A DMA cheat is a hardware cheat that reads a game's memory through direct memory access (DMA). A card in the gaming PC's PCIe slot copies that memory to a second computer, and the cheat runs there instead of on the gaming PC. Riot Games counts DMA among the 3 methods cheaters in its competitive games have favored over the last 5 years, and on May 22, 2026 it said Vanguard now enforces IOMMU memory protection on accounts identified as using DMA cheating devices.
DMA cheats are harder to catch than software cheats, but they get caught. Anti-cheat makers inspect the PCIe devices in a PC, block DMA reads with the IOMMU and study how players perform, and a caught DMA cheater can lose the PC as well as the account.
Sellers pitch DMA as the cheat no anti-cheat can see. The anti-cheat makers' own posts say otherwise.
What Is a DMA Cheat?
A DMA cheat is game cheating built on direct memory access, the feature that lets hardware such as network cards, storage controllers and graphics cards move data in and out of RAM without waiting on the CPU. Microsoft credits DMA for the speed of PCIe devices. The cheat version adds a purpose-built card to the gaming PC and uses that same right of access to copy the game's memory out of the machine.
The meaning of "DMA cheats" comes down to where the cheat lives: in hardware, outside the gaming PC's software. Wikipedia files the technique under the DMA attack, a computer security term for a device that abuses a high-speed expansion port to read or write a computer's physical memory, for example to steal cryptographic keys.
What a DMA cheat pulls out is whatever the game keeps in memory, such as enemy positions and health. Riot says DMA hardware is usually used for wallhacking, and that it pays off in tactical shooters, where the server's fog of war cannot hide every enemy from the game client.
How DMA Cheats Work
A DMA cheat setup has three parts, and none of them runs cheat software on the gaming PC:
- A DMA card, an FPGA-based PCIe card inside the gaming PC that reads physical memory directly.
- A second computer, laptop or desktop, that receives the copied memory, finds the game data in it and runs the cheat.
- An output back to the player, usually a radar or wallhack display (ESP). Some setups add an input device that moves the mouse for aim.
Riot's June 24, 2026 post introducing Vanguard On-Demand describes a purpose-built DMA card used to "exfiltrate entire pages of physical memory to a second PC." The second computer then scans those pages for the data the cheat needs.
The DMA Card, Board or Device
A DMA card, also sold as a DMA board or DMA device, is a PCIe expansion card usually built around an FPGA, a chip that can be programmed to behave like almost any device, so its firmware decides what it reports itself to be. Cheat sellers advertise firmware that passes the card off as an ordinary part such as a Wi-Fi adapter, and anti-cheats such as ACE now check each PCI device against a list of standard ones instead of trusting its label.
The same class of hardware has honest uses. Wikipedia lists kernel debugging, and Riot's anti-cheat team notes that DMA has legitimate jobs in printers, sound cards and Wi-Fi adapters, and that is the cover cheaters exploit.
Why Cheat Makers Moved to Hardware
DMA cheats spread because kernel-level anti-cheats got good at catching cheat software on the gaming PC. Riot calls Vanguard a kernel anti-cheat, and Steam lists Easy Anti-Cheat, Denuvo Anti-Cheat and EA Javelin as kernel-level anti-cheats. A DMA setup leaves little for them to find on the PC: the cheat logic runs on another machine, and Riot's December 2025 security update describes DMA cards as reaching memory directly, around both the CPU and Windows.
Riot's December 11, 2023 anti-cheat update called DMA one of the more advanced methods in Valorant's cheating communities, used "to try to work outside of Vanguard." The catch is cost and effort. A DMA rig needs a second computer, special hardware and custom firmware, and Riot calls DMA cheating "one of the world's most expensive hobbies."
Can Anti-Cheat Detect DMA Cheats?
Yes, anti-cheat can detect DMA cheats, though the makers admit no system catches every setup at once. FACEIT's February 27, 2025 patch notes asked "Does FACEIT AC Detect DMA Cheats?" and answered "Yes," crediting TPM 2.0 and kernel-level access. The Delta Force team adds that no anti-cheat stays cheat-proof forever. The defenses Riot, Anti-Cheat Expert (ACE) and Microsoft document fall into three layers.
IOMMU and Kernel DMA Protection
The IOMMU (input-output memory management unit) is the hardware that sits between DMA-capable devices and RAM and decides which device may reach which memory. Intel calls it VT-d and AMD calls it AMD-Vi. Windows 10 and 11 build Kernel DMA Protection on it: Microsoft's Kernel DMA Protection documentation says Windows uses the IOMMU to stop external PCIe peripherals, such as Thunderbolt and USB4 devices, from performing DMA unless their drivers support memory isolation.
Riot turned the IOMMU into an anti-cheat tool. Its May 22, 2026 statement says that once IOMMU protection is on, DMA cheat devices are blocked from reading memory in its games, and a rig that keeps trying may throw hardware faults. Riot's December 18, 2025 security update closed a boot-time gap as well: some motherboard firmware reported Pre-Boot DMA Protection as on while the IOMMU was not initialized correctly during early boot, and Vanguard now prompts affected players to update that firmware. Riot noted on September 20, 2024 that consoles already guard game memory this way, and DMA is "virtually nonexistent" there.
Riot's account restrictions also lean on the TPM. When Riot restricts an account, only a firmware TPM satisfies the requirement, because a discrete TPM module can be pulled and replaced. Riot calls the TPM's factory-burned Endorsement Key a hardware identity it could ban on sight, and that key is what TPM bans are built on.
Device and Firmware Checks
Anti-Cheat Expert checks the PCI devices in a PC while a game runs against a library of standard devices it keeps updated, and it interferes with any card it identifies as a DMA device. Delta Force, which uses ACE, announced DMA Shield on December 17, 2025: built on Windows' Kernel DMA Protection, it sends an unrecognized device to empty or junk memory instead of the game's data. Riot's League of Legends write-up from April 11, 2024 lists "are you currently using a DMA device" among the yes-or-no checks Vanguard reports.
Firmware is where DMA cheaters can get caught in groups. ACE's explainer, quoting an industry article, says cheaters use custom firmware "to avoid widespread bans triggered by other players' detections," which implies a firmware shared by many buyers can be flagged once and hit all of them.
Behavior and Server-Side Detection
Behavior detection catches DMA cheaters by what they do in a match, whatever hardware sits in the PC. ACE reviews replays, its name for recorded gameplay data, and runs big-data and AI analysis on player behavior to spot wallhack-style play. Ubisoft says the Data Ban system in Rainbow Six Siege moved to a machine learning model that weighs far more data points about each player's performance. FACEIT delays some bans on purpose: an engineer approves each new detection, and the wait keeps cheat makers from learning which signal caught them.
What Happens When a DMA Cheater Gets Caught
A caught DMA cheater can lose the account, the PC or both, depending on the publisher. Anti-Cheat Expert says it bans "accounts and machines that use DMA cheats." Riot applies its VAN:Restriction, a block that holds until security requirements are met, at the account or HWID level when Vanguard sees suspicious hardware behavior, and Riot lists hardware bans on reoffenders among Vanguard's actions in Valorant. Delta Force adds that a card caught trying to get past DMA Shield can have its hardware signature flagged, which makes starting over with a new account on that rig much harder.
Three different things can be blocked:
- An account ban locks the game account. Riot's Valorant support page says cheating with unauthorized hardware or software gets an account permanently banned, and players who queue with cheaters get 180-day bans.
- A hardware ban locks the PC through its hardware IDs, so a new account on that PC is blocked too. ACE's machine bans turn a DMA bust into a ban that follows the PC rather than one account.
- A device block stops the DMA card itself. In Riot's games the card stops reading memory once IOMMU is enforced. Riot says the card works again if IOMMU is switched off, but its games then still require IOMMU, so the device is worthless for Valorant while the PC itself is not "bricked."
DMA Cheats by Game
DMA cheats are documented differently in every game. Riot names DMA outright, while Epic, Embark, EA and Ubisoft write about cheat hardware, hardware bans or boot security, and none of their pages we read names DMA. Here is what each publisher's own pages say for the games behind the most common "dma cheat" searches:
| Game | Anti-cheat | What the publisher documents |
|---|---|---|
| Valorant | Riot Vanguard | IOMMU forced on DMA accounts; account or HWID restrictions |
| Fortnite | Easy Anti-Cheat | Terms ban cheat hardware connected to your device |
| Arc Raiders | Denuvo Anti-Cheat | Hardware bans on the PC, across all Embark games |
| Rust | Easy Anti-Cheat | No DMA statement found |
| Rainbow Six Siege | BattlEye | No DMA statement; machine learning Data Bans |
| Battlefield 6 | EA Javelin | Secure Boot and TPM 2.0 required; no DMA statement |
Valorant has the most detail. DMA hardware is one of the reasons Vanguard bans players in Valorant, next to kernel cheats, pixelbots and tampering with the anti-cheat.
Fortnite falls under Epic's terms of service, last updated September 10, 2026, which forbid having "cheat software, tools, or hardware present on or connected to your device." Epic's terms don't name DMA. A DMA card plugged into the PC is the kind of hardware that wording covers, but that is our reading, not Epic's.
Arc Raiders lists Denuvo Anti-Cheat on its Steam page, and none of Embark's pages we read mention DMA. Embark's hardware bans are its tool against a machine: the Help Center says a hardware-banned PC can no longer run any Embark game, THE FINALS included.
Rust's developer Facepunch and Rainbow Six Siege's publisher Ubisoft have no DMA statement in the sources we checked. Ubisoft's May 2024 anti-cheat update for Siege covers Data Bans, its QB system and MouseTrap, so the answer to "Can R6 detect DMA?" is that Ubisoft hasn't said. EA says Battlefield 6's Secure Boot and TPM requirements target memory manipulation and hardware ID manipulation, again without naming DMA.
One publisher outside this list went further. Krafton rewrote the PUBG: BATTLEGROUNDS terms, effective June 12, 2024, to name DMA boards as unauthorized hardware, with penalties up to a permanent ban and restrictions on the player's hardware devices.
Escape from Tarkov is another game where the developer names DMA. Battlestate Games' April 2026 anti-cheat diary pointed to a growing number of DMA tools among Tarkov cheats and listed IOMMU, VBS and HVCI as protections it may add in response.
The Real Risks of DMA Cheating
The risks of DMA cheating go past one lost account:
- Late bans. FACEIT bans everyone using a method once an engineer confirms the detection, so a setup that seems fine today can be caught later.
- Dead hardware. Riot says its IOMMU enforcement makes cheat devices worthless for Valorant.
- Scams. FACEIT says most videos claiming cheats work on its servers are scams, filmed on non-FACEIT servers or with detected cheats used right before the ban to sell fakes.
Where Saturn Fits After a Hardware Ban
Saturn fits only after the fact, when a publisher has hardware-banned the gaming PC. Saturn, an HWID spoofer for Windows, clears that hardware ID ban by changing the identifiers the ban was tied to. It is not a cheat and not a DMA tool. It does not hide a DMA card, does not change the card's own identifiers, and does not get anything past an anti-cheat.
That is what a spoofer changes: the motherboard's board and SMBIOS IDs, the CPU, the TPM, the disks (NVMe, SSD, HDD), RAM serials, the GPU, the monitor's EDID, the MAC address, USB IDs and UEFI firmware variables, with dozens of further IDs on top. One loader covers Vanguard, Easy Anti-Cheat, BattlEye, FiveM, EA Javelin and ACE, and the license decides which of those anti-cheats are included.
Saturn runs in two modes. The difference between temporary vs permanent spoofers decides how long the clean IDs last. Temporary mode clears the ban only while Saturn runs, with unlimited profiles; close it and the original, banned IDs come back. Permanent mode rewrites the hardware IDs for good, so the PC itself is cleared, using one HWID profile that has to be replaced with a newly bought one if it gets banned.
Account bans stay where they are. A spoofer cannot restore a banned Riot, Epic or Embark account, and a DMA card that a game blocks or flags stays blocked. Publishers also treat getting around a hardware ban as a violation of its own: Riot's ban data says its "tampering" category is most often triggered by cheaters trying to bypass hardware suspensions, and EA lists hardware ID manipulation among the cheats its Battlefield 6 checks target. Whether to play again on a spoofed PC is your own call, with that risk attached. Saturn's free trial lasts 24 hours and needs no payment card, only an email address.
DMA Cheats FAQ
Can you get banned with a DMA card?
Yes. Riot permanently bans Valorant accounts for unauthorized cheat hardware, Epic's terms forbid cheat hardware connected to your device, and Krafton's PUBG terms name DMA boards.
Do DMA cheats cause hardware bans?
They can. Anti-Cheat Expert bans accounts and machines over DMA cheats, and Riot restricts at the account or HWID level, but not every publisher documents a hardware ban for DMA.
Can Rainbow Six Siege detect DMA cheats?
Ubisoft has not said. Siege runs BattlEye and machine learning Data Bans, but Ubisoft has published nothing about DMA by name.
What is a DMA card used for?
A DMA card reads a computer's memory without going through the CPU. DMA hardware has legitimate uses such as kernel debugging; in games it becomes a cheat when it copies a protected game's memory to a second PC.
Does Vanguard detect DMA cheats?
Yes. Riot Vanguard checks whether a DMA device is in use and enforces IOMMU on accounts identified as using one, which blocks the card from game memory.
Does an HWID spoofer hide a DMA card?
No. An HWID spoofer changes the hardware IDs of the PC's own parts. It does not hide a DMA card or stop the IOMMU from blocking one, and Saturn leaves both the card and the account alone.