Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Linux build

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Sat Apr 25, 2026 2:46 am    Post subject: Linux build Reply with quote

There's now an initial version of cheat engine for linux available for download on cheatengine.org

it uses qt5 but if requested i can make a gtk version as well

please report bugs you encounter

the windows version will come soon

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Sat Apr 25, 2026 2:16 pm    Post subject: This post has 1 review(s) Reply with quote

Running on Arch w/ KDE desktop environment (Wayland). I got most of the way through the tutorial and didn't test most of the features.

v The binary `cheatengine-x86_64` links with `libQt5Pas.so.1`. This dependency should be mentioned somewhere, e.g. in the readme. On Arch, the package "qt5pas" provides this library; I've heard Debian, Ubuntu, and Fedora also have relevant packages.
Long term, an appimage would be convenient.


v vI noticed the scandata files are saved in the `/tmp` directory. This is often mounted as a `tmpfs` filesystem that's backed by RAM. If the game is already taking up the majority of the system's RAM, scanning could cause bad things to start happening.
`/var/tmp` might be a better default for people who don't know what they're doing: by convention, it's expected files in this directory will persist across a system restart, so it must be backed by something other than RAM.
Dynamically switching between them would be best, but also complicated.

If the main window isn't in focus, right clicking a record in the address list doesn't work properly. If it's some window CE created ("Advanced Options" or "Table Extras" buttons), the popup window spawns out of place relative to the window that was in focus; if some other window is focused (e.g. the tutorial, a web browser, etc.), an entirely new window is created that's also out of place.

CE gets stuck in an infinite loop trying to allocate memory in the target process. Tested with both AA `alloc` and Lua `allocateMemory`.
Code:
13:49:35 : 7817:CEODS:_CPUCOUNT=12
13:49:35 : ext_alloc(1, 3f0000, 4096)
13:49:35 : hasLoadedExtension == FALSE
13:49:35 : loadCEServerExtension
13:49:35 : this process is being debugged
13:49:35 : Not the debugger thread. Switching...
13:49:35 : loadCEServerExtension
13:49:35 : this process is being debugged
13:49:35 : This is the debugger thread
13:49:35 : modulepath = /tmp/CheatEngineLinux766/libceserver-extension_x86_64_linux.so
13:49:35 : This process is being debugged. Checking if it's already loaded
13:49:35 : OpenPipe("ceserver_extension7851")
13:49:35 : trying to connect to ceserver_extension7851
13:49:35 : connect returned -1
13:49:35 : Failed connecting to ceserver_extension7851
13:49:35 : Scanning for dlopen
13:49:35 : Trying to find dlopen
13:49:36 : dlopen not found, trying __libc_dlopen_mode
13:49:37 : failure finding dlopen or any variant of it
13:49:37 : Returned from debugger thread. Result:0
13:49:37 : Failure to load the extension
13:49:37 : 7817:CEODS:ext_alloc failed. trying allocWithoutExtension
13:49:37 : allocWithoutExtension
13:49:38 : Failure finding mmap address
13:49:38 : 7817:CEODS:Failure to allocate memory 3 (prefered=003F0000)
13:49:38 : ext_alloc(1, 3f0000, 4096)
...
This repeats endlessly from `ext_alloc...` to `CEODS: Failure to allocate memory...`

The vertical lines in the hex view are positioned incorrectly. Changing the window size doesn't help- that just makes more lines that are still off.

Clicking on the light bulb "help" window / image that's created with the tutorial made the tutorial unresponsive. One thread is maxed out at near 100%, so I guess it got stuck in an infinite loop.

In the "Find out what accesses / writes to this address" window, clicking on "Stop" after the target no longer exists doesn't work. The window itself closed fine, but I don't know if anything important leaked.

If the target dies, CE appears to keep trying to open `/proc/[pid]/maps`.

Trying to generate a pointermap crashes CE (right click address list -> Generate pointermap). Terminal output:
Code:
TReversePointerListHandler.create
Querying memoryregions
After split:
Allocating 524288 bytes to 'buffer'
Initial scan to determine the memory needed
Secondary scan actually allocating the memory and filling in the data
filling linked list
[FORMS.PP] ExceptionOccurred
  Sender=EAccessViolation
  Exception=Access violation
  Stack trace:
  $00007F77EFFEDFFF
  $00007F77F0008B34
  $00007F77EB319213
  $00007F77EFF07F0F
  $00007F77F0564B82
  $00007F77F0592189
  $00007F77F0558626
  $00007F77EF8D0448
  $00007F77EF8D17A0
  $00007F77EF924930
  $00007F77EE106F4D
  $00007F77EE108617
  $00007F77EE108825
  $00007F77EF921DC9
  $0000000000A7C4C7
  $00000000004C8F67
  $0000000000B79E79
TMemScan destructor
after DeleteScanfolder
TMemScan destructor exit
Symbolhandler was terminated. Not going to sync
Symbolhandler was terminated. Not going to sync


Module address symbols only work in the first section of the module.
Code:
print(getNameFromAddress(0x0041EFFF))  -- "tutorial-x86_64"+1EFFF
print(getNameFromAddress(0x0041F000))  -- 0041F000
Translating a symbol to an address still works: `getAddressSafe('tutorial-x86_64+1F000')` returns the expected value. But then again, `getAddressSafe('tutorial-x86_64-1000')` also returns the "expected" value even though it probably shouldn't.

CE logs a tremendous amount of information to the system log. Over 83% of lines in the log were from CE in this boot. It would be nice if you added some CLI flags to change this behaviour: e.g. `-v` for verbose, `-vv` for very verbose, maybe log to stdout / stderr by default and have a `--syslog` flag to also log to the system log, etc.


Minor:

Many files are executable when they shouldn't be: .lua, .txt, .png

The messages "This plugin supports grabbing the mouse only for popup windows" and "qt.qpa.wayland: Wayland does not support QWindow::requestActivate()" are often output to the terminal.

The colorscheme for AA scripts isn't great for a dark background.

I didn't expect CE to change the current working directory to `/proc/[pid]`.

The file open / save dialogs aren't like the standard ones other applications use. I guess that's a lazarus thing.

There was a noticeable lag of 0.5s - 1s about every other word typed in the Lua console. Maybe it was when the autocomplete "helper" window was suppose to pop up.

The windows are organized in the taskbar in a very weird way. The tutorial and the "help" light bulb window get grouped together, but all of the CE windows don't. It would be better if CE worked like most other applications where multiple windows get grouped together under the same icon.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Tue Apr 28, 2026 3:43 am    Post subject: Reply with quote

thanks. i'll get on it (did you try to allocate while the target was frozen ? as that's not an option at this time)
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Tue Apr 28, 2026 1:05 pm    Post subject: Reply with quote

The target wasn't frozen.

The Lua function `allocateMemory` doesn't enter an infinite loop, but it doesn't appear to work either. Running the code `return allocateMemory(4096)` in the Lua engine shows the function didn't return any values.
The Auto Assembler entering an infinite loop on allocation failure could be a separate issue from the allocation failure itself.

Steps to reproduce:
  1. Execute `sudo bash -c 'echo 0 >/proc/sys/kernel/yama/ptrace_scope'`
  2. Run the executable cheatengine-x86_64 as an unprivileged user
  3. Open the tutorial from the "Help" menu
  4. Attach to the tutorial
  5. Open an AA script window
  6. Execute the code `alloc(foo,4096)`

The lag when typing also happens in the AA script window. These messages are output to the terminal when the lag spike happens:
Code:
Getting processdata for TH32CS_SNAPFIRSTMODULE
Creating 1-entry module list for process 5210
The opened process is 64-bit
I guess it's something blocking the main thread for a second.
_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Thu Apr 30, 2026 8:00 am    Post subject: Reply with quote

for 4: when you say "attach to the tutorial" do you mean you click on "attach to process" or just doubleclick the tutorial, or click the tutorial and click ok ?

if you do "attach to process" which debugger interface method did you have selected in settings ?

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Thu Apr 30, 2026 1:06 pm    Post subject: Reply with quote

I click on the glowing computer icon in the top left of the main window to open the "Process List" window. The CE tutorial process is highlighted by default, so I don't change that. Then I click the "Open" button.

AFAIK the debugger is never attached to the process, but in Edit -> Settings -> Debugger Options -> Debugger method, "Use Linux(PTrace) debugger" is selected.
Executed in the Lua engine:
Code:
print(tostring(debug_isDebugging()))         -- false
print(tostring(allocateMemory(4096) == nil)) -- true
print(tostring(debug_isDebugging()))         -- false
NB: allocateMemory doesn't return nil, it returns nothing. `== nil` is required because tostring will give an error if no value is passed to it.

I tried selecting "GDB Server Debugger" but it made no difference.


Possibly related: in Memory View -> View -> Enumerate DLL's and Symbols, CE lists a lot of *.so.* files, but only the vdso has any symbol information. Executing the Lua function reinitializeSymbolhandler prints the following output to the terminal:
Code:
lua: reinitializeSymbolhandler
Symbolhandler was terminated. Not going to sync

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Thu Apr 30, 2026 2:08 pm    Post subject: Reply with quote

weird. try running ce with sudo. Perhaps your security blocks the readout of maps for same user accounts

or you're way to dockered up (do not run ce in a docker) ce can usually deal with the target being inside a docker, but if it is inside one it may mess up

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Thu Apr 30, 2026 4:21 pm    Post subject: Reply with quote

Running CE as root didn't change anything. Memory allocation still failed. The tutorial was run as an unprivileged user, and no containers are in use.

Here's the full output of running CE as root, opening the unprivileged tutorial process, executing `return allocateMemory(4096)` in the Lua engine, and closing CE after that failed:
Code:
$ sudo ./cheatengine-x86_64
[sudo] REDACTED
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
disassemblerarm64
DisassemblerThumb init
arm disassembler
autoassembler
networkinterface
disassembler
initializeLua()
liblua53.so = 624303344
symbolhandler
tcclib
Processhandlerunit
Assemblerunit
cefuncproc
cefuncproc 2
cefuncproc 3
cefuncproc 4
cefuncproc 5
cefuncproc 6
cefuncproc end
newkernelhandler
contexthandler
process_vm_readv=0x7f3ec95d5a20
process_vm_writev=0x7f3ec95d5a60
---
CESERVERPATH=/tmp/CheatEngineLinux766-2/
MEMORY_SEARCH_OPTION=2
ATTACH_TO_ACCESS_MEMORY=0
ATTACH_TO_WRITE_MEMORY=1
MEMORY_SEARCH_OPTION=2
MainUnit2
cemain
calling Application.Initialize
after calling Application.Initialize
symhandler stuff init
Not listening for new connectionsGetting processdata for TH32CS_SNAPFIRSTMODULE
Creating 1-entry module list for process 17554
The opened process is 64-bit
Keyboard found: /dev/input/event8
symhandler init done
creating forms
calling InitializeLuaScripts
TAutoSizeCtrlData.FixControlProperties :TCECheckBox a=akTop old=:TEdit new=nil
calling handleparameters
Starting CE
TMemScan constructor
CreateScanfolder
tempdiralternative=
tempdir=/var/tmp/
fScanResultFolder=/var/tmp/Cheat Engine/
CreateScanFolder exit
TMemScan constructor exit
OK button click
calling PWOP
Getting processdata for TH32CS_SNAPFIRSTMODULE
Creating 1-entry module list for process 17608
The opened process is 64-bit
calling open
openProcessEpilogue called
Retrieved the module list
Base=00400000
headersize=1431655765
After setcodeanddatabase
oldprocessid != processid
openProcessEpilogue exit
Lua thread terminated
Lua thread terminated
ext_alloc(1, 0, 4096)
hasLoadedExtension == FALSEloadCEServerExtension
modulepath = /tmp/CheatEngineLinux766-2/libceserver-extension_x86_64_linux.so
Scanning for dlopen
Trying to find dlopen
dlopen not found, trying __libc_dlopen_mode
failure finding dlopen or any variant of it
Failure to load the extension
ext_alloc failed. trying allocWithoutExtension
allocWithoutExtension
Failure finding mmap address
ext_alloc(1, 0, 4096)
hasLoadedExtension == FALSEloadCEServerExtension
modulepath = /tmp/CheatEngineLinux766-2/libceserver-extension_x86_64_linux.so
Scanning for dlopen
Trying to find dlopen
dlopen not found, trying __libc_dlopen_mode
failure finding dlopen or any variant of it
Failure to load the extension
ext_alloc failed. trying allocWithoutExtension
allocWithoutExtension
Failure finding mmap address
bye
TMemScan destructor
after DeleteScanfolder
TMemScan destructor exit
Symbolhandler was terminated. Not going to sync
Symbolhandler was terminated. Not going to sync


Edit:

I did an strace of CE's process and I think I found the problem.

CE keeps trying to open files like "/@usr/...". Before these attempts, there's reads from "/proc/[pid]/mountinfo"

My system:
Code:
$ cat /proc/self/mountinfo
71 2 0:33 /@ / rw,noatime shared:1 - btrfs /dev/nvme0n1p3 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,commit=120,subvolid=256,subvol=/@
...

"/@" is a subvolume in my btrfs filesystem. It's mounted at "/", the root of the virtual filesystem that programs see.

_________________
I don't know where I'm going, but I'll figure it out when I get there.


Last edited by ParkourPenguin on Sat May 02, 2026 4:10 pm; edited 2 times in total
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Thu Apr 30, 2026 10:06 pm    Post subject: Reply with quote

can you paste the maps file of the tutorial to pastebin and post the link here ? maybe it's a parser issue for your version
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Fri May 01, 2026 12:07 pm    Post subject: Reply with quote

https://pastebin.com/ZfMvXJRz

The first set of data is from /proc/[pid]/maps
The second is what CE shows in Memory View -> View -> Memory Regions

I don't know if this is related or not, but CE takes about 5 seconds to fail to allocate memory in the tutorial, but for a smaller program like `cat`, CE fails almost instantaneously. The output is the same.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Sat May 02, 2026 4:41 am    Post subject: Reply with quote

is the memory of libc readable (e.g in the screenshot read 7f1ae2bad000) and is it an ELF ?

and can cheat engine read the file at /usr/lib/libc.so.6 ?

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
ParkourPenguin
I post too much
Reputation: 155

Joined: 06 Jul 2014
Posts: 4760

PostPosted: Sat May 02, 2026 2:34 pm    Post subject: Reply with quote

Code:
$ cat /proc/[pid]/maps | grep libc
7ffb1e267000-7ffb1e28b000 r--p 00000000 00:21 1259957                    /usr/lib/libc.so.6
7ffb1e28b000-7ffb1e3fc000 r-xp 00024000 00:21 1259957                    /usr/lib/libc.so.6
7ffb1e3fc000-7ffb1e44a000 r--p 00195000 00:21 1259957                    /usr/lib/libc.so.6
7ffb1e44a000-7ffb1e44e000 r--p 001e2000 00:21 1259957                    /usr/lib/libc.so.6
7ffb1e44e000-7ffb1e450000 rw-p 001e6000 00:21 1259957                    /usr/lib/libc.so.6


Looks like CE can read the memory perfectly fine. The Lua function `compareMemory` doesn't seem to work, but comparing it manually works:
Code:
local start = 0x7ffb1e267000
local finish = 0x7ffb1e450000
local size = finish - start
local addr = assert(copyMemory(start, size, nil, 1))

local result, idx = compareMemory(start, addr, size, 1)
print(tostring(result), idx)
-- false, 0

local target_bt = readBytes(start, size, true)
local ce_bt = readBytesLocal(addr, size, true)

for i = 1, size do
  assert(ce_bt[i] == target_bt[i], ('CE mem != target mem: %02X != %02X'):format(ce_bt[i], target_bt[i]))
end

local t = {}
for i = 1,16 do t[i] = ('%02X'):format(ce_bt[i]) end
print(table.concat(t, ' '))
-- 7F 45 4C 46 02 01 01 03 00 00 00 00 00 00 00 00

The first 16 bytes are as expected. Dumping the first region of memory (7ffb1e267000-7ffb1e28b000) to a file via the Lua function `writeRegionToFile` seems to work properly:
Code:
$ file /tmp/libc_first_region
/tmp/libc_first_region: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter *empty*, missing section headers at 2010104

$ readelf -h /tmp/libc_first_region 2>/dev/null
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 03 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - GNU
  ABI Version:                       0
  Type:                              DYN (Shared object file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x27900
  Start of program headers:          64 (bytes into file)
  Start of section headers:          2006136 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         15
  Size of section headers:           64 (bytes)
  Number of section headers:         63
  Section header string table index: 62
The output of `readelf` is identical to that of `readelf -h /usr/lib/libc.so.6`. (the stderr output just complains about the rest of the file missing)

CE can also read the file "/usr/lib/libc.so.6". The Lua code `md5file('/usr/lib/libc.so.6')` returns the correct result.


Edit:
I did an strace of CE's process and I think I found the problem.

CE keeps trying to open files like "/@usr/...". Before these attempts, there's reads from "/proc/[pid]/mountinfo"

My system:
Code:
$ cat /proc/self/mountinfo
71 2 0:33 /@ / rw,noatime shared:1 - btrfs /dev/nvme0n1p3 rw,compress=zstd:3,ssd,discard=async,space_cache=v2,commit=120,subvolid=256,subvol=/@
...

"/@" is a subvolume in my btrfs filesystem. It's mounted at "/", the root of the virtual filesystem that programs see.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Sun May 03, 2026 2:18 am    Post subject: Reply with quote

yeah, that was the next thing on my list to check. The routine I use to convert a relative docker path to the actual filesystem path. On most systems this works good, but I guess something went wrong in your case.
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25922
Location: The netherlands

PostPosted: Sun May 03, 2026 3:02 pm    Post subject: Reply with quote

Here is an updated version of libceapi.so it should hopefully work better

https://mega.nz/file/hPBjVTpI#y_uxgUjgCCF_oIiBQemARa66_oXI7wsHc0aWqrLfFvM

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites