Zoltan

Every PCIe slot and M.2 NVMe connector on a motherboard has Direct Memory Access (DMA). Now DMA lets high-speed peripherals read and write physical RAM directly. The device issues Transaction Layer Packets (TLPs) straight to the host memory controller. So the CPU is not interrupted, and the OS kernel never arbitrates the transfer. Plug a $80 FPGA card (like a Xilinx Artix-7) into an open PCIe slot or an external Thunderbolt port, and you have unmonitored physical memory access. Security tools like PCILeech use this to scan RAM for Windows authentication routines (such as msv1_0.dll) and patch the password validation jump instruction directly in memory. The lock screen opens on any keypress. The defense is an IOMMU (Intel VT-d / AMD-Vi), which acts as a hardware page table for peripherals. But if your BIOS has VT-d disabled, or your OS lacks Kernel DMA Protection, your hardware bus treats any plugged-in card with complete trust.