Cheats in games: what they are and how they work in 2026

If you are only just looking at private software, you are probably wondering what cheats are and how cheats actually work. In this overview, with no filler, we go through what these programs are, which features they give you, how an external, internal and DMA cheat differ, how anti-cheats such as Vanguard and BattlEye catch them, and why complete safety does not exist.

What a cheat is in plain words

A cheat is third-party software that gives a player an advantage unavailable in fair play. It either reads the data of the running game or interferes with its work and shows you what the normal interface does not: enemy positions through walls, automatic aiming, hints about health and weapons. It is important to understand that a cheat works alongside the game or inside it on your PC — it does not hack the server. That is exactly why the whole question comes down to how quietly the software obtains the data it needs.

The main cheat features: ESP, aimbot and others

Different builds bundle different sets of features. Here is what you meet most often:

• ESP / Wallhack — outlines enemies through walls with their HP, weapon and distance. Gives a full picture of the battlefield.
• Aimbot — automatic aiming at a target. Adjustable smoothing and capture zone so it looks more human.
• Triggerbot — fires automatically the moment the crosshair lands on an opponent.
• Silent Aim — corrects the bullet trajectory towards the target without a visible jerk of the crosshair on screen.
• Radar — a separate minimap with player positions.
• Chams — repaints enemy models in bright solid textures so they are visible in any lighting.
• Movement exploits — bhop, auto-strafe and other movement tricks.

How cheats are built: external, internal, kernel and DMA

The key distinction in the external internal DMA cheat topic is where the code lives and how it obtains data. The architecture determines both the functionality and how noisy it is.

• External — run as a separate program and read the game memory from the outside, injecting nothing into its process and drawing over the window. Fewer features, but almost no traces inside the game.
• Internal — a library (DLL) is injected straight into the game process and gets direct access to the data. More precise and richer in capability, but the code lives inside a protected process where it is easier to detect.
• Kernel / driver-based — work at the level of the OS driver, the same place where part of modern anti-cheats live. They can hide from user-mode checks, but this is a direct race against kernel protection.
• DMA — a separate PCIe card (or a second machine) reads the gaming PC's memory directly, bypassing its processor and operating system. Almost nothing is running on the gaming machine, so this approach is quieter for software checks, but it is expensive and complex to set up.
• AI / pixel-based — a neural network analyses the screen image and moves the mouse like a human. It does not touch the game memory at all, so it bypasses memory checks, but it loses in precision and reacts more slowly.

The logic is simple: the fewer traces a cheat leaves inside the game process and the system, the fewer leads the anti-cheat has. That is why external is usually quieter than internal, while DMA and AI solutions move the work outside the game memory entirely.

Public and private cheats

Public (free, mass-market) builds quickly come to the attention of anti-cheats: their signatures spread across the internet and settle into detection databases, so they do not last long. Private ones are distributed within a closed circle, updated regularly for protection patches and do not show up en masse — which is why they hold out longer. That still gives no guarantees, but it reduces the risk noticeably. You can look at current private builds in the ResellerCheats catalogue.

How anti-cheats and detection work

An anti-cheat is a system that looks for signs of third-party interference. It works on several levels at once:

• Server-side behaviour analytics — statistics on accuracy, reaction time and impossible crosshair movements. Even an invisible cheat can give itself away through inhuman numbers.
• User-mode monitoring — scanning running processes, memory and known signatures on your PC.
• Kernel mode — a driver with maximum privileges that sees the system more deeply and starts together with the PC.

This is how Vanguard (Valorant), BattlEye, EAC (Easy Anti-Cheat) and Ricochet (Call of Duty) work. HWID bans come from the same place — they block not only the account but the hardware too, tying the ban to its identifiers. A spoofer is used to remove that binding — read more in the article about the HWID ban and the spoofer.

Honestly about the risks

Let us be direct: any cheat breaks the game rules and the user agreement, which means it cannot be completely safe. Private software, updates for patches and a spoofer reduce the probability of a ban but do not remove it. Your account, and the money and time you spent on the game, are what you put at stake yourself. We do not promise that you will not be banned: promising that would be a lie. Our job is to provide current private software and to explain honestly how it works, so you can make an informed decision.

Frequently asked questions

How does an external cheat differ from an internal one?

External is a separate program that reads the game memory from the outside and injects nothing into it; internal is injected straight into the game process. Internal is richer and more precise, external is usually quieter for some checks.

Does a private cheat protect against a ban 100%?

No. Closed access and regular updates reduce the risk but give no guarantees. Completely safe cheats do not exist.

What is an HWID ban and why is a spoofer needed?

It is a block by the identifiers of your hardware, not only your account. A spoofer replaces those identifiers to remove the binding — details in the article about the HWID ban and the spoofer.