What Cheat Engine Actually Is
Cheat Engine is a memory scanner and debugger for Windows. It lets you look at the values stored in a running program's memory and change them. That's basically it. People use it for game hacking, sure, but the tool itself was built for reverse engineering and debugging. Most of the people I know who come to it for games end up just changing HP values and money counters. The interface looks like it hasn't had a redesign since 2004. Don't let that fool you. It does what it does well enough.
How To Use Cheat Engine for Basic Value Scanning
Open Cheat Engine. Click the pointer icon in the top left corner, then click on your game's window to attach it. If your game doesn't show up, run the game first, then attach. Simple enough. The trickier part starts when you try to find values. Let's say you're playing a game and your health is at 150. You want to find the memory address that stores that number. Start a new scan. Enter 150 as the value. Set the type to Four Bytes (most common starting point). Click New Scan. You'll get thousands of results. Usually way too many to work with. Here's where most people get stuck or waste twenty minutes. Change your health in the game. If you take damage and it drops to 130, go back to Cheat Engine and click Next Scan. Enter 130. Repeat this process. Each scan narrows the field. After three or four iterations, you should have somewhere between one and maybe twenty addresses.
Double-click any of them to add them to the bottom list. Go back to the game and change the value again if you can. In Cheat Engine, right-click the address and select Freeze. Your value stays locked. Or just change it to whatever you want and see what happens. I worked on a project once where the target application was storing its values as doubles instead of integers. Every scan came back with nothing matching. I spent about an hour going through type options before I hit Double and got a clean result. If standard Four Byte scans keep returning zero hits after five tries, try Eight Byte or Double. It's not that uncommon in older games or ones built with certain frameworks.
Get the Full Details
How the Scanner Actually Works Under the Hood
When you tell Cheat Engine to scan for a value, it walks through the process's addressable memory space and compares every four-byte chunk against your input. A typical game process might expose several hundred megabytes of readable memory. That's a lot of data to compare. First scans on modern games can take anywhere from ten seconds to two minutes depending on how much memory the process is using and how fast your SSD is. After the first scan, Cheat Engine only rescan the addresses that matched previously. That's why subsequent scans are nearly instant. But here's something people don't always realize: if the game reallocates memory between scans, those addresses become invalid. You'll see your result count drop to zero or the values in your list turn red. When that happens, you restart from scratch. Attach again, new scan, start over. Pointer scanning is another thing entirely. Sometimes the address you found doesn't stay constant. The game moves the value around, and the original address stops working after a restart. Cheat Engine has a pointer scanner for this. You right-click an address and select Pointer Scan for this address. It takes longer. Ten to fifteen minutes on a modern system isn't unusual. But it finds the chain of pointers the game uses to reach that value, which means you can reference it by base address plus offset and it'll work even after the game restarts.
Common Problems and What to Do About Them
Anti-cheat is the big one. BattleEye, EAC, Vanguard, a lot of others will detect Cheat Engine the moment it attaches to a process. Some versions of CE actually include an anti-anti-cheat mode, but it's a whack-a-movie thing. If you're playing online, you probably shouldn't bother. If you're modding a single-player game with no protections, CE works fine. Another thing that comes up constantly: value types. Beginners always scan Four Byte first. That's usually right, but not always. Fighting games sometimes pack health into bit fields. Rhythm games might use Float. Save files often use Strings. If you're not getting results, try different types. Float is the second most common after Four Byte. After that, it's a guessing game until you see something that returns fewer than ten thousand results. I ran into a case last year where a game was encrypting its health value in memory. The actual number was garbled, but it changed predictably. Every time I took damage, the value went down by exactly 37 each time. I scanned for exact value first, got nothing useful. Then I switched to Increased Value when I took damage, decreased value when I healed, and found the address that way. This is the kind of thing you figure out through trial and error. There's no shortcut for it other than understanding that not every value in memory is stored in plain text.
What Cheat Engine Can't Do
It can't read values from protected kernel-mode drivers. If a game stores health in a separate driver process, CE won't touch it. You'd need something more specialized, and even then you're entering territory that's more reverse engineering than cheating. It can't help with networked values. If your health, score, or inventory is stored on a server and the game just displays what the server tells it, changing the local value does nothing. The server overwrites it every frame. There's no memory address to find because the truth lives elsewhere. This is where most people give up and blame the tool. The tool isn't the problem. The architecture is. 64-bit processes are handled fine by modern Cheat Engine, but the learning curve is steeper. Addresses are longer, the interface behaves slightly differently, and some tutorials online are outdated for 64-bit targets. Stick to current documentation if you're working with a newer game.
Download it from cheatengine.org. The official site has the latest stable release. Third-party mirrors sometimes bundle adware. Not worth the hassle. The installer is straightforward, and if you need Lua scripting for automation, that's built in and pretty powerful once you get past the syntax.
