HanabalExternal cheats, internal cheats and DMA cheats are the three shapes a Rust cheat can take, and all three do roughly the same job underneath. They read the game's state, draw an overlay somewhere and send input to the Rust window one way or another. What changes from shape to shape is where the code runs, which part of the system EAC can look at and how much hardware the user is asked to buy. The Rust list on Camelot has all three, so the pick is practical rather than theoretical.
If you've just landed on the catalogue, the full set lives on the Rust hub. 39 live builds sit there, six of them DMA and the rest split between external and internal. Prices on the cards are from the developers; status on each card is the current detection state.
This post walks through what each of the three types does well, what each one risks, what each one costs on our catalogue right now, and which specific Rust builds belong to which type.
Words used in this article
External cheat. An external cheat runs as its own program on the Windows PC where Rust is installed. It reads the game's memory from outside the Rust process, then draws an overlay on top of the screen. Everything happens on the main machine, including the overlay window EAC can look at.
Internal cheat. An internal cheat ships as a DLL that gets injected into the Rust.exe process while the game runs. Once it's loaded, the cheat code lives inside Rust itself and reads memory directly, without a second process doing the work.
DMA. DMA stands for Direct Memory Access. A DMA cheat uses a PCIe card installed in a second PC to read the main PC's memory over hardware. Rust and EAC run on PC 1; the cheat software and the overlay run on PC 2.
KmBox. A KmBox is a small USB device that plugs into the gaming PC and emulates a mouse and keyboard. DMA builds use it so that input sent from the second PC looks to Windows and Rust like a regular local peripheral.
HWID ban. An HWID ban blocks a specific hardware fingerprint (motherboard, disk, network card and so on) from logging in, not just the Steam account. If an external or internal cheat gets caught on the gaming PC, an HWID ban means a new account on the same rig stays banned too.
External Rust cheats
These are the oldest shape of cheat and still the most common. An external build starts as a separate program next to Rust: it opens a handle to the Rust process, reads positions and inventories out of memory, and draws its ESP on an overlay window above the game. Input is sent as regular mouse and keyboard events, the same as any other application on your PC.
What makes externals attractive is the lack of fuss. Nothing is injected, nothing touches Rust.exe's own code, and the install is usually a loader plus a launcher. That also keeps the price low: externals are the cheapest shape on Rust hacks on Camelot, and most run on a single PC without extra hardware.
The downside is visibility. The overlay window lives on the same machine EAC can scan, and reading memory from outside Rust.exe still leaves patterns the anti-cheat module has learned to spot. When a monthly wave hits, externals are usually the first shape to drop.
Externals currently on the Rust hub include ANCIENT, the LOVEC FULL pair, SALAMANDER and RAMPART. Each one carries its own feature mix. ANCIENT and RAMPART lean toward full aim with ESP, while SALAMANDER and the LOVEC family are known for loot and resource detail. All four sit in the same build shape: one PC, no DMA card, status per card.
Internal Rust cheats
An internal cheat skips the second process. A small loader injects the cheat's DLL into Rust.exe, and from that moment the cheat code runs inside the game. Reading player positions, bullet traces and inventory lives in the same address space as Rust itself, so there is no cross-process read for EAC to spot and no overlay window drawn by a separate application.
Two things make internals feel different once you play with one:
- Aim is smoother because the cheat and the game share state, so there is no round trip between a reader process and a drawer process.
- Radar and ESP are drawn through hooks into Rust's own renderer, which means the overlay looks like part of the game to a casual observer.
The catch sits on the detection side. A DLL that lives inside Rust.exe is the most intimate place a cheat can sit, and if EAC fingerprints the module the ban is instant. Internals have the highest ceiling for both performance and detection; a good one plays like a legit build, a bad one wipes your account the same day you install it.
Internal builds on the Rust hub include MASON, MASON INTERNAL, KRUSH and ARCANE. Mason's internal variant is the frequent pick on solo PvP accounts; KRUSH and ARCANE sit next to it as alternatives from different developers, each with its own aim and ESP style.
DMA Rust cheats
DMA is the only shape that splits across two computers. The setup is a second PC fitted with a PCIe DMA card plus firmware that identifies itself to the gaming PC as a fake network or sound device; a KmBox handles mouse and keyboard between the two. Rust and EAC run on PC 1 and see only a legitimate-looking card; the cheat, its overlay and its config live on PC 2 where EAC cannot look.
The deep hardware explainer, the firmware side and the EAC-blind read loop live in a separate post. For the full walk-through see our piece on a DMA Rust cheat.
Six DMA builds sit on the Rust page. Two good contrasts: NIGHTFALL DMA, which runs a full aim stack with FOV, prediction and per-weapon tuning at $17.50 for 7 days and $53.00 for 30 days, versus ELYSIAN DMA, which is read-only ESP with no KmBox and no aim at $7.05 for 3 days, $12.92 for 7 days and $34.05 for 30 days. One is the maximum aim DMA; the other is the smallest, cheapest DMA on the catalogue.
How Facepunch's ban system treats each type
Easy Anti-Cheat runs inside the Rust.exe process, which is where Facepunch keeps most of its scan logic. The system holds detections and releases them in Rust ban waves, roughly once a month, so a cheater can play for weeks before anything happens. The monthly wave is why the three types age so differently.
Externals sit in the easiest spot for EAC. The reader process, the overlay window and the input injection all run on the same PC the anti-cheat scans. Detections pile up quietly and release with the wave.
Internals are the fastest to catch when they are caught, because a DLL is already inside Rust.exe. When an internal survives a wave, it tends to keep surviving the next one; when it dies, it dies clean and everyone running that build goes at once.
DMA builds are the hardest to catch because PC 1 does not run the cheat at all. The card looks like a regular piece of hardware, the KmBox looks like a regular mouse, and the overlay is drawn on a screen EAC has never touched. Facepunch has not verified any DMA build as undetectable, and their 2026 EAC upgrade raised scanner invasiveness on the gaming PC; the status line on each card is the only source of truth.
How to pick
The pick is almost always driven by one of four situations. Find the row that matches and start there.
- Just trying cheats in Rust for a weekend. Go external. It's the cheapest route in and needs no extra hardware. ANCIENT or the LOVEC FULL pair are the usual first picks.
- Solo PvP on a main account, want silent aim and a clean radar. Internal is the shape to look at. MASON is the frequent choice because its aim and radar live inside Rust.exe, so the overlay feels like part of the game.
- Known face on a server, want the smallest possible scan surface. DMA. NIGHTFALL DMA for a full aim stack, or EVERWARE DMA if silent aim and a web radar matter more than per-weapon tuning.
- Farmer who needs to spot sulfur, sleepers and crates through walls. The read-only shape of ELYSIAN DMA is the cheapest way into DMA for loot and resource ESP. Among externals, builds with loot-focused ESP such as SALAMANDER are the cheaper alternative on a single PC.
One last point worth saying out loud: the right pick isn't fixed. Someone who starts on an external and settles into weekly play often moves to internal or DMA later. That is a normal path through the Rust builds we list, not a one-way choice.
