Riot Games bans DMA hardware cheats in Valorant

Learn how kernel-level security is evolving to combat sophisticated hardware-based exploits.
30-Second TL;DR
What Changed
Vanguard update targets DMA hardware-based cheats
Why It Matters
This move demonstrates the increasing difficulty of bypassing kernel-level anti-cheat systems. It serves as a case study for developers on the arms race between security software and hardware-level exploits.
What To Do Next
Review your application's security posture against hardware-level memory access if you are building high-security or anti-tamper software.
Key Points
- •Vanguard update targets DMA hardware-based cheats
- •High-cost cheat hardware rendered completely non-functional
- •Significant enforcement action against sophisticated anti-cheat evasion
Deep Insight
Background and context from public sources — not the original article. 15 sources cited.
Enhanced Key Takeaways
- •DMA (Direct Memory Access) cheats often involve a second computer and specialized FPGA software designed to masquerade as legitimate SATA or NVMe SSDs, making them particularly difficult for traditional anti-cheat systems to detect.
- •Riot's Vanguard anti-cheat system counters these DMA cheats by strengthening IOMMU (Input-Output Memory Management Unit) enforcement, a hardware-level component that controls device memory access. This enforcement generates repeated page faults and restarts, corrupting the firmware on the DMA device's FPGA and rendering the cheat hardware unusable.
- •The targeted DMA cheat hardware, including premium H2 boards, could cost cheaters upwards of $6,000, which are now effectively rendered worthless by the Vanguard update.
Technical Deep Dive
- Riot Vanguard operates at the kernel level (ring 0), granting it high system access privileges to detect advanced cheating techniques.
- DMA cheats exploit the ability of hardware devices to directly access system memory, bypassing the CPU and traditional anti-cheat monitoring.
- These cheat devices often use specialized FPGA (Field-Programmable Gate Array) software to appear as standard components like NVMe or SATA SSDs, further evading detection.
- Vanguard's updated detection mechanism focuses on strengthening IOMMU (Input-Output Memory Management Unit) enforcement. IOMMU is a hardware component that manages and regulates how peripheral devices access system memory.
- By enforcing IOMMU, Vanguard triggers repeated page faults and restarts, which interfere with and corrupt the firmware running on the DMA device's FPGA, effectively disabling the cheat hardware.
- To play Riot games, IOMMU must remain enabled, meaning that even if a user attempts to disable IOMMU to reactivate the cheat device, they will be unable to launch Riot's titles.
- DMA cheat setups typically involve a second computer connected to the gaming PC via a PCIe card, allowing the cheat software to run externally and read/write game memory in real-time.
Future ImplicationsAI analysis grounded in cited sources
Timeline
- 2020-04-07Riot Vanguard initially released as the anti-cheat for Valorant.
- 2020-05-08Vanguard received criticism for its intrusive nature and blocking legitimate software, leading to an update that blocked fewer programs.
- 2021-12Vanguard received an update for Valorant that included enhanced anti-cheat capabilities, adding detection and blocking of previously undetectable cheats.
- 2023Riot experienced a data breach, leading to public exposure of source code for League of Legends and anti-tamper software, prompting the use of Vanguard as a more sophisticated security system for League of Legends.
- 2024-04-11Vanguard was introduced into League of Legends.
- 2026-05Riot Games updated Vanguard to target and neutralize DMA hardware-based cheats by strengthening IOMMU enforcement.
Sources (15)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
Weekly AI Recap
Read this week's curated digest of top AI events →
AI-curated news aggregator. All content rights belong to original publishers.
Original source: cnBeta (Full RSS) ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
The weekly digest
One email a week. Unsubscribe anytime.

