Eac Kernel Driver Re

EasyAntiCheat.sys-class kernel driver reverse engineering: callbacks, device interfaces, integrity, communication, Rust/C++ RE notes.

netvar1337 5e92670 1014 B Updated

File contents

EAC kernel driver RE

Triage

  • Version the .sys (file version, PDB path leftovers, authenticode)
  • Imports: Flt*, Ps*, Ob*, Cm*, Mm*, Io*
  • Strings: device names, registry, error codes

High-value subsystems

  1. Process/thread/image notify routines
  2. Object callbacks (handle stripping)
  3. Minifilter / file integrity
  4. Device IOCTL ABI to usermode service
  5. Memory scan / module validation workers
  6. Timing and environment probes

Workflow

  • Static: IDA/Ghidra + AiDA assistance
  • Dynamic: prefer Kevlar/emulation or HV before live load
  • Document IOCTL codes and structures for usermode pairing

Pair with

eac-usermode-telemetry-re, kevlar-driver-emulation, kernel-callbacks, ida-reverse.

Refs

  • UC: EasyAntiCheat.sys kernel driver RE (Rust notes threads)

netvar1337/unleash/tree/main/contrib/skills/eac-kernel-driver-re commit 5e92670a47

Frequently asked questions

npx skillmds@latest add netvar1337/eac-kernel-driver-re