How modern anti-cheat systems actually detect modifications
BattlEye, Easy Anti-Cheat, Vanguard and VAC use overlapping techniques — memory scans, kernel drivers, integrity checks. A plain-English tour.
Every conversation about game cheats eventually runs into the question: how does the game know? You have not typed anything into a chat box, you have not clicked anything unusual, and yet ten seconds after you started a match, a message appears telling you your account has been banned. The magic feels vaguely offensive.
There is no magic. Modern anti-cheat is a well-documented engineering discipline, and it is worth understanding — both because it explains why CheatBook restricts itself to single-player entries, and because knowing how detection works helps you avoid stumbling into it by accident.
The four techniques, in order of intrusiveness
Every major anti-cheat product (BattlEye, Easy Anti-Cheat, Riot's Vanguard, Valve Anti-Cheat, Bungie's BattlEye-plus-in-house stack) uses some combination of these:
1. Signature scanning. The simplest technique. The anti-cheat keeps a list of known cheat programs — their file hashes, their memory footprints, their DLL names — and scans your system for anything on the list. Effective against off-the-shelf cheats, useless against anything new or custom.
2. Heuristic detection. Rather than looking for known cheats, look for patterns that only cheats produce. A player whose aim is mechanically perfect across a hundred games. A movement input that arrives faster than a human can physically produce. A memory write pattern that only makes sense if something is overwriting the game's own state. These signals rarely produce instant bans; they feed a "suspect" queue that human reviewers or a second-pass automated system evaluates.
3. Integrity checks. The game hashes chunks of its own executable and memory at intervals and compares them against expected values. If the values differ, something modified the process — a trainer, an injector, a memory editor. This is a cheap check to run and it catches most homebrew cheat tools.
4. Kernel-mode monitoring. The most controversial technique. The anti-cheat runs as a kernel driver, so it has visibility into every process, every file operation, and every memory read/write on your system, not just inside the game. Riot's Vanguard, ESEA's client, and (partially) BattlEye and EAC operate this way. It is much harder for a cheat to hide from a kernel driver than from a user-space process.
Why kernel-level anti-cheat is a fight
The last technique is where public opinion has broken down. Kernel drivers are, on paper, a security nightmare: any bug in the driver is a system-wide privilege escalation. In 2022, a signed driver from a since-deleted game vendor was repurposed by ransomware operators as a "bring your own vulnerable driver" attack, because the driver was already trusted by Windows.
Riot's argument for Vanguard is that competitive cheating in Valorant and League of Legends is a well-funded industry, and that industry uses kernel-level techniques to hide from user-space anti-cheat. To beat them, you need equal privilege. This is technically true. Whether the trade-off is worth it depends on how much you value the specific game.
CheatBook's position is that this is a private choice, but a real one — and it is one of the reasons we do not, and will not, document methods that require kernel-level modification of a running competitive game. Even discussing such techniques materially helps people who are actively harming other players.
Server-side signals
Client-side anti-cheat gets most of the press, but the more consequential detections happen server-side. The game server sees your inputs, your outcomes, and every other player's inputs and outcomes. Correlations that are invisible on the client are obvious to the server.
Common server-side signals:
- Movement inconsistency. Your character claims to be at position X, but the input sequence from the last 200ms could not physically have produced that position.
- Look-behind wallhack detection. You reliably shoot at players before they enter your line of sight — behind walls, around corners. Across enough samples this is statistically unmistakable.
- Reaction times. Human reaction to a novel visual stimulus bottoms out around 150ms. If your reaction times are consistently under that, you are either using an aimbot or you are a heavily-instrumented professional whose data the game already has.
These signals are why account bans for high-end cheating rarely arrive in the first match. The server needs time to collect statistically significant samples. What arrives instantly are the flat, dumb detections: a known cheat DLL in your process list, a modified executable, a memory pattern from a published trainer.
What this means for legitimate CheatBook use
Every entry we publish is intended for single-player, offline, or private-lobby use. But the anti-cheat landscape overlaps with our world in three specific ways:
Shared executables. Many games share a single executable between single-player, offline, and online modes. Using a cheat in offline mode does not delete the executable — it modifies it in memory. If you then launch the online mode without restarting the game or verifying files, the anti-cheat can detect the residue.
Shared save data. Some games (Bethesda titles are notable) will refuse to upload a save to cloud storage if the save has been flagged as modified. The flag persists even after the cheat is turned off. If you plan to use cloud saves for backup, do not use save-editing cheats mid-playthrough on those titles.
Shared hardware. A trainer running in the background at match start will get detected even if you did not launch it for that game. Close every cheat tool before starting anything online. The safest habit is to reboot between offline and online sessions.
The honest summary
Anti-cheat is a two-decade arms race that both sides are throwing serious money at. On the anti-cheat side, the trajectory has been from user-space DLL scanning to full kernel-level system monitoring. On the cheat side, the trajectory has been from user-space injectors to hardware-level DMA attacks that read game memory from a second machine.
Nothing about this arms race is relevant to CheatBook's core mission of documenting developer-sanctioned single-player cheats. But knowing the shape of it explains why we keep the two worlds strictly separated, and why every entry on the site carries the same offline-only warning.