For years, the standard mental model of PC cheating was software fighting software. A cheat injected code, altered memory, hooked game functions, or buried itself deeper in Windows, while anti-cheat software tried to find it before the match was ruined. Direct Memory Access cheating changes that contest because part of the cheat can sit outside the normal software path entirely, using hardware to read memory without behaving like a traditional program running inside the gaming PC.
That distinction matters most in serious competitive games, where information can be as powerful as aim. If a cheat can recover player positions, object states, or other client-side data from memory and process it somewhere else, it can produce radar or wallhack-style intelligence while leaving far less conventional cheat code exposed on the machine running the game. Riot Games describes modern DMA cheating as purpose-built PCIe hardware scanning physical memory, commonly to support wallhacking, and Microsoft documents the underlying security problem more broadly: DMA-capable PCIe devices can perform memory reads and writes without involving the system processor.
DMA Was Built for Performance, Not Cheating
Direct Memory Access is not a cheat technology. It is a normal computer capability designed so high-speed hardware does not need to ask the CPU to manually handle every piece of data moving between a device and memory. Storage controllers, graphics hardware, network devices, audio hardware, and other components benefit from being able to move data efficiently.
The security problem appears when a device receives more memory access than it should. A malicious or repurposed PCIe device can potentially inspect areas of physical RAM containing data from the running game. In a DMA cheating setup, the gaming PC can therefore become the source of raw information while analysis happens outside the game process, often on another computer. Riot has publicly described DMA devices extracting pages of physical memory to a second PC and searching that data for useful game state, including enemy positions.
That architecture attacks one of the assumptions traditional anti-cheat depended on. If the cheat process is inside Windows, defenders can inspect processes, drivers, memory modifications, loaded modules, suspicious handles, or other signs of tampering. If a separate hardware device is reading memory and another machine is interpreting the result, much of the visible activity has moved away from the system the anti-cheat is watching.
Why DMA Cheats Are Especially Dangerous in Competitive Shooters
A competitive game client needs enough information to render and simulate the match correctly. Developers can reduce unnecessary information sent to the client, and server-authoritative design can prevent many forms of manipulation, but a client still needs some state that can become valuable if exposed. Riot notes that server-side Fog of War in VALORANT cannot make every piece of opponent information completely opaque, which helps explain why memory-reading cheats remain attractive in tactical shooters.
The biggest advantage is often information rather than impossible mechanical input. A player with external radar can know that a rotation is coming before there is legitimate audio or visual confirmation. A wallhack can influence crosshair placement, timing, utility usage, positioning, and decision-making while the cheater deliberately avoids obvious snaps or superhuman accuracy. That makes the resulting play harder for opponents to interpret and can make purely behavioral detection more difficult than catching a blatant aimbot.
DMA also became threatening because the hardware layer once offered a cleaner separation from the anti-cheat layer. A kernel-level anti-cheat has extensive visibility inside Windows, but a PCIe device performing legitimate-looking memory transactions presents a different problem from an unsigned driver or injected DLL. The defender has to control what hardware is allowed to access, not simply search harder for a hidden executable.
The IOMMU Turns Memory Access Into a Permissioned System
The most important hardware defense is the Input-Output Memory Management Unit, usually shortened to IOMMU. Instead of allowing every DMA-capable device to address physical RAM freely, the IOMMU places a translation and permission layer between devices and system memory. Microsoft describes Windows DMA protection as using the IOMMU to restrict devices to assigned memory regions, while Riot describes the same idea from an anti-cheat perspective as preventing PCIe devices from freely browsing game memory.
For anti-cheat developers, that changes the problem dramatically. Game-related memory can be mapped so an untrusted peripheral cannot simply request the corresponding physical addresses. A DMA request outside the device’s permitted region can fail at the hardware translation layer before the cheat receives the information it wanted. Riot says Vanguard can use IOMMU protections to make selected game memory unreadable to DMA devices, turning a previously external memory-reading path into something the platform can restrict.
The tradeoff is compatibility. Real PCs contain legitimate devices that also rely on DMA, and not every driver or peripheral supports modern remapping behavior equally well. Microsoft notes that DMA remapping depends on compatible devices and drivers, while Riot acknowledges that some legitimate hardware still creates gaps that have to be handled carefully. Anti-cheat teams cannot simply disable all PCIe DMA without breaking normal systems, so enforcement has to distinguish expected device access from suspicious access.
Anti-Cheat Is Moving Earlier Into the Boot Chain
IOMMU protection is strongest when the system can prove that the protection was active before anything hostile had a chance to establish itself. This is why competitive anti-cheat requirements increasingly include UEFI, Secure Boot, TPM 2.0, virtualization-based security, and firmware updates rather than relying only on a driver that starts with the game.
Secure Boot helps verify that trusted components are loading during startup. TPM-based measured boot can create signed records of the boot process, giving anti-cheat software a way to check whether the machine started in an expected state. FACEIT says its anti-cheat uses TPM-backed boot measurements to verify system integrity, while Riot’s newer Vanguard security model combines Secure Boot, TPM, VBS, HVCI, and IOMMU as hardware-backed protections around Windows.
This shift became even more visible after Riot disclosed a pre-boot DMA protection weakness involving motherboard firmware. Riot said some firmware implementations reported that pre-boot DMA protection was active even though the IOMMU had not been initialized correctly during the earliest part of startup. The company worked with motherboard vendors on BIOS updates, and its December 2025 disclosure linked the issue to advisories affecting major board manufacturers.
That episode shows why checking a BIOS option is not always enough. Anti-cheat increasingly needs evidence that the protection actually functioned from power-on through Windows startup, not merely a configuration flag that says it should have functioned. Firmware, operating system security, anti-cheat software, and game-side detection are becoming parts of one trust chain.
Vanguard and FACEIT Show Where Enforcement Is Heading
Riot’s June 2026 Vanguard update is one of the clearest signs of this direction. Vanguard introduced an optional on-demand mode for PCs that pass its hardware security pre-check, allowing the driver component to run only while a Riot title is being played rather than launching at every system startup. To qualify, Riot lists modern Windows 11, Secure Boot, TPM 2.0, VBS/HVCI, and IOMMU among the required protections, with the idea that stronger native platform security reduces how much continuous monitoring Vanguard itself must perform.
FACEIT is pushing similar controls into competitive play. Its anti-cheat documentation, updated in July 2026, says IOMMU requirements are being rolled out progressively, and its security guidance also requires or promotes TPM 2.0, Secure Boot, virtualization protections, and DMA protection. FACEIT reported that during a limited three-month rollout it banned more than 200 players for DMA-based cheating, including roughly 20 using what it described as high-end devices.
Epic Games has also published player guidance explaining that some competitive experiences require IOMMU to meet security requirements. That does not mean every game will adopt identical rules, but it shows that hardware memory isolation is no longer a specialist concern limited to one anti-cheat vendor. Competitive PC gaming is increasingly treating platform security configuration as part of match integrity.
Hardware Security Does Not Make Cheating Disappear
No single security feature ends the problem. IOMMU can restrict DMA access, but implementation bugs, firmware flaws, incompatible drivers, and new hardware techniques can create openings. Secure Boot and TPM attestation make early compromise harder, but anti-cheat teams still need runtime detection, server-side analytics, account enforcement, driver protections, and game architecture that minimizes sensitive information exposed to the client.
Riot explicitly separates behavioral detection from client-side cheat classification in VALORANT, showing why layered defense still matters. A suspicious player may be caught because the hardware path failed, because the operating system state was untrusted, because the anti-cheat recognized tampering, or because server-side performance data revealed behavior inconsistent with legitimate play. The best anti-cheat systems are not betting the match on one detector.
There is also a cost for legitimate players. Stronger requirements can force BIOS updates, newer Windows versions, security features that were previously disabled, or replacement of hardware that does not cooperate with current memory-isolation standards. FACEIT, for example, says Windows 11 will become required on October 14, 2026, as it moves toward a stronger security baseline. These policies can be annoying for players maintaining older competition rigs, but they reflect a real change in the threat model rather than arbitrary feature creep.
The Next Anti-Cheat Battle Is About Trusting the PC Itself
The old cheat war centered on whether the game process had been modified. DMA cheating pushed the fight below that level, forcing anti-cheat developers to ask whether the hardware touching memory can be trusted and whether the machine was secure before Windows ever reached the desktop. That is a much bigger question, and it explains why motherboard firmware, TPM attestation, IOMMU configuration, Windows virtualization security, and kernel anti-cheat now appear in the same conversation.
For competitive communities, this also changes what a tournament-ready PC means. High refresh rates, low input latency, stable frame times, and clean network performance are still the familiar requirements, but system integrity is becoming another part of the specification. A machine that cannot prove its boot state or contain DMA-capable hardware may increasingly find itself outside the security baseline used by serious matchmaking and tournament platforms.
DMA cheats earned their reputation because they moved valuable parts of the cheat outside the place defenders traditionally watched. The response is not simply a more aggressive scanner. It is a PC architecture in which devices get narrower memory permissions, firmware has to establish those protections early, Windows has to preserve them, and anti-cheat can verify that the chain remained intact before allowing the player into competition.