An internal cheat is loaded into the game itself and runs as part of it. An external cheat is a separate program that runs beside the game and draws its own overlay on top. DMA takes external one step further by moving the reading onto extra hardware. The difference shapes which features a cheat can offer, how it affects performance and how anti-cheat sees it. None of them is risk free.
What an internal cheat is
An internal cheat puts its code inside the game's own process. Because it runs as part of the game, it can change how the game behaves, not just read from it. That is how features like silent aim or no-spread work: they alter what the game does with your shot.
The cost is that it lives where anti-cheat looks hardest. Anything loaded into a protected game has to stay hidden from checks that run inside and around that game.
What an external cheat is
An external cheat runs as its own program. It reads the information it needs, such as player positions, and draws it on a transparent overlay above the game: boxes, skeletons, distance, radar. The aimbot moves your aim the way your mouse or controller would, rather than changing the game's own logic.
Nothing is injected into the game, so the footprint is smaller. The trade-off is that it can only use what the game already has and can only act through your input, so game-altering features like silent aim are off the table.
Where DMA fits in
A DMA setup uses a separate card and usually a second computer to read the game's memory, so the cheat does not run on the gaming PC at all. It is external taken further, aimed at getting past anti-cheat on the gaming machine. It also costs more and takes more setup. Anti-cheat teams are responding: Call of Duty's Ricochet added detections aimed at DMA cheats for Modern Warfare 4's launch. Our post on whether you need DMA for CS2 goes into the hardware side.
External vs internal at a glance
| Internal | External | |
|---|---|---|
| Where it runs | Inside the game | Beside the game, as its own program |
| Typical features | Can change game behaviour, such as silent aim | ESP overlay, aimbot through input, radar |
| Footprint | Inside the protected game | Nothing injected into the game |
| Risk | Neither is risk free. Kernel-level anti-cheat watches the whole PC, not just the game. | |
What anti-cheat looks for
Modern anti-cheat such as Ricochet, Easy Anti-Cheat, BattlEye and Vanguard runs with deep access to Windows and checks far more than the game's own files. Being external lowers what a cheat leaves inside the game, but it does not make it invisible. Our post on how anti-cheat splits kernel and user-mode checks explains the layers.
That is why status matters more than any label. A build that was safe last week can need work after a game or anti-cheat update.
How Pandora's Box builds work
Our Call of Duty, Rust, Apex Legends, Fortnite and Marvel Rivals builds are external. You load every product through one loader, SafeLoader, which fetches the latest build each time you launch. When a game patches we push a new build, and if it needs testing first the live status page says so. Unsafe builds are paused rather than sold, and paused days are added back to your plan. How it works covers setup, and the pricing page lists every game. For Call of Duty specifically, see the MW4 external cheat.