# Eac Kernel Driver Re

> EasyAntiCheat.sys-class kernel driver reverse engineering: callbacks, device interfaces, integrity, communication, Rust/C++ RE notes.

- Skill: `netvar1337/eac-kernel-driver-re` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/eac-kernel-driver-re`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/eac-kernel-driver-re/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/eac-kernel-driver-re

---


# EAC kernel driver RE

## Triage
- Version the `.sys` (file version, PDB path leftovers, authenticode)
- Imports: `Flt*`, `Ps*`, `Ob*`, `Cm*`, `Mm*`, `Io*`
- Strings: device names, registry, error codes

## High-value subsystems
1. Process/thread/image notify routines
2. Object callbacks (handle stripping)
3. Minifilter / file integrity
4. Device IOCTL ABI to usermode service
5. Memory scan / module validation workers
6. Timing and environment probes

## Workflow
- Static: IDA/Ghidra + AiDA assistance
- Dynamic: **prefer Kevlar/emulation or HV** before live load
- Document IOCTL codes and structures for usermode pairing

## Pair with
`eac-usermode-telemetry-re`, `kevlar-driver-emulation`, `kernel-callbacks`, `ida-reverse`.

## Refs
- UC: EasyAntiCheat.sys kernel driver RE (Rust notes threads)