Ring 0: why kernel drivers changed everything
x86-64 CPUs have four privilege rings. Windows uses two: Ring 3 (user-mode) and Ring 0 (kernel). Anything in Ring 0 can read every process's memory, every loaded driver, the BIOS, the TPM and hardware IDs. Anything in Ring 3 sees only itself and whatever the kernel lets it see.
Until roughly 2015, most anti-cheats ran in Ring 3. Any injected DLL running at the same privilege level was invisible to them unless the anti-cheat found the signature or the game itself detected the modification. Kernel cheats (loaded via signed driver, capcom.sys exploit, or a manual mapper) simply couldn't be seen by user-mode scanners.
EAC, BattlEye, Ricochet, Vanguard, ACE and FACEIT AC all now ship signed kernel drivers. That means the anti-cheat sits at the same privilege as your cheat's driver — and it can walk every loaded module, check every callback, verify every syscall hook and scan every process's memory. This is why 'free public cheats' die in days: they run at Ring 3 or use a stale kernel loader that every AC recognises within a week.
Detection layer 1: signature scanning
The oldest and cheapest detection. The anti-cheat maintains a database of known cheat binaries — DLLs, drivers, kernel modules — and scans memory for byte patterns that match.
Modern signatures aren't literal file hashes. They're 'YARA-style' patterns that match function prologues, string tables, or the assembly shape of a known cheat's aimbot loop. That means recompiling with a different compiler flag rarely dodges detection — the code shape is what's fingerprinted.
Why signatures still work in 2026: most cheats reuse the same rendering/aim/ESP libraries. When BattlEye reverses one public cheat, it usually catches five paid ones sharing the same helper code. This is the primary reason RageByte builds its aim/ESP/loot modules from scratch per game rather than licensing shared codebases.
Detection layer 2: integrity & hook checks
Anti-cheats hash their own DLLs, the game DLLs, key Windows kernel structures (KiServiceTable, IDT, CR3) and known API bytes. If your cheat hooks CreateFileW to hide files, patches the game's Present() to draw ESP, or hides its driver from PsLoadedModuleList, the hash changes and the AC flags it.
Ricochet in particular is aggressive about this. It re-hashes ntoskrnl exports every few seconds and compares against known-good baselines. That's why hook-based Warzone cheats keep dying while direct-memory-read cheats (DMA) survive longer.
Detection layer 3: behavioural heuristics
The interesting one. Instead of asking 'is this cheat present', the AC asks 'does this player move like a human'. Key signals:
- Cursor snap velocity — human aim curves, aimbots teleport.
- Reaction time distribution — humans cluster around 180-350ms, aimbots below 80ms.
- Prefire consistency — humans miss walls 30% of the time, wallhackers pre-aim through walls with 0-frame reaction.
- Recoil compensation — humans undershoot at the end of a spray, no-recoil scripts don't.
- View-angle jumps — humans overshoot targets ~15% of the time, silent-aim doesn't.
BattlEye and Ricochet run these in real time. FACEIT runs them post-match. This is why 'legit-style' aim (30% humanisation, ~120ms delay, FOV under 4°) survives on kernel anti-cheats where full rage settings get flagged in a single match.
Detection layer 4: server-side ML
Since 2023 every major title feeds raw input/output telemetry into an ML pipeline. Ricochet's system is the most public — it also powers 'Damage Shield' (cheaters' bullets do zero damage without banning them) and 'Cloaking' (cheaters can't see legit players). BattlEye and EAC have quieter versions.
Server-side is why HWID spoofing alone doesn't save you long-term. Even if the driver-side scan misses your cheat, your gameplay signature builds a profile that survives account/hardware changes.
Detection layer 5: ban waves & shadow flags
Most AC teams don't ban on detection — they ban in waves. The AC flags an account, keeps letting the player queue, and correlates behaviour across their friend list, matches and hardware over 2-6 weeks. Then they publish a wave ban and take down thousands of accounts in a single afternoon.
BattlEye is famous for this. That's why cheats can feel 'safe' for a month and then everyone loses their accounts on the same day.
The five anti-cheats in one paragraph each
EAC (Epic Games) — most deployed. Rust, ARC Raiders, Fortnite, ARK. Kernel driver + user-mode service. Newer EAC-EOS variant integrates with Epic Online Services.
BattlEye — R6 Siege, DayZ, PUBG, Arma. Aggressive human reverse engineers, mass ban waves, best-in-class heuristics.
Ricochet (Activision) — Warzone, MW3, BO6, BO7. Kernel driver + heavy server-side ML. Damage Shield / Cloaking.
Vanguard (Riot) — Valorant, League. Loads at Windows boot, mandatory TPM 2.0 + Secure Boot. Most invasive of the five.
ACE (Tencent) — ARC Raiders (paired with EAC-EOS), Naraka, Honor of Kings. Driver named ACE-BASE.sys. Rapidly maturing.
What anti-cheats physically can't see
- A second PC reading your gaming PC's memory over PCIe DMA. The kernel driver is on the target PC; the cheat lives on a separate machine.
- Video-only overlays on a HDMI capture card fed into a separate machine that reads pixels and outputs mouse movement via Arduino/BetterMouse.
- Human aim assist from a friend spectating you on Discord. Not a joke — this is legal and unbanable.
Everything else — internals, externals, kernel drivers, manual mappers — is on a spectrum of 'harder to detect', not 'undetectable'.