# Kernel, DMA & Hardware for Game Hacking

Hypervisor-based introspection tool that achieves Ring -1 visibility. Uses EPT/SLAT hooks to read guest memory invisibly to the OS and its security software.

The classic way to sneak your unsigned driver into the Windows kernel. It uses a vulnerable Intel driver to 'map' yours into memory. It is heavily detected by top-tier anti-cheats, but it is still the baseline for learning how manual mapping works.

Pro Tip: Great for local research, but on Windows 11 24H2, you'll need to disable the vulnerable driver blocklist for this to work.

A robust utility for gathering unique identifiers from a computer. It pulls serial numbers from disks, volume metrics, and MAC addresses. It is exactly what you need when you're building a 'HWID' system to lock your license to a specific machine.

Pro Tip: Standard Windows APIs for hardware info are easily spoofed by researchers. Use this as a baseline, but always layer it with low-level checks if you're fighting serious spoofers.

A heavy-duty framework for gate-level netlist reverse engineering. It's strictly for hardware-level work, but if you're reversing FPGA bitstreams for DMA cards, this is the standard.

UEFI firmware editor used for HWID Spoofing (modifying SMBIOS) and verifying DMA Firmware vectors.

Pro Tip: Strictly relevant for anyone modifying SMBIOS tables or sanity-checking firmware changes.

The heavy artillery for driver mapping. When kdmapper fails because Windows blocked the specific driver it uses, KDU lets you cycle through dozens of other 'vulnerable' providers to find a way into the kernel.

Pro Tip: If you are hitting a wall with OS signature checks, KDU's massive stash of providers is your best bet to find a loophole.

The 'Power User' way to bypass Windows security. It sits in your UEFI bootloader and kills PatchGuard and driver signing before Windows even starts. Perfect for local dev work where you don't want to deal with signature enforcement.

Pro Tip: This is for a dedicated 'bench' PC. Do not use this on a machine where you play live games, as anti-cheats can easily see that PatchGuard has been neutered.

The gold standard for DMA users. It makes the target's entire memory look like a regular folder on your second PC. It is practically invisible to anti-cheats because you aren't running any code on the game machine.

Pro Tip: The gold standard for staying undetected. You'll need a compatible DMA card to actually use it, though.

This is the project most people end up at when they start digging into public DMA tooling. It is the main piece for talking to supported DMA hardware, grabbing memory, and building the rest of the setup around it.

Pro Tip: Start here if you want to understand the public DMA stack without guessing. A lot of other tools in this space make more sense after you look through PCILeech first.

LeechCore is the part underneath PCILeech and MemProcFS that actually handles the memory access side. If you want to build your own DMA tools instead of only using ready-made ones, this is usually where the real dev work starts.

Pro Tip: MemProcFS is easier to pick up fast, but LeechCore is the better place to look when you want more control and less magic.

DMALibrary is a C++ helper layer for people who want to build DMA tools without writing every memory read, scan, and process helper from scratch. It is more of a working base than a deep framework, which is exactly why a lot of people like it.

Pro Tip: If raw LeechCore feels too low-level, this is a nicer place to start. You get something usable fast, then clean it up once you know what parts you actually need.