How to Edit a Game’s Memory on Android
Some numbers never reach a file. Health during a fight, ammo, a timer, the score while a round is on: they exist in the game’s memory while it runs and nowhere else. The memory scanner finds them the way you’d find anything you can’t name. Search for the number you see, let it change, search again, until one address is left.
Try it on the home page first, against a slime, without installing anything.
What you need
- A rooted phone. Without root, no app can read another app’s memory.
- The game running. Open it, then switch to CheatDroid. If it isn’t running, the scanner says so; start the game and tap Re-check.
- The right type. Int, the default, fits almost every counter: coins, HP, ammo, lives. Try Float when nothing turns up, especially for bars and values with decimals. The chip with the type on it opens the rest: Long and Double for bigger numbers, Short and Byte for small ones a game packs tight, and text and hex further down. No idea which? Auto, after Byte, searches as all six at once and writes next to each match what it was found as.
Finding a value you can see
- In CheatDroid, tap the game, then Memory under Tools.
- Type the value the game shows and tap Scan. Thousands of matches is normal: a number like 100 is all over a game’s memory.
- Back in the game, make the value change. Take a hit, spend a coin.
- In CheatDroid, type the new value and tap the = button with it. Every address that didn’t follow drops out.
- Repeat until a handful are left. A wrong step is one tap on undo away.
- Only know how much it changed? The + and − buttons keep what went up or down by the number in the field: spend 25 coins, type 25, tap −25.
The floating window saves the switching: the button at the top of the scanner puts it on top of the game, so you take the hit and scan in the same place. Android asks once whether CheatDroid may draw over other apps.
When the game shows no number
A health bar, a fuel gauge, a timer drawn as a circle. Pick Unknown before the first scan, and CheatDroid takes a snapshot of everything instead. Then narrow it down by how the value moves: More, Less, Changed or Same. Scanning for Same a few times while nothing happens in the game throws out a lot. Bars are often Float.
On a big game the snapshot is big too. Bridge Race, a Unity game, started out with 576 million matches in 672 MB of the phone’s storage. Changed, More and Less throw out far more than Same does, so the first refine after something happened in the game is the one that brings it down: Changed left 211 there. When storage runs short, CheatDroid stops and says so instead of filling the phone.
When the number is rounded, or comes with others
A game that shows 1.2K coins keeps something between 1,150 and 1,249. Pick Range and search from one to the other; the refine buttons take a range too (1150~1249, the ~ key in the field types the tilde). It works for a decimal you can only guess the same way.
Numbers that belong together usually sit together. With Group, 12;3;450 finds a level, its stars and its coins when all three are within 512 bytes of each other, which leaves far fewer matches than any one of them.
If the game hides the number, keeping it as a key next to the value XORed with it (Anti-Cheat Toolkit, a Unity plugin, does that), turn on Encrypted and search for the number you see as usual.
Looking around a value
Every match has a ⋮ menu, and Show memory here opens the memory around it: one value a row, its address, its bytes and what they read as, live. Whatever the game keeps next to your coins, like gems or a level counter, is usually a few rows away; tap a row to set it. The chips on top read the rows as another type.
Two more things for following a value to the object that holds it. Find pointers to this, in the same menu, searches for addresses pointing into the 4 KB in front of the value, which is where the object holding it starts; it’s a step on top of your results, so undo goes back to the value. In the memory view, an Int or Long that holds an address inside the game has an arrow that goes there, and the address field takes an offset after the address (7A1234F0+18), the way a pointer chain is written down.
The type menu also searches for text, in UTF-16 (Unity) or UTF-8, and for a hex pattern with ?? for any byte. A player name is a good way into the struct that holds the rest.
Set it, or freeze it
Tap a result to set its value. Freeze after setting, or the snowflake on a result, keeps it there: CheatDroid writes it back many times a second until you stop, and a notification shows that a freeze is running. Stop it from the notification, or with Unfreeze in the scanner. A set you didn’t mean has Undo in the bar that comes up after it, which also puts back the value it overwrote.
A freeze doesn’t have to hold the number exactly. At least lets it go up and puts it back when it drops below, which suits coins you still want to earn; At most is the other way round, for a timer or a cost.
Scanning is free. Setting and freezing memory are part of Pro.
Timers and offline earnings
An idle game counts what you earn while it’s closed, and how long an upgrade still takes, from the phone’s clock. Time jump, on the game’s page in CheatDroid and in the floating window, moves the clock forward by an hour, a day or whatever you type, and restarts the game so it sees the new time. Back to real time puts it right again. The whole phone sees the moved clock while it’s moved, so don’t forget it. More in how to skip timers.
Scripts
The code icon at the top of the scanner opens Scripts: Lua with GameGuardian’s gg functions, so a GameGuardian script that searches, sets values and asks through its dialogs finds what it calls. Two examples come with it, one that does the steps above and one that opens a menu from the floating button. Running a script that only searches is free; one that sets values needs Pro. How to run one.
When the value snaps back
If the number on screen doesn’t change after you set it, you changed a copy and the game keeps the real value somewhere else. Two things usually work:
- Freeze all remaining matches together: Select all, then the snowflake, instead of one at a time.
- Freeze what drives the number instead. A puzzle game that counts moves used, not moves left, stops counting with that counter frozen at 0.
A value the server checks, or one the game recalculates every frame, can’t be changed from memory at all. Neither can one the game reads back from its save each time it needs it: Mystical Mixing’s crystals left four Ints that followed every change, and setting them did nothing, because the game takes the number from its PlayerPrefs. For those, the file is the place.
Memory or file?
A value set in memory lasts as long as the game keeps it there. If the game saves it later, coins for example, the new number ends up in its save file too. If it doesn’t, it’s gone when the game closes. For anything a game writes down, editing the file is quicker and permanent; the guide to hacking Android games starts there, and where games keep their saves tells you which file.
Used GameGuardian before? Here’s how the two compare.