Cheat Engine'de Pointer Tarama: Yeniden Başlatmaya Dayanan Adresleri Bul

You found your health value, saved it in a cheat table, restarted the game, and now the entry shows ?? or a random number. That is not a mistake on your part. Most game values live at a different address every time the game runs. A pointer is a path that leads to the value from a starting point that does not move, and Cheat Engine's pointer scanner is the tool that finds such paths for you.

This guide assumes you can already find a value with First Scan and Next Scan; if not, read the Cheat Engine tutorial for beginners first. Use these techniques in single-player and offline games only, and back up your saves before you experiment.

Why addresses change between restarts

Games create most of their data while running. When a level loads, the game asks the system for a block of memory for the player object, another for the inventory, and so on. This is dynamic allocation, and where each block ends up depends on what else was allocated before it, which differs from run to run and even between loading screens. Your health is stored at a fixed position inside the player object, but the player object itself moves.

On top of that, Windows loads programs and their modules (the main executable and its DLLs) at varying base addresses for security reasons. That is why stable addresses are always written relative to a module, such as "game.exe"+01A2B3C0, instead of as a raw number.

In the scan results list, Cheat Engine shows addresses that belong to a module in green. These are static: they keep the same offset inside the module on every run. Black addresses are dynamic. Most of the values you care about are dynamic.

How multilevel pointers work

A pointer is simply a value that holds an address. Games are full of them: a global "game manager" holds the address of the world, the world holds the address of the player, the player holds the address of a stats block, and the stats block holds health at offset 18. Following such a chain from a static starting point always lands on the current address of the value, no matter where the objects were allocated.

"game.exe"+01A2B3C0   read the 8-byte address stored here  (level 1)
  + 10                read the address stored here         (level 2)
  + 18                this is the health value

Cheat Engine writes the same path in bracket notation as [["game.exe"+01A2B3C0]+10]+18: each pair of brackets means "read the address stored here". The offsets are hexadecimal. A path with one offset is a single-level pointer; most real games need two to five levels.

Step 1: find the value's current address

Find the value as usual and add it to the address list. Make sure you have the right type, because the pointer entry will inherit it; the value types guide helps if you are not sure whether health is a 4 Bytes or a Float value. Confirm the address by changing it and seeing the change in the game.

Step 2 (optional): see what accesses the address

Right-click the entry and choose Find out what accesses this address or Find out what writes to this address. Cheat Engine attaches its debugger and lists the instructions that touch the value as you play. A typical result looks like movss [rbx+18],xmm0 or mov [rcx+18],eax. The number inside the brackets, here 18, is the offset of the value inside its object, and the register (rbx or rcx) held the object's address at that moment. Selecting the instruction and opening its details shows the register values.

This is the manual way to trace pointers: you scan for the object's address as an 8-byte hex value to find what points to it, then repeat for each level. It is how the built-in Cheat Engine tutorial teaches pointers, and it is worth doing once to understand the idea. Note that attaching the debugger can make some games unstable; save before you try it.

The instructions you find here are also the starting point for code injection scripts, an alternative to pointers that is covered in the Auto Assembler basics guide.

Step 3: run a pointer scan

Doing every level by hand is slow, so Cheat Engine can search for all plausible paths automatically. Right-click the entry and choose Pointer scan for this address. The settings dialog has many options; the important ones are:

• Address to find: filled in with your entry's address.
• Maximum offset value: how large each offset may be. The default is a sensible starting point; raise it only if scans find nothing.
• Max level: how many levels deep to search. Higher levels find more paths but take far longer and produce far more results. Start around 5.

Click OK, choose where to save the results (a .PTR file plus helper files), and wait. A first scan can produce hundreds of thousands or millions of candidate paths. Most of them are coincidences that only work in this session. The next steps throw them away.

Step 4: rescan after restarting the game

This is the step that makes pointer scanning work.

1. Keep the pointer scan window open, or reopen the saved .PTR file later from the pointer scanner's menu.
2. Close the game completely and start it again. Load a save.
3. Attach Cheat Engine again and find the value's new address with a normal scan.
4. In the pointer scan window, open its menu and choose the rescan option. Enter the new address as the address to find and confirm.

Cheat Engine checks every stored path against the new run and keeps only those that now lead to the new address. Repeat two or three times, preferably with variety: a different save, a different level, and at least once after rebooting your PC. Each round removes paths that only worked by chance. You can also rescan by value instead of by address when the value is known and distinctive.

Pointer maps: scanning smarter

A pointer map is a snapshot of all the pointers in the game's memory at one moment, saved to disk. You generate one from the address list's right-click menu while the game is running, and record the value's address for that session. Later, in the pointer scan settings, you can scan using a saved pointer map instead of live memory, and compare it against other saved maps, each paired with the address the value had in that session.

The advantage is that you can collect maps from several game sessions first and combine them in a single scan, without keeping the game open during the slow part. The end result is the same kind of filtered list a series of rescans produces, often reached faster.

Step 5: choose a result and add it to the table

The results list shows a Base Address column such as "game.exe"+01A2B3C0, then one column per offset, and the address the path currently points to. When choosing among the survivors, prefer:

• paths that start in the game's main executable or its main engine module;
• shorter paths with fewer levels;
• paths that survived the most varied rescans.

Double-click a result to add it to the address list. The entry's address appears with a P-> prefix to show it is a pointer. Check its type; pointer scan entries default to 4 Bytes, so change it to Float or another type if your value needs it. Give it a clear description and save the table.

You can also enter a pointer by hand: use the button to add an address manually, tick the Pointer option, put the module and offset in the base address field (for example "game.exe"+01A2B3C0) and add one field per offset. Cheat Engine shows the address each level resolves to as you type, which makes mistakes easy to spot. Pay attention to the order of the offset fields in that dialog: the offset applied first sits next to the base address.

Limits of pointers

A good pointer survives restarts, but not necessarily game updates. When the developer patches the game, the static base address and the offsets can change, and you will need to repeat the scan. Keep your .PTR files and notes so you can redo it quickly. Also be careful with values that have several copies, for example per-character stats in a party; a path may lead to whichever character was selected first.

Summary

1. Find the value and confirm it.
2. Optionally use the debugger to see which instructions access it.
3. Run a pointer scan with moderate level and offset settings.
4. Restart the game, find the new address, rescan. Repeat with varied sessions.
5. Pick a short, consistent path, add it to the table with the right type, and save.