dma-attack-techniques

PCIe DMA cheats use an external FPGA PCIe endpoint to send TLPs directly to system memory, bypassing the OS entirely. This external device architecture ensures no attacker code executes on the gaming PC, reading memory below the operating system level via direct hardware access.

PCIe configuration fingerprint validation checks TLP header fields, tag discipline, MPS/MRRS negotiation, completion splitting patterns, LTSSM/ASPM signals, and capability chains. These protocol-level observables identify untrusted external devices attempting DMA attacks through hardware behavior anomalies.

Model IOMMU enforcement by mapping IOTLB, ATS, PASID, and interrupt remapping to defensive controls. Evaluate ATS untrusted mode, ACS enforcement for P2P paths, and IOMMU fault signaling to constrain DMA access and detect unauthorized memory reads from external PCIe devices.

ACS enforcement blocks unauthorized peer-to-peer DMA paths, preventing direct memory access between devices. It complements IOMMU fault signaling and PCIe configuration fingerprint validation to detect pcileech workflows and constrain external FPGA devices acting as untrusted PCIe endpoints.

Device impersonation and firmware mimicry limit detection by emulating legitimate PCIe endpoint behaviors. However, physical-layer LTSSM/ASPM signals, TLP tag discipline, and completion splitting patterns remain observable, allowing anti-cheat systems to identify untrusted devices through protocol-level fingerprinting despite firmware spoofing.

Measured attestation provides a third defense layer alongside PCIe-level fingerprinting and IOMMU enforcement. By validating device integrity, it detects firmware mimicry and device impersonation, mapping protocol observables to defensive controls for comprehensive DMA threat mitigation in game security scenarios.