Tutorial How does Speedhack work under the hood in Cheat Engine? - UnreliableCode Forums

ByteSurgeon

Cheat Engine Specialist

MEMBER

Rep: 140

Join Date: Mar 2025

Posts: 19

Thanks: 30

2y ago · Nov 20, 2023 2:10 PM

#1

Ever wondered how Cheat Engine's Speedhack works so smoothly across almost any DirectX or Win32 game?

The Core Concept:
Games rely on high-precision system timers to compute delta time (

CPP

dt

) between frames:
-

CPP

QueryPerformanceCounter

&

CPP

QueryPerformanceFrequency

-

CPP

timeGetTime

(winmm.dll)
-

CPP

GetTickCount

/

CPP

GetTickCount64

When you activate Speedhack at 2.0x speed, Cheat Engine injects hooks into these timer functions inside the target process.

CPP

// Conceptual timing hook representation
static LARGE_INTEGER s_LastRealTime;
static LARGE_INTEGER s_FakeTime;
static double s_SpeedMultiplier = 2.0;

BOOL WINAPI Hooked_QueryPerformanceCounter(LARGE_INTEGER* lpPerformanceCount) {
    LARGE_INTEGER currentReal;
    Original_QueryPerformanceCounter(&currentReal);
    
    LONGLONG realDelta = currentReal.QuadPart - s_LastRealTime.QuadPart;
    s_FakeTime.QuadPart += (LONGLONG)(realDelta * s_SpeedMultiplier);
    s_LastRealTime = currentReal;
    
    *lpPerformanceCount = s_FakeTime;
    return TRUE;
}

By scaling the delta time that the game's physics, animation, and game loop receive, the game advances 2x faster in the exact same wall-clock duration!

Ever wondered how Cheat Engine's Speedhack works so smoothly across almost any DirectX or Win32 game?

[b]The Core Concept:[/b]
Games rely on high-precision system timers to compute delta time ([code=cpp]dt[/code]) between frames:
- [code=cpp]QueryPerformanceCounter[/code] & [code=cpp]QueryPerformanceFrequency[/code]
- [code=cpp]timeGetTime[/code] (winmm.dll)
- [code=cpp]GetTickCount[/code] / [code=cpp]GetTickCount64[/code]

When you activate Speedhack at 2.0x speed, Cheat Engine injects hooks into these timer functions inside the target process.

[code=cpp]// Conceptual timing hook representation
static LARGE_INTEGER s_LastRealTime;
static LARGE_INTEGER s_FakeTime;
static double s_SpeedMultiplier = 2.0;

BOOL WINAPI Hooked_QueryPerformanceCounter(LARGE_INTEGER* lpPerformanceCount) {
    LARGE_INTEGER currentReal;
    Original_QueryPerformanceCounter(&currentReal);
    
    LONGLONG realDelta = currentReal.QuadPart - s_LastRealTime.QuadPart;
    s_FakeTime.QuadPart += (LONGLONG)(realDelta * s_SpeedMultiplier);
    s_LastRealTime = currentReal;
    
    *lpPerformanceCount = s_FakeTime;
    return TRUE;
}[/code]

By scaling the delta time that the game's physics, animation, and game loop receive, the game advances 2x faster in the exact same wall-clock duration!

ByteSurgeon | Cheat Engine & Lua Automation

The following users thanked ByteSurgeon for this post:

HexRays99

Senior Reverse Engineer

VIP

Rep: 380

Join Date: Apr 2022

Posts: 36

Thanks: 94

2y ago · Nov 20, 2023 4:30 PM

#2

Great explanation! One thing worth noting for anyone researching anti-speedhack protections: server-authoritative game engines (like Source Engine, Unreal dedicated servers) validate player movement deltas against tick rates on the server, resulting in rubberbanding/teleport corrections if client time jumps ahead.

For singleplayer games or client-authoritative titles, hooking QPC and GetTickCount64 works like magic.

HexRays99 · Reverse Engineering & Static Analysis

CPP

// Always check your pointers!
if (!pLocalPlayer) return;

NullPtr_

Assembly & Engine Research

MEMBER

Rep: 260

Join Date: May 2023

Posts: 27

Thanks: 62

2y ago · Nov 21, 2023 2:45 AM

#3

Also don't forget

CPP

GetMessageTime()

or audio buffer synchronization in multimedia engines! If you speed up QPC without adjusting audio sample buffers, the audio will either desync or crackle.

NullPtr_ · 0xDEADBEEF was here

UnreliableCode Community

How does Speedhack work under the hood in Cheat Engine?

Create Forum Thread

Add Reputation