At some point, basic memory scanning stops being enough.
You find your health value, change it, and everything works. Then the game changes it back. Perhaps the address moves after restarting, the value is constantly recalculated, or you simply want to understand what part of the game is responsible for reducing your health in the first place.
That is where Find Out What Writes to This Address becomes useful.
Instead of only locating the number stored in memory, this feature lets you identify the machine-code instruction responsible for modifying it. That makes it one of the most important bridges between basic Cheat Engine scanning and more advanced techniques such as code injection, player-versus-enemy checks, and structure analysis.
If you are still getting familiar with basic scanning, our Cheat Engine beginner’s guide is a better place to start.
What Does “Find Out What Writes to This Address” Do?
Once you have found an address, Cheat Engine can monitor it and record the instructions that write new data to that location.
Suppose your health is currently stored at an address containing 100. You take damage and the value changes to 82. Somewhere in the game’s code, an instruction caused that change.
Cheat Engine can catch that instruction while it executes.
It might look something like this:
sub [rbx+30],eaxYou do not need to understand assembly language yet to make use of this. The important step is that you have moved from finding where health is stored to finding what code modifies health.
That distinction becomes extremely useful whenever simply editing or freezing the number does not produce the result you want.
Start by Finding the Value Normally
Before using the debugger, first find the value through an ordinary scan.
Health is a convenient example because you can usually control when it changes. If your character has 100 health, scan for 100, take damage, then use Next Scan with the new value. Repeat until you identify the correct address and add it to the address list.
Make sure the address really represents the gameplay value before continuing. Try changing it slightly and confirm that the game responds as expected.
Once you have the correct address, right-click it and select:
Find out what writes to this address
Cheat Engine may ask permission to attach its debugger to the game. Accept it, and a new window will appear showing any instructions that modify that address.
Initially, the window may be empty because nothing has written to the value yet. Return to the game and trigger the change naturally. Take damage for health, fire a weapon for ammunition, spend some money for currency, or sprint if you are investigating stamina.
Once the value changes, Cheat Engine should capture one or more instructions.
Definitely related: Why Cheat Engine Addresses Keep Changing Every Time You Restart a Game
Reading the Captured Instruction
Imagine that taking damage produces this result:
7FF612345678 - sub [rbx+30],eaxThe first section is the location of the instruction itself. The interesting part is:
sub [rbx+30],eaxAt a simplified level, sub means subtract. RBX contains an address, +30 refers to an offset from that address, and EAX contains the number being subtracted.
If RBX+30 is your health address and EAX contains 18, the instruction is effectively performing:
100 - 18 = 82That may be the exact instruction responsible for applying damage to your character.
This is one of the first moments where Cheat Engine starts revealing how the game actually processes its data rather than merely showing you the final number.
Use “More Information” to Inspect Registers
Selecting an instruction and clicking More Information gives you additional context, including the register values recorded when the instruction executed.
Suppose Cheat Engine shows:
RBX = 21B7D860
EAX = 00000012and the instruction is:
sub [rbx+30],eaxAdding the 30 offset to the address stored in RBX may give you the health address you originally found.
That tells you something important: RBX may be pointing to the beginning of a larger player structure, while health exists at offset +30 within that structure.
Nearby offsets might contain stamina, maximum health, character level, coordinates, or other properties. This is also why examining instructions becomes useful later when working with pointers and Cheat Engine’s Structure Dissect tool.
What Is the Difference Between “Writes” and “Accesses”?
Cheat Engine also provides Find Out What Accesses This Address, which sounds similar but serves a broader purpose.
Find Out What Writes to This Address only looks for instructions that modify the value. It is normally the better choice when you want to identify damage, stamina consumption, ammunition use, currency changes, regeneration, or another event that actually alters the number.
Find Out What Accesses This Address also captures instructions that merely read the value. A game may constantly read health to update the interface, check whether the player is alive, calculate effects, or make AI decisions without changing the health value itself.
For example:
mov eax,[rbx+30]may simply read the health value into EAX.
That instruction is not damaging the player, but it can still reveal that health is located at +30 inside whatever structure RBX points to.
The “accesses” option will therefore usually produce more results. Use it when no useful write instruction appears or when your goal is understanding the structure surrounding the value rather than only finding what changes it.
Finding What Keeps Overwriting Your Edit
This feature becomes especially useful when a value refuses to stay changed.
Suppose you change health from 100 to 999, but a moment later it returns to 100. Freezing the value might work, but it does not explain why the game keeps restoring it.
Monitoring writes can reveal the instruction responsible for that reset.
The same idea applies to values such as maximum health, movement speed, ammunition capacity, or calculated character statistics. If the game continuously recalculates a value, finding the writer lets you investigate the system doing the recalculation rather than repeatedly fighting the result.
This is often more useful than simply scanning for the number again.
Replacing an Instruction With NOPs
Once you find the instruction modifying the value, Cheat Engine allows you to replace it with NOPs, short for “no operation.”
A NOP does nothing. If you replace a damage instruction such as:
sub [rbx+30],eaxwith NOPs, the subtraction no longer happens.
In a simple case, this can immediately create something resembling god mode because damage is no longer deducted from health.
It is also an excellent way to test whether you found the correct instruction. If you disable it and your character stops taking damage, there is a good chance you identified the relevant code.
However, NOPing an instruction is usually better treated as an experiment than a finished cheat.
The Instruction May Affect Enemies Too
Games often reuse the same instructions across multiple characters.
The instruction responsible for reducing your health may also reduce the health of enemies, companions, NPCs, or anything else using the same character system.
If you replace that shared damage instruction with NOPs, your character may become immortal—but so might every enemy.
You have successfully defeated death itself.
Unfortunately, the boss also received the memo.
Before permanently modifying an instruction, it is therefore useful to determine what other addresses it affects.
Find Out What Addresses This Instruction Accesses
Once you have identified an interesting instruction, Cheat Engine can reverse the investigation by showing which addresses that instruction touches.
Instead of asking which instruction modifies your health address, you are now checking which objects use that instruction.
Start the address-monitoring option on the instruction, then perform several controlled actions. Take damage yourself, attack an enemy, and perhaps attack another enemy. If multiple addresses appear, the instruction is probably shared across several character objects.
This information is essential when creating more selective cheats.
For example, a future script might check whether the current object belongs to the player before blocking damage. Enemy damage would continue normally while player damage is ignored.
Finding that distinction often requires comparing structures, registers, identifiers, or other nearby data, but the first step is simply discovering that the instruction is shared.
Why This Can Be Better Than Freezing a Value
Freezing and modifying values are still useful. There is nothing wrong with using the simplest technique that achieves the result you want.
However, freezing health tells Cheat Engine to keep restoring a number. Finding the instruction that changes health reveals the actual game logic responsible for damage.
That opens much more flexibility.
Once you understand the relevant code, you can potentially create modifications that reduce damage instead of eliminating it, apply god mode only to the player, multiply enemy damage, prevent health from dropping below a certain value, or perform another action whenever damage occurs.
This is where Cheat Engine begins shifting from straightforward memory editing toward reverse engineering.
Common Problems
If no instructions appear, first confirm that the monitored value genuinely changes after you start the debugger. You may also have found a display copy rather than the real gameplay value. Trying Find Out What Accesses This Address can sometimes reveal more useful code.
If too many instructions appear, keep the test controlled. Start monitoring, trigger one specific event, and stop immediately afterward. Running around, opening menus, fighting several enemies, and triggering multiple systems at once will make the results unnecessarily difficult to interpret.
Some games may also crash or refuse to run when a debugger attaches. This is especially relevant to software using anti-debugging or anti-cheat systems, which is another reason Cheat Engine experimentation is best kept to offline single-player games.
Finally, if NOPing an instruction causes unrelated systems to stop working, restore the original code. That usually means you found an instruction shared by multiple objects or systems rather than something exclusive to your target.
Where This Leads Next
Learning to find the instruction that writes to an address opens several important directions in Cheat Engine.
The most obvious next step is code injection, where you stop simply disabling an instruction and instead redirect execution through your own custom code. That allows much finer control than replacing everything with NOPs.
The same technique also connects naturally to AOB scanning, because a reusable injection script needs a reliable way to find the relevant instruction after the game restarts.
Later, Structure Dissect can help identify the object behind registers such as RBX, while comparing player and enemy structures can reveal how to apply an injected modification only to the player.
In other words, Find Out What Writes to This Address is not just another debugging option. It is one of the main gateways from scanning numbers to understanding game logic.
Final Thoughts
The basic workflow is straightforward: find the value normally, monitor what writes to its address, trigger the value change, and inspect the resulting instruction.
From there, you can examine registers, determine which object the instruction is operating on, test the effect of disabling it, and check whether the same code also affects enemies or other entities.
The important shift is conceptual.
Basic scanning tells you where a value currently exists. Finding what writes to that address begins telling you how the game produces and modifies that value.
Once you reach that point, health is no longer just a number you can change from 100 to 999.
It becomes part of a system you can actually investigate.
