Cheat Engine

Cheat Engine, commonly abbreviated as CE, is a free memory scanner/hex editor created by Eric "Dark Byte" Heijnen for the Windows operating system. Cheat Engine is used for cheating in computer games, and has influenced many, as it is often modified and recompiled to evade detection. This program resembles L. Spiro's "Memory Hacking Software", Tsearch, and ArtMoney It searches for values input by the user with a wide variety of options such as "Unknown Initial Value" and "Decreased Value" scans. Cheat Engine can also create standalone trainers that can operate independently of Cheat Engine.

Cheat Engine can view the disassembled memory of a process and make alterations to give the user advantages such as infinite health, time or ammunition. It also has some Direct3D and OpenGL manipulation tools, allowing you to see through walls, zoom in/out and with some advanced configuration allows Cheat Engine to move the mouse for you to get a certain texture into the center of the screen. This is commonly used to create Aimbots.

Cheat Engine is often mistaken for a virus, because Cheat Engine Injects into processes, anti viruses commonly mistakes it for an virus. There is a version that is not detected as a virus, but many of the features are disabled.

Coding

Two branches of Cheat Engine exist, Cheat Engine Delphi and Cheat Engine Lazarus. Cheat Engine Delphi is primarily for 32-bit versions of Windows XP. Cheat Engine Lazarus is designed for 32 and 64 bit versions of Windows Vista. Cheat Engine is, with the exception of the Kernel Module, coded in Object Pascal.

Cheat Engine exposes an interface to its device driver with dbk32.dll, a wrapper that handles both loading and initializing the Cheat Engine driver and calling alternative Windows kernel functions. Due to a programming bug in Lazarus pertaining to the use of try and except blocks, Cheat Engine Lazarus had to remove the use of dbk32.dll and incorporate the driver functions in the main executable.

The Kernel module, while not essential to normal CE use can be used to set hardware breakpoints and bypass hooked API in Ring 3, even some in Ring 0. It is compiled with the Windows Driver development kit and is written in the C Programming Language.

Cheat Engine also has a plugin architecture for those who do not wish to share their source code with the community. They are more commonly used for game specific features, as Cheat Engine's stated intent is to be a generic cheating tool.

Scripting

Cheat Engine has an auto assembler engine for injecting assembly code into processes that supports standard x86 opcodes as well as MMX, SSE, and SSE2 opcodes. Unlike many other cheating tools, Cheat Engine's (dis)assembler engine is not based of that of Ollydbg. For Cheat Engine's own User Interface, Cheat Engine has an integrated C++-like scripting language based on the UnderC project.

Future

Cheat Engine Lazarus now has the ability to load its unsigned 64-bit device driver on Windows Vista x64 edition, by using DBVM to allocate nonpaged memory in kernel mode, manually loading the executable image, and creating a system thread at DriverEntry. However, since the DriverEntry parameters are not actually valid, the driver must be modified for DBVM.

DBVM

Cheat Engine version 5.4 and above can interact with "DBVM" (Dark Byte's Virtual Machine), a Hypervisor/Tiny Operating System that boots immediately before any Operating System encapsulating it in a virtual machine environment, developed to help circumvent anti-cheating software and x64 versions of Windows' Kernel Patch Protection and anti unsigned code loading technology. Because DBVM uses the newer Intel-VT instructions it requires certain hardware to function, most importantly an Intel Core 2 Duo or newer. It is currently not compatible with AMD processors.

References

External links

• Official Website
• Cheat Engine Forum