What Is Polymorphic Encryption? Signature Detection and Ban Waves

What polymorphic encryption is: the short answer

Polymorphic encryption is the general name for techniques that make every copy of a piece of software a different file. The aim is that no two users run the same binary. The term comes from the software security literature and is not specific to game cheats; it has been studied in antivirus research for decades.

The reason it surfaces in a game cheat context is this: the oldest and cheapest detection method available to anti-cheat systems is signature checking. Once a file is recognised, everyone running that same file is recognised at the same time. Polymorphism targets exactly that point, and it makes a real difference there.

The concrete contribution of polymorphic builds is this: one sample being obtained does not put everyone running that software on the same list at the same time.

Why signature-based detection is not enough on its own

Signature detection works on simple logic: the fingerprint of a known file is held in a database, and encountered files are compared against it. The method's strength is speed; its weakness is that it cannot recognise anything it has not seen before.

That weakness pushed the security side toward a second approach: heuristic and behavioural analysis. Here the question is not what a file is but what it does. Modern anti-cheat systems use both approaches together, and we covered which system leans more on which in the Riot Vanguard vs VAC Live comparison.

What a ban wave is and why it happens

A ban wave is when an anti-cheat system, having recognised a particular piece of software, processes the accounts using it in bulk. The bulk part is not coincidence: once a detection is confirmed, enforcement is usually accumulated and applied in one pass. The reason is operational efficiency as much as a desire to control when the detection method becomes visible.

What determines the size of a wave is how many people run the same file. This is exactly where polymorphic builds show their value: with no shared file fingerprint, a list drawn from a single sample cannot cover everyone using that software. On the signature side that is a concrete, measurable difference.

What polymorphism solves and what it does not

The problem it solves is clear, and it is not a small one: one file fingerprint making an entire user base visible at once. Most of the bulk recognitions seen with widely distributed software start from that single point.

The channels that fall outside its scope:

• Behavioural analysis. Assessment based on your in-game statistics is independent of the file's structure. We detailed that channel in the legit config article.
• Runtime monitoring. An anti-cheat running at kernel level observes the current state of the system regardless of how the file looks on disk.
• The report system. Complaints from other players can trigger human review, and that channel is unaffected by any technical measure.
• Hardware identity. Enforcement applied to a machine identity after an account closure is a separate matter; the detail is in the HWID ban article.

These are not flaws in polymorphism; they sit outside its scope, and each is the subject of a separate measure. To state the risk once and plainly:

Polymorphic builds close the signature side. They do not zero out account risk, and no technical measure does. The right decision is one made knowing the risk and checking the product's current state.

The difference between polymorphic and metamorphic

The two terms are often confused. The distinction in the literature runs like this: a polymorphic approach largely preserves the code itself while producing a different outer layer or a different layout in every copy. A metamorphic approach rewrites the code itself, so that two copies differ not only in packaging but in instruction sequence.

In practice the two can be layered together. The literature studies those layers under headings such as instruction reordering, control flow obfuscation and compile-time randomisation. This article contains no guidance on how to implement any of them; the aim is that you know what these terms describe when you see them in a product description.

What to expect on performance

Most of the cost of these techniques falls in the preparation stage where the file is produced, and that stage happens on the build side rather than on your machine. Whether you notice a difference in game depends on how many layers are applied, on the software's architecture and on your hardware, which is why we do not publish a single figure that would hold for everyone.

For the same reason, treat percentage promises about performance with caution: a number given without its measurement method carries no information. If you do notice something on your own system, support can help you separate whether it comes from the product or from a setting on the system side.

Why free software gets recognised in bulk

The shared weakness of free or widely distributed software is that one file exists in identical form on thousands of machines. That makes a signature-based system's job easy: once a single sample is obtained, the entire distribution becomes visible.

The same logic does not automatically reverse for paid products. What matters is not price but distribution method. A paid product that hands the same binary to every buyer carries the same structural weakness as a free one.

The reverse is also true, and this is the part that matters: a product distributed in a limited way, sold privately and tracked for state is structurally different from one that hands the same file to everyone. The private licences sold at Divine work on that model: distribution is not open, every licence key is bound to a single order, and the product's current state is published openly on the live status page. Fortnite Private License and ARC Raiders Elite are concrete examples of it.

Watch for unverifiable claims

A few claims made frequently around this topic cannot be verified. Measures of the form "no two files share more than X percent similarity" are meaningless unless the measurement method is published. "No mass ban has ever occurred" is likewise a statistic with no citable source. Describing polymorphism as offering "complete protection from ban waves" belongs to the same group.

That is why we tie a product's state to a single open, updated record rather than to a claim: the status page. There you see one of undetected, developing or updating; that label is independent of marketing copy and is the most current data you can check before buying. We explained what the labels convey in the what undetected means article.

What this means for a buyer

When you see the word polymorphic in a product description, take it as the seller stating they apply a measure against signature-based detection. Applied properly this is a real difference for a buyer: it takes you out of the crowd sharing one common file, so a single sample being obtained does not place you on the same list as everyone else.

The purchase side is short. Once payment is confirmed your licence key is allocated automatically; it is sent to your email address and written to the order record in your account at the same time. You download the loader from the link on that same order record, enter the key into the loader, and activation is done. The detail is in the licence key delivery and activation article.

Two things to look at when deciding: the product's current state and the risk you accept. The order is this: check the label for the product you are interested in on the status page, then move to the product page. You can review the private licences at Fortnite Private License, ARC Raiders Elite and Valorant USB, and you will find the general framework for choosing a product in the game cheat buying guide.