DMA cheats are the reason "but he wasn't banned" means so little at the top of the ladder. They're the hardest class of cheat to detect because, technically, the cheat never runs on the gaming PC at all. Here's how they work and why they beat anti-cheat.
What DMA means
DMA stands for Direct Memory Access. A DMA cheat uses a second computer connected to the gaming PC through a PCIe card that can read the gaming PC's memory directly — including the game's memory, where enemy positions live. The reading happens from the outside, over hardware, without asking the operating system.
Why anti-cheats can't see it
VAC, FACEIT AC, and the rest run on the gaming PC. They scan that machine's memory and processes. A DMA rig runs the cheat on a separate machine — the gaming PC has no cheat process, no injected module, nothing local to detect. The second PC reads the data and shows the cheater an ESP overlay on a second screen, or feeds an aim routine. As we explain in how VAC detection works, user-mode anti-cheat is blind to this by design, and even kernel anti-cheat struggles — though FACEIT and others have invested heavily in hardware-fingerprint and screenshot detection to fight back.
What it costs
A DMA setup runs roughly €300–€800 to assemble: a DMA card, a second (often cheap) PC, and a capture/feed setup. That price is exactly why DMA cheating concentrates among committed, sometimes profit-motivated cheaters — boosters, account sellers, and a slice of high-elo players — rather than casual rage-hackers.
How to spot a DMA user anyway
Here's the good news: DMA is a delivery mechanism, not a new playstyle. A DMA cheater still ends up with wallhack-style information or aimbot-style precision — so the on-demo tells are the same ones in our cheat-detection checklist: pre-aiming exact positions, tracking through walls, never clearing empty angles, inhuman consistency. The cheat hides from software, not from a human watching the demo.
And because DMA users often run otherwise-clean accounts (no signature to catch), account and behavioural history matter more, not less. A player with no ban but a pattern of community reports and suspicious demos is exactly the profile DMA produces. That's the gap a reputation lookupand community review are built to fill — the detection layer that doesn't depend on finding code on a machine.
The takeaway
- DMA runs the cheat on a second PC — nothing to detect on the gaming PC.
- It beats user-mode anti-cheat outright and challenges kernel AC.
- It still produces normal cheat tells on the demo — humans can catch it.
- A clean ban record is especially meaningless against DMA users.