Internal vs External Cheats: What the Difference Means

“Internal” and “external” come up on almost every cheat page and in almost every argument about detection. The terms describe where the cheat runs. That one difference shapes what it can do, how fast it is and what an anti-cheat has to look for.

The short version

What an internal cheat is

An internal cheat is loaded into the game’s process and runs as part of it. Once inside, the game’s memory is its own memory. It can read player positions as easily as the game does and call the game’s own functions: the ones that work out what is visible, where a bone is or which way a shot goes.

That access is why internal builds can offer features that change how the game behaves rather than only reading it. Silent aim changes a shot as it is fired. Magic bullet changes where it lands. Coloured player models, the old wallhack method, change how the game draws. All of these are much easier from inside.

The cost is that the cheat lives where the anti-cheat looks hardest. Every anti-cheat inspects its own game’s process: the code loaded into it, its memory and any changes to the game’s functions. An internal build has to stay hidden in exactly that place, which is a large part of the engineering work behind one.

What an external cheat is

An external cheat is a separate program. It never runs inside the game. It reads the game’s memory from outside, through the operating system or through a driver of its own, and then acts on what it finds.

Because it cannot call the game’s functions, an external cheat works with raw data. It reads positions, does its own maths to project them onto the screen, and draws the result on an overlay window above the game. To aim, it moves your mouse the way your hand would.

That makes some things simpler. Nothing inside the game changes, so a patch that rewrites how the game renders does not break the drawing. The cost is speed, because every read crosses from one program to another, and features that need the game’s own machinery are hard or impossible from outside.

DMA: external, one step further

A DMA setup takes the external idea as far as it goes. The cheat runs on a second computer and reads the gaming PC’s memory through a hardware card plugged into it. Nothing from the cheat runs on the gaming PC at all. It costs a second PC and the hardware, and it brings its own detection questions, which the DMA page covers.

Which is harder to detect?

This is the question everyone asks, and the honest answer is that it depends on the build, not the category.

Kernel-level anti-cheats such as Easy Anti-Cheat and BattlEye run with the same level of access as the drivers on your PC. From there they can inspect the game’s process for internal cheats and also look across the system for external ones: programs holding access to the game, drivers that should not be there and windows drawn over the game. Neither type is invisible by default.

What decides the risk in practice:

• How well the build hides. Whether its code and behaviour look like anything the anti-cheat already knows.
• How fresh it is. Builds that change their signature and are rebuilt when the game patches last far longer than public ones.
• How it is used. Behaviour in a match is judged separately from the software, whatever type it is.

Our guide to how anti-cheat detects cheats goes through each of those layers.

Why the choice is made per game

Every game and anti-cheat combination is different, so there is no single right answer. The EA FC 27 page puts it plainly: whether that build runs internal or external is decided by what holds up better against Javelin, and confirmed at launch.

The same reasoning applies to every title we support. Each game’s FAQ tab states its build type where it is confirmed. The Rust build, for example, is internal and software only, and runs on the same Windows PC as the game with no second computer and no DMA card.

Common misconceptions

“External cheats cannot be detected because they never touch the game.” They have to read the game’s memory to do anything, and that access is visible to an anti-cheat with kernel access.

“Internal cheats are always detected faster.” A well-hidden internal build can outlast a careless external one by a long way. Quality matters more than category.

“External means no features.” External builds can run full ESP, radar and aimbot. What they give up is the handful of features that need the game’s own functions.