ESP stands for Extra Sensory Perception — it's any cheat that shows you information the game wouldn't normally reveal. Here's every type explained.
Player ESP (Wallhack)
The most common form. Reads enemy player positions from game memory and draws overlays on your screen:
- Bounding box — rectangle around the player model
- Skeleton — bone-by-bone wireframe of the player
- Glow / outline — coloured glow around the model (requires more complex rendering)
- Head dot — just the head position, useful for aimbot targeting
Info ESP
Additional data drawn near the player icon:
- Health bar — enemy HP in real-time
- Name tag — in-game username
- Distance — metres to target
- Weapon — what they're currently holding
Loot / Item ESP
Shows items, weapons, ammo, or resources through walls. Common in survival games (Rust, DayZ, Tarkov). Reads item data from the game world and draws markers over the item positions.
Radar Hack
Technically ESP — draws a minimap overlay showing all enemy positions. Subtler than boxes but just as powerful strategically. Harder for reviewers to spot in demos.
How It Actually Works
External ESP reads player entity data (X/Y/Z coordinates, health, name) from game memory and converts those 3D world positions to 2D screen positions using the game's view matrix. The overlay is drawn in a transparent window on top of the game — nothing is injected into the game process.
Browse all free cheat builds with ESP: Cosmo Cheatz →
How Anti-Cheats Detect ESP Overlays
VAC and BattlEye rely mostly on signature scans and behavioural heuristics rather than screenshot review. Vanguard, by contrast, loads a kernel-mode driver at boot and blocks unsigned code from reading protected process memory, which is why external overlays that work fine on Faceit servers are useless on Valorant. Easy Anti-Cheat added a module in 2023 that enumerates topmost layered windows and checks for WS_EX_TRANSPARENT plus WS_EX_LAYERED flags on processes with no visible UI thread, a pattern common to overlay renderers. Detection also comes from server-side statistics: a player who pre-aims at targets through geometry across several hundred rounds generates aim-snap and crosshair-placement telemetry that is statistically implausible. The practical failure point is rarely the overlay itself but the read primitive underneath it. A driver like WinRing0 left installed after a cheat is unloaded is a common ban trigger on its own, because anti-cheats flag the vulnerable driver by its known hash regardless of what is using it.
Why ESP Breaks After Game Updates
Every ESP depends on a chain of offsets that shift whenever the game is patched. The entity list pointer, the view matrix address, the bone matrix array and the health field offset are all hardcoded values that the developer extracts from each new build. A typical Escape from Tarkov wipe changes the majority of these, and a small hotfix can invalidate one of them while leaving the rest working, which produces partial breakage: boxes appear in the wrong place, health bars read zero, or the overlay draws at the origin. The view matrix is the most fragile because a wrong matrix projects every entity to the same screen coordinate. Users can verify a working build by checking that a known map landmark lines up with an entity at a fixed distance, or by watching whether the box tracks smoothly when strafing. Jitter or drift during movement almost always indicates a stale matrix rather than a bad overlay renderer.
Stream-Proofing and Its Real Limits
Overlay capture is the usual weak point in a streamed game. OBS with Game Capture hooks the swap chain through graphics API interception, so a separate transparent window drawn on the desktop generally will not appear in the stream, while Display Capture records everything including overlays. That distinction is why some cheats advertise themselves as OBS-safe. The approach collapses the moment anything else touches the desktop: Discord screen share, a second monitor mirrored in Windows settings, or Nvidia ShadowPlay instant replay will all capture the composited desktop and expose the overlay. Anti-cheat developers know this and increasingly rely on server-side review rather than client capture. Frame-perfect tracking through smoke or foliage, or a crosshair that snaps to a target before the player turns, is visible in a demo regardless of what the stream showed. Treat stream-proofing as a capture artefact, not as concealment.