About dma-attack-techniques
A security research skill for classifying DMA attack techniques by examining the memory initiator, transport, privileges, isolation boundary, and observable evidence. It guides focused analysis of PCIe, IOMMU defenses, detection, and forensics.
Key features
- 01DMA classification and threat modeling
- 02PCIe device and TLP analysis
- 03IOMMU state and defense checks
- 04Detection and forensic evidence review
Use cases
- 01Assess whether a technique qualifies as DMA
- 02Review IOMMU coverage and configuration
- 03Plan PCIe detection and evidence collection
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/dma-attack-techniquesin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/repository-resources.mdclassification-and-threat-model.mdrepository-map.mdassurance-boundaries.mdacquisition-and-transport.mdiommu-state-verification.mddetection-and-forensics.mdpcie-devices.mdiommu-and-defense.mdDetails
From the project READMEDMA attack techniques
Identify the memory initiator, transport, required privilege, isolation boundary, and observable artifacts before classifying a technique as DMA.
Topic routing
- Classification and threat model for acquisition-path distinctions and attacker prerequisites.
- PCIe devices for TLPs, configuration space, programmable endpoints, and emulation limits.
- IOMMU and defense for VT-d/AMD-Vi, ACS, ATS/PASID, domain assignment, hypervisors, and trust anchors.
- IOMMU state verification for separating ACPI advertisement, Windows policy, live unit state, and per-requester coverage.
- Detection and forensics for defensive PCIe inventory, signal correlation, evidence capture, Thunderbolt/USB4, and memory access.
- Acquisition and transport, assurance boundaries, and repository resources for focused evidence and source selection.
- Repository map when maintaining the collection.
Use windows-kernel-security for host driver and kernel internals. Apply game-security-research-rigor before turning architecture claims into findings.
Comments
Markdown supported