To understand how cheats work, you need to understand their adversary — the anti-cheat. Modern protection systems are complex software suites operating on multiple levels simultaneously. Let's break down how they work from the inside.

Two Operating Levels: User-Mode and Kernel-Mode

All anti-cheats can be categorized by their privilege level.

User-Mode Anti-Cheats

Operate at the same level as regular programs (Ring 3). They can:

  • Scan processes — search for known cheats by signatures (file hashes, memory strings)
  • Check file integrity — compare game file checksums against reference values
  • Monitor memory access — track which processes read the game's memory
  • Check windows — search for overlays placed over the game

Limitation: a user-mode anti-cheat can't see what happens in the kernel. A kernel-level cheat can completely hide from such a scanner.

Kernel-Mode Anti-Cheats

Operate at the OS kernel level (Ring 0) — the same level where device drivers run. This gives them virtually unlimited capabilities:

  • Full memory access — including kernel memory where cheats may hide
  • System call interception — tracking all memory, file, and registry access
  • Driver inspection — finding unauthorized or vulnerable drivers
  • Pre-game monitoring — some load at Windows startup
  • Hidden process detection — even if a cheat hides its process, a kernel-mode anti-cheat can find it

Kernel-mode anti-cheats include: Vanguard (Valorant), EAC (Easy Anti-Cheat), BattlEye, Ricochet (Call of Duty).

Core Detection Methods

1. Signature Scanning

The oldest, most basic method. The anti-cheat maintains a signature database — unique byte sequences characteristic of known cheats. During scanning, it searches for matches in:

  • Loaded modules and DLLs
  • Game process memory
  • Files on disk
  • Kernel drivers

Bypass: cheat developers obfuscate code (change signatures) with every update. This is why cheats that enter the signature database get Detected status — their unique "fingerprint" is known to the anti-cheat.

2. Memory Monitoring

Anti-cheat tracks which processes and drivers access game memory:

  • API hooks — intercepting functions like ReadProcessMemory, WriteProcessMemory
  • Memory page protection — setting special flags on critical game memory regions
  • Callback notifications — registering notifications for new process creation, thread creation, module loading

3. Integrity Checks

Anti-cheat verifies that game code and resources haven't been modified:

  • Code section hashes — executable section checksums compared against reference values
  • Hook detection — searching for modified functions (jmp/call instructions that shouldn't be there)
  • IAT/EAT checks — import/export tables must not contain substitutions

4. Driver Verification

Kernel-mode anti-cheats control system drivers:

  • Whitelist/blacklist — allowed and forbidden drivers by hash or signature
  • Signature verification — Windows requires signatures for driver loading (Secure Boot + DSE). Cheats bypass this through vulnerable signed drivers (BYOVD) or mapping
  • Mapped driver detection — searching for code in the kernel not registered as a legitimate driver

5. Behavioral Analysis

Modern anti-cheats go beyond scanning — they analyze player behavior:

  • Statistical anomalies — inhuman headshot percentages, perfect tracking through walls
  • Input analysis — mouse movement patterns, reaction speed, keystroke uniformity
  • Server-side checks — the server compares player actions with what they "should see" (enemy visibility, reaction time)
  • Machine Learning — some anti-cheats (Ricochet) use ML models to identify atypical behavior

Behavioral analysis is why even an undetected cheat can lead to a ban if used too aggressively.

Major Anti-Cheats: Details

Easy Anti-Cheat (EAC)

Games: Fortnite, Apex Legends, Rust, EFT Arena, Dead by Daylight, The Finals, Hunt: Showdown

Level: Kernel-mode

Key features:

  • Kernel component loads with game launch
  • Aggressive kernel memory scanning
  • Frequent signature database updates
  • System telemetry collection
  • Game file integrity verification

EAC is one of the most widespread anti-cheats. Its strength lies in update frequency: new signatures are added regularly, making life harder for cheat developers. Detailed EAC guide →

BattlEye

Games: Escape from Tarkov, Rainbow Six Siege, PUBG, DayZ, Arma 3, Unturned

Level: Kernel-mode

Key features:

  • Kernel driver with deep access
  • Active user-mode and kernel-mode scanning
  • Server-side heuristics — behavioral analysis on the server side
  • Vulnerable driver blacklist
  • Wave ban and instant ban systems

BattlEye is known for aggressive client-side work — it deeply inspects the system and uses numerous callbacks for monitoring. Detailed BattlEye guide →

Vanguard

Games: Valorant

Level: Kernel-mode (loads at Windows startup)

Key features:

  • Starts at OS boot — not when the game launches, but when the computer turns on
  • Requires Secure Boot and TPM
  • Blocks vulnerable drivers before game launch
  • Monitors system continuously
  • Instant bans for detected cheats

Vanguard is the most aggressive mainstream anti-cheat. Its early boot loading makes bypassing significantly harder than competitors. Detailed Vanguard guide →

Ricochet

Games: Call of Duty (Warzone, MW, BO6)

Level: Kernel-mode + server-side

Key features:

  • Kernel-level client-side driver
  • Server component with ML — machine learning for behavioral analysis
  • "Punishment" instead of instant bans — can activate Damage Shield, reduce cheater visibility
  • Changes detection methods each season

Ricochet's uniqueness lies in its server-side focus. Even if the client component doesn't detect the cheat, server analysis can identify a cheater by behavior. Detailed Ricochet guide →

VAC (Valve Anti-Cheat)

Games: CS2, Team Fortress 2, Dota 2

Level: User-mode

Key features:

  • Runs entirely in user-mode (Ring 3)
  • Signature scanning of processes and modules
  • Wave bans — collects data silently, bans en masse weeks/months later
  • No kernel-level component

VAC seems softer than competitors, but its "silent collection" strategy is deceptive: a cheat might work for weeks, then a ban wave hits. Supplemented by Overwatch (player replay analysis) and VACNet (ML system for CS2).

What Anti-Cheats Know About Your System

Kernel-mode anti-cheats collect extensive information:

  • HWID — disk, motherboard, network card, GPU, RAM identifiers
  • Process list — all running programs
  • Loaded drivers — complete list with hashes
  • Installed programs — via registry
  • Windows — list of windows and their properties
  • Network connections — active connections

This information is sent to anti-cheat servers for analysis. This is exactly why an HWID spoofer is a critical part of protection.

Evolution: From Signatures to AI

Anti-cheats are getting smarter:

  • 2000s — pure signature scanning, user-mode
  • 2010s — kernel-mode drivers, expanded telemetry
  • 2020s — machine learning, behavioral analysis, server-side checks, early boot loading

The trend is clear: server-side behavioral analysis is becoming more important than client-side scanning. This means even a perfectly masked cheat can be caught through suspicious gameplay. That's why proper in-game behavior is just as important as the cheat's quality.

How This Affects Cheat Selection

  • User-mode anti-cheat (VAC) → even a simple external cheat can remain undetected for a long time
  • Kernel-mode without early boot (EAC, BattlEye) → requires a kernel-level cheat or DMA
  • Kernel-mode with early boot (Vanguard) → hardest case, DMA is the most reliable option
  • Server-side analysis (Ricochet) → technical undetectability isn't enough; legitimate gameplay is necessary

More about cheat types and their interaction with anti-cheats: How Cheats Work.

IVSOFTE Catalog — cheats with current status for every anti-cheat. Browse catalog →