The Reality of Modern Anti-Cheats

By: sebwebneb

Disclaimer: Before we dive into the technicals, I have to say that all information described in this post is already public and can be figured out by independent research. Nothing I describe here is bound to a specific contract between me and Epic Games, nor does it involve proprietary detection methods that I have reported. Anything discussed is either already detected or a common industry standard for how anti-cheats work. This is for educational and research purposes only and should in no scenario be used to operate against good-faith.

During my analysis of Easy Anti-Cheat’s (EAC) driver detection, I uncovered a significant logic flaw in how the system identifies the Interception framework which is a common tool used by input-based cheats for aimbots and recoil compensation.

The vulnerability stems from a reliance on static filename verification rather than signature or interface checks.

The Logic Flaw

After analyzing the launch sequence, I noted that EAC was specifically querying for two driver names: