chengyixu/cheat-engine-cli-skill/cheat-engine-cli

Cheat Engine CLI

Turn authorized process-memory work into a repeatable command sequence instead of an improvised terminal session.

Start With Authorization

Confirm that the target process, application, game, machine, and network endpoint are owned by the user or explicitly authorized for inspection.

Refuse workflows involving multiplayer cheating, credential extraction, stealth, persistence, anti-cheat bypass, or access to third-party processes without permission.

Treat memory writes, process termination, injection, debugger controls, thread controls, remote file mutation, allocation, and protection changes as destructive. Never infer confirmation from earlier conversation. Require an explicit approval immediately before execution.

Discover the Installed CLI

Prefer an existing cecli on PATH. Otherwise check ./bin/cecli, ./bin/cecli.exe, and the build output of the official companion repository.

Run:

cecli --version
cecli self-check

If the binary is unavailable, follow references/getting-started.md or references/getting-started.zh-CN.md.

Select One Target Mode

Choose exactly one mode:

• Local macOS or Windows: add --native to each command.
• Remote Linux or Android: add --endpoint host:52736 and connect to an authorized upstream ceserver.
• Remote macOS or Windows VM: use --endpoint host:port with the optional cebridge transport.

Never combine --native and --endpoint.

On macOS, require a debugger-signed CLI and explain that SIP-protected processes remain unavailable. On Windows, recommend an elevated terminal only when the authorized target runs at higher integrity.

Build a Verified Baseline

Run read-only discovery before any scan or write:

cecli --native server info --human
cecli --native process list --filter '<name>' --human
cecli --native process info --pid <pid> --human
cecli --native memory regions --pid <pid> --human

Replace --native with --endpoint host:52736 for remote targets.

Verify the process name, PID, architecture, and a readable address range. Do not guess a PID or address.

Prefer Machine-Readable Output

Use JSON for automation and --human only for interactive review.

cecli --native process list --filter game \
  | jq '.data.processes[] | {pid,name}'
 
cecli memory scan --help --pretty \
  | jq '.data.commands[0]'

Use --fields path,... to minimize agent context and --quiet when only the exit code matters. Keep diagnostics on stderr.

Read Before Scanning

Inspect mapped regions, then perform bounded reads:

cecli --native memory read \
  --pid <pid> --address <address> --size 16
 
cecli --native memory read \
  --pid <pid> --address <address> \
  --format typed --type i32

Use exact typed reads only when the data type is known. Supported types include signed and unsigned integers, floats, UTF-8, UTF-16LE, and hexadecimal data.

Scan Deliberately

Prefer the portable client-side scanner:

cecli --native memory scan \
  --pid <pid> --type i32 --value 100 \
  --alignment 4 --protection writable --limit 100

For byte patterns:

cecli --native memory scan \
  --pid <pid> --pattern '48 8B ?? FF' \
  --start <address> --end <address> --limit 100

Constrain address range, protection, alignment, and result count whenever possible. Do not claim unknown-initial-value or changed/unchanged refinement support; current scans are exact-value or exact-pattern scans.

Use memory aobscan only for explicit remote protocol compatibility testing against the bundled patched server, never as the default scanner.

Gate Every Write

Follow this sequence without shortcuts:

1. Read the current value.
2. Run the exact write with --dry-run.
3. Show the PID, address, type, old value, proposed value, and encoded bytes.
4. Ask for explicit confirmation.
5. Execute with --yes --verify only after confirmation.
6. Report the read-back result.
7. Offer to restore the original value.

cecli --native memory write \
  --pid <pid> --address <address> \
  --type i32 --value <value> --dry-run
 
cecli --native memory write \
  --pid <pid> --address <address> \
  --type i32 --value <value> --yes --verify

Never use --yes in a reusable example that could execute without a fresh human review. Keep reusable examples in dry-run mode.

Handle Failures Precisely

• Exit 2: fix invalid input or obtain required confirmation.
• Exit 10: verify the endpoint, server, firewall, and tunnel.
• Exit 20: refresh the process list, regions, or remote path.
• Exit 30: stop after a conflict or failed write verification; do not retry blindly.
• macOS native denial: verify signing and permissions; do not attempt to bypass SIP.
• Windows native denial: verify PID and integrity level; do not target protected processes.

Use cecli issue create for structured local feedback when a reproducible CLI defect appears.

Load References Progressively

• Read references/getting-started.md for English installation and platform setup.
• Read references/getting-started.zh-CN.md for 简体中文 installation and platform setup.
• Read references/workflows.md for complete English inspection, scan, and write playbooks.
• Read references/workflows.zh-CN.md for完整的中文操作流程。
• Read references/safety.md or references/safety.zh-CN.md before destructive or ambiguous requests.

Use the canonical CLI repository for the current command reference and release artifacts: https://github.com/chengyixu/cheat-engine-cli.