External Cheats, Overlays and Injected Code: What AACGUARD Looks For

Cheats come in a few main families, and each one leaves different traces. Knowing them helps players understand their scan and helps admins read findings.

Internal cheats: code inside the game

An internal cheat is loaded into the game process, usually by a loader or injector. AACGUARD checks the modules loaded in the game, including manually mapped code that tries to hide from normal module lists. It also searches the game's memory for byte patterns and names of known cheats, so internal cheats are found even when they are renamed.

External cheats: reading memory from outside

An external cheat runs as a separate program and reads (or writes) the game's memory to find player positions. AACGUARD looks for other programs that have the game's memory open for reading or writing, which is how these cheats work.

Overlays: drawing over the game

ESP cheats often draw boxes and names in an invisible window over the game. AACGUARD checks for windows drawn over the game. Legitimate overlays such as Discord, Steam or recording tools are recognised and not counted.

Proxy DLLs and plugins

Some cheats replace or add DLL files in the game folder, or load as .asi plugins, so the game loads them itself. AACGUARD checks the CS 1.6, CS:GO and CS2 folders for these files.

OpenGL wallhacks (CS 1.6)

Classic CS 1.6 wallhacks hook the game's OpenGL drawing functions to draw players through walls. AACGUARD checks whether those functions are hooked, whatever the cheat is called.

Loaders and traces

Even when the cheat is closed, the loader that started it often leaves traces in Windows' execution records, Downloads, the Desktop or the Recycle Bin. See What Windows remembers.

Fair results

Every one of these checks feeds the same scoring: findings are weighed, legitimate software is recognised, and a single weak sign never produces CHEAT DETECTED. See Reading a scan result.