[blibble]

then you just sit on the unencrypted pci bus and sniff the interesting stuff out of it

(e.g. display lists)

already some hacks doing this

[Rohansi]

Anti-cheats are already detecting DMA devices like this.

[blibble]

this doesn't require DMA, just pcie sniffing/proxing

I don't see how you can detect it if it's done properly