External vs Internal
Game cheats broadly fall into two categories: external and internal. The distinction matters because it determines how visible the tool is to anti-cheat software and how likely it is to trigger a ban.
An internal cheat injects code directly into the game process. It loads a DLL into the game's address space, hooks rendering functions to draw overlays, and patches game memory to modify behavior. This gives it deep access but also leaves a large footprint — modified modules, injected threads, and altered memory pages that anti-cheat can detect.
An external cheat runs as a separate process entirely. It reads game memory through operating system APIs without ever placing code inside the game. The overlay renders in its own window. No DLLs are injected, no functions are hooked, and no game files are modified.
Why External Is Safer
Anti-cheat systems focus their detection on what's happening inside the game process. They scan loaded modules for known signatures, check code integrity against expected hashes, and look for injected threads or hooked functions. An external tool sidesteps all of this.
Memory reads through the Windows API are a normal operating system operation. Debuggers, accessibility tools, performance monitors, and streaming software all read process memory. There is no reliable way for anti-cheat to distinguish a cheat's memory read from a legitimate one based on the read alone — the API call is identical.
External cheats also avoid modifying game files on disk. Anti-cheat often checksums game binaries and assets at launch. Since an external tool never touches those files, those integrity checks pass cleanly.
How Anti-Cheat Works
Modern anti-cheat in competitive games typically operates on several layers:
- Signature scanning — checking loaded modules against a database of known cheat binaries. This catches internal cheats whose DLLs match a known hash or byte pattern.
- Integrity checks — verifying that game code and data in memory haven't been tampered with. Hooks, patches, and injected code all fail these checks.
- Behavioral analysis — statistical analysis of player actions, particularly aim patterns. Inhuman reaction times, perfect tracking, or impossibly consistent headshot rates can flag an account for review.
- Driver-level monitoring — kernel drivers that watch for suspicious process interactions, handle creation patterns, and known cheat driver signatures.
Each layer targets a different attack surface. Internal cheats are vulnerable to the first two. External cheats must primarily contend with the last two.
How Heretical Stays Ahead
Being external is necessary but not sufficient. A poorly written external tool can still be detected through behavioral patterns or predictable memory access. Heretical addresses each remaining detection surface:
- Automatic offset scanning — when Deadlock updates, memory layouts change. Rather than waiting for a manual patch, Heretical scans for current offsets on launch using byte-pattern signatures. This means the tool adapts to game updates within minutes.
- Humanized aim — the aimbot includes micro-tremor simulation, variable reaction delays, overshoot dynamics, and Kalman prediction. Aim patterns are statistically modeled to fall within normal human distributions, passing behavioral analysis.
- Separate overlay — ESP renders in its own window that never interacts with the game process. No drawing hooks, no shared surfaces, no detectable overlay attachment.
- Zero injection footprint — no DLLs loaded into the game, no remote threads created, no handles held longer than necessary. The process interaction looks identical to any system utility.
What To Avoid
Not all cheats are built with the same care. Some common red flags:
- Free cheats with no source — often bundled with malware, and rarely updated when detection vectors change. The cost of a ban is higher than any subscription.
- Internal-only tools — anything that requires DLL injection is inherently more detectable. If a tool asks you to inject a DLL, it's operating inside the game process.
- Tools that require disabling anti-cheat — this is a red flag that the tool cannot coexist with anti-cheat, and disabling protections often gets flagged independently.
- Stale tools — a cheat that hasn't been updated in weeks after a game patch is likely using outdated offsets at best, or is abandoned at worst. Active maintenance is a baseline requirement.
The safest approach is a well-maintained external tool with humanized behavior, automatic updates, and a track record of staying undetected through game patches.