how do game trainers work with both the original and the cracked version?

[nameuserHey]

Don't the addresses of variables/functions change?

[TimFun13]

Yes, but if they use AOBs; then enough can be the same. And you can make use of readMem or reassemble if needed to match stuff at runtime. Like my Far Cry 3 table works for both steam and "non-uplay" versions and with some other tricks it even works for the DX9 EXE and the DX11 EXE; only the EXE name for my auto-attach script has to be changed.

[JohnFK]

Yes

Not always. Most cracks nowadays only replace steamapi and work as an emulator. This way the game files are 100% identical to the release version. In all other cases what you said is right.