Valorant crackdown on sophisticated hacks using SATA and NVMe DMA cheat firmware
Riot Games appears to have pushed a new Vanguard anti-cheat update for Valorant targeting DMA-based cheat firmware using SATA and NVMe interfaces. The update triggered an IOMMU restart warning in-game and made affected DMA firmware unusable on the same Windows installation.
DMA, or Direct Memory Access, allows hardware devices to access system memory without routing every operation through the CPU. This can be used by legitimate hardware, but it is also used by external cheat devices that read or modify game memory outside the normal software stack. Riot previously said DMA tools connect directly to the motherboard and make memory tampering harder for Windows to detect.
IOMMU, or Input-Output Memory Management Unit, is the hardware feature used to control which devices can access which memory regions. Riot already discussed this last year, saying Vanguard was looking into IOMMU enforcement to prevent malicious devices from accessing Valorant memory. In December, Riot also published a separate technical post about a motherboard firmware issue where some systems reported Pre-Boot DMA Protection as active even when IOMMU was not fully initialized early enough during boot.
“Congrats to the owners of a brand new $6k paperweight”
However, Riot’s official X account responded to the report with “congrats to the owners of a brand new $6k paperweight,” which suggests the company is aware of the wave. Japanese outlet Automaton also reports that Riot has not published a full breakdown for this specific update yet.
The December issue affected platform firmware and led to BIOS updates from motherboard vendors. The new report claims Vanguard is now blocking DMA cheat firmware itself, including firmware using SATA and NVMe paths.
Source: Riot Games