Riot's Vanguard Anti-Cheat Now Detects $6,000 DMA Hardware

Key Takeaways

• Riot's Vanguard can now detect DMA cards that physically slot into PCIe slots to read game memory directly
• DMA cheating hardware costs up to $6,000 and was previously undetectable by kernel-level anti-cheats
• This marks a new front in the arms race between game developers and cheat makers

Riot Games is gloating. The company behind Valorant posted on X to taunt cheaters who invested thousands of dollars in specialized hardware designed to bypass its Vanguard anti-cheat system. That hardware no longer works.

“Congrats to the owners of a brand new $6k paperweight.”

— Riot Games on X

The target of Riot's mockery: Direct Memory Access (DMA) cards. These physical devices slot into a computer's PCIe slot and read game data directly from RAM, bypassing the operating system entirely. Until now, this hardware-level approach let cheaters evade even kernel-level anti-cheat software.

How DMA Cheats Worked

To understand why this matters, you need to understand how anti-cheat software has evolved. Years ago, cheat programs ran as standard applications. They hooked game data through normal methods the operating system allows. Game developers countered by building anti-cheats that could detect these hooks.

Cheat makers responded by going deeper. They started running their software at 'ring 0', the kernel level where system drivers operate. At this level, cheats can read game data from memory without the usual restrictions that apply to normal applications.

This led to kernel-level anti-cheats like Vanguard, which Riot launched in 2020. These systems run at the same deep level as the cheats, giving them visibility into suspicious software that operates at ring 0. Vanguard was controversial because it loads when Windows boots, not just when you launch a game.

But there's a layer below ring 0: the hardware itself. DMA cards exploit a feature of modern CPUs that allows certain hardware to access RAM directly, bypassing the CPU for the sake of speed. Legitimate devices like high-end network cards use this capability. Cheaters figured out they could use it too.

The Hardware Workaround

A DMA cheat card physically plugs into a computer's PCIe slot. It pretends to be harmless hardware while secretly reading game data directly from system memory. Because the cheating happens at the hardware level, software-based anti-cheats couldn't detect it. The data never passes through the operating system's normal channels.

These devices aren't cheap. Some cost up to $6,000, which is the figure Riot cited in its taunting post. Buyers presumably calculated that the expense was worth it for undetectable cheating in competitive games.

That calculation just changed. Riot hasn't explained exactly how Vanguard now detects DMA cards. The company has strong incentives to keep those details private. Revealing the detection method would help cheat developers find new workarounds.

The Endless Arms Race

Anti-cheat versus cheat is a perpetual arms race. Each time developers close one door, cheaters search for another. The jump to DMA hardware represented a significant escalation. It moved the battlefield from software to physical devices that cost real money and require technical knowledge to install.

Riot's ability to detect these cards is notable because it suggests the company has found ways to identify suspicious hardware-level memory access patterns, even when that access bypasses the operating system. This could involve monitoring for anomalies in how memory is being read, or detecting the signatures of known DMA cheat cards.

For legitimate competitive players, this is welcome news. DMA cheats were particularly frustrating because they were nearly impossible to catch through traditional means. A player using a DMA card could run an aimbot or wallhack while appearing completely clean to most anti-cheat systems.

What Happens to the Hardware

Players caught using DMA cards face the same consequences as any other detected cheater: bans. But the financial sting is sharper. A software cheat might cost $50 per month. A DMA card costs thousands upfront, and now it's useless for its intended purpose in Valorant.

Whether other games will follow Riot's lead remains to be seen. Vanguard is among the most aggressive anti-cheats in gaming. Other developers may lack the resources or willingness to implement similar detection. For now, Valorant players have one less type of cheater to worry about.

Frequently Asked Questions

What is a DMA cheat card?

A DMA (Direct Memory Access) cheat card is physical hardware that plugs into a computer's PCIe slot. It reads game data directly from RAM, bypassing the operating system and traditional anti-cheat software.

How much do DMA cheat cards cost?

High-end DMA cheat cards can cost up to $6,000, according to Riot Games. The high price reflected their previous ability to evade detection.

Does Vanguard anti-cheat work on all games?

No. Vanguard is Riot's proprietary anti-cheat that only works on Riot games like Valorant and League of Legends. Other games use different anti-cheat systems.

Why is Vanguard controversial?

Vanguard runs at the kernel level and loads when Windows boots, not just when you play a game. Some players consider this too invasive, though Riot argues it's necessary for effective cheat detection.

Can DMA cheat cards be used for anything else?

DMA cards can have legitimate uses in security research and system diagnostics. However, cards marketed specifically for cheating are typically optimized for that purpose and may have limited alternative value.

Source: PCGamer latest