CypherCon 2025

Not Fair!!1!: Bypassing Anti-Cheat With Direct Memory Access

Connor Kastner

Signatures? Heuristics? Side-channel monitoring? Syscall scans? How the hell is it even possible to cheat in a video game anymore? The infamous cat-and-mouse game between cheaters and developers is never ending. We’ll be talking about the history of anti-cheats and how the newer method of Direct Memory Access (DMA) has been gaining traction in recent years.

We’ll explore the mechanics of DMA and its implications for game exploitation. DMA allows certain hardware components to access system memory independently of the CPU, leveraging the ability to read and write to game memory in real-time without triggering a conventional anti-cheat. Furthermore, we’ll explore the technical challenges that DMA presents to anti-cheat engineers, including the need for advanced detection techniques in the ever-evolving world of security.

Importance: I’m writing this talk to discuss the architecture and evolution of anti-cheat systems, the technical expertise and creativity involved in bypassing these measures, and to introduce what DMA is and how its mechanism of exploitation by bypassing user land through the hardware level

Connor Kastner

Hack the video games?!

Connor Kastner started his cybersecurity journey at a young age, modding consoles, using lag switches against friends in video games, and being a general annoyance with computers overall.

In his current day as a SOC Analyst at ATC, he has a keen eye for detail and a proactive approach to threat detection. He plays a vital role in safeguarding critical infrastructure against emerging threats. When he’s not working, he’s probably at a concert or trying a new restaurant.