Safe Poor DMA, alternative for DMA cards by abusing window defender driver to read physical memory

Description​

Poor DMA can be seen as an alternative to real DMA cards where you do not need custom firmware to bypass anti-cheats. It is important to mention that Poor DMA in its current state primarily relies on reading physical memory, though it can also be expanded to read virtual memory. For the purpose of reading memory and performing initial kernel address translation via CR3, Poor DMA abuses a Windows driver named KslD.sys, which is a legitimate component of Windows Defender. Specifically, this driver is used for low-level diagnostic operations such as arbitrary reading of physical and virtual memory and DPC-based CPU register reads (including IDTR, GDTR, CR0, CR3, and CR4). These primitives allow for safe memory reading and seamless translation between virtual and physical addresses (and vice versa) making it essentially the perfect driver for our use case.

While a purely physical read primitive would technically be sufficient, that approach would normally require scanning the Windows LOW_STUB (the first 1MB of physical memory) to locate the initial kernel CR3 for EPROCESS translation. With raw kernel pointer dereferencing, reading through unmapped physical memory carries a constant risk of triggering a BSOD (PAGE_FAULT_IN_NONPAGED_AREA). However, because KslD.sys utilizes MmCopyMemory with the MM_COPY_MEMORY_PHYSICAL flag (via Sub-Command 0x0C), invalid or unpopulated physical addresses fail gracefully by returning an error status rather than bugchecking the system. This makes scanning physical memory including LOW_STUBmuch safer. Even so, our current approach of querying control registers directly via KslD.sys Sub-Command 0x02 remains the cleanest and most reliable method, completely avoiding brittle heuristics and hardcoded offsets that break across Windows updates. In the near future, I plan to expand Poor DMA to support additional BYOVD drivers. Because most public drivers only provide raw physical read primitives without a dedicated DPC register read to fetch CR3, future updates will introduce alternative bootstrap methods such as LOW_STUB scanning and Superfetch memory ranges (SystemSuperfetchInformation) to handle initial address translation for any kernel structure including EPROCESS across any driver.

Here is full list of all IOCLT functions:
As you can tell, it can read pretty much EVERYTHING you could ever ask for!

Why is this such a powerful alternative to real DMA cards?​

Firstly, this comes down to how kernel drivers are categorized by their trust level. As you may know, anti-cheats blacklist vulnerable drivers commonly abused for cheating, but they cannot do this indiscriminately for every driver out there.

1. Low-Tier OEM Drivers:
If we were to use a vulnerable driver from some obscure company, we would receive a ban very quickly, both in terms of game bans and Microsoft blacklisting the certificate. This is because such drivers are rarely used, and why would an ordinary player be running a driver for a niche device they don't even have plugged into their machine? In that situation, it creates an obvious BYOVD (Bring Your Own Vulnerable Driver) signature. Combined with behavioral detection (like a sudden sharp increase in K/D) and multiple accounts sharing the exact same driver profile, anti-cheat developers can easily fingerprint and ban users while blacklisting the driver hash, in consequence even private cheats are being detectable.

2. Big-Tech Silicon Drivers (Intel, etc...):
Another tier of drivers comes from major tech giants other than Microsoft, such as Intel famous for shipping diagnostic drivers with exposed IOCTL functions. These drivers cannot be blacklisted easily because they are tied to real, legitimate hardware used by millions of everyday machines. If Windows were to blacklist them outright, countless legitimate network adapters and chipsets would stop working properly. A famous example of this is , which abuses an Intel network diagnostic driver via BYOVD under the name . It took years for Windows to finally block initial version of it. However, iqvw64e.sys also allows arbitrary kernel code execution, putting it on a completely different level of exploitation risk and giving security teams even more reason to eventually revoke it .

3. First-Party Microsoft Drivers (KslD.sys):
Lastly, we have first-party Microsoft drivers, in our case KslD.sys. Crucially, it does not provide arbitrary write or execute primitives, but only arbitrary read. In real-world cyberattacks, this read primitive can still be abused (for example, to dump cached credentials from lsasrv.dll inside the lsass.exe process, though that still requires administrator privileges).

For our use case, we use it with a 2-PC DMA approach: we only read memory on the gaming PC where the game is running, while transferring all raw bytes over LAN to a secondary computer running the cheat. For visual overlays, you can use an hardware fuser, while for aimbot functionality you can use external hardware like a KMBox or Makcu (Makcu is preferred one, there is no emulation of device but pass-through, thus there is no need to spoof it!) to create a true DMA hybrid what I call Poor DMA. At the same time, this can also be run locally on a single machine as an external cheat, though running both on the same PC means your overlay window could be detected!

Microsoft's Security Boundary Reality​

I would also like to clarify that KslD.sys is a well-known and documented driver. The exact design philosophy behind it hasn't been publicly detailed by Microsoft, but since it can read anything on your system, Microsoft chose not to force it to run constantly. Instead, you can easily start, stop, and configure the driver service as you wish because there are no ObRegisterCallbacks or CmRegisterCallback routines preventing you from modifying its service parameters.

You might ask: why would Microsoft expose such powerful IOCTLs in this driver in the first place? The answer is a fundamental, well-known principle of Windows security: to Microsoft, the boundary between Administrator and Kernel is not a security boundary. If you report a bug that allows an Administrator to talk to a driver or inspect kernel state, MSRC will give you nothing as bounty reward, because an Administrator is already assumed to hold full machine compromise.



Because of this philosophy, Windows Defender was able to ship this driver. In a massive company like Microsoft, this wasn't the decision of one rogue engineer, rather it was reviewed and accepted by a dozen people who signed off on it. In other words, Microslop is just being Microslop... But on the bright side, this approach keeps our scene alive and creates jobs for kernel anti-cheat/EDR engineers and us cheaters. I'd call that a win-win situation.

Detection Vectors & Limitations​

In summary, if you use this software as intended, reading strictly from a secondary PC and playing as legitimately as possible, there is very little chance of receiving a ban because the only driver running in Ring 0 is an official, signed Microsoft binary.
However, there are still potential detection vectors to keep in mind:

1. The AllowedProcessName Registry Key: In order to open a handle to \\.\KslD, you have to add your executable's path to AllowedProcessName in the registry. Anti-cheats could theoretically implement a hardcoded check on this key to see whether it points to MsMpEng.exe or an unknown third-party executable.
2. Open Handle Auditing: Anti-cheat drivers can walk the system handle table and flag an unsigned, non-PPL process holding an open handle to \Device\KslD. Whether this happens depends on whether anti-cheat developers bother to push specific heuristics for it.

So, is it completely undetectable across every game? The simple truth is: as long as a method remains private, it generally stays undetected. Once it becomes public, that changes. During testing, I was able to use this across games like Wardogs, Rust, Fortnite, Apex Legends, Hell Let Loose, and Hell Let Loose: Vietnam. The only games outside its scope are CS2 on the FACEIT Client and Valorant (Vanguard). Both utilize hypervisor-based anti-cheats (Ring -1), where Extended Page Table (EPT) violations will immediately trap and flag physical reads touching protected game memory, unless there is some hypervisor bypass at play.

Screenshots:​

poor_dma_lan.exe reading MZ header of lsass.exe:​

Explanation of Infrastructure:​

Here is a breakdown of how the entire pipeline communicates between the two machines:
[ GAMING PC (Target) ] [ RADAR / CHEAT PC ]
┌───────────────────────┐ ┌───────────────────────┐
│ Game.exe │ │ Cheat GUI / Radar │
│ │ │ │ ▲ │
│ [ Physical RAM ] │ │ │ │
│ ▲ │ │ poor_dma_client.exe │
│ │ MM_COPY │ └───────────┬───────────┘
│ KslD.sys │ │
│ ▲ │ TCP Socket │
│ │ IOCTL │ ◄─────────────────┘
│ poor_dma_server.exe │ (Port 39172)
└───────────────────────┘

Execution Flow:

1. Driver Authorization & Handshake:
   On startup, poor_dma_server.exe drops the signed KslD.sys into System32\drivers\wd\, sets the service registry key AllowedProcessName to authorize its own NT binary path, and starts the service. This grants the server access to open a handle to \\.\KslD without triggering signature enforcement errors.
2. Control Register Bootstrap:
   The server queries KslD.sys Sub-Command 0x02 (SUB_GET_CPU_REGISTERS), extracting the hardware CR3 and physical RAM bounds directly from CPU registers via kernel DPCs. This establishes the initial System PML4 root for page translations.
3. Network Discovery & Scatter Streaming:
   The secondary machine runs poor_dma_client.exe, which automatically locates the server via UDP broadcast on port 39171 and establishes a persistent TCP stream on port 39172. The client can send batched scatter-read requests to query hundreds of game pointers simultaneously in a single network round-trip.
4. Software 4-Level Page Walking:
   When virtual memory is requested, the server walks the target's 4-level x64 paging structures (PML4 -> PDPT -> PD -> PT) cached in software. It translates target virtual addresses into raw physical offsets and fulfills reads using KslD.sys physical copies (DIR_PHYSICAL), returning pure raw bytes to the secondary machine.
5. Total Target PC Isolation:
   Because all game logic parsing, entity lists, drawing loops, and overlays run exclusively on the secondary PC, the gaming PC remains completely clean: zero open handles to the game process, zero injected DLLs, and zero overlay windows, one of the most stealthy ways to read physical memory (in consequence cheat!!!).

Setup Guide:​

IMPORTANT REQUIREMENTS & COMPATIBILITY:
1. Supported Windows Versions:
Poor DMA currently officially supports Windows 11 24H2 (Build 26100) and 25H2 (Build 26200). The server checks the OS build on startup and will actively halt execution on unsupported or older/newer Windows versions to prevent crashes caused by mismatched EPROCESS offset profiles.
2. Local Network (LAN):
Communication occurs strictly over your local network. Both machines must be on the exact same subnet / router, otherwise UDP broadcast discovery and TCP socket streaming will not connect.

Click to expand...

1. Host Machine (Gaming PC / Target):
   Run poor_dma_server.exe as Administrator.
   (<Administrator elevation is required to manage the KslD service and register AllowedProcessName>).
2. Secondary Machine (Radar / Cheat / Dumper PC):
   Run poor_dma_client.exe (or your custom reading tool / overlay).
   The client will automatically broadcast on port 39171, discover the server on your LAN, and begin streaming memory over TCP 39172.
3. Done!
   Your secondary machine is now reading the target system's memory without any cheat processes, overlays, or open handles existing on the gaming PC.

Usage:​

1. Core Server & LAN Operation

• lan_server (<default / no arguments>)
  Starts the headless TCP/UDP LAN server. Listens on TCP port 39172 (with UDP broadcast discovery on 39171) to stream physical memory, translated virtual memory, and batched scatter-reads directly to your secondary machine over the local network.

2. Process & DTB Inspection

• lan_server system
  Inspects the Windows kernel state via KslD.sys. Dumps active CPU CR3, kernel DTB, total physical RAM size, ntoskrnl.exe base address, and the bootstrap PsInitialSystemProcess structure.
• lan_server processes
  Traverses ntoskrnl!PsActiveProcessHead and the ActiveProcessLinks double-linked list to print all active processes, their PIDs, EPROCESS pointers, Kernel DTBs, and User DTBs (KVA Shadow).
• lan_server fixcr3 <name|pid:N>
  Forces the standalone PFN scan (MmPfnDatabase) to recover the real PML4 / DTB for a protected process when anti-cheat CR3 shuffling wipes it from EPROCESS, immediately verifying it against the target's loaded modules.

3. Module & Base Address Resolution

• lan_server modules <name|pid:N>
  Traverses PEB -> PEB_LDR_DATA using the resolved process DTB to list all loaded .exe and .dll modules, their virtual base addresses, and image sizes.
• lan_server <process>
  Fast lookup to resolve and print only the main executable image base address (e.g. lan_server RustClient.exe).
• lan_server <process> <module>
  Resolves and prints the base address of a specific loaded module inside the target process (e.g. lan_server RustClient.exe GameAssembly.dll).
• lan_server <process> all
  Dumps the base addresses of all loaded modules for fast offset discovery.

4. Memory Reading

• lan_server read-process <name|pid:N> <va> [size] (<or: lan_server <process> <va> [size]>)
  Performs software 4-level x64 page-table walking against the target process's DTB to translate and read arbitrary user-mode virtual memory.
• lan_server read-kernel <va> [size] (<or: lan_server <kernel-va> [size]>)
  Reads raw Windows kernel virtual addresses directly via KslD.sys and system CR3 translation.

Note on Memory Reading & CR3 Fix:
Poor DMA includes everything you need to easily read physical and translated virtual memory. For edge cases, it includes a dedicated CR3 fix that extracts the MmPfnDatabase base address from MmGetVirtualForPhysical and scans physical page frames for the system's recursive PML4 fingerprint to recover the true process DTB whenever an anti-cheat scrambles or wipes it from EPROCESS, rendering standard CR3 shuffling ineffective. Note that on newer Windows builds (starting from 24H2), in some games anti-cheats no longer utilize CR3 shuffling due to system instability issues, but this feature remains available as a fallback just in case, the implementation logic can be found in windows/dtb.rs.

Click to expand...

Integration:​

When it comes to reading memory via poor_dma_client.exe, there are two primary workflows:

1. Standalone CLI Mode (No Coding Required)
   You can use the client directly from the command line to inspect processes, dump module bases, and read raw virtual/kernel addresses. This is ideal for offset discovery, memory dumping, and quick analysis without needing to write or compile any custom code.
2. Direct Code Integration (Recommended for Real-Time Use)
   For performance-critical applications like an ESP, radar, or aimbot overlay, integrating the client library directly into your project is strongly recommended. This gives you full access to low-latency streaming and batched scatter-reads over the TCP socket. Feel free to inspect the source code and adapt the LAN communication protocol into your own external or DMA cheat framework, source code is below on GitHub, on forum there are only BINs.

Disclaimer & Notes:​

• Ban Risk:
  I want to reiterate that there is always an inherent risk of being banned, even with a 2-PC setup. Nothing is truly "100% safe" forever, especially once techniques become public.
• Accuracy & Experience Notice:
  Please keep in mind that some of the information and technical observations shared here may be incomplete or inaccurate, as they are based strictly on my own hands-on experience, testing, and what others have shared with me. Do not take everything as 100% true and accurate.
• Future Updates:
  Expect future updates introducing support for additional vulnerable drivers, alternative memory translation methods, and expanded functionality, though updates will not be on a regular schedule!
• Development & AI Assistance:
  AI tooling was utilized during development, mainly for code refactoring, cleanup, and boilerplate generation. However, several core components had to be written manually due to automated AI refusals around BYOVD topics. The overall concept, architecture, and execution flow were designed by me.
• Binaries & Source Code:
  The forum attachment contains only pre-compiled binaries (poor_dma_server.exe and poor_dma_client.exe). The full source code is open-source and hosted on GitHub at the link below. If you find this project useful, don't forget to drop a star on the repo, I'd really appreciate it!

View Full Source Code on GitHub:
Current build 10.10.2026

Compatible Projects:​

Wardogs:
Fortnite:
Rust:

love u bro <3 keep it up! +rep

this one is actually a good post +rep

cool

-rep stop posting bullshit detected by eac tourney shit is ass if ur not a minimum of SMM or at least hardware do not attempt fortnite pls /del thanks.

courvix said:

-rep stop posting bullshit detected by eac tourney shit is ass if ur not a minimum of SMM or at least hardware do not attempt fortnite pls /del thanks.

Click to expand...

I guess you misread something, also I warned regarding potential bans, I was able to cheat in fortnite for around a week (still no ban), and it was working fine, ofc I was using fuser, if you used overlay directly on the same screen RIP you, also be more respectful buddy

exactly the same can be done with any other driver like I did way before this thread u could bypass any battle on war thunder by reading the men or even injecting the cheat like u usually would but trough a vulnerable driver its astra64.sys comes with certain software and its signed so battle
eye doesnt even check it

Would you recommend using this over real dma? Bc i am kind of poor and want to start cheating in fortnite but do not know how to. I want to be able to cheat but without spending much money, if dma is better, where can i get the best quality for the cheapest prices?

rezty said:

Would you recommend using this over real dma? Bc i am kind of poor and want to start cheating in fortnite but do not know how to. I want to be able to cheat but without spending much money, if dma is better, where can i get the best quality for the cheapest prices?

Click to expand...

for fortnite you need dma, firmware that will support IOMMU bypass fuser and second pc, this is very expensive thing, and if you will buy it from untrusted seller, then you might get ban very quick, and if you wish to use this approach, thus poor dma, then you need only fuser and second pc, but this is public method thus you never know how detectable is it

Plisskien said:

for fortnite you need dma, firmware that will support IOMMU bypass fuser and second pc, this is very expensive thing, and if you will buy it from untrusted seller, then you might get ban very quick, and if you wish to use this approach, thus poor dma, then you need only fuser and second pc, but this is public method thus you never know how detectable is it

Click to expand...

thanks but like, what do you recommend to start cheating in fortnite? Like where can i buy all the pieces for cheap but with good quality? (also the firmware)

rezty said:

thanks but like, what do you recommend to start cheating in fortnite? Like where can i buy all the pieces for cheap but with good quality? (also the firmware)

Click to expand...

I can help only with hardware, look for this thread:

for firmware, I don't know any seller, check black market in that case

Plisskien said:

I can help only with hardware, look for this thread:

Help  Thread 'looking for insane cheap DMA card supplier'

9/27/26

ik they arent really cheap but my friend says he gets them for 50 a piece for 100t and 45 a piece for 75t so if someone could help that be great

• jax2131512s
• dma
• Replies: 2
• Forum: DMA Discussions

• 

for firmware, I don't know any seller, check black market in that case

DMA Hardware/Firmware

Shop 35T and 75T PCIe DMA cards, 1:1 custom emulated firmware, KMBox automation, and UHD video fusers for completely undetectable 2nd PC gaming.

hackvshack.net

Click to expand...

alright thank you bro, i was thinking of trying out ai aimbot as well as it is way cheaper but idk, im looking into it.

Plisskien said:

I guess you misread something, also I warned regarding potential bans, I was able to cheat in fortnite for around a week (still no ban), and it was working fine, ofc I was using fuser, if you used overlay directly on the same screen RIP you, also be more respectful buddy

Click to expand...

wait i currently use poor dma version for fortnite. so everything is software, i just use esp because i cant seem to get like a soft aim. i do it on the same screen tho the esp? any tips for not getting caught?

mdbtate said:

wait i currently use poor dma version for fortnite. so everything is software, i just use esp because i cant seem to get like a soft aim. i do it on the same screen tho the esp? any tips for not getting caught?

Click to expand...

For aimbot you need MAKCU, this is why it is called like this, and important thing overlay from the cheat might me detectable!!! This is why you should use fuser, now you just risk more.

Thank you!!! I don’t know why the aim assist is wonky, like aiming all over the place but it’s more fun with it off anyway.

MattBaker said:

Thank you!!! I don’t know why the aim assist is wonky, like aiming all over the place but it’s more fun with it off anyway.

Click to expand...

which cheat are you using?