# Eac Ban Stack

> EAC/EasyAntiCheat ban-stack research: HWID serials, server-side trust, usermode telemetry, kernel driver signals, FN-class ban discussions.

- Skill: `netvar1337/eac-ban-stack-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/eac-ban-stack-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/eac-ban-stack-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/netvar1337/eac-ban-stack-2

---


# EAC ban-stack research

## Layers (typical)
1. **Usermode service/EOS process** — telemetry, module enumeration, heartbeats
2. **Kernel driver (`EasyAntiCheat.sys` class)** — callbacks, memory integrity, handle protection
3. **Server backend** — aggregates client evidence, HWID features, trust crypto
4. **Game account linkage** — bans stick to account + device features

## Research tasks
- Diff usermode vs kernel collection responsibilities
- Identify which IDs are local-only vs shipped remote
- Trace ban triggers: injection artifact, integrity fail, tamper, report spam
- Separate **detection** (instant kick) vs **silent flag** (delayed ban)

## Practical lab method
1. Baseline clean boot captures (procmon, ETW, driver list)
2. Introduce one variable at a time (mapper, overlay, debugger)
3. Record network destinations + payload sizes (not necessarily decrypt)
4. Correlate local artifacts with ban timing

## Pair with
`eac-kernel-driver-re`, `eac-usermode-telemetry-re`, `hwid-identifier-surfaces`, `tpm-attestation-research`, `anti-cheat-bypass`.

## Refs
- UC: serials & EAC/FN bans; complete AC bypass sources lists; EAC sys/EOS RE threads