I've been looking a bit into [Cheat Engine](http://www.cheatengine.org/), which allows you to inspect and manipulate the memory of running processes on Windows: You scan for variables based on their value, then you can modify them, e.g. to cheat in a game.

In order to write a bot or something similar, you need to find a static address for the variable you want to change - i.e. one that stays the same if the process is restarted. The method for that goes roughly like this:

1. Look for the address of the variable you're interested in, searching by value
2. Look for code using that address, e.g. to find the address of the struct it belongs to (since struct offsets are fixed)
3. Look for another pointer pointing to that pointer until you find one with a static address (shows as green in Cheat Engine)

It seems to work just fine judging from the tutorials I've looked at, but I have trouble understanding *why* it works.

**Don't all variables, including global static ones, get a pretty random address at runtime time?**

Bonus questions:

1. How can Cheat Engine tell if an address is static (i.e. will stay the same on restart)?
2. A tutorial referred to the fact that many older and some modern games (e.g. Call of Duty 4) use *only* static addresses. How is that possible?