DMA Cheats: What They Are and How They Get Caught

A DMA cheat is a hardware cheat that reads a game's memory through direct memory access (DMA). A card in the gaming PC's PCIe slot copies that memory to a second computer, and the cheat runs there instead of on the gaming PC. Riot Games counts DMA among the 3 methods cheaters in its competitive games have favored over the last 5 years, and on May 22, 2026 it said Vanguard now enforces IOMMU memory protection on accounts identified as using DMA cheating devices.

PC already banned after a DMA bust? An HWID spoofer clears the hardware ID ban on the gaming PC; the banned account and any blocked DMA card stay as the publisher left them.

DMA cheats are harder to catch than software cheats, but they get caught. Anti-cheat makers inspect the PCIe devices in a PC, block DMA reads with the IOMMU and study how players perform, and a caught DMA cheater can lose the PC as well as the account.

Sellers pitch DMA as the cheat no anti-cheat can see. The anti-cheat makers' own posts say otherwise.

A DMA cheat is game cheating built on direct memory access, the feature that lets hardware such as network cards, storage controllers and graphics cards move data in and out of RAM without waiting on the CPU. Microsoft credits DMA for the speed of PCIe devices. The cheat version adds a purpose-built card to the gaming PC and uses that same right of access to copy the game's memory out of the machine.

The meaning of "DMA cheats" comes down to where the cheat lives: in hardware, outside the gaming PC's software. Wikipedia files the technique under the DMA attack, a computer security term for a device that abuses a high-speed expansion port to read or write a computer's physical memory, for example to steal cryptographic keys.

What a DMA cheat pulls out is whatever the game keeps in memory, such as enemy positions and health. Riot says DMA hardware is usually used for wallhacking, and that it pays off in tactical shooters, where the server's fog of war cannot hide every enemy from the game client.

A DMA cheat setup has three parts, and none of them runs cheat software on the gaming PC:

A DMA card, an FPGA-based PCIe card inside the gaming PC that reads physical memory directly.

A second computer, laptop or desktop, that receives the copied memory, finds the game data in it and runs the cheat.

An output back to the player, usually a radar or wallhack display (ESP). Some setups add an input device that moves the mouse for aim.

Riot's June 24, 2026 post introducing Vanguard On-Demand describes a purpose-built DMA card used to "exfiltrate entire pages of physical memory to a second PC." The second computer then scans those pages for the data the cheat needs.

Diagram of a DMA cheat setup: the gaming PC holds game data in RAM, a PCIe DMA card copies that memory out, and a second PC runs the cheat and shows ESP.

The DMA Card, Board or Device

A DMA card, also sold as a DMA board or DMA device, is a PCIe expansion card usually built around an FPGA, a chip that can be programmed to behave like almost any device, so its firmware decides what it reports itself to be. Cheat sellers advertise firmware that passes the card off as an ordinary part such as a Wi-Fi adapter, and anti-cheats such as ACE now check each PCI device against a list of standard ones instead of trusting its label.

The same class of hardware has honest uses. Wikipedia lists kernel debugging, and Riot's anti-cheat team notes that DMA has legitimate jobs in printers, sound cards and Wi-Fi adapters, and that is the cover cheaters exploit.

Why Cheat Makers Moved to Hardware

DMA cheats spread because kernel-level anti-cheats got good at catching cheat software on the gaming PC. Riot calls Vanguard a kernel anti-cheat, and Steam lists Easy Anti-Cheat, Denuvo Anti-Cheat and EA Javelin as kernel-level anti-cheats. A DMA setup leaves little for them to find on the PC: the cheat logic runs on another machine, and Riot's December 2025 security update describes DMA cards as reaching memory directly, around both the CPU and Windows.

Riot's December 11, 2023 anti-cheat update called DMA one of the more advanced methods in Valorant's cheating communities, used "to try to work outside of Vanguard." The catch is cost and effort. A DMA rig needs a second computer, special hardware and custom firmware, and Riot calls DMA cheating "one of the world's most expensive hobbies."

Yes, anti-cheat can detect DMA cheats, though the makers admit no system catches every setup at once. FACEIT's February 27, 2025 patch notes asked "Does FACEIT AC Detect DMA Cheats?" and answered "Yes," crediting TPM 2.0 and kernel-level access. The Delta Force team adds that no anti-cheat stays cheat-proof forever. The defenses Riot, Anti-Cheat Expert (ACE) and Microsoft document fall into three layers.

Three layers anti-cheats use against DMA cheats: IOMMU memory protection (Riot, Microsoft), PCI device checks (ACE) and server-side behavior review.

IOMMU and Kernel DMA Protection

The IOMMU (input-output memory management unit) is the hardware that sits between DMA-capable devices and RAM and decides which device may reach which memory. Intel calls it VT-d and AMD calls it AMD-Vi. Windows 10 and 11 build Kernel DMA Protection on it: Microsoft's Kernel DMA Protection documentation says Windows uses the IOMMU to stop external PCIe peripherals, such as Thunderbolt and USB4 devices, from performing DMA unless their drivers support memory isolation.

Riot turned the IOMMU into an anti-cheat tool. Its May 22, 2026 statement says that once IOMMU protection is on, DMA cheat devices are blocked from reading memory in its games, and a rig that keeps trying may throw hardware faults. Riot's June 24, 2026 On-Demand post adds that it had already spent a year forcing IOMMU restrictions onto high-rank Valorant DMA cheaters.

Riot's December 18, 2025 security update closed a boot-time gap as well: some motherboard firmware reported Pre-Boot DMA Protection as on while the IOMMU was not initialized correctly during early boot, and Vanguard now prompts affected players to update that firmware. Riot noted on September 20, 2024 that consoles already guard game memory this way, and DMA is "virtually nonexistent" there.

Riot's account restrictions also lean on the TPM. When Riot restricts an account, only a firmware TPM satisfies the requirement, because a discrete TPM module can be pulled and replaced. Riot calls the TPM's factory-burned Endorsement Key a hardware identity it could ban on sight, and that key is what TPM bans are built on.

Device and Firmware Checks

Anti-Cheat Expert checks the PCI devices in a PC while a game runs against a library of standard devices it keeps updated, and it interferes with any card it identifies as a DMA device. Delta Force, which uses ACE, announced DMA Shield on December 17, 2025: built on Windows' Kernel DMA Protection, it sends an unrecognized device to empty or junk memory instead of the game's data. Riot's League of Legends write-up from April 11, 2024 lists "are you currently using a DMA device" among the yes-or-no checks Vanguard reports.

Firmware is where DMA cheaters can get caught in groups. ACE's explainer, quoting an industry article, says cheaters use custom firmware "to avoid widespread bans triggered by other players' detections," which implies a firmware shared by many buyers can be flagged once and hit all of them.

Behavior and Server-Side Detection

Behavior detection catches DMA cheaters by what they do in a match, whatever hardware sits in the PC. ACE reviews replays, its name for recorded gameplay data, and runs big-data and AI analysis on player behavior to spot wallhack-style play. Ubisoft says the Data Ban system in Rainbow Six Siege moved to a machine learning model that weighs far more data points about each player's performance. FACEIT delays some bans on purpose: an engineer approves each new detection, and the wait keeps cheat makers from learning which signal caught them.

Flow showing why "undetected" cheats get caught: a new method is sold as undetected, the anti-cheat confirms the detection and holds the ban, then everyone using it is banned.

A caught DMA cheater can lose the account, the PC or both, depending on the publisher. Anti-Cheat Expert says it bans "accounts and machines that use DMA cheats." Riot applies its VAN:Restriction, a block that holds until security requirements are met, at the account or HWID level when Vanguard sees suspicious hardware behavior, and Riot lists hardware bans on reoffenders among Vanguard's actions in Valorant. Delta Force adds that a card caught trying to get past DMA Shield can have its hardware signature flagged, which makes starting over with a new account on that rig much harder.

Three different things can be blocked:

An account ban locks the game account. Riot's Valorant support page says cheating with unauthorized hardware or software gets an account permanently banned, and players who queue with cheaters get 180-day bans.

A hardware ban locks the PC through its hardware IDs, so a new account on that PC is blocked too. ACE's machine bans turn a DMA bust into a ban that follows the PC rather than one account.

A device block stops the DMA card itself. In Riot's games the card stops reading memory once IOMMU is enforced. Riot says the card works again if IOMMU is switched off, but its games then still require IOMMU, so the device is worthless for Valorant while the PC itself is not "bricked."

What a DMA ban can hit: the account stays banned, the DMA card stays blocked, and the gaming PC's hardware ID ban is the part an HWID spoofer clears.

DMA cheats are documented differently in every game. Riot names DMA outright, while Epic, Embark, EA and Ubisoft write about cheat hardware, hardware bans or boot security, and none of their pages we read names DMA. Here is what each publisher's own pages say for the games behind the most common "dma cheat" searches:

Which publishers name DMA: Riot, Krafton and Battlestate do; Epic, Embark and EA cover cheat hardware, PC bans and TPM; Facepunch and Ubisoft have no DMA statement.

Valorant has the most detail. DMA hardware is one of the reasons Vanguard bans players in Valorant, next to kernel cheats, pixelbots and tampering with the anti-cheat.

Fortnite falls under Epic's terms of service, last updated September 10, 2026, which forbid having "cheat software, tools, or hardware present on or connected to your device." Epic's terms don't name DMA. A DMA card plugged into the PC is the kind of hardware that wording covers, but that is our reading, not Epic's.

Arc Raiders lists Denuvo Anti-Cheat on its Steam page, and none of Embark's pages we read mention DMA. Embark's hardware bans are its tool against a machine: the Help Center says a hardware-banned PC can no longer run any Embark game, THE FINALS included.

Rust's developer Facepunch and Rainbow Six Siege's publisher Ubisoft have no DMA statement in the sources we checked. Ubisoft's May 2024 anti-cheat update for Siege covers Data Bans, its QB system and MouseTrap, so the answer to "Can R6 detect DMA?" is that Ubisoft hasn't said. EA says Battlefield 6's Secure Boot and TPM requirements target memory manipulation and hardware ID manipulation, again without naming DMA.

One publisher outside this list went further. Krafton rewrote the PUBG: BATTLEGROUNDS terms, effective June 12, 2024, to name DMA boards as unauthorized hardware, with penalties up to a permanent ban and restrictions on the player's hardware devices.

Escape from Tarkov is another game where the developer names DMA. Battlestate Games' April 2026 anti-cheat diary pointed to a growing number of DMA tools among Tarkov cheats and listed IOMMU, VBS and HVCI as protections it may add in response.

The risks of DMA cheating go past one lost account:

Late bans. FACEIT bans everyone using a method once an engineer confirms the detection, so a setup that seems fine today can be caught later.

Dead hardware. Riot says its IOMMU enforcement makes cheat devices worthless for Valorant.

Scams. FACEIT says most videos claiming cheats work on its servers are scams, filmed on non-FACEIT servers or with detected cheats used right before the ban to sell fakes.

Malware. Free cheats are one of malware's favorite disguises. Security firm Flare traced 41% of the infections on 53,896 infostealer-hit PCs to gaming-related files, and cheats, mod menus, aimbots and skin changers were over half of those. A DMA rig's second PC still runs cheat software, so the risk follows it.

Flare infostealer data: 41% of infections on 53,896 infected PCs began with a gaming-related file, and over half of those were cheats, mod menus, aimbots or skin changers.

A DMA card is invisible from across a match, so a report rests on what the player does, like tracking enemies through walls. Each publisher routes cheating reports its own way.

Reporting in Valorant

Riot's Valorant support team says the best way to report a potential cheater is in-game, during or after the match. Afterwards, open Career, pick the match, right-click the player's name, choose Report and fill out the form.

Reporting in Fortnite and Arc Raiders

Fortnite reports start in the in-game menu: hamburger menu, Report, Submit a report, A player or sidekick, then the player and the reason. Arc Raiders puts reports behind the lobby's Social button: the Recent tab, the player's name, Report, then a reason and a short description.

Reporting in Rainbow Six Siege

Rainbow Six Siege has an in-game reporting tool, and Ubisoft also takes cheating reports as support cases, which should carry a video link, the Siege Match ID and the player's username.

What Happens After a Report

A report starts a review, not a ban. Embark verifies every Arc Raiders report before acting, so mass reporting alone bans no one, and Ubisoft keeps the outcome confidential.

Where to report a cheater: Valorant from Career and the match, Fortnite from the menu, Arc Raiders from Social and Recent, Rainbow Six Siege in-game or by support case with video.

An HWID spoofer fits only after the fact, when a publisher has hardware-banned the gaming PC. An HWID spoofer for Windows clears that hardware ID ban by changing the identifiers the ban was tied to. It is not a cheat and not a DMA tool. It does not hide a DMA card, does not change the card's own identifiers, and does not get anything past an anti-cheat.

That is what a spoofer changes: the motherboard's board and SMBIOS IDs, the CPU, the TPM, the disks (NVMe, SSD, HDD), RAM serials, the GPU, the monitor's EDID, the MAC address, USB IDs and UEFI firmware variables, with dozens of further IDs on top. One loader covers Vanguard, Easy Anti-Cheat, BattlEye, FiveM, EA Javelin and ACE, and the license decides which of those anti-cheats are included.

What an HWID spoofer changes: the gaming PC's board, SMBIOS, CPU, TPM, disk, RAM, GPU, EDID, MAC, USB and UEFI IDs, while the DMA card and the banned account are left alone.

Spoofers run in two modes. The difference between temporary vs permanent spoofers decides how long the clean IDs last. Temporary mode clears the ban only while the spoofer runs, with unlimited profiles; close it and the original, banned IDs come back. Permanent mode rewrites the hardware IDs for good, so the PC itself is cleared, using one HWID profile that has to be replaced with a newly bought one if it gets banned.

Account bans stay where they are. A spoofer cannot restore a banned Riot, Epic or Embark account, and a DMA card that a game blocks or flags stays blocked. Publishers also treat getting around a hardware ban as a violation of its own: Riot's ban data says its "tampering" category is most often triggered by cheaters trying to bypass hardware suspensions, and EA lists hardware ID manipulation among the cheats its Battlefield 6 checks target. Whether to play again on a spoofed PC is your own call, with that risk attached. The free trial lasts 24 hours and needs no payment card, only an email address.

DMA sits at the hardware end of cheating: FiveM cheats are mostly software menus and Lua executors, while Tarkov cheats range from ESP and aimbots to the DMA rigs Battlestate names.