Eac Ban Stack

EAC/EasyAntiCheat ban-stack research: HWID serials, server-side trust, usermode telemetry, kernel driver signals, FN-class ban discussions.

netvar1337 Updated

File contents

EAC ban-stack research

Layers (typical)

  1. Usermode service/EOS process — telemetry, module enumeration, heartbeats
  2. Kernel driver (EasyAntiCheat.sys class) — callbacks, memory integrity, handle protection
  3. Server backend — aggregates client evidence, HWID features, trust crypto
  4. Game account linkage — bans stick to account + device features

Research tasks

  • Diff usermode vs kernel collection responsibilities
  • Identify which IDs are local-only vs shipped remote
  • Trace ban triggers: injection artifact, integrity fail, tamper, report spam
  • Separate detection (instant kick) vs silent flag (delayed ban)

Practical lab method

  1. Baseline clean boot captures (procmon, ETW, driver list)
  2. Introduce one variable at a time (mapper, overlay, debugger)
  3. Record network destinations + payload sizes (not necessarily decrypt)
  4. Correlate local artifacts with ban timing

Pair with

eac-kernel-driver-re, eac-usermode-telemetry-re, hwid-identifier-surfaces, tpm-attestation-research, anti-cheat-bypass.

Refs

  • UC: serials & EAC/FN bans; complete AC bypass sources lists; EAC sys/EOS RE threads

netvar1337/unleash/tree/main/go/embed/contrib/skills/eac-ban-stack commit 52d906f336

Frequently asked questions

npx skillmds@latest add netvar1337/eac-ban-stack-2