Glossary of Terms

Aim Key — a designated key that activates aimbot when held down. Without pressing Aim Key, aimbot doesn't work, allowing control over when it's used. Usually bound to mouse side buttons or right-click (ADS). Using Aim Key reduces suspicion since aimbot isn't active constantly.

Aim Lock — an aggressive aimbot mode where the crosshair instantly locks onto a target and stays fixed on it. Unlike Smooth Aim, Aim Lock doesn't simulate gradual aiming — the crosshair 'sticks' to the enemy. Easily recognized by observers and anti-cheat due to unnatural crosshair behavior. Sometimes called 'rage aimbot'.

A program or feature that automatically aims at enemies. Aimbot can operate in different modes: full auto-aim, aim on key hold (Aim Key), smooth aiming (Smooth Aim), bone targeting (Head, Chest). Using overly aggressive aimbot significantly increases the risk of detection and ban.

Anti-Aim — a feature that distorts player model position information sent to the server. The character's head 'jitters' or faces the wrong direction, causing the opponent's aimbot to miss. Effective only in HvH mode. Uses desynchronization (desync) between client and server models.

Anti-Cheat — software designed to detect and prevent cheat usage. Operates at kernel level or user-space level. Popular anti-cheats: EAC (Easy Anti-Cheat), BattlEye, Vanguard (Riot), FACEIT. Kernel-level anti-cheats have maximum system access and are the most difficult to bypass.

Arduino in cheat context — a microcontroller used as an alternative to KmBox for emulating mouse and keyboard input. Arduino (Leonardo, Pro Micro) or other HID devices connect as regular peripherals and relay commands from the DMA cheat. Cheaper than KmBox (~$5–20) but requires manual firmware setup and has input speed limitations.

Auto Accept — a feature that automatically accepts a found match in games with matchmaking (CS2, Valorant, Dota 2). When the game finds a match and the 'Accept' button appears, the cheat clicks it instantly. Useful when the player is away during search. Belongs to the misc (utility) feature category.

Backtrack — a feature that allows shooting at previous enemy positions (where they were several ticks ago). Uses lag compensation mechanics — the server accepts hits at positions valid within the allowed latency window. Effective against high-ping opponents. Configurable in milliseconds or ticks.

Ban Wave — a mass ban of accounts using a specific cheat. The anti-cheat accumulates data on suspicious accounts and bans them simultaneously rather than individually. This makes it harder for cheat developers to determine the exact moment of detection. Ban waves can affect thousands of accounts in a single operation.

BattlEye — a kernel-level anti-cheat used in PUBG, DayZ, Rainbow Six Siege, Arma 3, Escape from Tarkov (alongside EAC), and other games. Operates as a kernel driver, scans running processes, checks modules in memory, tracks suspicious behavior patterns. Known for aggressive system scanning.

Bhop (Bunny Hop) — jump automation for speed accumulation. A script or cheat feature presses jump at the perfect ground-touch moment, allowing the character to gain speed above normal. In CS2, used together with strafing for fast map traversal. Server plugins often limit maximum speed to counter Bhop.

Bone Aim — an aimbot setting that determines the body part the crosshair targets. The player model skeleton consists of 'bones': head, neck, chest, stomach, limbs. Headshot targeting deals maximum damage but raises suspicion with high headshot percentage. Chest/Body targeting is less noticeable.

Box ESP — a type of ESP where a rectangular frame (box) is drawn around each enemy model. 2D box is a flat rectangle on screen, 3D box is a volumetric cuboid that rotates with the model. Box helps quickly determine distance to the enemy (smaller box = further target) and their stance.

Bypass — any technique that circumvents anti-cheat protection. Includes: bypassing file integrity checks, masking processes and modules, intercepting syscalls, spoofing memory scan results, bypassing driver signature verification. Bypass is an ongoing 'arms race' between cheat and anti-cheat developers. Each anti-cheat update can break the current bypass.

Chams (from 'chameleon') — a feature that replaces player model textures with bright solid colors. Usually enemies are colored red, teammates — green/blue. Models are visible through walls and objects. Chams make it easier to recognize enemies in complex lighting conditions and on cluttered maps.

Closet Cheat — a style of cheat usage where the player carefully hides its application. Settings are minimally aggressive: low aimbot FOV, high Smooth, ESP only for information without shooting through walls. The goal is to gain a slight advantage while maintaining the appearance of fair play. Closet cheaters play on main accounts and avoid suspicious actions.

Config (CFG) — a file with saved cheat settings: aimbot parameters (FOV, Smooth, Bone), visual settings (ESP, Chams, colors), activation keys, and other options. Configs can be exported, imported, and shared. Experienced users share tested configs for different game modes (Legit, Rage, HvH).

Custom Crosshair — a feature that replaces the standard game crosshair with a custom overlay. Allows using a dot, circle, cross, or other crosshair shapes regardless of game settings. Especially useful in games without a built-in crosshair (hip fire) or with inconvenient default crosshairs.

Desync (desynchronization) — a discrepancy between client and server player models. Used in Anti-Aim: the client shows opponents one body position while the server hitbox is in a different location. Maximum desync angle is limited by the game engine. In CS2, server and client models can diverge up to 58 degrees.

Detected — a cheat status meaning the anti-cheat can identify it. Using a detected cheat leads to immediate or delayed ban (during a ban wave). After detection, the cheat developer must update the bypass, change signatures, and release a new version. Until the update, using the cheat is extremely risky. Detected status can be temporary — after an update, the cheat becomes UD again.

DMA (Direct Memory Access) — a method of reading game PC memory using a special board (PCIe card) connected to a second computer. The cheat runs on the second PC and reads data from the first PC's memory without launching any software on the gaming computer. This makes anti-cheat detection virtually impossible. Requirements: DMA board (~$90–600), second PC, firmware for masking, KmBox (for aimbot).

Kernel Driver — a driver operating at the OS kernel level (Ring 0). In cheat context, used to bypass kernel-level anti-cheats: the cheat driver loads into the kernel and gets the same privileges as the anti-cheat. Allows hiding processes, intercepting system calls, masking memory reads. Requires signing or an exploit to load.

EAC (Easy Anti-Cheat) — one of the most widely used kernel-level anti-cheats by Epic Games. Used in Fortnite, Apex Legends, Rust, Escape from Tarkov, Dead by Daylight, and hundreds of other games. Scans memory, verifies game file integrity, monitors system calls. Periodically updates signatures to detect new cheats.

ESP (Extra Sensory Perception) — a feature that displays hidden information about enemies: health, distance, name, weapon, armor. Information is drawn over the game as text, boxes, or lines. ESP allows seeing enemies through walls and objects without modifying map geometry.

External cheat — a cheat running as a separate process without injection into the game. Reads/writes game memory through system APIs (ReadProcessMemory / WriteProcessMemory). Less functional than internal (cannot render through game engine), but safer — doesn't modify the process directly. Visualization goes through overlay.

FACEIT Anti-Cheat — a kernel-level anti-cheat for the FACEIT platform, used in CS2, Valorant, and other games on FACEIT. Required installation for anti-cheat queue play. Scans processes, drivers, verifies game integrity, and controls overlays. Known for strict ban system and separate trust factor rating system.

Fakelag — a feature that artificially delays sending network packets to the server. The player model on opponents' screens 'teleports', making aiming difficult. Packets are accumulated and sent in bursts, creating choppy movement. Used in HvH to dodge opponent's aimbot.

Firmware in DMA context — software loaded onto a DMA board (FPGA). The firmware disguises the board as a regular PCIe device (network card, sound card) so the anti-cheat cannot detect it as a DMA device. Quality firmware is a key safety factor for DMA cheats. Requires regular updates.

FOV (Field of View) in aimbot context — the radius of the area around the crosshair where the aimbot starts aiming at a target. The smaller the FOV, the less noticeable the aimbot (only works when crosshair is already near the enemy). Large FOV aims across half the screen and is easily noticed by observers.

FPGA (Field-Programmable Gate Array) — a programmable logic chip that forms the core of DMA boards. Unlike regular processors, FPGA can be reprogrammed by loading different firmware. This allows the DMA board to emulate any PCIe device. Popular chips: Xilinx Artix-7 (Squirrel/35T), Kintex (75T). The more powerful the FPGA, the faster memory reading.

Glow — an effect that highlights player models with colored glow visible through walls. Implemented through the game engine's built-in glow system (glow outline), making detection harder than regular Chams. Often used in Source engine games (CS2, Apex Legends). Glow color is customizable: red for enemies, green for teammates.

Hitbox — an invisible geometric area that defines the hit zone on a player model. Each body part has its own hitbox (head, body, arms, legs) with different damage multipliers. Aimbot targets hitboxes, not the visual model. Hitbox sizes may not match the visible model, affecting hit accuracy.

HvH (Hack vs Hack) — a game mode where all participants use cheats in rage settings. The goal is not to hide the cheat but to determine whose cheat is more powerful. Popular in CS2 on dedicated servers. The winner has the faster aimbot, better anti-aim dodging hitboxes, and more accurate resolving of the opponent's real head angle.

HWID Ban (Hardware ID Ban) — a ban based on computer hardware identifiers. The anti-cheat reads unique hardware IDs (disk serial numbers, MAC address, motherboard ID) and blocks them. After an HWID ban, a new account on the same PC will be automatically banned. Bypass — using a spoofer.

Injection — the general process of embedding external code into the target process's (game's) address space. Multiple methods exist: DLL injection via CreateRemoteThread, manual mapping, reflective loading, thread hijacking, APC injection. Method choice depends on which checks the anti-cheat performs. Injection is a fundamental step for any internal cheat.

Injector — a program for loading cheat code into the game process. The injector embeds the cheat's DLL library into the game's memory, after which the cheat gains access to internal data and functions. Modern injectors use anti-cheat bypass techniques (manual mapping, syscalls).

Internal cheat — a cheat injected directly into the game process via DLL injection. Gets full access to game memory and functions, can call engine internal functions directly. Provides maximum functionality (rendering through game's DirectX/Vulkan, access to all data), but more vulnerable to anti-cheat detection.

Inventory Changer — an extended version of Skinchanger that allows fully changing inventory contents on the client side. Besides weapon skins, includes medals, coins, stickers, agents, and other items. All changes are visible only to the user. Has advanced settings: wear (float), pattern, StatTrak counter.

Kernel-level — the level at which a program operates in the OS kernel (Ring 0), where code has maximum privileges. Kernel-level anti-cheats (EAC, BattlEye, Vanguard) operate at this level, monitoring all system processes. Kernel-level cheats also operate here, making detection and removal extremely difficult for both sides.

KmBox — a hardware device for emulating keyboard and mouse input. In DMA cheats, it's used to implement aimbot: the second PC (with DMA radar) sends commands to KmBox, which controls the gaming PC's mouse as a real device. Anti-cheat cannot distinguish KmBox input from real input.

Legit Mode — a cheat operation mode with settings that imitate regular player behavior: small FOV, high Smooth, disabled or subtle ESP. The goal is to gain advantage without attracting attention from observers and statistical analysis systems. Used on main accounts to minimize ban risk.

Loader — a cheat launcher program. Verifies the license (activation key), downloads the current cheat version from the server, prepares the system (disabling conflicting processes, checking Windows updates), and initiates the injection process. Most commercial cheats are distributed through their own loaders.

Loot ESP — a type of ESP that displays items, loot, containers, and valuable objects on the map. Especially useful in looter games (Escape from Tarkov, DayZ) and Battle Royale (PUBG, Apex Legends). Allows seeing container contents, key item locations, and valuable gear through walls.

Macro — a programmed sequence of mouse or keyboard actions that automatically compensates weapon recoil (No Recoil / Anti-Recoil). The macro simulates downward mouse movements during firing, minimizing bullet spread. Can be hardware-based (on mouse) or software-based.

Manual Mapping — an advanced technique for loading a DLL into a process without using standard Windows APIs (LoadLibrary). The injector manually allocates memory, copies DLL sections, resolves imports, and calls the entry point. The module doesn't appear in the process's loaded DLL list, significantly complicating anti-cheat detection. One of the primary bypass techniques in modern cheats.

Night Mode — a feature that changes the brightness and color palette of the game world. Can make the map darker (night effect) or brighter for better visibility in dark areas. Modifies lighting parameters in game memory or through shaders. Doesn't provide direct gameplay advantage but improves comfort and can enhance enemy visibility.

No Flash — a feature that removes or reduces the blinding effect of flashbang grenades. The player sees the screen normally while others are fully blinded. Implemented by modifying the flash overlay alpha channel in game memory. Often included with other 'misc' cheat features.

No Smoke — a feature that makes smoke grenades fully or partially transparent. Allows seeing and shooting through smoke while opponents see nothing. Server-side anti-cheats can track kills through smoke as suspicious patterns, so overuse increases ban risk.

Noclip — a feature that disables character collision with map objects, allowing free movement through walls, floors, and ceilings. Rarely works in online games due to server-side position validation. More commonly used in single-player games and map development.

Overlay — a method of displaying cheat information on top of the game without injecting into its process. A separate transparent window is created that draws ESP, radar, and other visual elements. External overlay is considered safer than internal (inject), as it doesn't modify game memory.

Passthrough in DMA context — a technique for forwarding a device (usually GPU) through a virtual machine to the guest OS. GPU Passthrough allows running the game in a VM with direct GPU access while the DMA cheat runs on the host system. Can also refer to PCIe passthrough where the DMA board 'transparently' passes data between systems. Requires IOMMU support (VT-d / AMD-Vi).

Paste — a cheat assembled from copied (pasted) code without deep understanding of how it works. A paste developer takes open-source code or a leaked private cheat, minimally modifies it, and sells/distributes it as their own. Pastes are usually low quality, quickly detected by anti-cheat (since signatures are already known), and may contain bugs or malware.

PCIe (Peripheral Component Interconnect Express) — a high-speed bus for connecting devices to the motherboard (graphics cards, SSDs, network cards). DMA boards use the PCIe slot for direct memory reading without CPU involvement. PCIe versions (3.0, 4.0, 5.0) differ in bandwidth, affecting DMA board data reading speed.

Prediction — an algorithm that predicts a moving enemy's position. Takes into account speed, movement direction, and network latency (ping) to aim not at the current but the future target position. Critically important for games with bullet ballistics (Apex Legends, PUBG) where projectiles have travel time.

Private Cheat — a cheat with a limited number of users, sold by invitation or through closed access. A small user base reduces detection probability: fewer cheat copies in the wild make it harder for anti-cheat to collect signatures. Private cheats are usually more expensive than public ones ($50–300/mo) but significantly safer and stay undetected longer.

Public Cheat — a cheat available to a wide audience without user limits. Sold on open platforms or distributed for free. Due to the large number of users, quickly ends up in anti-cheat databases and gets detected. Public cheat lifespan in undetected status is usually shorter than private. Free public cheats often contain malware.

Radar — a feature that displays all player positions on a mini-map or separate overlay. Can be shown on the main monitor or a second screen. DMA radar runs on a separate PC and is considered the safest option, as it doesn't interact with the game process directly.

Radar Hack — a feature that adds all enemy positions to the standard game mini-map. Unlike a separate overlay radar, Radar Hack modifies the built-in mini-map, looking less suspicious on recordings. In CS2, works by modifying the 'spotted' flag for enemy players in client memory.

Rage Mode — a cheat operation mode with maximum aggressive settings: instant aimbot, maximum FOV, no smoothing, rapid fire. Used when the player doesn't care about stealth — on 'disposable' accounts or in HvH (Hack vs Hack) mode. The opposite of Legit Mode, where settings minimize suspicion.

RCS (Recoil Control System) — an automatic weapon recoil compensation system. Unlike a simple macro, RCS works by reading game memory and knows the exact recoil pattern of each weapon in real time. This allows compensating recoil with perfect accuracy, accounting for the number of bullets fired and weapon type.

Resolver — an algorithm that determines the real position of an opponent's hitbox when they use Anti-Aim. Analyzes server data, movement history, and desynchronization patterns to calculate where the enemy's head is actually 'looking'. Resolver quality is one of the key factors in HvH battles.

Ricochet — a kernel-level anti-cheat by Activision, used in Call of Duty: Warzone and Modern Warfare. Operates as a kernel driver and includes a server-side detection system. Unique feature — 'mitigation system': instead of instant bans, can apply real-time penalties (invisible players, damage disabling, teleportation). Combines a client kernel driver with server-side machine learning analysis.

Ring-0 — the highest privilege level in x86 processor architecture. Code running in Ring-0 has full access to all hardware and system memory. The Windows kernel, device drivers, kernel-level anti-cheats, and kernel-level cheats operate at this level. Loading code into Ring-0 requires a signed driver or a vulnerability exploit.

Signature Scan — a cheat detection method where the anti-cheat searches memory for unique byte sequences (signatures) characteristic of known cheats. Similar to how antivirus searches for virus signatures. Cheat developers counteract this through code obfuscation, polymorphism, and encryption. The term is also used by cheat developers to find needed functions in game memory by byte patterns.

Silent Aim — a type of aimbot where bullets hit the target without visible crosshair movement. Visually the crosshair points in one direction, but bullets hit the enemy. Works by modifying shooting packets sent to the server. One of the most suspicious types of aimbot.

Skinchanger — a feature that allows visually changing weapon, knife, and glove skins on the client side. Other players don't see the changed skins — they're displayed only for the user. Doesn't affect gameplay, but allows 'trying on' rare skins without purchasing them.

Smooth Aim — an aimbot setting that determines the speed of aiming at a target. With a high Smooth value, the crosshair moves to the enemy gradually, simulating human hand movement. Low Smooth means instant lock-on, easily detectable by both anti-cheat and observers. Proper Smooth tuning is a key factor for aimbot legitimacy.

Snaplines — lines drawn from your character (or screen center) to each enemy's position. Help quickly determine the direction to enemies and estimate distance. Usually drawn from the bottom of the screen to the feet or center of the enemy model.

Speedhack — a feature that increases character movement speed beyond normal game speed. Can work through game timer modification or direct movement speed alteration. Easily detected by server-side anti-cheats, so rarely used in online games.

Spoofer — a program that changes hardware identifiers (HWID) of a computer: hard drive serial numbers, network card MAC addresses, motherboard IDs, and other unique data. Used to bypass hardware bans (HWID ban). After a ban, it allows creating a new account and continuing to play without buying new hardware.

Streamer Mode — a cheat operation mode that hides visual elements from screen capture software (OBS, Streamlabs, Discord). Allows using the cheat while streaming — viewers don't see ESP, boxes, and other overlays, but the streamer sees them on their monitor. Implemented via rendering in a separate layer invisible to Screen Capture API.

Target Priority — an aimbot setting that determines target selection order when multiple enemies are within FOV. Priority options: closest to crosshair (by angle), closest by distance, lowest HP, threatening (shooting at you). Proper priority selection improves combat effectiveness.

Third Person — a feature that switches the camera from first-person to third-person view. Allows seeing your character and a wider viewing angle. In first-person shooters, it provides an advantage — you can peek around corners without exposing yourself. Usually only works client-side, the server position doesn't change.

Tick Rate — the frequency at which a game server updates, measured in hertz (ticks per second). A 64-tick server updates the world state 64 times per second, 128-tick — twice as often. Higher tick rate provides more accurate hit registration. Affects Backtrack functionality and aimbot precision. CS2 uses a sub-tick system.

Trace Cleaner — a utility for removing traces of cheat usage from the system: Windows registry entries, temporary files, logs, driver remnants. Used before launching a new cheat version or after a ban to prepare the system for a clean start. Doesn't replace a spoofer — cleans only software, not hardware traces.

Triggerbot — a feature that automatically fires when the crosshair is over an enemy. Unlike aimbot, triggerbot doesn't aim — it only presses the fire button. Considered less suspicious than aimbot, as mouse movement remains natural.

Undetected (UD) — a cheat status meaning it is not detected by the current anti-cheat version. The status is not permanent and can change after an anti-cheat update. 'UD' doesn't guarantee complete safety — bans are possible through suspicious statistics, player reports, or manual review. Detected status means the cheat is found and usage will result in a ban.

Updating — a cheat status meaning it is temporarily unavailable due to an update. Reasons: game update changed memory structure (offsets), anti-cheat update broke the bypass, or the developer is releasing new features. During updating, using the previous version may cause crashes or bans. Update duration ranges from several hours to several days.

Usermode (Ring-3) — the level at which a program operates in the OS user space. Usermode cheats work as regular applications without kernel privileges. Use Windows API (ReadProcessMemory, WriteProcessMemory) for game memory operations. Easier to develop but more easily detected by kernel-level anti-cheats that monitor all Ring-3 calls.

Vanguard — a kernel-level anti-cheat by Riot Games, used in Valorant and League of Legends. Starts at Windows boot and runs continuously, even when the game is off. Controls drivers, processes, and kernel modules. One of the strictest anti-cheats: blocks vulnerable drivers, prohibits virtual machines, monitors system integrity. Bypassing Vanguard requires kernel-level solutions.

Visibility Check — an aimbot or ESP function that verifies whether an enemy is visible (not blocked by a wall or object). Aimbot with Visibility Check enabled only aims at visible enemies, reducing suspicion. Without this check, aimbot may aim through walls, instantly revealing cheat usage.

Wallhack — a feature that allows seeing players and objects through walls and other obstacles. Unlike ESP, Wallhack can modify texture rendering, making walls semi-transparent. Often used together with Chams to highlight player models behind walls.

Watermark — a cheat's informational overlay, usually in a screen corner, showing cheat name, FPS, ping, tick rate, and time. Serves as a cheat operation indicator and may contain developer advertising. In some cheats, watermark can be disabled or displayed information can be customized.