EAC kernel driver RE
Triage
- Version the
.sys(file version, PDB path leftovers, authenticode) - Imports:
Flt*,Ps*,Ob*,Cm*,Mm*,Io* - Strings: device names, registry, error codes
High-value subsystems
- Process/thread/image notify routines
- Object callbacks (handle stripping)
- Minifilter / file integrity
- Device IOCTL ABI to usermode service
- Memory scan / module validation workers
- Timing and environment probes
Workflow
- Static: IDA/Ghidra + AiDA assistance
- Dynamic: prefer Kevlar/emulation or HV before live load
- Document IOCTL codes and structures for usermode pairing
Pair with
eac-usermode-telemetry-re, kevlar-driver-emulation, kernel-callbacks, ida-reverse.
Refs
- UC: EasyAntiCheat.sys kernel driver RE (Rust notes threads)