DMA attack techniques

Identify the memory initiator, transport, required privilege, isolation boundary, and observable artifacts before classifying a technique as DMA.

Topic routing

• Classification and threat model for acquisition-path distinctions and attacker prerequisites.
• PCIe devices for TLPs, configuration space, programmable endpoints, and emulation limits.
• IOMMU and defense for VT-d/AMD-Vi, ACS, ATS/PASID, domain assignment, hypervisors, and trust anchors.
• IOMMU state verification for separating ACPI advertisement, Windows policy, live unit state, and per-requester coverage.
• Detection and forensics for defensive PCIe inventory, signal correlation, evidence capture, Thunderbolt/USB4, and memory access.
• Acquisition and transport, assurance boundaries, and repository resources for focused evidence and source selection.
• Repository map when maintaining the collection.

Use windows-kernel-security for host driver and kernel internals. Apply game-security-research-rigor before turning architecture claims into findings.