The open-source lineage behind every DMA card
Independent security research built the toolchain this whole market runs on. It is worth knowing whose work it is.
By Lethal Research · Updated 8 September 2026
Almost every DMA product sold today sits downstream of public security research that was never built for gaming. The reader software, the FPGA designs, the library that reads memory under them, and even the words the market uses about itself all trace back to open repositories from one independent researcher. Most product pages credit that work badly or not at all, which hurts buyers as much as the researcher. If you do not know which layer is open and documented, you cannot tell what a vendor added.
Where it starts: DEF CON 24
In 2016 Ulf Frisk presented "Direct Memory Attack the Kernel" at DEF CON 24. The demo showed a PCIe device costing about a hundred dollars reading and writing the physical memory of a target machine. No software ran on the target and no driver was installed on it, because the target's own PCIe root complex does the work. Full-disk encryption does not help, because the memory is live. The slides are still published in the researcher's own presentations repository, and DEF CON mirrors them.
That talk was not the first DMA attack paper; what it changed was reach. Earlier work needed FireWire, Thunderbolt or special lab hardware, while Frisk's later research moved the build onto stock FPGA boards and published the gateware. That is the moment the technique stopped being a conference demo and became something anyone could buy parts for. He presented the FPGA version at 34C3 the following year.
The three repositories that matter
| Project | What it is | Licence | Why the DMA market cares |
|---|---|---|---|
| PCILeech | The attack and acquisition tool. Reads and writes target memory over PCIe DMA, dumps memory, mounts filesystems. | AGPL-3.0 | The reference implementation. Board support lists in this repo are why specific card models exist as products at all. |
| pcileech-fpga | The FPGA gateware. Verilog designs for the boards, per-device, including Artix-7 targets from XC7A35T up to XC7A200T. | See repo | This is the firmware layer. Commercial firmware is a modified descendant of these designs, not a clean-room product. |
| LeechCore | The physical memory acquisition library. Abstracts FPGA hardware, USB3380, dump files, VMware, QEMU, remote agents. | GPL-3.0 | Everything that talks to a card talks through something shaped like this. It is the API boundary of the field. |
| MemProcFS | Mounts physical memory as a virtual filesystem so processes, handles and modules are browsable as files. | AGPL-3.0 | The analysis layer. It is also the clearest demonstration of how much structure is recoverable from raw memory. |
Licences as published on each repository at the time of writing. Read them yourself before you build on top.
PCILeech, pcileech-fpga, LeechCore and MemProcFS are independent open-source projects by Ulf Frisk. Lethal Solutions has no tie to the author or to these projects: no partnership, no endorsement either way and no hand in their development. We link them because crediting work by name is the least anyone should do, and because a buyer who reads the upstream repositories knows this hardware better than one who reads product pages.
What this means when you are buying
The honest version of how this market works is short. The hardware is stock: an Artix-7 FPGA plus a USB 3 bridge, on a PCIe card. The base gateware and the acquisition library are both open. What a firmware vendor sells is a changed device identity, upkeep against a moving anti-cheat target, and support, which are real things to sell but not the same as having invented the stack.
- A vendor who cannot say what their firmware changes, against the public designs, probably did not change much.
- The upstream projects were built for memory forensics and security research. That is still their main use. Their existence says nothing about whether a game's terms of service allow any use downstream.
- Licences matter. AGPL and GPL carry duties. If a product builds on that work and ships with no source and no notice, that is a fact about the vendor, not about you.
- Reading the upstream issue trackers is the cheapest hardware schooling in this field.
PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system.
PCILeech README, github.com/ufrisk/pcileech
That sentence is the whole design, and a security researcher wrote it about a research tool. Everything this market has added since is packaging around it. Knowing that does not make the packaging worthless, but it does let you tell good packaging from a reskin.
The guides behind this post
How to fix "Unable to locate valid DTB"
11 min readThe DTB error means the reader read memory through your card but could not find the Windows kernel's Directory Table Base. Work in order: generate a memory map, disable VT-d/VT-x or SVM/IOMMU in the game PC's BIOS, prove USB stability, then cold-boot both machines.
Open the guideThe FPGA DNA ID, in detail
9 min readThe DNA ID is a 57-bit, read-only value burned into each Xilinx 7-series FPGA at the factory. Logic reads it through the DNA_PORT primitive. Custom firmware is built against that value, so the image runs on one board only. It is not a licence key, and it holds no information about you.
Open the guideRecovering a card that will not enumerate
10 min readA card that stops enumerating after a flash is almost never dead silicon. At power-on the FPGA loads its bitstream from SPI flash. A bad image means configuration never completes, so no PCIe endpoint appears. But JTAG does not depend on what is in the flash, so the fix is almost always a reflash.
Open the guideRead next
Questions about this? Ask on Discord
All posts