Check the bridge is reachable and report the Cheat Engine version.

Get Cheat Engine version, Lua version, and install directory.

List every low-level route the in-CE bridge exposes (for debugging).

List running processes (pid + name). Optionally substring-filter.

Attach (open) a process by PID (int) or by executable name (e.g. 'game.exe').

Required before any scan / read / write. Returns pid, name, and whether the target is 64-bit.

Detach from the currently open process.

Report which process is currently attached, if any.

List loaded modules (name, base address, size, path). Optional filter.

Module base addresses are the anchor for stable 'module+offset' pointers.

Enumerate committed memory regions (base, size, protection flags).

Read a value from memory.

address accepts hex ('0x7FF...'), decimal, a symbol, or 'module+offset'. size applies to string/aob reads. wide reads UTF-16 strings. type is one of: byte, 2byte/word, 4byte/int, 8byte/qword, float, double, string, aob (space-separated hex), pointer.

Read many addresses in one round trip.

reads is a list of objects like {"address": "0x...", "type": "float"}.

Write a value to memory.

type is one of: byte, 2byte/word, 4byte/int, 8byte/qword, float, double, string, aob, pointer. For aob, pass value as a hex string like 'AA BB CC'.

Hex-dump a region of memory (16 bytes/row, hex + ASCII). Max 64 KiB.

Allocate executable memory in the target (for code caves). Optionally near an address so 32-bit relative jumps remain in range.

Free memory previously allocated with memory_alloc.

Run a first scan over the attached process and return the match count.

scan_type: exact, bigger, smaller, between (needs value2), unknown, changed, unchanged, increased, decreased, increasedby, decreasedby. For 'unknown' start a value-agnostic scan, then narrow with scan_next. Use scan_results to page through matches.

Narrow the active scan (next scan). Same scan_type vocabulary as scan_first. Typical: scan changed/unchanged/increased/decreased while the in-game value moves, until few matches remain.

Page through the current scan's matches (address + value). Max 1000/call.

Discard the active scan and free its memory.

Array-of-bytes pattern scan. pattern like 'DE AD ?? EF' (?? = wildcard). Returns matching addresses. Great for finding code to hook.

List entries in the cheat table (id, description, address, value, frozen).

Add an entry to the cheat table. address may be a literal address or a 'module+offset' expression. Returns the new entry's id.

Remove a cheat-table entry by id.

Set the value of a cheat-table entry (writes it to the target).

Freeze (or unfreeze) a cheat-table entry so its value is held constant.

Activate/deactivate an entry (e.g. an Auto Assembler 'script' entry).

Bind a hotkey to an entry. action: 1=toggle freeze, 2=set value, 3=decrease, 4=increase. keys is a virtual-key code or list of codes.

Save the current cheat table to a .CT file at path (on the CE host).

Load a .CT file. merge keeps existing entries; otherwise replaces.

Remove all entries from the cheat table.

Resolve a multi-level pointer chain.

Reads the pointer at base, adds offsets[0], reads again, and so on — returning the final address and the full chain. Use this to verify a 'module+offset -> [+off] -> [+off]' path before adding it to the table.

Start a pointer scan for address (finds stable pointer paths to it). Runs asynchronously inside Cheat Engine; inspect/refine results in CE's UI.

Disassemble count instructions starting at address.

Assemble a single instruction (e.g. 'mov eax,1') to bytes. address provides context for relative operands.

Run a Cheat Engine Auto Assembler script — the core of code-injection cheats (godmode, infinite ammo, etc.).

Pass enable=False to run the script's [DISABLE] section to revert. Example godmode skeleton::

[ENABLE]
aobscanmodule(hook,game.exe,29 87 ?? ?? ?? ??)  // sub [edi+x],eax
alloc(newmem,128,hook)
label(ret)
newmem:
  // do nothing instead of subtracting health
  jmp ret
hook:
  jmp newmem
  nop 2
ret:
[DISABLE]
hook:
  db 29 87 ?? ?? ?? ??
dealloc(newmem)

Attach the debugger and collect the instructions that WRITE to address over duration seconds. The classic way to find the code that changes a value (e.g. the instruction that decrements health).

Collect instructions that READ OR WRITE address over duration seconds. Useful to find a base instruction for pointer/structure work.

Set (or, with remove=True, clear) a breakpoint at address.

Initialise Cheat Engine's Mono data collector (for Unity/Mono games). Call once after attaching, before mono_classes.

Enumerate Mono/Unity classes (namespace, name, class pointer). Optional substring filter. Requires mono_init first.

Set the speedhack multiplier (1.0 = normal, 2.0 = double speed, 0.5 = half). Affects the game's perception of time.

Escape hatch: run arbitrary Lua inside Cheat Engine and capture print output + return value. Use when no dedicated tool covers what you need.