EAC ban-stack research
Layers (typical)
- Usermode service/EOS process — telemetry, module enumeration, heartbeats
- Kernel driver (
EasyAntiCheat.sysclass) — callbacks, memory integrity, handle protection - Server backend — aggregates client evidence, HWID features, trust crypto
- Game account linkage — bans stick to account + device features
Research tasks
- Diff usermode vs kernel collection responsibilities
- Identify which IDs are local-only vs shipped remote
- Trace ban triggers: injection artifact, integrity fail, tamper, report spam
- Separate detection (instant kick) vs silent flag (delayed ban)
Practical lab method
- Baseline clean boot captures (procmon, ETW, driver list)
- Introduce one variable at a time (mapper, overlay, debugger)
- Record network destinations + payload sizes (not necessarily decrypt)
- Correlate local artifacts with ban timing
Pair with
eac-kernel-driver-re, eac-usermode-telemetry-re, hwid-identifier-surfaces, tpm-attestation-research, anti-cheat-bypass.
Refs
- UC: serials & EAC/FN bans; complete AC bypass sources lists; EAC sys/EOS RE threads