is just too simple).

.topic 1057

In gamehacking intercepting is the process of locating specific areas of code in order to change them. Usually it refers to the act of code-injection and redirecting program flow to this code.

.topic 1058

Code-injection is a technique whereby the gamehacker formulates their own code and routes program execution through to this spot before returning back to normal. Code-injection is necessary for more advanced hacks that need to create special compares and execute more code which there simply isn't room for in the original code spot.

.topic 1059

A register is a temporary location held by the CPU used to store various values throughout a program's execution.

.topic 1060

The stack is a temporary memory location held by the CPU which is extremely quick to access, and is done so frequently.

.topic 1061

Darkbyte is the developer of Cheat Engine. Contact: dark_byte@hotmail.com

.topic 1062

A code cave is an empty or unused area of memory (usually filled with blank 00 bytes) that a reverser can use to place their own code.

.topic 1063

The processor mode in which system services and device drivers run. All interfaces and CPU instructions are available, and all memory is accessible. (From MSDN)

.topic 1064

The processor mode in which applications run. A limited set of interfaces are available in this mode, and access to system data is limited. (From MSDN)

.topic 1065

Assembly (or ASM) is a low-level language. At the lowest level is binary, which is what the processor ultimately interprets. However, one level up we have assembly which the numeric representation of this binary code. This is what a reverser is presented with when reversing a game (or application).

.topic 1066

The Cheat Engine website can be found at:

http://www.cheatengine.org/


Cheat Engine help

Darkbyte is the developer of Cheat Engine. Contact: dark_byte@hotmail.com


Cheat Engine help

In gamehacking, debugging is basically the process of finding interesting gamecode.


Cheat Engine help

Gamehacking is the art of cheating or in some way modifying a game to achieve a desired effect. This can be anything from memory editing with the aim of making a trainer (with options such as God mode, Infinite Ammo and Super Speed), through to creating graphics hooks (for wallhacks, chams etc) and even resource extraction. It's a growing scene, and is closely linked to general application reversing.


Cheat Engine help

A hexer is another name for a gamehacker. Despite how it sounds, a hexer is not just someone who hex-edits files (that is just too simple).


Cheat Engine help

Code-injection is a technique whereby the gamehacker formulates their own code and routes program execution through to this spot before returning back to normal. Code-injection is necessary for more advanced hacks that need to create special compares and execute more code which there simply isn't room for in the original code spot.


Cheat Engine help

In gamehacking intercepting is the process of locating specific areas of code in order to change them. Usually it refers to the act of code-injection and redirecting program flow to this code.


Cheat Engine help

The processor mode in which system services and device drivers run. All interfaces and CPU instructions are available, and all memory is accessible. (From MSDN)


Cheat Engine help

An opcode is really just another name for an assembly instruction, such as
'MOV [ESI+4D8],EAX'. These are what gamehackers will attempt to locate and manipulate to change the way the game runs.


Cheat Engine help

A process is a program or game running in windows. These processes are what CE targets in memory in order to be able to cheat with them.


Cheat Engine help

A register is a temporary location held by the CPU used to store various values throughout a program's execution.


Cheat Engine help

A memory scanner/searcher is a tool, such as Cheat Engine, used to trawl game memory for useful addresses.


Cheat Engine help

The stack is a temporary memory location held by the CPU which is extremely quick to access, and is done so frequently.


Cheat Engine help

A trainer is a program written to modify certain memory locations in order to achieve certain hacks. They usually come with instructions on how/when to use it, and they tend to have hotkeys to activate the hacks in-game. Cheat Engine has a built-in trainer maker tool.


Cheat Engine help

The processor mode in which applications run. A limited set of interfaces are available in this mode, and access to system data is limited. (From MSDN)


Cheat Engine help

A variable is something that changes which is hackable. An example is player health or ammo.


Cheat Engine help

The Cheat Engine website can be found at:

http://www.cheatengine.org/