DMA, external or internal cheats: which one are you buying?
How a DMA setup, a single-PC external and a kernel-level internal cheat differ in how they work, the risks they carry and what you need to buy.
Short answer
An internal cheat runs inside the game, has the most features and leaves the largest local footprint. An external runs beside the game as a separate process on the same PC. DMA runs nothing cheat-related on the gaming PC, but it needs a PCIe card, a second PC and a longer setup.
On this page7
What makes the three types different?
All three architectures answer the same question: where is the code that reads the game's memory located? It can be inside the game, beside the game on the same PC, or on another machine entirely. Price, feature set, setup time and what an anti-cheat can see all follow from that one answer.
How the three types compare
No column wins in every row, which is why all three types are still sold.
| Internal | External (1 PC) | DMA (2 PC) | |
|---|---|---|---|
| Where the read happens | Inside the game process | Another process, same PC | PCIe card, streamed to a second PC |
| Local footprint | Largest: injected into the game | Smaller: no injection, still a process on disk | Smallest: nothing cheat-related installed |
| Feature ceiling | Highest — can touch anything the game touches | High for reads, limited for writes | Reads and overlay; writes are rare and risky |
| Hardware cost | None | None | Card, second PC, often an input device and a fuser |
| Setup time | Minutes | Minutes | An evening for a first build |
| Aim assistance | Native | Native or via a HID device | Needs a HID device — never included by default |
| Where ESP appears | On the game screen | On the game screen | Second monitor, or main monitor via a fuser |
| Fails when | Anti-cheat blocks the injection path | Anti-cheat blocks handle or read access | Firmware identity or the USB path is the weak link |
"Smallest footprint" does not mean "no risk": it moves the risk from software on your disk to hardware identity and behaviour.
What DMA does better
DMA has two real advantages. First, nothing has to defeat the anti-cheat's protection of its own process to read memory, because the read happens below the operating system, over PCIe. Second, an anti-cheat that scans the gaming machine's disk, processes and drivers finds a normal machine, because that is what it is. These two properties are why DMA survived several generations of kernel anti-cheat while purely local approaches kept being replaced.
Warning
What DMA does worse
DMA costs more, is more complex and needs more patience. You are buying four things instead of one, possibly from four different sources, and each of them has to match the other three. A single wrong USB cable costs an evening. The failures are hardware failures, so instead of an error dialog you get a device that does not appear. Debugging a missing device is far less pleasant than reading a crash log.
Is DMA the right choice for you?
If you answer no to any of the first three, DMA is the wrong purchase this month.
- I have a free PCIe or M.2 slot with physical clearance in the gaming PC
- I have, or will buy, a second Windows machine with a rear USB 3 port
- I am willing to spend an evening on a first-time setup before it works
- I know whether I need aim assistance, because that decides whether I need an extra device
- I know where I want the overlay: on a second screen, or on my main screen through a fuser
- I have checked the live status board for the game I actually play
Questions about the three types
Can I use a DMA card with one PC?
No. The card reads the machine it is installed in, and something else has to receive that data. The receiving machine cannot be the same machine that is being read.
Is a single-PC external safer than an internal?
Usually somewhat, because it does not inject into the protected process. However, it still runs on the machine the anti-cheat is scanning, which means a smaller footprint rather than no footprint.
Can a DMA setup be detected?
Yes, through three routes: firmware identity on the PCIe bus, the USB descriptor of the input device, and behavioural analysis of your inputs and results. Good firmware and a properly configured input device address the first two, but only how you play addresses the third.
Do I need a fuser?
Only if you want the overlay on your main monitor. A second monitor showing a radar needs no fuser at all, and that is the cheaper and more reliable first build.
Sources
The comparison table comes from the team's own bench and support experience, and its setup times, failure modes and cost lines are not from a published source.
- 01
- 02Kernel-level anti-cheat overview (Wikipedia)
what a kernel anti-cheat is and what it scans on the gaming PC
en.wikipedia.org
- 03GDC talk: Robocalypse Now, deep learning cheat detection
behaviour in a match as a third detection route
gdcvault.com
Read next
Still stuck? Open a ticket on Discord
All guides