In Battlefield 6, under kernel-level EA Javelin, only one memory reading approach still works: external, where the cheat pulls data from the game process from the outside through a separate window, without injecting its own code into the executable. Internal DLL injection, which was the standard in almost every shooter for years, loses its point under Javelin's kernel module: the driver spots an attempt to write into another process at the kernel level before the user's antivirus reacts, and before the injection itself even finishes.
The Battlefield 6 cheats page lists the working options with price and status, and both live products in the catalog right now, SHACK and BLANK, run exactly on this external scheme. We tested both on the current game build under Javelin with Secure Boot and TPM 2.0 enabled, breakdown below.
Internal vs external: how memory access actually works
The internal approach means foreign code literally sits inside the Battlefield 6.exe process: a DLL loads through CreateRemoteThread, manual mapping, or a similar method, then runs as part of the game itself, with direct access to its memory from inside. This used to be the standard in almost every online shooter, because it gave the cheat maximum response speed and direct access to internal rendering functions. The external approach works differently: a separate process on the same computer reads the game memory from outside through system calls like ReadProcessMemory, without writing any code into the Battlefield 6.exe address space, and draws its own overlay window on top of the game with ESP markers or aimbot target highlighting. For a cheat like this, the game stays just a data source, not a host for foreign code.
The same shift shows up well beyond Battlefield 6. Other kernel-level systems such as Riot Vanguard in Valorant or Ricochet in Call of Duty pushed cheats the same way: products that survived several seasons on the market eventually moved from internal injection to external memory reading too. That is not a coincidence, it is a direct result of how that kind of monitoring works. The deeper such a system sits in Windows, the more expensive it gets to hide foreign code inside the game process itself.
Why internal became risky under Javelin
EA Javelin runs in the Windows kernel, not in user space, so it sees memory operations before any antivirus does: a remote thread created in a foreign process, anomalies in the loaded module list, attempts to write executable code into another process's memory region. These are exactly the signs typical of internal injection, and they are easiest to catch right at load time, before a player even gets into a match. On top of that, Javelin relies on Secure Boot and TPM 2.0 as the foundation of trusted boot, while VBS and HVCI isolate the kernel from unsigned drivers and modules trying to attach themselves with elevated rights.
In practice this means an internal cheat either gets caught almost right after loading, or needs constant, costly disguises built to look like legitimate code: signature swaps, delayed loading, string obfuscation. For a mass-market product in a regular catalog, that arms race simply does not pay off, which is why cheat developers for Battlefield 6 mostly dropped internal early in the life of the game and of Javelin as a project.
What a player actually sees with the external scheme
From the outside it looks like just another window next to the game: the cheat does not touch Battlefield 6.exe, does not write into its memory, it only reads player coordinates, health state, and map data through a safe read call, then draws ESP markers or aimbot hints through its own overlay on top of the game window. Often this is a separate transparent, borderless window layered on top in windowed or borderless mode, and in practice the player is running two independent programs at once, not one modified game.
Technically, that window is usually built through a WinAPI layer on top of the desktop: it is transparent, borderless, flagged as always on top, and it does not intercept mouse clicks in the game, because clicks pass straight through it. The cheat converts target coordinates from 3D memory data into 2D screen points using a view matrix, which it also reads from the game process rather than computing itself. The game process has no idea this window even exists, to the game it is just another program on the user's desktop.
Stability is higher with this kind of cheat: the game does not crash from a conflict with foreign code inside the process, because there is no foreign code inside the process at all, which means fewer typical crashes and less chance of a BSOD from a badly written injection driver. On the downside, the external scheme needs more frequent updates: any Battlefield 6 patch that changes the memory data structure breaks the addresses the cheat relies on, and the developer has to recalculate the offsets. After a major update this can take a few days, and during that window a product in the catalog may briefly move to updating status. The risk of an HWID ban stays the same for both schemes, the external scheme lowers the chance of getting caught, not the severity of the consequences if a detection does happen.
DMA as a separate hardware category
DMA, direct memory access through a dedicated PCIe card in a second physical computer, deserves its own mention: the card reads the gaming PC's memory directly through a hardware channel, bypassing the target machine's operating system almost entirely, so as far as Windows and its drivers on the gaming PC are concerned, the cheat process formally does not exist at all. This is the stealthiest version of the external approach by its very nature, but also the most expensive one: it needs two computers, the card itself, and setup work to link them, which makes DMA a separate hardware category for hardcore cheaters rather than something sold as regular software in the ForgeCheats catalog.
For a regular buyer the difference is practical: a software cheat from the catalog installs in a couple of minutes on one computer and needs nothing beyond the game itself and a game license key, while a DMA setup needs a separate budget for the card and a second system unit, time to configure the bridge between machines, and a fair bit of hardware experience. For the vast majority of tasks in Battlefield 6, from leveling an account to a comfortable session in Portal or REDSEC, regular software like SHACK or BLANK covers the job without that level of complexity.
What to pick for Battlefield 6 under the external scheme
Both working products in our catalog right now, SHACK and BLANK, read Battlefield 6 memory through the external scheme and stay undetected under EA Javelin on the current patch. Three other listings, ANCIENT, ARCANE, and FECURITY, currently sit in updating status after a server-side change, and we do not recommend buying them until that status changes. The difference between SHACK and BLANK is not the reading scheme itself, both are external, it is the feature set and comfort, the wider the set, the more sense a higher price makes.
- Budget entry without overpaying: BLANK at $5 is enough to get a feel for the memory-reading scheme in practice and get basic ESP without extra features.
- Full set with controller support: SHACK at $45 carries the extended feature set and works with an Xbox or PS5 pad, which matters if you are not playing on mouse and keyboard.
- A long session in Conquest or Breakthrough: for stretched-out modes SHACK is the better fit, its external overlay holds up more steadily under long load without drops.
- A quick run in Hazard Zone, Gauntlet, or REDSEC: BLANK is enough here, the task is shorter, the risk is lower, and paying extra for the full feature set makes little sense.
- What not to buy right now: ANCIENT, ARCANE, and FECURITY, all three are waiting on updated memory-read signatures after the latest patch.
All the current options for Battlefield 6 cheats → with price, undetected status, and a feature comparison are collected on one page, and the list gets updated right after every Battlefield 6 patch and every change to EA Javelin.
Questions about choosing between SHACK and BLANK, setting up the external overlay, or compatibility with a specific mode, our community handles those: Telegram (200+ members) and Discord (637+ members).
How that same external approach behaves on older hardware - see our guide on weak PCs and the cheat overlay.
Frequently asked questions about Battlefield 6 cheats
How does an external cheat differ from internal in practice for a player?
An external cheat runs as a separate process and draws its own overlay on top of the game without writing into Battlefield 6.exe memory, while internal embeds code directly into the game process. For the player the difference shows up in stability and risk: external crashes the game itself less often and gets caught by Javelin noticeably less often. At ForgeCheats both live products, SHACK and BLANK, run only on the external scheme.
Can you get banned for an external cheat under EA Javelin?
The risk is not zero for either scheme, but external reduces the typical signatures the kernel module relies on: a foreign thread in the game process, writes into foreign memory, anomalous modules. We test every product in the catalog before publishing it and track status after every Battlefield 6 patch, the current build as of writing dates to summer 2026. An HWID ban stays an extreme measure on EA's side, not an automatic result of the memory-reading itself, but it is still worth avoiding obvious red flags and checking a product's status in the catalog before every session.
Why does Battlefield 6 need Secure Boot and TPM 2.0 if I just want to run a cheat?
EA Javelin checks these two requirements before the game even launches, they are not directly tied to the cheat itself, they confirm the integrity of the Windows boot process. There is no need to disable them for third-party software, and it would not make sense for the external scheme anyway, since it never touches the kernel to begin with.
How is DMA different from a regular external cheat in the catalog?
DMA reads memory through a dedicated PCIe card on a second computer, bypassing the target machine's Windows almost entirely, while regular external software like SHACK or BLANK works within a single operating system through a safe read call. DMA costs more and takes more setup, it is a separate hardware category, not an alternative inside a software catalog.
How often do external cheats get updated after Battlefield 6 patches?
Usually within a day or two after a major patch, sometimes faster if the changes to the game's memory layout are minor and the developer only needs to fix a couple of offsets instead of recalculating the whole structure. The current undetected or updating status for every product is always visible on the Battlefield 6 cheats page, worth checking before buying and before every major game update.
