How Does Anti-Cheat Detect Cheats? Every Layer Explained

Every anti-cheat answers the same question: is this player running something they should not be? None of them answers it with a single check. They stack several layers, each catching what the others miss.

The layers at a glance

Signatures: looking for known cheats

The oldest method is still one of the most effective. When an anti-cheat team gets hold of a cheat, it records distinctive pieces of it: file hashes, byte patterns in its code, the names of its windows or drivers. From then on, any PC carrying that pattern is flagged.

This is why public cheats die quickly. Thousands of people download the same file, and the anti-cheat only needs one copy to catch them all. Private builds that change their signature are far harder to catch this way. Elocarry builds are polymorphic, so their signature changes on every launch.

Integrity: checking the game itself

The anti-cheat knows what the game’s code and memory should look like. It checks for:

• code in the game’s process that the game did not load
• changes to the game’s functions, such as redirected calls
• unexpected threads and memory regions
• modified game files

These checks target internal cheats, which live inside the game’s process.

System checks: what else is running

Cheats that stay outside the game still have to touch it. Anti-cheats look for programs holding access to the game’s memory, drivers that should not be loaded, debuggers and memory tools, and windows drawn over the game that are not known overlays. Many anti-cheats refuse to start at all if well-known memory editing tools are running.

This layer is where kernel-level anti-cheat matters. Running as a driver gives the anti-cheat a view of the whole system rather than just the game.

Hardware and boot checks

Modern anti-cheats also check how the PC itself is set up:

• Boot security. Whether Secure Boot is on and the PC started normally. Battlefield 6 will not start without it.
• TPM. The TPM can prove how the PC booted. FACEIT and Javelin ask for TPM 2.0, and so does Vanguard on Windows 11.
• Devices. Hardware that could read game memory directly, the basis of DMA cheats, and memory protection settings that block it.
• Hardware identifiers. The serial numbers behind a HWID, which let a game recognise a PC that was banned before.

Server and statistical checks

Some cheating never shows on the PC at all, only in the match. The game server sees everything you do: movement speed, positions, shots and hits. It can flag actions that are impossible, such as moving faster than the game allows, and patterns that are merely improbable, such as reaction times or headshot rates far beyond human players.

Valve has run machine learning over Counter-Strike gameplay for years to spot aimbot patterns, and Counter-Strike 2’s VAC Live can cancel a match when it detects a cheater. This layer is the reason settings like smoothing and reaction delay exist: they keep in-game behaviour inside the human range.

Reports and replays

Finally, other players. Reports feed review systems, and in games with replays a human or an automated system can watch what you did. Tracking players through walls or snapping between heads is easy to see in footage even when no scan found anything. Marvel Rivals and Counter-Strike 2 both lean on this layer.

Why bans come later

A detection and a ban are separate events. Many anti-cheats record detections and act on them later, often in a ban wave where accounts flagged over days or weeks are banned at once. Valve designed VAC bans to be delayed for exactly this reason: an instant ban would tell the cheat’s developer what was caught.

What undetected really means

“Undetected” means no current detection is known. It is a statement about today, not a promise. Anti-cheats update constantly, and the only way a build stays undetected is by changing as quickly as they do and pausing the moment anything looks wrong.

That is how we run our builds. Every one is polymorphic, every one is rebuilt when its game or anti-cheat patches, and every status change is posted live. Check the status page before you load in, and if a build is flagged, wait for the green light. No method is ever guaranteed, and anyone who says otherwise is not being straight with you.