Lua
Cheat Engine Lua API Index
A task-oriented reference index for Cheat Engine's Lua functions, classes, globals, and scripting helpers.
Cheat Engine exposes an extensive Lua API for cheat tables, trainers, and standalone scripts. This page is a task-oriented index: choose the area you are working in, then follow a function link for its detailed reference.
Contents
- 1 Variables
- 2 Functions
- 2.1 Quick navigation
- 2.2 Function naming guide
- 2.3 Cheat Table
- 2.4 Trainers
- 2.5 Protection
- 2.6 Scanning
- 2.7 Process
- 2.8 Threads
- 2.9 Handles
- 2.10 Addresses
- 2.11 Memory
- 2.12 Conversions
- 2.13 Input Devices
- 2.14 Screen
- 2.15 Sounds
- 2.16 Text-to-Speech
- 2.17 Fonts
- 2.18 Forms and Windows
- 2.19 Cheat Engine
- 2.20 Lua
- 2.21 Types
- 2.22 Object-oriented
- 2.23 Assembly
- 2.24 Auto Assembler
- 2.25 Debugger
- 2.26 DBK (Driver-Based Kernel)
- 2.27 DBVM
- 2.28 Translation
- 2.29 Files
- 2.30 Structures
- 2.31 Miscellaneous
- 2.32 Extended API reference (CE 7.5)
- 2.32.1 Core runtime, memory, and conversion helpers
- 2.32.2 Files, symbol loading, and native compilation
- 2.32.3 Auto Assembler authoring and callbacks
- 2.32.4 Process control, code execution, and prompts
- 2.32.5 Target inspection, allocation, and task progress
- 2.32.6 Registered symbols
- 2.32.7 Debugging extensions
- 2.32.8 Forms, controls, graphics, dialogs, and streams
- 2.32.9 Threads, synchronization, and structures
- 2.32.10 Low-level memory: DBK and DBVM
- 2.32.11 Direct3D, disassembly, and pipes
- 2.32.12 SQL and data access
- 2.32.13 Modules, .NET, and diagrams
- 2.32.14 Remote execution, XML, and virtual trees
- 2.32.15 CEServer and Lua string extensions
- 3 Classes
Variables
Globals
Global Variables
CPU / Debug Variables (Registers)
CPU / Debug Variables
Functions
Function names follow consistent patterns: create... creates an object or window, get... retrieves data, set... changes a setting, read.../write... transfer data, and register.../unregister... manage callbacks. Related functions are kept together where possible.
Quick Navigation
Function naming guide
Function Naming Guide
create...get..., enum...set..., enable...read..., write...Local, memory functions normally operate on the opened target process.register..., unregister...Cheat Table
These functions help manage the cheat table and its files.
Cheat Table
Returns the cheat table Addresslist object.
Returns a TableFile stored in the cheat table (search by filename or identifier).
Adds a new file entry to the cheat table.
Loads a ".ct" or ".cetrainer" file or stream into the cheat table.
Saves the current cheat table to disk.
Trainers
Functions related to the trainer (.exe) generator.
Trainers
Adds a new feature to the EXE trainer generator window and calls your callback when a user builds a .exe trainer.
Unregisters a previously registered trainer feature.
Protection
Functions for protecting Cheat Engine or encoding code.
Protection
Prevents basic memory scanners from opening or inspecting the Cheat Engine process.
Enables kernel-mode protections or DRM measures to prevent normal memory scanners from reading the Cheat Engine process.
Encodes a given Lua function to a string that can be stored/transferred; can be decoded later with decodeFunction.
Decodes an encoded function string back into a callable Lua function.
Scanning
Functions that control and query memory scans.
Scanning
Scans the currently opened process for an array-of-bytes (AOB) pattern and returns a StringList of all matches.
Scans the process memory for a byte pattern and returns the address if exactly one unique match is found; returns nil otherwise.
Scans the entire process for a pattern and returns the address if exactly one unique match exists; returns nil otherwise.
Returns the currently active scan session as a MemScan object.
Process
Functions for creating/opening processes and querying system/process state.
Process
Creates (and optionally debugs) a new process.
Opens a process given a process name or PID; attaches Cheat Engine to it for memory access.
Callback invoked by Cheat Engine when it opens a process (user-defined handler).
Returns the process ID (PID) of the currently foreground (top) window process.
Returns the PID of the currently opened/attached process.
Returns the PID for a given process name (if running).
Opens a file and treats it like a process (gives memory access similar to opening a process).
Saves changes made to the opened file.
Sets the pointer size (in bytes) Cheat Engine will use (e.g. 4 or 8); useful if a 64-bit process requires 32-bit pointer handling.
Sets assembler bit mode: 0 = 32-bit, 1 = 64-bit.
Returns a system process list object.
Returns a list of top-level windows.
Pauses the currently opened process.
Resumes the currently opened process.
Returns true if the target process is 64-bit, otherwise false.
Returns a table with information about each module in the current process (or a specified PID).
Returns a table containing the memory layout with information about each memory region.
Closes a remote handle to a process.
Threads
Threads
Returns the number of CPU cores available on the system.
Fills a List object with the thread list of the currently opened process (returns thread IDs and basic info).
Returns true if the current Lua code is running in the main thread (available in CE 6.4+); otherwise false.
Executes the provided function in the main thread and returns that function's return value. Useful for GUI updates or operations that must run on the main thread.
Schedules the provided function to run in the main thread but does not wait for the result (fire-and-forget).
Intended to be called from the main thread's loop to process pending synchronized calls when using threads and synchronize/queue.
Handles
Handles
Returns a table (or list object) containing system handles (open handles) for the system or the current process, depending on context.
Addresses
These functions help convert between memory addresses and symbol/CE address string representations.
Addresses
Returns the numeric address of a symbol (module+export, label, or CE symbol). Raises an error if the symbol cannot be resolved.
Same as getAddress but returns nil if the symbol cannot be found (does not throw).
Returns the address formatted as a string, preferring symbol/module+offset notation when available.
Assigns the specified symbol name to an address (adds a user-defined symbol).
Removes a previously registered symbol mapping for an address.
Returns a table/object with symbol information (module name, search key, address, size), matching the SymbolList structure.
Reinitializes the symbol handler (useful after loading new modules).
Returns true if the specified address lies inside a loaded module.
Returns true if the address is inside a system module (OS module), e.g., kernel or system DLLs.
Returns the size (in bytes) of the specified module. Use getAddress to retrieve the module base address first if needed.
Sets whether address/symbol lookups will throw errors on failure or return 0/nil depending on configuration.
Registers a callback function invoked when a symbol is parsed/loaded.
Unregisters a previously registered symbol lookup callback.
Registers a callback called when an address-to-name conversion is requested.
Unregisters the address lookup callback.
Reinitializes only the .NET portion of the symbol handler (useful when .NET modules change).
Memory
Memory
Allocates executable/non-executable memory in the target process and returns the allocated address.
Frees memory previously allocated in the target process.
Creates or opens a named shared memory object of the given size for interprocess communication.
Creates a memory section object (OS-specific) for sharing or mapping memory.
Maps a created section into the process address space, returning the mapped base address.
Unmaps a previously mapped section view from the process address space.
Copies memory from a source address to a destination address (can be used within target process or between processes depending on API).
Compares two memory regions (can be used within target process or between processes depending on API).
Allocates a block of nonpaged kernel memory (requires driver or appropriate privileges) and returns its address.
Frees kernel-mode memory previously allocated.
Maps memory from one process context into another usermode context (maps a specified address from PID A into PID B's address space).
Unmaps memory previously mapped with mapMemory.
Creates a memory stream object that can be used to read/write memory data conveniently from Lua.
Reading from Target Process
Reading from Target Process
Reads raw bytes at the given address. If ReturnAsTable is true, returns a table; otherwise returns multiple byte values.
Reads a 16-bit (word) integer from the specified address. Optional second parameter: if true, reads as signed integer.
Reads a 32-bit (dword) integer from the specified address. Optional second parameter: if true, reads as signed integer.
Reads a 64-bit (qword) integer from the specified address.
Reads a pointer-sized value: readQword on 64-bit targets, readInteger on 32-bit targets.
Reads a single-precision (32-bit) floating-point value from the specified address.
Reads a double-precision (64-bit) floating-point value from the specified address.
Reads a null-terminated string from memory up to maxlength bytes (prevents infinite loops on corrupted memory).
Reads a region from a file and writes it to a specific address in the target process.
Reading from Cheat Engine Memory
Reading from Cheat Engine Memory
Same as readBytes, but reads from Cheat Engine's own memory.
Reads a 16-bit integer from CE's memory. Optional: use signed if second parameter is true.
Reads a 32-bit integer from CE's memory. Optional: use signed if second parameter is true.
Reads a 64-bit integer from CE's memory.
Reads a pointer-sized value from CE's memory (64-bit or 32-bit depending on CE build).
Reads a single-precision float from CE's memory.
Reads a double-precision float from CE's memory.
Reads a null-terminated string from CE's memory.
Writing to Target Process
Writing to Target Process
Writes the given bytes (from a table) to the specified address in the target process.
Writes a 16-bit integer to the specified address. Returns true on success.
Writes a 32-bit integer to the specified address. Returns true on success.
Writes a 64-bit integer to the specified address. Returns true on success.
Writes a single-precision float to the specified address. Returns true on success.
Writes a double-precision float to the specified address. Returns true on success.
Writes a string to the specified address (typically null-terminated). Returns true on success.
Writes a memory region to a file. Returns the number of bytes written.
Writing to Cheat Engine Memory
Writing to Cheat Engine Memory
Writes a 16-bit integer to CE's memory. Returns true on success.
Writes a 32-bit integer to CE's memory. Returns true on success.
Writes a 64-bit integer to CE's memory. Returns true on success.
Writes a single-precision float to CE's memory. Returns true on success.
Writes a double-precision float to CE's memory. Returns true on success.
Writes a string to CE's memory. Returns true on success.
Writes the given bytes (from a table) to CE's memory.
Conversions
Encoding/Decoding
Encoding/Decoding
Converts a string from ANSI encoding to UTF-8 encoding.
Converts a string from UTF-8 encoding to ANSI encoding.
Computes and returns the MD5 hash of a string as a hexadecimal string.
Converts a given integer to a userdata variable.
Converts a given userdata variable back to an integer.
To Byte Table
Convert data types into byte tables (tables of individual byte values).
To Byte Table
Converts a 16-bit word to a byte table.
Converts a 32-bit dword to a byte table.
Converts a 64-bit qword to a byte table.
Converts a single-precision float to a byte table.
Converts a double-precision float to a byte table.
Converts a string (ANSI/UTF-8) to a byte table.
Converts a string to a wide string (Unicode) and then to a byte table.
From Byte Table
Convert byte tables back into data types.
From Byte Table
Converts a byte table to a 16-bit word.
Converts a byte table to a 32-bit dword.
Converts a byte table to a 64-bit qword.
Converts a byte table to a single-precision float.
Converts a byte table to a double-precision float.
Converts a byte table to a string.
Converts a byte table to a wide string (Unicode).
Binary Operations
Bitwise operations on integers.
Binary Operations
Bitwise OR operation.
Bitwise XOR (exclusive OR) operation.
Bitwise AND operation.
Bitwise shift left operation.
Bitwise shift right operation.
Bitwise NOT (complement) operation.
Input Devices
Keyboard & Mouse
Keyboard & Mouse
Returns the current mouse cursor position as X and Y coordinates.
Sets the mouse cursor position to the specified X and Y coordinates.
Returns true if the specified key is currently held down.
Simulates pressing a key (puts the key into down state).
Simulates releasing a key (puts the key into up state).
Simulates a complete key press (down and up).
Calls the Windows API mouse_event directly for advanced mouse control. See MSDN documentation.
Sets the global key poll interval (frequency of keyboard state updates).
Sets the minimum delay (in milliseconds) between consecutive activations of the same hotkey.
Game Controller
XBox/game controller input.
Game Controller
Fetches the current state (buttons, triggers, sticks) of a connected XBox 360 controller.
Sets the speed of the left and right vibration motors in an XBox 360 controller (for haptic feedback).
Clipboard
Screen
Screen
Returns the height of the screen in pixels.
Returns the width of the screen in pixels.
Returns the screen DPI (dots per inch) for determining screen scaling/density.
Returns the height of the usable work area (excludes taskbars).
Returns the width of the usable work area (excludes taskbars).
Returns a Canvas object for drawing directly to the screen. Limited usefulness in practice due to performance constraints.
Returns the RGB color value of a pixel at the specified screen coordinates.
Sounds
General Audio
General Audio
Plays an audio file (supports various formats like .wav, .mp3, etc.).
Plays a system beep/ping sound.
Text-to-Speech
Text-to-Speech
Speaks the given text using the system's text-to-speech engine and optional flags. See MSDN SpeakFlags.
Speaks the given text using an English voice by wrapping it in an XML voice specification.
XM Player
Plays tracked music (XM format) using the built-in XM player.
XM Player
Plays an XM audio file given its filename.
Pauses the currently playing XM audio file.
Resumes playback of a paused XM audio file.
Stops XM audio playback completely.
Returns true if an XM audio file is currently being played.
Fonts
Fonts
Loads a font from a memory stream and returns a handle/ID for later use with unloadLoadedFont.
Unloads a previously loaded font by its handle/ID, freeing resources.
Forms and Windows
Forms and Windows
Finds a window by class name and/or window title/caption.
Gets a window handle based on a relative command (e.g. parent, child, next). See MSDN GetWindow.
Returns the caption/title text of the specified window.
Returns the class name of the specified window.
Returns the process ID (PID) of the process that owns the specified window.
Returns the handle of the topmost (foreground) window currently active.
Sends a Windows message to the specified window.
Hooks a window's window procedure (WndProc) to intercept and handle messages.
Uninstalls a WndProc hook previously installed via hookWndProc.
Cheat Engine
Functions for managing and controlling Cheat Engine itself.
Version and Information
Version and Information
Returns the Cheat Engine version as a floating-point number (e.g. 7.5).
Returns full version information: a raw integer and a table containing major, minor, release, and build numbers.
Returns true if Cheat Engine is running as 64-bit; false if 32-bit.
Returns the process ID of the Cheat Engine process itself.
Returns the folder path where Cheat Engine (or the current trainer) is located.
Management
Management
Closes Cheat Engine.
Returns the Timer object responsible for freezing/unfreezing values in the address list.
Returns the Timer object responsible for updating displayed values in the address list.
Returns the common module list as a StringList object.
Returns the AutoAttach list as a StringList object.
Connects to a remote Cheat Engine server (given host and port). Subsequent operations route through the server.
Reloads Cheat Engine settings from the registry and applies them immediately.
Loads the specified plugin.
Returns the settings object for accessing/modifying CE configuration.
Registers a binutils (assembler/disassembler) toolset with Cheat Engine.
Comments and Headers
Comments and Headers
Gets the user-defined comment attached to the specified address.
Sets a user-defined comment at the specified address.
Gets the user-defined header text at the specified address.
Sets a user-defined header text at the specified address.
Advertising and Support
Advertising and Support
Displays an advertising/support window to help fund Cheat Engine development.
Hides/closes the advertising window if it was showing (crude but functional name).
Forms and UI
Forms and UI
Returns the total number of forms currently attached to the main CE application.
Returns the form object at the specified index (0-based).
Returns the first MemoryView form object (the hex editor window).
Returns the main Cheat Engine window form object.
Returns the settings/options dialog form object.
Returns the Lua engine/console form object (creates it if needed).
Shows the main Cheat Engine window (opposite of hideAllCEWindows).
Hides all normal Cheat Engine windows (e.g. the trainer table UI).
Registers a callback function invoked when a form is added to CE's form list.
Unregisters a previously registered form add notification callback.
Messages
Messages
Shows a simple message box with the given text to the user.
Pops up a message dialog box (similar to showMessage, with more control over buttons/options).
Outputs a message using the Windows OutputDebugString API (visible in debuggers).
Processes pending window messages in the event queue, allowing button clicks and UI updates to be handled.
Input
Input
Shows a dialog prompting the user to input a string. Returns the entered string, or nil if cancelled (CE 6.4+).
Shortcuts
Shortcuts
Converts a shortcut integer value to its textual representation (e.g. "Ctrl+Alt+A"). (CE 6.4+)
Converts a text representation (e.g. "Ctrl+Alt+A") to a shortcut integer value. (CE 6.4+)
Converts a key combination to its string representation, matching the hotkey handler's format.
Speed Hack
Speed Hack
Enables the speed hack (if not already active) and sets the game/process speed multiplier (e.g. 2.0 for 2x speed).
Returns the current speed hack multiplier value that was last set.
Lua
Functions for managing the Lua engine and state.
Lua
Creates a fresh Lua state, resetting the environment and clearing all previously defined variables/functions.
Pauses execution for the specified number of milliseconds.
Creates and returns an integer reference handle that can store and retrieve Lua objects persistently.
Retrieves the Lua value/object referenced by the given reference handle.
Destroys and frees a reference handle, removing the reference and allowing garbage collection.
Types
Functions for registering and managing custom data types.
Types
Registers a callback function invoked by Cheat Engine's auto-guess feature to predict and suggest variable types.
Registers a custom data type defined using Lua functions for reading/writing/display logic.
Registers a custom data type defined using an Auto Assembler script.
Object-oriented
Functions for determining class inheritance and type relationships.
Object-oriented
Returns true if the given object is a valid Cheat Engine class instance (inherits from Object).
Returns true if the given object inherits from the Component class.
Returns true if the given object inherits from the Control class (UI controls).
Returns true if the given object inherits from the WinControl class (windowed controls).
Assembly
Functions for working with x86/x64 machine code and assembly instructions.
Assembly
Executes an Auto Assembler script (given as text) for code injection, patching, or other assembly operations.
Validates an Auto Assembler script for syntax errors. Returns true on success; false with error message on failure.
Disassembles the instruction at the given address and returns a formatted string: "address - bytes - opcode extra".
Parses a disassembled instruction string and returns 4 separate strings: address, bytes, opcode, and extra field.
Returns the size (in bytes) of the instruction at the given address.
Attempts to find and return the address of the previous instruction (heuristic guess).
Registers a custom callback function for the single-line assembler to convert instruction mnemonics to bytes.
Unregisters a previously registered custom assembler callback.
Auto Assembler
Commands & Hooks
Commands & Hooks
Registers a custom Auto Assembler command that calls the specified Lua function when invoked in a script.
Unregisters a previously registered Auto Assembler command.
Registers a callback function invoked before the Auto Assembler parses a script (prologue phase).
Unregisters an Auto Assembler prologue callback.
Changes memory protection on a block of memory to be writable and executable.
Scripts & Templates
Scripts & Templates
Registers a reusable template for the Auto Assembler script generator.
Unregisters a previously registered Auto Assembler template.
Generates and appends a default code injection script to the provided script (allocates space, injects code, patches original).
Generates and appends an Array-of-Bytes (AOB) injection script to the provided script (searches for pattern, injects code).
Generates and appends a complete full injection script with all patches and cleanup code.
Generates an Auto Assembler script that hooks (intercepts) the given API function address.
Debugger
Functions for managing the debugger. See Lua Debugging for detailed information.
Status and Information
Status and Information
Returns true if the debugger has been started and is active.
Returns the current debugger interface type: 1=Windows, 2=VEH, 3=Kernel, nil=no debugging.
Returns true if the target process can stop on a breakpoint. (CE 6.4+)
Returns true if the debugger is currently halted on a thread (at a breakpoint).
Returns a Lua table containing all currently active breakpoint addresses.
Breakpoint Management
Breakpoint Management
Starts debugging the currently attached process.
Sets a breakpoint of a specific size (in bytes) at the given address.
Removes a breakpoint at the specified address.
Resumes execution when the debugger is halted on a breakpoint.
Adds a thread to the no-break list so breakpoints on it will be ignored.
Removes a thread from the no-break list.
Callbacks
Callbacks
User-defined callback invoked by CE when a breakpoint is hit (define your own implementation).
User-defined callback invoked by the Windows debugger when a module is loaded.
Register and Context Management
Register and Context Management
Force-updates the Lua variables representing CPU registers from the current thread context. (CE 6.5+)
Force-updates the CPU registers from the Lua variables representing them. (CE 6.5+)
Refreshes the UI to reflect the current debug context if the debugger is broken.
Returns the memory address of the specified XMM register for the currently broken thread.
Advanced Debugging
Advanced Debugging
Tells the kernel-mode debugger to record the last few branch/jump instructions before a breakpoint is hit.
Returns the maximum number of branch records this CPU supports.
Returns the Last Branch Record value at the given index (when handling a breakpoint with branch recording enabled).
Detaches the debugger from the target process if possible.
DBK (Driver-Based Kernel)
Functions for kernel-mode operations via the DBK driver.
Initialization and Setup
Initialization and Setup
Loads and initializes the DBK kernel driver into memory if possible.
Redirects OpenProcess API calls to use kernel-mode DBK equivalents.
Redirects ReadProcessMemory and WriteProcessMemory to use kernel-mode DBK versions.
Redirects virtual memory query APIs to use kernel-mode DBK equivalents.
Process and Thread Information
Process and Thread Information
Returns the kernel pointer to the EPROCESS structure of the selected process ID.
Returns the kernel pointer to the ETHREAD structure of a given thread ID.
CPU Register Access
CPU Register Access
Reads a Model-Specific Register (MSR) using the DBK driver.
Writes a Model-Specific Register (MSR) using the DBK driver.
Returns the value of Control Register 0 (CR0).
Returns the value of Control Register 3 (CR3) for the currently opened process.
Returns the value of Control Register 4 (CR4).
Memory and Execution
Memory and Execution
Converts a virtual address to its physical address using the DBK driver.
Executes a routine from kernel mode (e.g. injected code written with Auto Assembler).
When set to true, write operations bypass copy-on-write behavior.
DBVM
Functions for hypervisor-based operations and advanced memory monitoring via DBVM.
Initialization
Initialization
Initializes the DBVM hypervisor functions for use.
Memory Operations
Memory Operations
Adds a memory region to DBVM.
Reads physical memory directly using DBVM (hypervisor-level access).
Writes physical memory directly using DBVM (hypervisor-level access).
MSR and Control Register Access
MSR and Control Register Access
Reads a Model-Specific Register (MSR) using DBVM (bypasses driver).
Writes a Model-Specific Register (MSR) using DBVM (bypasses driver).
Returns the real (unhooked) value of Control Register 4 (CR4).
Memory Monitoring
Memory Monitoring
Starts monitoring write accesses to a memory region.
Starts monitoring read accesses to a memory region.
Retrieves the log/results of memory region monitoring (reads or writes).
Stops memory region monitoring.
Memory Cloaking
Memory Cloaking
Cloaks a memory page so modifications become invisible to the target process.
Disables cloaking on a page and undoes hidden modifications.
Reads the original (hidden) memory contents of a cloaked region.
Writes to the original (hidden) memory contents of a cloaked region.
Breakpoints and Debugging
Breakpoints and Debugging
Cloaks a page, sets a breakpoint at the given address, and modifies registers when the breakpoint is hit.
Removes a "change registers on breakpoint" breakpoint.
CR3 (Process Context) Logging
CR3 (Process Context) Logging
Starts logging all CR3 (process context/page directory) changes.
Stops CR3 logging.
Performance and Anti-Detection
Performance and Anti-Detection
Sets system-wide speed hack via DBVM (affects all processes).
Configures TSC (Time Stamp Counter) adjustment to bypass VM detection (RDTSC hooks).
Translation
Translation
Returns the path to the current translation files. Returns an empty string if no translation is active.
Loads a ".PO" translation file into Cheat Engine's translation system.
Returns the translated text for a given source string. If no translation is found, returns the original string.
Returns the translation for a specific string ID (lookup by numerical or symbolic ID).
Files
Files
Returns a 64-bit file version and a table splitting the version into major, minor, release, and build.
Returns an indexed table (array) of filenames in the specified directory.
Returns an indexed table (array) of subdirectory names in the specified directory.
Structures
Structures
Registers a callback similar to onAutoGuess that the structure dissect window calls when the user requests Cheat Engine to guess a structure layout.
Unregisters a previously registered structure dissect auto-guess override.
Registers a function that will be called when the structure dissect UI requests a name for a newly detected structure definition.
Unregisters a previously registered structure name lookup callback.
Miscellaneous
Miscellaneous
Injects a DLL into the currently opened process.
Executes a given command or opens a file/URL using the system shell.
Executes a stdcall function at a given address in the target process with one parameter and waits for it to return.
Extended version of executeCode (supports more parameters/options).
Executes a stdcall function at a given address in Cheat Engine's own process (local execution).
Extended version of executeCodeLocal with additional options.
Registers a callback invoked when an API pointer is changed (allows reacting to API remapping).
Sets the pointer/address used for a specified API function.
Computes and returns the MD5 checksum (hex string) of the bytes at the provided memory address/size.
Computes and returns the MD5 checksum (hex string) of a file's contents.
Retrieves the specified system metric or configuration setting. See: MSDN documentation.
Returns the tick count in milliseconds since the system started.
Reads an environment variable stored in the current user's registry environment.
Writes an environment variable to the current user's registry environment.
Broadcasts a notification that environment variables were changed (call after setting registry variables).
Returns the application object (main application/titlebar context).
Returns an Internet client class object. The provided string specifies the client name/type.
Signs a .CT-File given a valid and installed Cheat Engine Signature.
Extended API reference (CE 7.5)
This section covers additional global and factory APIs exposed by celua-75.lua. It is grouped by the task they support rather than by their implementation order. Class instance methods remain documented with their respective classes.
Core runtime, memory, and conversion helpers
Use these for runtime detection, memory-protection changes, byte/value conversion, and sharing simple values between Lua states.
Core runtime, memory, and conversion helpers
Returns 0 if CE is running in Windows, 1 for Mac
Returns true if CE is running in windows Dark Mode. Has no effect on mac
Sets the given protection on the address range. Note, some systems do not support X and W to be true at the same time
Alias for readShortInteger; reads an 8-bit integer from target-process memory.
Reads an 8-bit integer from target-process memory.
Alias for writeShortInteger; writes an 8-bit integer to target-process memory.
Writes an 8-bit integer to target-process memory.
Writes a pointer-sized integer to target-process memory.
Writes a pointer-sized integer to Cheat Engine memory.
Sign-extends a value using the specified most-significant bit.
Converts an Extended value to a byte table.
Converts a byte table to an Extended value (returned as a double).
Returns the given variable from the main lua state. Only basic types are supported. (Handy for new lua state threads)
Sets the global variable names string in the main lua state. Only basic types are supported
Encodes a Lua script, optionally using the specified Lua DLL.
Files, symbol loading, and native compilation
These APIs operate on paths, augment symbol information, or compile and assemble native and .NET code.
Files, symbol loading, and native compilation
returns the filename of the path
returns the file extension of the path
Returns the filename of the path, without the extension
removes the filename from the path
Returns the path to the temp folder
Returns true if a file exists at that path
Returns true if a file existed at that path, and now not anymore
Will download the PDB files of Windows and load them (Takes a long time the first time)
Will check the option for kernelmode symbols in memory view (Gets only the exports unless enableWindowsSymbols() is used)
Returns the classname of a given structure based on RTTI information (assuming it can be found, returns nil if not or unknown)
Reinitializes Cheat Engine's own symbol handler.
Waits till the sections have been enumerated
Waits till all DLL Exports are loaded
Waits till all .NET symbols are loaded (this includes DLL Exports)
Waits till all PDB symbols are loaded (this includes DLL Exports, and .NET)
Will interrupt symbol enum to query the debughelp symbol handler about a specific symbol. This can take a while. Default is false
Stops the symbolloader from processing any debug files and releases what it had open
If set to true looking up a symbol will wait for the symbol to be loaded(default true)
Assembles one instruction and returns its bytes.
Compiles C code and returns a table with the addresses of the symbols on success, or nil with a secondary result containing the errormessage
Compiles an indexed list of C source files.
Compiles the TCC library functions some C code may need to function internally
Adds an extra default include path for the compile() function
Removes a specific path previously added with addCIncludePath
Compiles c# code and returns the autogenerated filename. references is a list of c# assemblies this code may reference.
Calls a static .NET class method from Cheat Engine.
Auto Assembler authoring and callbacks
Use callback registrations to extend Auto Assembler parsing and structure dissection; keep any returned registration ID for cleanup.
Auto Assembler authoring and callbacks
Makes the lua highlighter show the functionname as a functionkeyword
Removes the given name from showing up as a functionkeyword
Registers a callback for global-structure-list updates.
Unregisters a global-structure-list update callback.
Registers a function to be called when a structure needs to be dissected
Unregisters the structure and element list callback.
Returns the next unused newmem allocation number in an Auto Assembler script.
Adds a snapshot of original code as a comment to an Auto Assembler script.
Finds a unique AOB pattern for an address and returns its offset.
Process control, code execution, and prompts
This group covers process handles, code invocation, clipboard access, GC control, and small user-facing dialogs.
Process control, code execution, and prompts
Shows a selection list and returns the selected index and text.
Duplicates the provided CE based handle into the target process (You still need tell the target about this handle, like an injected dll data block)
If defined this function will be called twice when a table gets loaded. Once before the loading, and once after.
Returns the handle of the currently opened process
Returns the size of the currently opened target executable.
Gets the current pointersize
Returns CPUID register values for the supplied EAX and ECX inputs.
Enables or disables the passive Lua garbage collector.
Configures the active Lua garbage collector.
Returns the inverted color
Executes the given command and returns the output of the command as a string and the exitcode as an integer (Should not open a console window) If pathtoexecutein is not provided the path...
Reads the text from the clipboard
Alias for injectDLL; injects a DLL or dylib into the target process.
Injects a .NET assembly and invokes its specified method.
Executes a method.
Target inspection, allocation, and task progress
These helpers inspect the target architecture, allocate memory in Cheat Engine, disassemble bytes, or update Windows taskbar progress.
Target inspection, allocation, and task progress
Allocates named shared memory in the Cheat Engine process.
Returns true if the target process is x86 based
Returns true if the target process is arm based
Returns true if the target process is running on the Android OS
Returns the autorun path
Disassembles the given bytes and returns the result.
Same as print(string.format(...))
Sets the state of the cheatengine task in the taskbar (windows only) values: tbpsNone, tbpsIndeterminate, tbpsNormal, tbpsError, tbpsPaused
Sets the state of the cheatengine task progress status
Registered symbols
Use these only for symbols registered through Lua or Auto Assembler; they do not enumerate every symbol known to the symbol handler.
Registered symbols
Returns a table with elements containing {symbolname, address, OPTIONAL {allocsize, processid, donotsave
Deletes all symbols registered with registerSymbols, both in AA and Lua scripts (Does not remove registered symbolLists)
}}
Debugging extensions
These functions add debugger state checks and per-thread breakpoint control beyond the main debugger section.
Debugging extensions
Returns true if the debugger was single stepping an instruction earlier
Breaks the thread with the specific threadID (Note: The thread may not break instantly and may have to be awakened first)
sets a breakpoint of a specific size at the given address for the specified thread. if trigger is bptExecute then size is ignored.
Forms, controls, graphics, dialogs, and streams
All create... entries here return a CE class object. Assign an owner where the function accepts one so the object's lifetime is managed correctly.
Forms, controls, graphics, dialogs, and streams
Created an empty region
Creates a menu item that gets added to the owner menu
Creates a MainMenu object.
Creates a PopupMenu object.
creates an imagelist object
Creates a stringlist class object (for whatever reason, lua strings are probably easier to use)
creates a CEForm class object(window) and returns the pointer for it. Visible is default true but can be changed
Returns the generated CEform
Returns the generated CEform
Creates a new lua engine form object. If there is no main luaengine window, this will become it.
TFrmAutoInject - Spawns an autoassembler window with the optionally provided script
Creates a Paintbox class object
Creates a Label class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a Splitter class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a Panel class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates an Image class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates an Edit class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a Memo class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a synedit object. mode: 0=Lua highlighting, 1=Auto Assembler highlighting
Creates a Button class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a CheckBox class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a ToggleBox class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a GroupBox class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a RadioGroup class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a ListBox class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a Calendar class object which belongs to the given owner. Owner can be any object inherited from WinControl. Valid date is between "September 14, 1752" and "December 31, 9999"
Creates a ComboBox class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a ProgressBar class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a TrackBar class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a ListView class object which belongs to the given owner. Owner can be any object inherited from WinControl
Creates a TreeView object.
Creates a Timer object.
Returns a font object (default initialized based on the main ce window)
Returns a Bitmap object
Returns a PortableNetworkGraphic object
Returns a Jpeg object
Returns an Icon object
Returns a empty picture object
returns an initialized GenericHotkey class object. Maximum of 5 keys
Creates a new colordialog
Creates a new colorbox
Creates a find dialog object.
Creates an opendialog object
Creates a save dialog object.
Creates a directory-selection dialog object.
Creates a file-backed stream with the requested mode.
Creates a stream backed by a string buffer.
Returns a new MemScan class object
Creates a FoundList for the provided MemScan object.
Creates a new memoryview window. This window will not receive debug events. Use getMemoryViewForm() function to get the main memoryview window
Threads, synchronization, and structures
Use synchronization objects when worker threads share state. Structure helpers create or retrieve layout definitions used by the structure dissector.
Threads, synchronization, and structures
Creates and starts a native thread for the supplied Lua function.
Creates a native thread in the suspended state.
Creates a new thread in a new lua state. This is more efficient as no locking inside lua takes place, but has no access to userdefined lua functions and only limited base CE functions.
Returns a critical section object
Returns an event object
Returns an semaphore object
Returns a createMultiReadExclusiveWriteSynchronizer
Opens a structure dissect form for an address.
returns a table of StructureFrm objects (can be useful for finding a structure window with the wanted structure)
Returns the number of Global structures. (Global structures are the visible structures)
Returns the Structure object at the given index
Returns an empty structure object (Not yet added to the Global list. Call structure.addToGlobalStructureList manually)
If PDB files are loaded this will create a structure with that name if it can be found
Low-level memory: DBK and DBVM
Advanced / platform-specific. These APIs require the DBK driver and/or DBVM and can affect the whole system, not only the opened process.
Low-level memory: DBK and DBVM
Changes all memory access to physical memory
When set to true CE's memory scanner will skip hardware device owned memory. Default state is true
Reads physical memory through the DBK driver and returns a byte table.
Writes physical memory through the DBK driver.
Sets the keys to operate DBVM. Key1 and Key3 are pointersize, key2 is 32-bit. Note that if key1 or key3 are 64-bit wide, 32-bit CE can not use DBVM.
Returns the total memory free for DBVM, and the total number of full pages as secondary result
Creates a DBVM watch that records instruction execution.
Sets a int3 breakpoint at the given address after cloaking that page and when hit does a trace.
Returns DBVM trace status, current entry count, and maximum count.
Requests the active DBVM trace to stop.
Disables the current trace and removes all results
Returns an array of traceentries. (Context of the system at the time of the event, like registers)
Returns the number of breakpoint slots currently available
Returns summary information for a DBVM breakpoint event.
Returns full register, FPU, and stack information for a DBVM breakpoint event.
Sets the state of the frozen thread
Resumes the specific thread. continueMethod can be 0=run, 1=step into
Returns the process and thread IDs for a DBVM breakpoint event.
Looks up the physical address for the given virtual address in the given pagetable base. Returns nil if not paged
Reads the virtual memory of the given process's CR3 value. Returns a bytetable on success, nil if fail to read (paged out)
Writes virtual memory using the supplied process CR3 value.
Direct3D, disassembly, and pipes
Use this group for overlays, custom disassembly output, named-pipe communication, and related analysis tools.
Direct3D, disassembly, and pipes
Creates a Direct3D hook object.
Creates a disassembler object that can be used to disassemble an instruction and at the same time get more data
Returns the default disassembler object used by a lot of ce's disassembler routines (Only use this from the main thread)
Returns the legacy shared visible-disassembler override object.
Same as Disassembler.OnDisassembleOverride, but does it for all disassemblers, including newly created ones. Tip: Check the sender to see if you should use syntax highlighting codes or not
Unregisters a global disassembler override callback.
Creates or returns the current code DissectCode object
Creates a RipRelativeScanner object.
Returns a LuaPipeClient connected to the given pipename. Nil if the connection fails. Timeout is number of milliseconds before it disconnects on read/write operations. 0 or nil means never
Creates a LuaPipeServer which can be connected to by a pipe client. InputSize and Outputsize define buffers how much data can be in the specific buffer before the writer halts.
Starts a Lua server with the supplied name.
Returns the Ultimap2 form, or nil when it is not open.
Returns the Code Filter form.
SQL and data access
These factory functions create database connections, transactions, and queries. Configure the appropriate connection before executing a query.
SQL and data access
creates an SQLite3Connection object
Lets you set the path to the sqlite3.dll in case it's not .\win*\sqlite3.dll
creates an ODBCConnection object
Creates an SQLTransaction object
Creates an SQL query object.
Modules, .NET, and diagrams
The .NET functions query data collected from the target; they require an active .NET data collector and may return empty data when the runtime is unavailable.
Modules, .NET, and diagrams
Returns the hotkey handler thread used internally by CE
Creates a remote thread in the target process.
Loads a DLL/module into the target process.
Returns the current dotnetdatacollector object
Returns all .NET application domains collected from the target.
Returns .NET modules for the specified application domain.
Returns type definitions for the specified .NET module.
Returns methods for the specified .NET type definition.
Returns the parent module and type definition for a .NET type.
Returns field and layout data for the specified .NET type.
Returns parameters for the specified .NET method.
Returns .NET object and field data for the specified address.
Enumerates all collected .NET objects; this may take a long time.
Returns addresses of collected .NET objects with the specified type.
Creates a diagram control object.
Remote execution, XML, and virtual trees
These APIs create reusable helpers for remote calls, XML documents, custom CE controls, and virtual trees.
Remote execution, XML, and virtual trees
Creates an ExecuteCodeExStub object which the executor can execute
Creates an ExecuteCodeExStub object which the executor can execute
creates a new remote executor
Creates a Cheat Engine custom button control.
Creates an empty XML document
reads the given filename and return an XMLDocument with the parsed contents of the file
reads the given stream and returns an XMLDocument with the parsed contents of the stream
Creates a VirtualStringTree object.
CEServer and Lua string extensions
CEServer functions apply only after connecting to a server. The string functions are called as methods (for example text:startsWith('CE')).
CEServer and Lua string extensions
Returns whether Cheat Engine is connected to CEServer.
Returns the CEServer path on the target.
Splits a string at the specified separator.
Returns whether a string ends with the specified text.
Returns whether a string starts with the specified text.
Classes
A compact list of notable classes implemented by Cheat Engine.
Classes
Container for memory records in a cheat table.
Bitmap graphic object for drawing images.
Brush used by a Canvas to fill areas.
Visual button component.
Base class common to button-like controls.
Drawing surface used in paint events for lines, text, and images.
Calendar/date-picker UI control.
Cheat Engine main/form window class.
Component used in Cheat Engine 5.x trainers.
Checkbox UI control supporting checked/unchecked/indeterminate states.
Base class for owner-managed components.
Base class for visible UI controls.
Abstract collection class (used by ListColumns and similar).
Item managed by a Collection.
Edit field with an attached dropdown ListBox.
Synchronization primitive for thread-safe access.
Base class for windowed controls that handle their own painting.
Custom data-type converter for interpreting raw memory.
D3D hook helper for rendering overlays in DirectX 9/10/11 games.
Font texture map used by D3D hook rendering.
Texture management for D3D hook sprites.
Text container used to draw text via D3D hook.
Abstract render object controlling rendering behavior.
Rendered sprite/texture displayed via D3D hook.
Disassembler helper class.
Visual disassembler UI used in Memory View.
Single line entry in a disassembler view.
Structure dissection helper.
Single-line text edit control.
Event wrapper class for callbacks.
Stream class for file-based I/O.
Standard file selection dialog wrapper.
Search/find dialog class.
Font definition and metrics class.
Window/form class.
Companion class for MemScan results; reads result files.
Register hotkeys with CE's hotkey handler.
Abstract base for image/graphic classes.
Lightweight control for simple graphics.
Panel-like container with a header.
Hex display helper used by Memory View.
Hex display UI component in the Memory View.
Icon resource wrapper.
Image control for displaying pictures.
Internet client helper class.
JPEG image handler class.
Static text label control.
Abstract pipe communication class.
Client implementation for pipe communication.
Server implementation for pipe communication.
List box control with selectable strings.
Column descriptor for a ListView.
Container for ListColumn objects.
Entry in a ListView.
Container for ListItem objects.
Multi-column list view control.
Top-level menu bar for a form.
Multi-line text editor control.
Memory scanner class for performing scans.
Common ancestor for menu-related classes.
Menu item descriptor.
Cheat table entry describing an address/value/hotkey etc.
Hotkey interface for a MemoryRecord.
In-memory stream class.
Memory view (hex editor) window class.
Synchronizer for safe concurrent read/write access.
Root base class for most CE classes.
Control for custom painting surface.
Container for multiple pages/tabs.
Container control for grouping child controls.
Drawing pen used by Canvas for lines.
Container for Graphic objects.
Context (right-click) menu class.
PNG image class.
Visual progress indicator control.
Group of radio-button controls.
Base class for raster image controls.
Helper for RIP-relative instruction scanning.
File open dialog class.
File save dialog class.
Directory selection dialog class.
Semaphore synchronization primitive.
Access and modify Cheat Engine settings and store plugin data.
UI splitter control for resizing panels.
Ordered list container for strings.
Abstract base for text collections.
Stream wrapper around a string buffer.
Structure definition class for memory layouts.
Single element inside a Structure.
Structure editor/dissector form class.
Grouping helper for structure elements.
Symbol lookup class (address ↔ name).
Single page within a PageControl.
Represents a file stored inside a cheat table.
Thread wrapper class.
Non-visual timer component triggering onTimer events.
Toggleable button-like control.
Slider control for numeric values.
Node in a Treeview.
Container for TreeNode objects.
Tree view control.
Base class for windowed controls.
XM player class for tracker music playback.
SQL Classes
SQL Classes
Base for custom DB connection implementations.
Database container/manager for connections and datasets.
Generic SQL connection abstraction.
SQLite3 connection implementation.
ODBC data source connection.
Transaction object for DB operations.
SQL-specific transaction object.
Single query parameter object.
Parameter container for queries.
Field metadata and values container.
Abstract dataset representing query results.
Database-backed dataset implementation.
In-memory buffered dataset.
Extended/custom SQL query object.
Standard SQL query executor and result-holder.
Class Helper Functions
Class Helper Functions
Returns true if the given object/class inherits from Object.
Returns true if the object/class inherits from Component.
Returns true if the object/class inherits from Control.
Returns true if the object/class inherits from WinControl.
Creates an instance of the specified registered class (default constructor).
Creates an instance of the specified component class (owner/parent may be required).
Undefined Class Property Functions
Not all class properties are explicitly exposed; these helpers allow dynamic access to published properties and method/event bindings.
Undefined Class Property Functions
Returns a StringList of published property names for the specified class.
Sets the value of a published property on an object instance (not usable for method properties).
Gets the value of a published property on an object instance (not usable for method properties).
Assigns a Lua function to a method/event property on an object.
Retrieves a callable wrapper to invoke the original method/property on the object.
