How a DMA rig actually reads memory
PCI Express supports DMA — devices can read/write host RAM without CPU involvement. Certain FPGA cards (Squirrel, LeetDMA, Enigma X1, Captain DMA) speak PCIe and expose a firmware image (pcileech, MemProcFS) that lets a second PC issue arbitrary memory reads over the bus.
Setup: 1. Gaming PC (Target) — runs Windows and the game normally. 2. DMA card — installed in a spare PCIe slot on the target. 3. Second PC (Reader) — connects to the DMA card over USB-C (fpga → USB) or a second PCIe slot. 4. Reader runs the actual cheat: reads target's game memory, computes ESP/aim, and outputs mouse input via KMBox / Arduino / HDMI capture pixel-scan.
The target PC never runs a cheat process. Anti-cheat cannot see the reader PC — from Windows' perspective the DMA card is a generic 'network adapter' or 'unknown PCI device'.
Why kernel AC can't (yet) see it
The target has no cheat process, no injected DLL, no kernel driver from the cheat vendor, no ReadProcessMemory calls. Every user-mode signature scan, kernel-module walk and integrity check comes up clean.
What COULD catch DMA: - PCIe topology enumeration — every PCI device has a Vendor/Device ID. Anti-cheats can blacklist known DMA card IDs. Countered by firmware that spoofs the ID to a random NIC. - BAR size heuristics — DMA cards use unusual BAR sizes. Firmware fixes that too. - Timing side-channel — measuring memory-access latency to detect an out-of-band reader. Extremely noisy in practice. - Server-side ML — behavioural detection catches obvious rage-DMA the same way it catches internal rage. Legit DMA users survive.
As of 2026, no shipped AC catches a well-configured DMA rig on the driver side. All reported DMA bans trace back to behaviour (rage FOV, 100% HS rate) or careless firmware.
The input problem
Reading memory is easy. Injecting mouse movement without the anti-cheat seeing a fake HID device is the hard part. Options:
- KMBox (Net or B+) — dedicated hardware that relays real mouse input from the reader to the target over USB. Presents as a real mouse to the target. Current gold standard, $150-300.
- Arduino Leonardo / Pro Micro — cheaper HID emulator. Works but the USB descriptors are static and getting blacklisted.
- BetterMouse / mouse-injection software on the reader → HDMI-KVM back to the target — no HID at all, pure image-based control. Complex.
The target should never see any driver that wasn't there before you installed the game. KMBox handles this by masquerading as a normal HID mouse.
Cost breakdown
- DMA card: $250-800 (Squirrel low-end, Enigma X1 high-end).
- KMBox Net: $150-250.
- Second PC / mini-PC to run the reader: $200-400 for a used Ryzen box.
- HDMI capture (if using pixel-scan): $80-150.
- Cheat subscription: varies per game, $30-100/month.
All-in: $700-1600. Worth it for someone running rage cheats daily on high-value accounts (streamers, ranked climbers, cheat providers themselves). Overkill for casual weekend rage.
Who should actually buy DMA
- You run rage cheats 20+ hours a week and losing an account per session is expensive.
- You want to play on your MAIN account (still not recommended, but DMA + closet cheating is the closest 'main-safe' setup that exists).
- You're on Valorant / FACEIT CS2 where kernel cheats die weekly.
- You have the technical patience to flash firmware, configure MemProcFS, debug KMBox latency.
If that's not you: buy a normal kernel cheat + HWID spoofer for 10% of the cost, plan on throwaway accounts, and skip DMA.
What publishers are trying
- BattlEye publicly said they're 'investigating hardware-level detection' — no shipped feature as of mid-2026.
- Ricochet is the most active. They fingerprint PCIe topology on Warzone launch and flag unusual configurations for server-side review. That's why DMA firmware quality matters — cheap $150 cards ship with lazy defaults and get flagged.
- Vanguard requires TPM 2.0 and Secure Boot, which limits some old DMA loaders but doesn't stop modern rigs.
- EAC-EOS is quietest — still no meaningful DMA counter as of 2026.
The arms race is real but slow. DMA is unlikely to become 'easily detected' in the next 12 months.