DMA & hardware security
How hardware-based cheating works at a conceptual level, why software anti-cheat struggles with it, and what each vendor publicly says it does about it.
What is DMA?
Direct Memory Access lets a hardware device, such as an SSD, a network card or a GPU, read and write system memory without going through the CPU. It is how fast hardware normally works.
How it is abused
A cheater puts a PCIe card in the gaming PC. The card reads the game's memory and sends it to a second computer, which draws the overlay or computes the aim. Nothing cheat-related runs on the gaming PC for anti-cheat to see.
Why software struggles
Anti-cheat drivers inspect processes, drivers and memory on the machine. A DMA read bypasses the operating system entirely, so the defense has to move to the hardware: controlling which devices may touch memory in the first place.
The main defenses
- IOMMU (Intel VT-d, AMD-Vi): works like a firewall for memory. It limits which memory regions each device is allowed to access, so an unknown card can't read the game. It must be enabled in firmware and initialized early in boot.
- Secure Boot + TPM: make sure only signed software loads at startup and let the anti-cheat verify a clean boot. This closes the window where something could prepare the system before the anti-cheat starts.
- Device and firmware checks: flag PCIe devices that pretend to be ordinary hardware. Vendors rarely publish details, since doing so helps cheat makers.
- Memory encryption (AMD SEV / Intel TME): often mentioned alongside this topic, but these target other threats (a malicious hypervisor, physical probing of RAM chips). On a normal desktop they generally don't stop a DMA device, and no anti-cheat vendor is known to rely on them.
Vendor countermeasure matrix
Only what vendors have said publicly. "Not documented" means we found no statement, not that no defense exists.
| Anti-cheat | Boot integrity (Secure Boot + TPM) | IOMMU / DMA protection | PCIe device whitelisting & firmware signatures | Memory encryption (AMD SEV / Intel TME) |
|---|---|---|---|---|
| Riot Vanguard | Required TPM 2.0 + Secure Boot on supported Windows 11 setups Tom's Hardware | Enforced Enforces IOMMU protection early at boot; Riot says this blocks DMA devices Riot Games | Not documented No public statement found | Not known No public evidence it is relied on |
| FACEIT Anti-Cheat | Required TPM 2.0 and Secure Boot mandatory for all players since Nov 25, 2025 FACEIT support | Required IOMMU/VBS required for CS2 players above 3000 Elo and on compatible hardware FACEIT support | Not documented No public statement found | Not known No public evidence it is relied on |
| RICOCHET | Reported Press reports say recent Call of Duty PC releases require TPM 2.0 and Secure Boot. Confirm on the game's official page. | Not documented No public statement found | Not documented No public statement found | Not known No public evidence it is relied on |
| Easy Anti-Cheat | Not documented Varies per game; no vendor-wide statement found | Not documented No public statement found | Not documented No public statement found | Not known No public evidence it is relied on |
| BattlEye | Not documented Varies per game; no vendor-wide statement found | Not documented No public statement found | Not documented No public statement found | Not known No public evidence it is relied on |
| ESEA client | Not documented No public statement found | Not documented No public statement found | Not documented No public statement found | Not known No public evidence it is relied on |
Riot Vanguard
- Boot integrity (Secure Boot + TPM)
- Required
TPM 2.0 + Secure Boot on supported Windows 11 setups Tom's Hardware
- IOMMU / DMA protection
- Enforced
Enforces IOMMU protection early at boot; Riot says this blocks DMA devices Riot Games
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
FACEIT Anti-Cheat
- Boot integrity (Secure Boot + TPM)
- Required
TPM 2.0 and Secure Boot mandatory for all players since Nov 25, 2025 FACEIT support
- IOMMU / DMA protection
- Required
IOMMU/VBS required for CS2 players above 3000 Elo and on compatible hardware FACEIT support
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
RICOCHET
- Boot integrity (Secure Boot + TPM)
- Reported
Press reports say recent Call of Duty PC releases require TPM 2.0 and Secure Boot. Confirm on the game's official page.
- IOMMU / DMA protection
- Not documented
No public statement found
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
Easy Anti-Cheat
- Boot integrity (Secure Boot + TPM)
- Not documented
Varies per game; no vendor-wide statement found
- IOMMU / DMA protection
- Not documented
No public statement found
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
BattlEye
- Boot integrity (Secure Boot + TPM)
- Not documented
Varies per game; no vendor-wide statement found
- IOMMU / DMA protection
- Not documented
No public statement found
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
ESEA client
- Boot integrity (Secure Boot + TPM)
- Not documented
No public statement found
- IOMMU / DMA protection
- Not documented
No public statement found
- PCIe device whitelisting & firmware signatures
- Not documented
No public statement found
- Memory encryption (AMD SEV / Intel TME)
- Not known
No public evidence it is relied on
Documented timeline
Apr 2025
FACEIT begins a limited rollout of IOMMU and VBS requirements for CS2. FACEIT support
Aug 2025
FACEIT enforces IOMMU/VBS for all CS2 players above 3000 Elo. FACEIT support
Nov 25, 2025
FACEIT makes TPM 2.0 and Secure Boot mandatory for all players. FACEIT support
Dec 18, 2025
Riot discloses a flaw in some motherboard firmware: it reported DMA protection as active before the IOMMU was properly initialized, which could let hardware cheats act before Windows (and Vanguard) loaded. Riot Games
Why this matters for Linux
Boot-chain attestation and early IOMMU enforcement are built around Windows and its signed boot path. They are a big reason the strictest anti-cheats can't offer Linux support. See Secure Boot, TPM and anti-cheat and test your own setup with the compatibility checker.
Last researched October 2026. Vendors change requirements often: check each vendor's own support pages. This page describes defenses at a conceptual level only.