Direct Memory Access Everywhere

Direct Memory Access Everywhere

Speakers: Joe FitzPatrick, Grace Parrish

Conference: DEF CON 33 (Las Vegas, August 9, 2025)

YouTube: Not yet available

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Joe%20FitzPatrick%20Grace%20Parrish%20-%20Direct%20Memory%20Access%20Everywhere.pdf

Overview

Direct Memory Access (DMA) attacks have been a fixture in hardware security research for decades. The threat model is straightforward in principle: an attacker who gains physical access to an exposed high-speed bus — PCIe, Thunderbolt, FireWire, ExpressCard — can use a malicious peripheral device to read and write arbitrary physical memory addresses, bypassing operating system access controls entirely. The potential impact includes memory scraping for credentials and keys, injecting shellcode into kernel space, and bypassing disk encryption such as BitLocker.

Despite decades of awareness, published tooling, academic research, and even dedicated hardware mitigations (IOMMU / VT-d / AMD-Vi), most systems in production remain practically unprotected. The gap between "mitigation exists" and "mitigation is correctly enabled and enforced" is vast: BIOS configuration, OS settings, driver interactions, and Thunderbolt security levels must all align. In practice, they rarely do.

At DEF CON 33, Joe FitzPatrick and Grace Parrish introduced Epic Erebus, a new open-source PCIe tool designed to make DMA attacks more accessible to penetration testers and defenders alike, and to expose just how widespread the exploitable attack surface remains. The talk is both a retrospective on the DMA attack landscape and a practical demonstration of a new capability that meets modern hardware where it actually lives.

Background

DMA Fundamentals

Modern computer architectures allow peripherals to transfer data directly to and from system memory without CPU intervention, via the DMA engine. This design is essential for performance: a GPU, network card, or NVMe drive that required CPU involvement for every byte transferred would be completely impractical. The mechanism is deeply embedded in how PCI Express works at the Transaction Layer — a device can issue Memory Read and Memory Write Transaction Layer Packets (TLPs) targeting physical addresses, and the CPU memory controller will honor them.

From a security standpoint, the CPU's virtual memory protections are irrelevant to DMA. A malicious device bypasses them entirely. Early DMA attacks targeted internal expansion slots (PCI, ExpressCard), requiring physical access to the chassis interior. The attack surface expanded dramatically when Thunderbolt arrived, exposing the full PCIe bus through an external port. More recently, USB4 with Thunderbolt compatibility has continued that trend.

The Mitigation Landscape

The architectural defense against DMA attacks is the IOMMU (Input-Output Memory Management Unit), known as VT-d on Intel platforms and AMD-Vi on AMD platforms. An IOMMU restricts which physical memory addresses a given device is allowed to access, providing hardware-enforced isolation analogous to virtual memory for CPUs. Kernel DMA Protection (Windows), Thunderbolt security levels, and OS IOMMU drivers are the software layers that configure and enforce IOMMU policy.

The challenge is that this protection chain requires:

• IOMMU enabled in BIOS/UEFI firmware
• OS kernel configured to use the IOMMU
• Thunderbolt security level set to not auto-authorize devices
• No vulnerable DMA-capable drivers pre-loaded at boot
• Correct behavior across suspend/resume cycles

Any one of these failures defeats the entire mitigation. Historically, firmware vendors have shipped systems with IOMMU disabled by default for performance or compatibility reasons. Thunderbolt-equipped laptops vary wildly in their default security posture. And as the Thunderclap research (NDSS 2019) demonstrated, even enabled IOMMUs can be circumvented via malicious peripheral devices that exploit misconfigured IOMMU policies in OS device drivers.

Prior Art

FitzPatrick and Parrish situate their work within a rich lineage of prior DMA tools and research:

• winlockpwn (Adam Boileau) — early FireWire-based DMA attack tool for bypassing Windows login screens
• NSA Playset SLOTSCREAMER — PCI-based DMA attack hardware, released as open hardware
• pcileech (ulf Frisk) — the dominant modern DMA framework; supports FPGA-based PCIe devices; widely used for memory forensics and offensive DMA research
• picodma — lightweight PCIe DMA implant
• Thunderclap — NDSS 2019 research exposing IOMMU policy weaknesses via malicious Thunderbolt peripherals
• Thunderstrike — firmware attack via Thunderbolt demonstrating persistent implant installation

The problem FitzPatrick and Parrish identified is that despite all this tooling, the barrier to entry for DMA testing remains high. Existing tools require specific FPGA development boards, custom firmware, driver development expertise, and careful matching of PCIe link speed parameters. For a penetration tester or a hardware security team conducting device evaluations, setting up a functional DMA test environment is a significant undertaking.

Key Findings

The central finding of the talk is that DMA attack surfaces have not meaningfully shrunk. While Thunderbolt security has improved on paper, practical deployments of endpoints, servers, and embedded systems continue to expose DMA-capable interfaces without adequate IOMMU enforcement. Reasons include:

• Poor default configurations: Systems frequently ship with IOMMU disabled in firmware or Thunderbolt security set to a permissive level.
• Perceived difficulty: DMA attacks are widely regarded as "hard" among enterprise IT and even many security teams, which reduces the priority assigned to configuring mitigations.
• Lack of effective testing: There is no simple, widely-used tool that a security team can drop into a device evaluation to quickly answer "is this system actually protected against DMA attacks?" — until now.

Epic Erebus is designed to fill that gap.

Technical Deep Dive

Epic Erebus

Epic Erebus is a new, fully open PCIe implementation that exposes complete Transaction Layer Packet (TLP) control to the operator. The name is a deliberate pun: "RE-Bus" (reverse engineering the PCIe bus) meets Erebus (the Greek primordial deity of darkness). Key design goals:

Small and portable: The hardware form factor is designed to be carried by a penetration tester and connected to target systems quickly.

Easy to use: Unlike pcileech and similar tools, Epic Erebus is built for accessibility — the workflow from connecting the device to performing a memory read or write should be achievable without deep FPGA development expertise.

Open PCIe implementation: Rather than using off-the-shelf PCIe IP cores, Erebus implements PCIe from the ground up as open hardware (based on the ECP5-PCIe project). This gives the operator full visibility and control over every TLP being sent and received — including non-standard or malformed TLPs that can probe IOMMU behavior.

IOMMU probing: Because Erebus provides raw TLP control, it can systematically probe the IOMMU policy in place on a target system. By issuing memory read requests to ranges that should be protected versus ranges that should be accessible, it can determine whether the IOMMU is actively enforcing policy, misconfigured to allow broader access, or absent entirely. This makes it a diagnostic tool as much as an attack tool — defenders can use it to validate their own IOMMU configurations.

PCIe Transaction Layer Basics

PCIe operates as a point-to-point serialized link. The Transaction Layer is the highest protocol layer, responsible for generating and consuming TLPs. Each TLP has a type (Memory Read Request, Memory Write, Configuration Read/Write, etc.) and an address field specifying the target memory location. A device issuing a Memory Read Request to a physical address that falls within system RAM — and where the IOMMU has not restricted the device's access — will receive the contents of that memory from the host.

From the attacker's perspective, the critical TLP types are:

• Memory Read (MRd): Request data from a physical address range
• Memory Write (MWr): Write data to a physical address range

These two primitives are sufficient to read credentials from memory, patch kernel data structures, or write shellcode to executable memory pages.

Attack Workflow

1. Connect Epic Erebus to a PCIe/Thunderbolt/USB4 port on the target system
2. Enumerate the PCIe topology to understand what devices are visible and what addresses are mapped
3. Probe IOMMU policy by issuing read requests to protected ranges — observe whether completions with data are returned or error completions
4. If IOMMU is absent or misconfigured, issue targeted memory reads to known physical addresses (e.g., process memory, LSASS space on Windows, LUKS key material on Linux)
5. For active exploitation: patch memory to bypass authentication or inject code

The tool also supports reverse engineering of proprietary PCIe peripherals by capturing and analyzing TLP traffic from legitimate devices, facilitating DMA mitigation analysis on specialized hardware.

Demo / PoC

The DEF CON demonstration showed Epic Erebus connected to a live target system and performing:

1. IOMMU detection — confirming whether IOMMU enforcement was active
2. Memory reads — extracting content from system RAM including credential material
3. IOMMU bypass confirmation — demonstrating that default-configured systems without correct IOMMU setup are fully compromised

The open-source hardware and software for Epic Erebus is released publicly, consistent with FitzPatrick's philosophy of open hardware security tools (his prior contributions include work on the NSA Playset project and the Tribble PCIe implant).

Key references for the tool and its lineage:

• Tribble (Grand Idea Studio)
• pcileech
• ECP5-PCIe (open PCIe implementation)
• Thunderclap paper (NDSS 2019)
• NSA Playset SLOTSCREAMER

Defensive Implications

Properly defending against DMA attacks requires action at every layer of the stack:

Firmware/BIOS:

• Enable IOMMU (VT-d / AMD-Vi) in UEFI firmware settings. This is typically disabled by default on many motherboards.
• Set Thunderbolt security to "User Authorization" or "Secure Connect" — never "No Security."
• Enable Kernel DMA Protection in UEFI (available on Windows 10 1803+ with compatible firmware).

Operating System:

• Windows: Verify Kernel DMA Protection is active via msinfo32 (check "Kernel DMA Protection: On"). Enable Memory Integrity (HVCI) which requires devices to pass DMA remapping requirements.
• Linux: Enable intel_iommu=on or amd_iommu=on kernel parameters; use iommu=pt only when necessary and understand the security implications.
• Ensure Thunderbolt/USB4 authorization policy requires user approval for new devices (not auto-authorize).

Physical Security:

• Lock Thunderbolt ports via firmware if external DMA-capable connections are not operationally necessary.
• Consider port blockers for physical Thunderbolt ports on unattended systems (e.g., kiosk terminals, server consoles).
• Include DMA testing in hardware security assessments for new device platforms using tools like Epic Erebus to validate the effectiveness of IOMMU configurations.

Testing:

• Use Epic Erebus as part of hardware penetration testing engagements to empirically validate whether DMA protections are effective rather than simply assuming IOMMU is enabled.
• Test across suspend/resume cycles — some systems re-enable DMA access during sleep states.

Key Takeaways

• DMA attacks have been known for decades, but most production systems remain vulnerable due to poor default configurations, underestimation of exploitability, and lack of practical testing tools.
• IOMMU mitigations are only effective when correctly configured at every layer — firmware, OS, and driver — a condition that is genuinely rare in practice.
• Epic Erebus is a new open-source PCIe tool that makes DMA attack testing and IOMMU validation accessible to penetration testers and hardware security teams without deep FPGA expertise.
• The tool provides full TLP-level control, enabling both offensive DMA capabilities and defensive auditing of IOMMU policy configurations.
• The move of PCIe DMA exposure from internal slots to external Thunderbolt and USB4 ports means the attack surface now reaches laptop users, not just server operators — and warrants corresponding attention in endpoint security programs.

About the Speakers

Joe "securelyfitz" FitzPatrick is a trainer and researcher at SecuringHardware.com. His career spans low-level silicon debug, security validation, and penetration testing of CPUs, SoCs, and microcontrollers. He has developed and delivered hardware security training to hundreds of researchers, penetration testers, and hardware validators worldwide through his Applied Physical Attacks training curriculum. He is a contributor to the NSA Playset project — a collection of open hardware recreations of NSA ANT catalog implants — and has presented at DEF CON, Black Hat, and similar conferences for many years. His work consistently lowers barriers to hardware security research through open tooling and educational content.

Grace "Baelfire" Parrish is completing her final year of a cybersecurity degree at Oregon State University. Despite her student status, her experience is deep and hands-on: she spent a decade as a board-level repair technician, has worked with industrial control systems, and has built custom Binary Ninja plugins and FPGA-based hardware projects. She has helped deliver hardware security training at Black Hat and serves as team captain for a competitive pentesting team. She is entering the offensive security industry with an unusually strong foundation in the hardware layer — precisely the skill set needed for work like Epic Erebus.