BOT PROTECTION FOR GAMES

DMA Cheats: The Hardware in the PCIe Slot That Anti-Cheat Cannot See

A second PC reads your game memory through a card in the PCIe slot. The cheat never runs on the machine being watched.

A DMA cheat uses an FPGA card in a PCIe slot to read the game's memory directly and send it to a second PC, where the cheat software runs. The gaming PC never executes the cheat, which is why kernel-level anti-cheat struggles to see it.

The setup: two PCs and a card in the slot

Open the case and there is a small board in a PCIe slot, usually built around a Xilinx Artix-7 FPGA. It does one thing: read the PC's memory directly, without asking the operating system. The card streams what it reads to a second PC sitting next to the desk, and that second machine runs the actual cheat, the aimbot, the wallhack, the radar. The gaming PC never runs a line of cheat code.

That split is the whole trick. Kernel-level anti-cheat lives on the gaming PC and watches what runs there. The cheat runs somewhere else entirely. The gaming PC looks clean because, by the narrow definition the anti-cheat uses, it is clean.

Why kernel anti-cheat cannot see it

Direct memory access is a legitimate hardware feature. Capture cards, storage controllers, and network cards all use DMA to move data without bothering the CPU. An anti-cheat cannot simply ban every DMA device, because half the hardware in a gaming PC uses the same mechanism. The cheat hides inside a feature the system is designed to allow.

What the anti-cheat can do is look for the signs around the card: a second PC on the same desk, unusual memory access patterns, a device that identifies itself oddly. Those are probabilistic signals, not proof, and every false positive bans a legitimate player with a capture card. Riot counts DMA among the three favored cheating methods of the last five years, which tells you how far the cat-and-mouse game has gone.

What the anti-cheat teams are doing about it

The countermeasures are getting more aggressive. Vanguard now enforces IOMMU memory protection on accounts flagged for DMA use, which restricts what a DMA device can read. FACEIT's February 2025 patch notes confirm DMA detection tied to TPM 2.0 and kernel-level access checks. KRAFTON reports around 260,000 DMA-based cheaters permanently banned in PUBG during 2025, with more than 80,000 of those coming after the Zakynthos enhancement in August 2025.

None of this kills DMA cheating. It raises the cost and shrinks the window, and the cheat developers respond by changing how the card presents itself. The honest way to describe the state of play is an arms race with no finish line, where each side's new move lasts a few months.

The price of the rig, and why that matters

A DMA card runs roughly $100 to $420, and the second PC another $100 to $600. That puts the full rig somewhere between $200 and $1,000, which is real money but not prohibitive for someone who boosts accounts for a living. The price is the reason DMA cheating stays niche: it is too expensive and too fiddly for a casual cheater, and cheap enough for a professional one.

That price split is also why the bans skew the way they do. The cheaters getting caught are the ones running the rigs at scale, selling boosts and farming accounts. The single player with a DMA card in a home PC is harder to find and, frankly, less of a priority for the teams doing the banning.

Keep reading

Related guides on this site: how hardware bans work and how spoofers get around them how kernel-level anti-cheat actually works how real-money trading gets traced through trade graphs More from Bot Protection For Games.

Frequently asked questions

What is a DMA cheat?

A DMA cheat uses an FPGA card in a PCIe slot to read the game's memory directly and send it to a second PC. The cheat software runs on the second PC, so nothing suspicious executes on the gaming machine itself.

Can Vanguard or BattlEye detect DMA cheats?

Partly. Vanguard enforces IOMMU memory protection on flagged accounts, and FACEIT ties DMA detection to TPM 2.0 and kernel checks. But DMA is a legitimate hardware feature, so detection relies on signals around the card rather than the card itself.

Why do DMA cheats need a second PC?

The cheat has to run somewhere, and running it on the gaming PC would expose it to the anti-cheat. The second PC runs the aimbot or wallhack using the memory the DMA card streams over, keeping the gaming PC clean.

How much does a DMA cheat setup cost?

A DMA card runs about $100 to $420, plus $100 to $600 for a second PC. The total rig lands between roughly $200 and $1,000, which keeps it out of reach for casual cheaters but affordable for professionals.