Analyze PCIe DMA threats, host-mediated memory acquisition, FPGA behavior, and IOMMU defenses. Use when the memory initiator or device boundary matters; use kernel security for host-only mechanisms.
Security
3.5K Stars
494 Forks
Updated Sep 13, 2026, 11:32 AM
Why Use This
This skill provides specialized capabilities for gmh5225's codebase.
Use Cases
Developing new features in the gmh5225 repository
Refactoring existing code to follow gmh5225 standards
Understanding and working with gmh5225's codebase structure
---
name: dma-attack-techniques
description: Analyze PCIe DMA threats, host-mediated memory acquisition, FPGA behavior, and IOMMU defenses. Use when the memory initiator or device boundary matters; use kernel security for host-only mechanisms.
---
# DMA attack techniques
Identify the memory initiator, transport, required privilege, isolation boundary, and observable artifacts before classifying a technique as DMA.
## Topic routing
- [Classification and threat model](references/classification-and-threat-model.md) for acquisition-path distinctions and attacker prerequisites.
- [PCIe devices](references/pcie-devices.md) for TLPs, configuration space, FPGA constraints, pcileech, and device emulation.
- [IOMMU and defense](references/iommu-and-defense.md) for VT-d/AMD-Vi, ACS, ATS/PASID, domain assignment, hypervisors, and trust anchors.
- [Detection and forensics](references/detection-and-forensics.md) for fingerprinting, evidence capture, Thunderbolt/USB4, and memory access.
- [Acquisition and transport](references/acquisition-and-transport.md), [assurance boundaries](references/assurance-boundaries.md), and [repository resources](references/repository-resources.md) for focused evidence and source selection.
- [Repository map](references/repository-map.md) when maintaining the collection.
Use `windows-kernel-security` for host driver and kernel internals. Apply `game-security-research-rigor` before turning architecture claims into findings.
