The single most important safety factor in choosing a cheat isn't the features — it's the injection method. Here's the honest breakdown.
Internal Cheat (DLL Injection)
An internal cheat injects a .dll file into the game process. This gives it direct access to game memory, which makes features like bone-based aimbot trivial to write — but it also means:
- The game process now has a foreign module loaded.
- Anti-cheats scan loaded modules. An unsigned or unknown DLL is flagged instantly.
- Any integrity check the game runs will catch a modified memory region.
Verdict: Higher-feature ceiling, but much higher ban risk. Avoid in games with kernel-level anti-cheat (Vanguard, FACEIT).
External Cheat (Memory Reading)
An external cheat runs as a completely separate process and reads game memory via system APIs (ReadProcessMemory on Windows). Nothing is injected. From the game's perspective, nothing has changed.
- No module appears in the game's loaded DLL list.
- No memory is modified — only read.
- Kernel-level scanners see a normal game process.
Verdict: Safer by default. Can't do in-process hooks (no bone aim on some engines), but ESP, radar, and trigger-bot work perfectly.
What Cosmo Cheatz Uses
Every build on this site is external. The loader runs outside the game process, overlays are rendered by a separate window, and no DLL is ever written to disk in a detectable location. Browse all free cheats →
What About Kernel Drivers?
Some paid providers use signed kernel drivers to bypass kernel-level anti-cheat (Vanguard, Ricochet). This is the highest tier — but also the most legally grey and technically demanding. Free cheats rarely include this; if you need it, verify the driver is legitimately signed before running.
How Anti-Cheats Detect Handles Now
Since late 2024, several anti-cheats have stopped relying solely on module lists and started enumerating open process handles. Easy Anti-Cheat and BattlEye both ship drivers that query which processes hold handles to the protected game, and Windows exposes this through ObRegisterCallbacks, which lets a kernel driver strip or log HANDLE rights at open time. An external reader built on OpenProcess with PROCESS_VM_READ is visible to that callback even though it never injects anything. Typical countermeasures involve opening with the minimum rights, closing handles quickly, and randomising read timing, but the fundamental signal remains: a foreign process requesting read access to game memory. Vanguard goes further on Valorant and checks for handle duplication tricks at the driver level. The practical takeaway is that external is lower risk, not zero risk, and a tool that opens a handle every frame is far more exposed than one that reads a narrow region on a timer.
Timing and Telemetry Give You Away
Detection increasingly targets behaviour rather than presence. Servers log input intervals, view angles, and reaction times; a trigger-bot firing within 8ms of an enemy crossing a pixel boundary is statistically impossible for a human, and Rainbow Six Siege's server-side analysis has flagged accounts on that basis alone. The same applies to aim smoothing set too low and to ESP users who pre-aim consistently through walls before an enemy is visible. External tools that poll every frame at 1000Hz produce suspiciously regular memory access patterns that a kernel driver can profile. Lower your polling rate to 30-60Hz, add jitter to sleep calls, and cap trigger-bot delay at 40ms or more. People routinely get banned with a technically clean loader because their statistics looked mechanical, and no amount of handle hygiene fixes that.
Verifying an External Build Is Working
Confirmation that a build is doing its job should come from outside the game. Open Task Manager, find the cheat process, and check its handle count and memory readings before and after attaching; a healthy external reader holds one or two handles to the target, not dozens. Process Explorer from Sysinternals shows the exact handle path and access mask, which tells you whether it is reading or writing. In-game, test on a practice range or offline bot match first: Tarkov's offline mode and CS2's workshop maps are useful because they do not touch a live anti-cheat. Watch for frame-time spikes using the in-game net graph; an external overlay rendering through a separate window should not add more than 1-2ms. If the game closes on launch or the overlay flickers, the tool is likely touching the process in ways a driver dislikes, and that is your warning sign before a live match.