Using DeepSeek to Write Game Cheats? A Technical Analysis of AI-Assisted Reverse Engineering

Recently, a technical demonstration video from Bilibili (China's major video platform) has drawn attention: a creator showcased how to write a "cheat program" for games using the AI large language model DeepSeek alongside memory scanning tools. Using Among Us and CS2 as examples, the video presents the complete process from memory analysis to AI-generated code. What this reveals is not just the age-old problem of game security, but how AI programming capabilities are lowering technical barriers—including for uses that operate in gray areas.

To be clear: This article is purely a technical analysis. Cheating undermines game fairness and may violate user agreements or even laws and regulations. We firmly oppose any actual cheat development or use.

The Technical Essence of Game Cheats: Memory Read/Write Principles

The core approach demonstrated in the video isn't some arcane magic—it's a classic technique in game hacking: memory scanning and read/write operations. Taking the "invisibility" feature in Among Us as an example, the creator's goal was to find the "internal timer" controlling the invisibility state.

When a game is running, various character states (health, coordinates, timers, etc.) are stored as numerical values in memory. A cheat, at its core, is simply finding these memory addresses and then reading or modifying them as needed. The underlying principle stems from the process architecture of modern operating systems: each running process has its own independent virtual address space, with game data stored as specific data types (integers, floats, doubles, etc.) in heap or stack memory. Windows provides system APIs like ReadProcessMemory and WriteProcessMemory that allow processes with appropriate permissions to read and write the memory of other processes—these are legitimate interfaces designed for debuggers and system management tools, but they also form the foundational infrastructure for cheat technology. The creator repeatedly emphasized: this invisibility timer is a floating-point number that continuously decreases to zero before resetting.

Cheat Engine Memory Scanning: The "Process of Elimination"

The creator used Cheat Engine, a memory scanning tool, employing a typical "unknown initial value" scanning strategy. Cheat Engine is an open-source memory scanning and debugging tool developed by Eric Heijnen (known online as Dark Byte) in the early 2000s, and it remains actively maintained today. It supports memory scanning, disassembly, pointer scanning, speed modification, and many other features. Its core working principle involves traversing the target process's memory space through debugging APIs provided by the operating system, progressively narrowing search results based on user-defined filtering criteria. While Cheat Engine itself is a legitimate security research and educational tool, its use in online games typically violates game terms of service.

The specific scanning workflow is as follows:

• First scan for "unknown initial value," yielding a massive number of results
• After going invisible, the timer decreases—select "decreased value" and scan again
• When the timer resets and the value increases, filter with "increased value"
• Iterate repeatedly, narrowing candidates from millions down to dozens

Ultimately, through the method of "freezing values and observing game behavior," he identified the true address controlling the invisibility timer from 69 candidates. This is a manual process requiring patience and experience—AI did not intervene at this stage.

What Role Did DeepSeek Play in Cheat Development?

What truly deserves attention is AI's positioning in the entire workflow. After the creator found the target memory address, he opened DeepSeek and issued instructions in natural language:

"Write me a Python program using pymem that attaches to the process and writes a float to this memory address in a while true loop, approximately every 15 seconds."

DeepSeek promptly generated a complete Python script that uses the pymem module to attach to the game process and periodically resets the timer value in a loop to maintain permanent invisibility. pymem is a third-party Python library that wraps Windows platform process memory operation APIs, providing a Pythonic interface for process attachment, memory read/write, module enumeration, and other operations. Under the hood, it calls Windows API functions like OpenProcess, ReadProcessMemory, and WriteProcessMemory from kernel32.dll. Such libraries have legitimate uses in automated testing, game MOD development, and security research—for example, developers use them for runtime debugging, and security researchers use them to analyze malware behavior. The creator only needed to replace the process name with the actual target to run it.

AI Is a "Code Translator," Not a "Vulnerability Finder"

From a technical analysis perspective, DeepSeek's role here is essentially that of an efficient code translator—it quickly converts the clear requirement of "read/write a specific memory address" into runnable Python code. The true technical core (finding the memory address, understanding game mechanics) still relies on human reverse engineering capabilities.

The creator himself remarked somewhat self-deprecatingly that "AI is just that dumb," because the AI merely mechanically completed the simple task of memory writing. In other words: AI lowers the coding barrier, not the cracking barrier. Someone who doesn't understand memory scanning cannot conjure a cheat out of thin air even with DeepSeek.

The Double-Edged Sword Effect of AI-Assisted Programming on Game Security

While this video focuses on the specific scenario of game cheats, it reveals a broader trend: as large models' coding capabilities improve, writing programs with specific functionalities has become unprecedentedly easy.

In the past, transforming reverse engineering analysis into usable tools required developers to be proficient in Python, C++, and various memory manipulation libraries. Now, as long as you can clearly describe your requirements in natural language, AI can produce runnable code in seconds. This capability represents a massive productivity boost for legitimate software development, automation scripts, and data analysis—but it can equally be used for malicious purposes.

Platform Regulation and Creator "Self-Censorship"

A noteworthy detail: the video creator repeatedly "stopped short" during the demonstration. He deliberately didn't show "stable pointers" (a technique that allows cheats to remain effective after game restarts), explaining that this was to avoid the video being taken down by the platform.

A "stable pointer" (also called a static pointer or pointer chain) is the key technique in cheat development for upgrading from a "one-time modification" to a "persistent tool." Due to modern operating systems' Address Space Layout Randomization (ASLR) and dynamic memory allocation mechanisms, the memory address of the same variable typically changes each time a game launches. The principle behind stable pointers is finding the chain of pointer references from the program module's base address (a relatively fixed static address) to the target variable—because the offset relationships within a module are determined at compile time and don't change. Through this pointer chain, a cheat can automatically relocate the target variable's address after each game restart, achieving a "set it and forget it" effect. The creator's choice not to demonstrate this step both reflects the regulatory pressure content platforms exert on gray-area technical content and indicates that this technique significantly increases the actual harm potential of cheats.

Mainstream LLM providers typically set up defenses through safety alignment, refusing explicitly malicious requests. Safety alignment in large models is primarily achieved through techniques like RLHF (Reinforcement Learning from Human Feedback), Constitutional AI, and red-team testing, training models to identify and refuse harmful requests. However, "request decomposition" (also known as prompt jailbreaking or indirect prompt attacks) is one of the core challenges currently facing AI safety. When users break down a malicious objective into multiple seemingly innocuous technical subtasks—for example, decomposing "make a game cheat" into "how to write to a memory address with Python"—models often cannot infer the complete malicious intent from a single request. This falls within the "dual-use" problem in AI safety research, and academia and industry have yet to find a perfect solution, primarily relying on multi-layered defense strategies including context understanding, intent inference, usage scenario monitoring, and downstream behavior auditing to mitigate risks.

Conclusion: Technology Is Neutral, But Applications Have Boundaries

This demonstration offers insights on multiple levels. For game developers, it once again proves that purely client-side value validation is extremely insecure—critical logic must be verified server-side. The creator also repeatedly mentioned that "the server only recognizes data packets," hinting at the direction for defensive measures.

This involves a core architectural principle of modern online game anti-cheat: the Authoritative Server Model. Under this architecture, the client is only responsible for collecting player inputs and rendering visuals, while all critical game logic—including damage calculation, position validity verification, and ability cooldown determination—is executed and validated on the server side. Even if client memory is completely tampered with, the server will reject anomalous operations through data packet legitimacy checks (such as whether movement speed exceeds the maximum or whether ability use intervals are reasonable). Current mainstream commercial anti-cheat systems like EAC (Easy Anti-Cheat), BattlEye, and Riot's Vanguard detect the presence of memory scanning tools and anomalous process behavior through kernel-level drivers on the client side, forming a multi-layered defense system with server-side validation. Relatively lightweight indie games like Among Us have far less sophisticated anti-cheat mechanisms compared to AAA competitive titles, making them easier targets for such demonstrations.

For the AI industry, this is a vivid case study: AI programming tools are genuinely changing the distribution of technical capabilities. This is both an opportunity and a responsibility. The tools themselves are neutral—pymem libraries and memory scanners all have legitimate uses (such as software debugging, performance analysis, and security research), and DeepSeek is a powerful productivity assistant.

But as the creator repeatedly emphasized: "You need to have moral principles and be responsible." Cheating in multiplayer games destroys fairness and harms others' experience—no matter how "cool" the technology, it's not worth promoting. What's truly valuable is understanding these technical principles and applying them to legitimate fields like reverse engineering education and game security defense.

Key Takeaways