dma-attack-techniques

name dma-attack-techniques description Guide for PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security. Use this skill when researching pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation in game security research. DMA Attack Techniques Overview This skill covers Direct Memory Access research from the awesome-game-security collection, focusing on FPGA-based PCIe attacks, pcileech usage, physical-memory access workflows, and the defensive limits of software anti-cheat once a hostile device can read memory below the OS. README Coverage Cheat > DMA Anti Cheat > Detection:DMA Anti Cheat > Detection: Hacked Hypervisor Anti Cheat > Detection:Virtual Environments Anti Cheat > Detection:HWID Windows Security Features Threat Model External DMA Cheat Architecture A modern external DMA cheat consists of three components: 1. Cheat PC — runs the cheat application, signature databases, aim assistance, ESP rendering, and a network/USB link to the gaming PC. 2. DMA Card — an FPGA-based PCIe endpoint installed in the gaming PC (typically M.2 NVMe slot). Exposes a memory-read/write interface to the cheat PC. Uses Bus Master capability to issue Memory Read TLPs against the gaming PC's RAM. 3. Actuator (optional) — a USB HID emulator (microcontroller-based) that injects keyboard/mouse input on the gaming PC according to commands from the cheat PC, closing the loop. The structural property that makes this threat distinctive: no attacker code executes on the gaming PC. The DMA card performs hardware-level transactions between the FPGA and the gaming PC's memory controller, mediated by the chipset and (when configured) the IOMMU. The gaming PC's OS, drivers, and anti-cheat see only a PCIe device announcing itself through Configuration Space and performing what looks like ordinary DMA. Three Defense Layers Layer Mechanism What It Catches ───────────────────────────────────────────────────────────────────────────── PCIe-layer Inspect Config Space & Identity mismatch — spoofed fingerprinting behavior at the bus level device that doesn't match real silicon's full signature IOMMU Use the IOMMU to bound Out-of-domain DMA — device enforcement what physical memory the trying to read game memory device can touch it wasn't allocated External TPM-anchored measured boot, Boot-chain compromise — IOMMU attestation cloud-verified or kernel itself subverted PCIe Protocol Stack Three Protocol Layers Layer Unit Function ──────────────────────────────────────────────────────────────── Transaction TLP Memory/IO/Config reads & writes, completions, messages Data Link DLLP Acknowledgements, flow control credits, power management Physical Ordered Sets Link training, equalization, clock recovery A real device's behavior is shaped by all three layers. Many FPGA designs primarily customize Transaction-Layer behavior; Physical and Data Link behavior may retain implementation fingerprints unless the selected IP, configuration, and surrounding behavior closely match the claimed device. Whether a fingerprint is usable must be validated on the actual link. TLP (Transaction Layer Packet) Format Every TLP contains a 3 DW (12-byte) or 4 DW (16-byte) base header; optional TLP Prefixes may precede it. 4 DW headers are used for 64-bit addresses and certain message types. First DWord (DW0) encoding: Bits Field Notes [31:29] Fmt[2:0] Header format + data presence [28:24] Type[4:0] TLP type (combined with Fmt) [22:20] TC[2:0] Traffic Class (default 0) [18] Attr[2] ID-Based Ordering (IDO) [15] TD TLP Digest (ECRC trailer) [14] EP Poisoned data [13:12] Attr[1:0] Relaxed Ordering, No Snoop [11:10] AT[1:0] Address Type (critical for ATS bypass) [9:0] Length[9:0] Payload length in DWords (0x000 = 1024 DW = 4 KB) Fmt[2:0] encoding: 000 = 3 DW header, no data 001 = 4 DW header, no data 010 = 3 DW header, with data 011 = 4 DW header, with data 100 = TLP Prefix Key TLP types (Fmt + Type combinations): Fmt Type TLP 000 0_0000 MRd (Memory Read, 3DW / 32-bit addr) 001 0_0000 MRd (Memory Read, 4DW / 64-bit addr) 010 0_0000 MWr (Memory Write, 3DW) 011 0_0000 MWr (Memory Write, 4DW) 000 0_0100 CfgRd0 (Config read — terminate at this device) 010 0_0100 CfgWr0 000 0_0101 CfgRd1 (Config read — forwarded by bridges) 010 0_0101 CfgWr1 000 0_1010 Cpl (Completion without data) 010 0_1010 CplD (Completion with data) 001 1_0rrr Msg (Message, no data) 011 1_0rrr MsgD (Message with data) Detection-Relevant DW0 Fields TC[2:0] — Traffic Class. Default traffic commonly uses TC0, but non-zero TC is valid when platform and device policy configure it. Compare usage with the claimed device, driver, and workload rather than flagging it in isolation. Attr[2:0] — RO/NS/IDO. A device emulating a NIC must follow that NIC's typical NS/RO usage pattern; mismatches are visible. AT[1:0] — Address Type: 00 = Untranslated (IOMMU will translate) 01 = Translation Request (ATS only) 10 = Translated (device claims it has already translated via ATS) This field is the basis of ATS bypass attacks. TD — TLP Digest. If set, an ECRC trailer is present. EP — Poisoned. Indicates data is known-bad. TLP Routing and Requester ID Three routing modes: - Address routing — Memory and IO TLPs, matched against bridge apertures - ID routing — Config TLPs and Completions, by BDF - Implicit routing — Some Messages (broadcast, terminate at root) DW1 carries the Requester ID (16 bits = Bus:Device:Function, "BDF") and an 8-bit Tag for matching completions to requests. Requester ID is a key input to IOMMU lookup, ACS source validation, AER source identification, and interrupt-remapping policy. If spoofed IDs are accepted without topology or source validation, per-function isolation can be undermined; the exact effect depends on the platform and remapping path. Transaction categories: - Posted (P) — fire-and-forget (Memory Writes, Messages) - Non-Posted (NP) — requires completion (Memory Reads, IO/Config R/W) - Completion (Cpl/CplD) — response to Non-Posted requests Completion Status codes: 000 = Successful Completion (SC) 001 = Unsupported Request (UR) 010 = Configuration Request Retry Status (CRS) 100 = Completer Abort (CA) UR vs CA distinction matters for spoofing detection — real silicon responds differently to malformed config accesses vs accesses to unimplemented offsets. Many spoofed firmwares hard-code one or the other. Memory Read Completion Splitting A single Memory Read TLP returns up to Max_Read_Request_Size (MRRS) bytes. The completer splits the payload at any boundary >= RCB (Read Completion Boundary, 64 or 128 bytes). Each fragment cannot exceed Max_Payload_Size (MPS). Each Completion carries: - Lower Address[6:0] — lowest 7 bits of first byte address - Byte Count[11:0] — bytes remaining (last fragment's Byte Count equals its own payload length) - BCM — PCI-X compatibility (typically 0) - Tag — matches originating MRd's Tag The split pattern (fragment count, boundary positions) is a strong fingerprint: real memory controllers produce characteristic distributions of fragment sizes and inter-fragment gaps. BRAM-backed emulators producing perfectly uniform 64-byte fragments at constant cadence are anomalous. Tag Space and Fingerprinting - 5-bit Tag (original): 32 outstanding non-posted requests per Requester ID - Extended Tag (PCIe 1.1+, Device Control[8]): 8-bit / 256 outstanding - 10-Bit Tag (PCIe 4.0+, Device Control 2[12]): 1024 outstanding Tag turnover discipline — which tags get reissued and how quickly — reflects the device's internal request tracking pipeline. Firmware that issues reads with no tag turnover (same tag, or monotonic beyond negotiated limit) is observably distinct from real silicon. MPS and MRRS as Fingerprints Both are negotiated once at link bring-up and fixed for the session. - Device Capabilities[2:0]: Max_Payload_Size_Supported (0=128, 1=256, 2=512, 3=1024, 4=2048, 5=4096 bytes) - Device Control[7:5]: current MPS (must be <= Supported, set to minimum of all devices in hierarchy) - Device Control[14:12]: Max_Read_Request_Size (same encoding) The discriminator is donor consistency: a device claiming a donor that is known to support larger payloads, different tag behavior, or a different negotiated profile should match that donor under the same root-port constraints. Data Link Layer DLLPs provide reliable delivery between Physical and Transaction layers. DLLP Purpose ───────────────────────────────────────── Ack TLP received correctly Nak TLP received with error; sender must replay InitFC1/2 Flow control credit initialization at link bring-up UpdateFC Ongoing flow control credit updates PM_* Power management (L0s, L1 entry/exit) Vendor Vendor-defined Flow control credits are per TLP category: - PH / PD — Posted Header / Data - NPH / NPD — Non-Posted Header / Data - CplH / CplD — Completion Header / Data Negotiated credit values are not generally exposed through standard Link Capabilities register. They are visible in protocol-level traces, some root-port/vendor performance counters, or FPGA-side debug. Useful for lab fingerprinting and forensic captures, not normal runtime config-space detection. Physical Layer Two details matter even without PHY-level instrumentation: LTSSM (Link Training and Status State Machine): - States: Detect → Polling → Configuration → L0 (operational) → L0s, L1, L2 (low-power) → Recovery → Hot Reset → Disabled → Loopback - Observable via Link Status Register and root-port performance counters Detection-relevant: - Negotiated Link Width (Link Status[9:4]): Compare with slot wiring, platform policy, signal quality, and matched donor deployments; devices can legitimately train below maximum width - Current Link Speed (Link Status[3:0]): A lower negotiated generation is contextual, not a contradiction by itself - Recovery cycle frequency: Comparative signal; materially different from donor reference is anomalous ASPM (Active State Power Management): - L0s and L1 are link-level low-power states - Capability does not imply the platform enabled ASPM; evaluate transitions only under verified policy and workload conditions that should exercise them Configuration Access Mechanisms Two mechanisms on x86: CAM (Legacy I/O-port path): 1. CPU writes to I/O port 0xCF8 (Bus:Device:Function:Register) 2. CPU reads/writes at I/O port 0xCFC - Reaches only first 256 bytes - Still used during early BIOS/UEFI boot ECAM (Enhanced, MMIO path): 1. Read MCFG ACPI table for segment base addresses 2. Compute: addr = base + ((bus << 20) | (dev << 15) | (func << 12) | offset) 3. OS maps physical address into kernel virtual memory - Required for Extended Configuration Space (0x100–0xFFF) - Where AER, DSN, LTR, VSEC, ATS, PASID, SR-IOV live On Windows, supported paths are: - IRP_MN_READ_CONFIG / IRP_MN_WRITE_CONFIG - BUS_INTERFACE_STANDARD.GetBusData / SetBusData Production anti-cheat should use documented bus interfaces; direct MCFG mapping is a lab-only technique. PCIe Configuration Space Legacy 256-Byte Header (Type 0 Endpoint) Offset Field Notes 0x00 Vendor ID (2B) Chip manufacturer (e.g., 0x8086 Intel) 0x02 Device ID (2B) Specific product 0x04 Command (2B) BME (bit 2), MemSpace (bit 1), IOSpace (bit 0) 0x06 Status (2B) Capabilities List (bit 4) 0x08 Revision ID + Class Code Class triplet: Base / Sub / ProgIF 0x0C Cache Line / Latency / Header Type 0x00 = endpoint, Header Type / BIST 0x01 = bridge, 0x80 = multi-function 0x10–27 BAR0–BAR5 Memory or I/O windows 0x2C Subsystem Vendor ID Often distinguishes board manufacturers 0x2E Subsystem Device ID 0x30–33 Expansion ROM Base 0x34 Capabilities Pointer Offset of first capability in linked list 0x3C IRQ Line/Pin/Min/Max Legacy INTx routing BAR encoding (32-bit BAR): bit 0: 0 = Memory BAR, 1 = I/O BAR bits 2:1: 00 = 32-bit, 10 = 64-bit (BAR pair) bit 3: Prefetchable BAR size discovery: write 0xFFFFFFFF to BAR, read back. Lower bits (except type bits) come back as 0; rest form a size mask. Real silicon's size masks are device-specific; a spoofed BAR with 64 KB mask when the donor uses 4 KB is detectable in one operation. Capabilities Chain If Status[4] is set, 0x34 points to the first capability. Each capability has a 2-byte header: [ID | Next]. Next is DWord-aligned in 0x40–0xFF, or 0x00 to terminate. Common capability IDs: ID Capability 0x01 PCI Power Management 0x05 MSI 0x10 PCI Express 0x11 MSI-X 0x12 SATA Configuration 0x13 PCI Advanced Features 0x14 Enhanced Allocation Detection: walk the chain, validate each capability's declared size doesn't overlap the next, Next is DWord-aligned and within bounds, no cycle exists. A malformed chain is itself a signal. PCIe Express Capability (ID 0x10) The single most important capability for spoofing detection. Offset Field Notes +0x02 PCIe Capabilities Cap Version, Device/Port Type, Slot Impl +0x04 Device Capabilities MPS Supported, FLR, Phantom Functions +0x08 Device Control MPS current, MRRS, Error Enables +0x0A Device Status CED, NFED, FED, URD, Transactions Pending +0x0C Link Capabilities Max Link Speed/Width, ASPM, L0s/L1 latencies +0x10 Link Control ASPM Control, RCB, Link Disable, Retrain +0x12 Link Status Current Link Speed/Width, Link Training +0x24 Device Capabilities 2 Completion Timeout Ranges, AtomicOp, OBFF, LTR mechanism +0x28 Device Control 2 Completion Timeout Value, AtomicOp, LTR Enable +0x2C Link Capabilities 2 Supported Link Speeds Vector +0x30 Link Control 2 Target Link Speed, Compliance +0x32 Link Status 2 De-emphasis, EQ Phase status Detection leverage per field: - Device Type (+0x02[7:4]): must match donor's role - MPS Supported (+0x04[2:0]): hard-IP ceiling contradicts donor - FLR support (+0x04[28]): verify FLR changes same sticky/non-sticky state as claimed donor; naive firmware acknowledges FLR but continues unchanged, producing state inconsistent with donor-defined reset semantics - Link Status (+0x12): Width/Speed are negotiated, observable, hard to lie about — hard IP reports what LTSSM actually achieved - Slot Clock Config (+0x12[12]): must match real platform behavior - Completion Timeout ranges (+0x24): selecting outside claimed ranges is a discriminator - AtomicOp (+0x24[6-9]): server-class GPUs/NICs may support; FPGA support depends on IP generation and configuration; compare advertised and exercised behavior with the claimed donor MSI and MSI-X Capabilities MSI (ID 0x05): Message Control bits: [0] MSI Enable [3:1] Multiple Message Capable (0–5, representing 1–32 vectors) [6:4] Multiple Message Enable (cannot exceed Capable) [7] 64-bit Address Capable [8] Per-Vector Masking Capable x86 MSI Address: bits [31:20] fixed at 0xFEE (LAPIC prefix) [19:12] Destination ID, [3] Redirection Hint, [2] Destination Mode Message Data: [15] Trigger Mode, [10:8] Delivery Mode, [7:0] Vector MSI-X (ID 0x11): - Supports up to 2,048 vectors - Table stored in BAR-mapped region (not Config Space) - Each entry: 16 bytes (Addr Low, Addr High, Data, Vector Control) - PBA (Pending Bit Array): bit-per-vector pending state Naive MSI-X emulation failures: - Ignores Vector Control Mask writes - Sets PBA bits but never clears on unmask - Returns hardcoded PBA values - Doesn't retire pending interrupts when masks clear Detection probe: mask vector → induce interrupt condition → observe PBA bit → unmask → observe interrupt firing. A conforming implementation should satisfy the relevant MSI-X semantics; incomplete emulations may fail, while sophisticated emulations can pass. AER Extended Capability (ID 0x0001) Three error classes: - Correctable: Receiver Error, Bad TLP, Bad DLLP, Replay Timer Timeout - Uncorrectable Non-Fatal: Completion Timeout, Completer Abort, UR, ACS Violation - Uncorrectable Fatal: Malformed TLP, DLL Protocol Error, Surprise Down Each has Status (sticky, W1C), Mask, and Severity registers. Header Log (16B) captures full TLP header of first logged uncorrectable error. Detection: - Absence of AER when donor model is known to expose it = mismatch - Zero correctable-error count over long window when donor's silicon normally produces a baseline rate = anomalous - Anomalous UR response patterns to probes of unimplemented offsets Extended Capabilities 4-byte header at each offset: [31:20] Next Capability Offset (0 to terminate) [19:16] Capability Version [15:0] Extended Capability ID Key Extended Capability IDs: 0x0001 AER 0x0002 Virtual Channel (VC) 0x0003 DSN (Device Serial Number, 8 bytes) 0x000B Vendor-Specific Extended Capability (VSEC) 0x000D ACS (Access Control Services) 0x000E ARI 0x000F ATS (Address Translation Services) 0x0010 SR-IOV 0x0015 Resizable BAR (RBAR) 0x0018 LTR (Latency Tolerance Reporting) 0x001B PASID 0x001D DPC (Downstream Port Containment) 0x001E L1 PM Substates 0x001F Precision Time Measurement (PTM) Detection-relevant: - DSN: 8-byte unique serial; donor-cloned firmware can collide with another player's identical card - VSEC: Xilinx PCIe IP optionally emits VSEC blocks with characteristic Vendor ID + VSEC ID combinations - ATS/PASID/SR-IOV presence on consumer-class donor is demographically suspicious — rare outside server-class hardware IOMMU Architecture Translation Flow 1. Device issues Memory TLP with target IOVA. TLP header carries 16-bit Requester ID (BDF). 2. TLP travels upstream through switches/bridges to root complex. 3. IOMMU intercepts, uses Requester ID to look up translation context. 4. IOMMU walks device's I/O page tables: IOVA → physical address. 5. Permission bits (Read, Write) checked against access type. 6. Success: TLP forwarded with translated physical address. 7. Failure: fault logged, device receives UR or CA completion. Intel VT-d Internals Two-level table lookup: BDF → Root Table (256 entries, 16B each, indexed by Bus) → Context Table (256 entries, 16B each, indexed by Dev:Func) → Second-Level Page Tables (3–5 levels) → Final 4 KB physical page Context Entry fields: - SLPTPTR: Second-Level Page Table Pointer - Domain ID: 16-bit (multiple devices can share a domain) - AW: Address Width (3/4/5-level = 39/48/57-bit IOVA) - T: Translation Type (untranslated-only, translated-only, or both) - P: Present - FPD: Fault Processing Disable Page table entries (PTE, EPT-like format): [0] R - Read permission [1] W - Write permission [7] PS - Page Size (1=leaf super-page, 0=next-level table) [N-1:12] Physical address of next-level table or 4 KB page Super-pages: level-2 leaf = 2 MB, level-3 leaf = 1 GB. Scalable Mode (VT-d 3.0+): Context Entry → PASID Directory → PASID Table → per-PASID first-level page-table roots. Enables Shared Virtual Memory (SVM). Check RTADDR_REG.TTM to determine which mode is in effect. AMD-Vi Internals Single-level Device Table indexed directly by BDF: BDF → Device Table Entry (32 bytes) → I/O Page Tables (1–6 levels) → Final page DTE encodes: - Page Table Root Pointer - Mode (0–6, selects paging levels) - Domain ID (16 bits) - IR, IW — Default Read/Write permission - GV — Guest Valid (nested translation) - PASID-related fields Page sizes: 4 KB, 2 MB, 1 GB. IOTLB and Invalidation Translations cached in IOTLB (I/O Translation Lookaside Buffer). When mappings change, IOTLB must be invalidated. Two distinct caches when ATS is in use: - IOMMU's own IOTLB - Device-side TLB (DevTLB) caching prior translations Full invalidation with ATS requires: 1. IOMMU invalidates own IOTLB 2. IOMMU sends ATS Invalidate Request Message to device 3. Device drops affected DevTLB entries, replies with Invalidate Completion If step 2 or 3 is skipped, device retains stale translations and can DMA to unmapped addresses. VT-d invalidation granularities: - Global: flush entire IOTLB - Domain-Selective: flush all entries for a Domain ID - Page-Selective: flush specific IOVA range in a domain Strict vs lazy invalidation: Lazy mode defers IOTLB invalidation, batching them for performance. Opens a window where stale translations remain valid — a device whose driver has unmapped a buffer can still DMA to the old IOVA. Fault Recording VT-d: Fault Recording Registers — circular array capturing Requester ID, faulting IOVA, fault reason, TLP type. AMD-Vi: Event Log Buffer — producer-consumer ring buffer of IO_PAGE_FAULT, INVALID_DEVICE_REQUEST, ATS-related events. Both surface faults via interrupts and event-log entries. On Windows, some IOMMU violations observable through WHEA/bug-check paths and Driver Verifier DMA-violation telemetry. Per-device fault rate is one of the most operationally useful