DMA hardware and cheats: a complete breakdown.

DMA stands for Direct Memory Access. This isn't a hacker term, but a standard technology that's been built into every computer for decades.

The gist is simple: the processor (CPU) is the brain that calculates everything. RAM is the desktop, where all the game information is stored in real time: player coordinates, health, weapons, loot, crate contents.

Without DMA, any device (network card, SSD, sound card) is forced to constantly yank the processor. The CPU is distracted, fetching data, and then returning to work. This slows down the system.

DMA solves this problem: the device accesses RAM directly over the PCIe bus, without the processor's involvement. It's fast, efficient, and safe for anti-cheat software.

If a device can read and write to memory without permission, it can be abused. This is exactly how DMA cheats work.

PCI Express is a high-speed bus on the motherboard. It connects the graphics card, SSD, network cards, and DMA card.

When the PC is turned on, each PCIe device presents itself to the system: it reports its Vendor ID, Device ID, and fills out the configuration space. The system sees it as a regular network card and loads the driver.

Key fact: every PCIe device is DMA-capable by default. This is what cheats exploit.

Imagine: a gaming PC in an apartment, an anti-cheat guard inside. He sees regular cheats right away.

And now someone drilled a hole in the wall from the neighboring apartment and inserted a tube. The guard can't see the tube—it's connected at the hardware level.

Physical diagram

- Gaming PC: a board on an FPGA chip is inserted into a free PCIe slot (or M.2 via an adapter). To the system, it looks like a regular device.

- Second PC: connected via cable (USB 3.2 / Thunderbolt). All the cheating software runs here: LeechCore, VMM, ESP, radar, and aimbot software.

- Process: the second PC sends a command to the board, which reads the gaming PC's RAM, the data is processed, and displayed on the screen.

Image output:

- Separate monitor (radar/ESP).

- Fuser (HDMI combiner) - merges signals from two PCs into a single image without lag.

What does the anti-cheat see? Zero processes, zero DLLs, zero drivers. Everything dirty is physically on another computer.

Gaming PC

Clean. You only need a free PCIe x1/x4/x16 slot (or M.2). The rest is a regular gaming PC.

Second PC (or Laptop)

This is where all the magic happens: LeechCore / VMM / FTD3XX, data processing, radar rendering, and ESP. The requirements for 2026 aren't prohibitive:

- Minimum 4 cores / 8 GB RAM.

- Windows 10/11. (The smallest builds are best for optimized read speeds.)

- USB 3.0 / Thunderbolt (for maximum speed).

A laptop as a second PC is possible, but with some caveats. The screen is usually 1080p 60 Hz, so you'll need to configure the virtual display for the overlay to work correctly.

FPGA (Field-Programmable Gate Array) is a programmable gate array. Simply put, it's a chip that can be reprogrammed at the hardware level to do anything.

A regular processor executes programs—a set of instructions. An FPGA is different: you literally rebuild the chip's internal logic, as if reassembling the chip from its basic components. The same FPGA can function as a network controller, a video processor, or a DMA controller—depending on the firmware.

Why not a regular microcontroller?

- FPGA is incredibly fast—the logic is hardcoded into the hardware, not interpreted.

- Fully supports the PCIe bus at the hardware level—it appears to the system as any PCIe device.

- Firmware can be updated—the cloaking is updated with every anti-cheat update.

The XC7A35T (35T) is garbage

| Speed: ~150 - 190 MB/s

| Reads/sec: 4,000 - 6,000 |

| Resources: Minimal logic and BRAM

| Card price: $50+

The smallest chip. Few internal resources – only basic memory reading without complex processing. Firmware developers are cramped: there's no room for high-quality masking. Outdated. Firmware updates for it are less frequent, and it's unstable in demanding games. Basically, garbage.

The XC7A75T (75T) is the golden mean

| Speed: 200 MB/s+

| Reads/sec: 5,000 - 12,000

| Resources: Significantly more logic and BRAM

| Card price: $100+

A workhorse. Significantly more resources → complex obfuscation, parallel data processing, stable performance with various games. Easy to flash, suitable for 95% of tasks. The best choice for the vast majority of users. Optimal price/quality ratio.

XC7A100T (100T) - top-tier

| Speed: Up to 220+ MB/s

| Reads/sec: 6,000 - 13,000+

| Resources: Maximum

| Card price: $150+, you can buy Heino 1.2 for $560.

Maximum logical resources and internal memory. The most complex firmware logic, best obfuscation, and support for multiple data channels simultaneously. Consumes more power. Only worthwhile if maximum speed is needed.

Thunderbolt DMA (ZDMA) (100T+75T)

| Speed: 1 Gb/s

| Reads/sec: 50,000+

| Resources: Outrageous

| Card Price: $600+

This is where the real magic—and the real headache—begins. The firmware is loaded into the FPGA chip and determines how the DMA card behaves. This is literally the most important element of the entire system.

What the anti-cheat sees

The anti-cheat scans the list of PCIe devices and sees not the physical card, but what it appears to be. The firmware creates the configuration space—registers with the Vendor ID, Device ID, and dozens of other parameters.

- High-quality firmware—the DMA card completely emulates the device it's masquerading as.

- Good firmware—the DMA card looks like a regular Realtek network card, sound card, or USB controller. Something so mundane that the anti-cheat skips over it without suspicion.

- Stock/free firmware—a cardboard mask with the words "I'M NOT A CHEATER." The anti-cheat immediately detects an unfamiliar Vendor ID, incorrect registers, and a non-existent model. Ban.

What does high-quality firmware do?

1. Full emulation of the configuration space of a real device. All registers, all capability structures, all PCIe expansions are filled exactly like those of a real device. The anti-cheat checks dozens of parameters – everything matches.

2. Simulation of the behavior of a real device. Advanced anti-cheat solutions don't just look at registers – they "talk" to the device: send requests and analyze the responses. Good firmware responds just like a real device.

3. Optimization of read patterns. If a DMA card systematically reads the same addresses every millisecond, this is suspicious. Good firmware randomizes the timings and read order.

ESP / Wallhack

The most common. All players' coordinates, health, view direction, and current weapon are retrieved from memory. On the second monitor (or via the Fuser over the game), frames around enemies, lines, distances, and HP bars are drawn. You can see every enemy through any walls.

In shooters (CS2, Valorant, Apex Legends, Fortnite, Tarkov, R6 Siege, PUBG), this is a huge advantage. You'll never be caught off guard.

Radar

A top-down view with all players' dots is drawn on the second monitor. Like a minimap with WH, you can see who's where, where they're moving, and whether it's safe to run. It works even in games without a radar.

Aimbot via recording to memory

If the firmware supports recording, you can change the character's viewing angle, forcing the crosshair to automatically aim at the enemy. A more risky option: recording leaves more traces and is easier to detect.

Aimbot via hardware mouse emulation

An alternative and more secure approach. A second PC sends commands to a special device (KMBox Net, MAKCU), which is connected between the mouse and the gaming PC. The device intercepts the movements of a real mouse and incorporates micro-corrections from the aimbot.

For the gaming PC, these are normal mouse movements. No suspicious software, no injections. The device emulates real HID peripherals with the same handles as a real mouse.

Loot Reading

In inventory games (Tarkov, PUBG, DayZ), you can see the contents of containers, backpacks, and valuable items on the map. Everything is visible through walls and from a distance. You collect the most valuable loot faster than anyone else.

"No Recoil" and Other Modifications

By writing to specific addresses, you can eliminate spread, recoil, and other game mechanics.

A fuser (HDMI/DP combiner) is a hardware solution that physically combines two HDMI/DP signals into a single output:

The primary signal is the pure game from your gaming PC (without any internal overlays).

The second signal is a transparent overlay (ESP, radar, aimbot indicators, timers, etc.) from a separate mini PC or laptop.

The result is a single, beautiful image on your monitor, where the game and cheat appear as a single unit.

Main advantage:

Anticheat (VAC, EAC, BattlEye, Faceit, Vanguard, and any others) only sees the game from the primary PC. The overlay physically bypasses the gaming PC's graphics card—it simply doesn't exist in the system. No injections, DLLs, drivers, or suspicious processes.

What does Fuser offer:

- Complete invisibility at the hardware level

- Zero load on your gaming PC

- Minimal latency (less than 1 ms)

- Support for high resolutions and refresh rates (up to 4K 144+ Hz depending on the model)

- Works with any games and any cheats

- One monitor - no switching or Alt+Tab

- Easy to set up: just two HDMI inputs and one output

- Ideal for those tired of software overlays that get banned within 1-2 days.

Fuser is when the cheat and the game exist in separate worlds, and you see them together.

Traditional anti-cheat solutions (Vanguard, Ricochet, BattlEye, EAC) operate at the OS level. DMA operates below, at the hardware level.

What anti-cheat solutions are trying to do in 2026:

- PCIe device and configuration space checking.

- IOMMU + Azure Attestation (a new Microsoft feature).

- Read pattern analysis.

- Server culling (avoid sending data that shouldn't be visible).

- The most effective approach is server culling + behavioral ML. However, it requires powerful servers and can reduce gameplay smoothness.

Buying a card with public/stock firmware

The most common and most expensive mistake. Firmware is the only thing that anti-cheat software (Vanguard, FACEIT, EAC, BattlEye) actually detects.

Newbies buy a "ready-made" card for $100-$300 with "TOP FIRMWARE" → ban in 1-7 days.

Correct: a cheap card (75T/100T) + custom firmware from a trusted developer ($300-$1000+). Without it, 100% detection.

Obvious cheating behavior

100% headshot, 50+ K/D on a new account → AI analysis + manual bans. Bragging in chat or on a stream → instant reports.

Hot Removal of the Card

Removing the DMA card from a running PC. Result in 80% of cases: a fried card and a fried motherboard. Always turn off the PC before handling the board.

Weak Secondary PC

An old computer without USB 3.0, without a proper video output (HDMI/DP), with very weak hardware. Result: lags, delays, and instability. Minimum 4 cores and 8 GB of RAM.

Not testing the device after flashing.

After flashing, do not test how the device appears in the system and do not reboot the PC without completely disconnecting it from the power outlet. Old device data remains in the system cache.

IOMMU enabled by default.

Improved server culling.

Hardware attestation (Intel TXT / AMD SEV).

Increased entry cost (custom firmware is becoming more expensive).

DMA won't be completely eliminated, but it's entirely possible to make it very expensive and risky.

As of March 2026, DMA cheats remain the most reliable and effective way to bypass virtually any kernel-mode anti-cheat. The key is high-quality proprietary firmware, a proper dual-computer setup, and careful gaming without unnecessary fuss. When everything is configured correctly, the anti-cheat simply doesn't notice what's going on: all the dirty software resides on a separate second PC, and the gaming computer remains squeaky clean. No suspicious processes, DLLs, drivers, or strange memory access—only hardware access via PCIe, which traditional anti-cheats physically can't fully control.

Of course, the industry is constantly evolving. Game and anti-cheat developers are constantly inventing new barriers: server culling, improved IOMMUs, behavioral analysis, and attestation. But it's a classic arms race. DMA won't disappear completely because it's built into the very architecture of modern computers. You can make it more expensive and complex, but completely closing it is practically impossible without completely overhauling the entire hardware.

If you approach things wisely—choose a decent 75T card, use proprietary firmware, configure the fuser or MAKCU, and don't immediately start wiping everyone with 100% headshots—then DMA provides a real and lasting advantage. This isn't about "easy bans in a week," but about a well-thought-out tool that works for months and even years when used correctly. Overall, the topic is alive and well, and will remain so for a long time. The main thing is to take your time and do everything wisely.

High-quality DMA cards, proprietary firmware, fusers, KMBox/MAKCU, and a complete setup can be purchased at dma-market.com.