Repository navigation
Code Cheats and Scripts
A plain patch can only switch something off for everyone. Code cheats and scripts add decisions.
Both run code in or against your game, so entries that come from an imported file are held for review before first use. Read them, and only use files from people you trust.
Code cheats and the script additions described here are new in 0.4.0. They are tested against a simulated console that really runs the injected code, but have not yet been run on a real PS5.
A code cheat replaces one line of the game with a jump to new code, which decides what to do and then returns.
Start one from the Code tab (Run my own code here… on a line) or from New → Code cheat (if this, then that).
No assembly needed. You fill in a sentence:
When the game runs this line, if [the value being written / a register / a value next to it] is / is not / is above / is below [number], then [do the original / skip it / store a number instead / set a register], otherwise [...].
The choices offered come from the line itself, so "the value being written" and "the object it belongs to" appear in words. Show the code reveals the assembly it generates, which you can edit.
Example: the line mov [rbx+0x730], r14d writes health for every character, and [rbx+0x18] holds a team number that is 0 for the player. The rule "if the value at rbx+0x18 is 0, skip it, otherwise do the original" makes only the player invulnerable. Debugging explains how to find a field like that team number.
Intel syntax. The console assembles it (Keystone, inside ps5debug-NG).
; one hit kill, but not on the player
cmp dword ptr [rbx+0x18], 0 ; team 0 is the player
je keep
mov r14d, 0 ; enemies: health becomes 0
keep:
original ; the game's own line| In the code | Means |
|---|---|
; text |
A comment |
name: |
A label; jump to it forward or backward |
original on a line of its own |
The game's line this cheat took over |
return |
Where the game carries on. A jump there is added after your last line, so you only write jmp return to leave early. |
source |
The address of the game's line |
[name] |
A variable or label, read or written |
db, dw, dd, dq
|
Place data |
Named values kept next to the code, with a type (whole numbers from 1 to 8 bytes, float, double, or raw bytes) and a starting value.
movss xmm0, dword ptr [speed]While the cheat is on, each variable shows as a box on the cheat's row and can be changed live. A variable can also offer named choices.
- Give any cheat a Name in code. Code can then use another code cheat's labels and variables, or the address of a patch, value or function call entry, by name.
-
Shared code entries hold functions and variables for several cheats: write
call healPlayerin each. - Switching a cheat on switches on what it uses first. Switching something off switches off what depends on it first, and the row says so. Circular references are refused with a message.
- One cheat can hook several lines under one switch; they share variables and labels.
Everything is assembled first, sizes and jump distances are checked, and the game's original bytes are compared with what the cheat expects. If any part fails, nothing is written. The editor shows whether the place was found once, several times or not at all, and the game's original line that will be replaced.
- A hook replaces at least five bytes. Switch one on at a quiet moment in the game.
- Code cheats cannot be kept on by the PS5 without the browser.
- A wrong code cheat can crash the game. Save your game first.
A script is JavaScript that runs in the page, in a sandbox, and talks to the game through a small API. It stops when you switch it off or close the page.
// Keep health topped up.
const health = await cs.pointer("game+10100", 0x340);
while (true) {
if ((await cs.read(health, "u32")) < 50) await cs.write(health, "u32", 100);
await cs.sleep(250);
}| Call | Does |
|---|---|
await cs.read(address, type) |
Reads a value. Types: u8 u16 u32 u64 i8 i16 i32 i64 float double
|
await cs.write(address, type, value) |
Writes a value |
await cs.readBytes(address, count) |
Reads raw bytes as hex text |
await cs.writeBytes(address, "90 90 90") |
Writes raw bytes |
await cs.address("game+1A2B3C") |
Turns an offset in the game's executable into an address |
await cs.find("89 81 ?? ?? 00 00") |
Finds a byte pattern in the game's code; the address, or null |
await cs.pointer("game+10100", 0x340) |
Follows a pointer path to an address |
await cs.call(address, arg1, arg2) |
Calls a game function and returns its result |
await cs.enable("Name"), cs.disable("Name")
|
Switches another cheat on or off |
await cs.variable("speed").get(), .set(2.5)
|
Reads or changes a variable of a code cheat that is on |
await cs.assemble("mov eax, 1\nret") |
Assembles code to bytes |
await cs.notify("text") |
Shows a notification on the TV |
await cs.sleep(ms) |
Waits |
cs.log("anything") |
Prints under the script |
A script can add its own buttons, with inputs, to its row:
const gold = await cs.pointer("game+10100", 0x358);
cs.command("Give money", { amount: "number" }, async ({ amount }) => {
await cs.write(gold, "float", amount);
});
cs.onHotkey("F7", () => cs.variable("speedMultiplier").set(2));Hotkeys work while the page is open and in front.
CheatSpecter is free software under the GPL-3.0 license and comes with no warranty. Use it at your own risk. Releases · Changelog · Report a problem
Getting started
Guides
- Finding Values
- Making and Managing Cheats
- Code Cheats and Scripts
- Debugging
- Engine Helpers
- Community Cheat Tables
Claude (MCP)
Reference