The two rings you actually care about
Windows runs code in either Ring 3 (user-mode) or Ring 0 (kernel). A user-mode program can only see its own memory and whatever the kernel exposes via APIs. A kernel-mode driver can see everything — physical memory, every process, every driver, hardware registers.
Anti-cheats care about who's watching who. If the AC is in Ring 0 and the cheat is in Ring 3, the AC has a strict privilege advantage. If both are in Ring 0, it's a fair fight and detection becomes about who's better at hiding.
User-mode cheats — the old world
Injected DLL, EXE overlay, or an external process reading game memory via ReadProcessMemory. Works fine when the AC is also user-mode (Punkbuster, VAC, older EAC).
Since ~2018 every major AC is kernel. That means: - Injected DLLs get flagged by kernel enumeration of loaded modules. - ReadProcessMemory calls to the game process are logged by kernel callbacks. - Even manual mapping (loading a DLL without CreateRemoteThread) is caught by page-table scans.
User-mode cheats still exist for casual, unprotected games. For any kernel-AC title, they're dead within days.
Kernel-mode cheats — the current standard
A cheat loaded as a Windows kernel driver, either via: - Signed driver — legit EV cert (very expensive, revoked fast). - Vulnerable driver loader — abuse a known-buggy signed driver (capcom.sys, gdrv.sys, RTCore) to map an unsigned driver. Microsoft's vulnerable driver blocklist kills these constantly. - BYOVD ('bring your own vulnerable driver') — the modern default. Rotate to a new vulnerable driver every month or two as blocklist updates catch up.
Once loaded, the driver can read game memory without ReadProcessMemory, hide itself from PsLoadedModuleList, and hook syscalls. The AC still has some advantages (it loaded first, at boot, with the kernel's blessing), but detection becomes a real cat-and-mouse instead of a one-shot kill.
Internal vs external cheats
Orthogonal to kernel/user-mode:
- Internal — cheat code runs inside the game process. Fast, direct memory access, easy hooks for Present() / DirectInput. Detected easily by module enumeration if user-mode.
- External — cheat runs in a separate process, reads game memory over an IPC or driver channel. Slower, needs its own overlay window. Harder to detect if the read channel is kernel or hardware (DMA).
Most 2026 kernel cheats are 'external kernel': a kernel driver on the same PC exposes a read/write API to a user-mode UI process. Best of both worlds — no injection into the game, no direct ReadProcessMemory.
DMA — the third option
A PCIe DMA card in a second PC reads the target PC's memory directly, bypassing the CPU and the OS entirely. There is no cheat process on the gaming PC to detect. See the dedicated DMA guide for the setup.
DMA is what 'undetectable' actually means in 2026. The tradeoff: hardware cost ($400-1500 for the card + KVM + capture setup), latency, and mouse input has to be injected via Arduino or an external mouse-injection tool. Overkill for casual, standard for pro-tier rage.
Which type should you actually use
- Rust, ARC Raiders, Apex, R6 (EAC / BattlEye) — kernel external cheat is the standard. Internal user-mode dies fast. DMA is optional for the paranoid.
- Warzone / BO7 (Ricochet) — kernel external minimum. DMA is genuinely popular here because Ricochet is aggressive.
- Valorant / LoL (Vanguard) — Vanguard loads at boot with TPM+SecureBoot enforcement. Kernel cheats need a boot-time loader themselves. DMA + Arduino is what actually works.
- CS2 with FACEIT AC — assume any user-mode cheat dies in a week. Kernel + heavy signature rotation.
RageByte ships kernel external cheats across all our supported games. The loader is rebuilt weekly against fresh vulnerable-driver rotations.