Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can ini

Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can initiate DMA without the need for any OS-side drivers, an application with sufficient permissions can still locate them in the configuration tree. This is already part of the cat and mouse with game hackers, as they identify some of the standard PCIe VID/DIDs and at a second level, the PCIe configuration values for these cards. Beyond this, there are also a lot of ways using performance counters to see if memory is being accessed without the access being accounted for at the CPU level - https://github.com/ufrisk/pcileech/issues/107 https://github.com/ufrisk/pcileech/issues/107 has some documents around these approaches.