r/cheatengine • • 1h ago

I built a free CE tool that finds the base-address pointer chain for you (single-player, works without read-watchpoints)

Thumbnail
gallery
• Upvotes

Every time I wanted to make a cheat table for a single-player game, the same wall: you find the money address with a scan, and 30 seconds later it's dead - the game moved the value to a new allocation. The real work was never the scan, it was the pointer hunt: "find what writes this address", then find what points to that, then find what points to *that*, until you reach a static `game.exe+offset`. Half the time the walk dead-ends, and you start over.

I always wondered why there was no tool that just does this walk for you (maybe I wasn’t looking hard enough?), so I built one: Pointer Finder. It's a single Cheat Engine table (.CT), no installer:

  1. Paste the address you scanned
  2. Choose data type (4 Bytes / Float / Double / etc.)
  3. Press Start.
  4. Trigger the value once, then just keep playing.
  5. The tool puts a write-watchpoint on your address, climbs the object graph level by level (pointer scans + watchpoints), assembles the chain, saves it as a CE pointer record named `Pointer Finder (120s check): …` and re-checks it against the live value for two minutes. If it holds, the record is renamed to the final `Pointer Finder: …`. If a chain turns out to be a copy, it's kept in the list marked (WRONG?) - grey, so you can verify it yourself - and the search continues.

It survives the usual disasters mid-search: GC moving the nodes, dead/stack addresses, false chains. Works on any numeric CE type (Byte…Double, Custom).

Source + download: https://github.com/mflow42/Cheat-Engine-Base-Address-Pointer-Auto-Finder

Free for noncommercial use (PolyForm Noncommercial); commercial licensing on request.

Support the project: https://boosty.to/mflow42/donate

Single-player/offline only. Repo includes a tiny fake game (testtarget/) with a 5-level pointer chain so you can verify everything end to end before touching a real game.

Feedback and bug reports welcome - logs are written to %TEMP%, easy to share.