Easy Anti-Cheat (EAC) Explained: What It Actually Detects in 2026

Easy Anti-Cheat is the most widely deployed kernel-mode anti-cheat on Windows in 2026, and it is also the one most players actually see. If you have launched Fortnite, Apex Legends, Fall Guys, Rust, Elden Ring, or (as of Season 22 in April 2026) Rocket League in the last year, a driver signed by Epic Games has been briefly loaded into your kernel. It unloads when you quit. That single implementation detail (session-scoped, not persistent) tells you almost everything about the tradeoffs Epic made when they rebuilt EAC after the 2018 Kamu acquisition. Epic's own marketing puts current coverage at 200-plus games and more than 20 billion gameplay sessions annually, which makes EAC the closest thing the PC anti-cheat market has to a default.

A brief history of Easy Anti-Cheat

EAC itself originated in 2006 as an anti-cheat for Counter-Strike 1.6. The Finnish company Kamu Solutions was formed in 2013 to commercialize the codebase as licensed middleware, and for the next five years it was a paid third-party integration used by a handful of shooters. Epic Games acquired Kamu on October 8, 2018 and folded EAC into the Epic Online Services stack. Post-acquisition, EAC became free to integrate through EOS, which is why so many studios standardized on it after 2020. Fall Guys, Fortnite, Apex Legends. Rust adopted EAC in 2016 and has stayed on it, with Facepunch reaffirming the partnership in their 2025 anniversary post.

The pre-2018 product was a userland-heavy scanner with a small kernel driver. Modern EAC (the post-2020 rewrite that ships as EasyAntiCheat_EOS) is a heavier kernel driver plus a userland service, backed by a telemetry pipeline that lives inside Epic's EOS infrastructure. Most of the older reverse-engineering notes floating around describe a codebase that no longer exists.

How EAC works at game launch

The load sequence for EasyAntiCheat_EOS on a current Windows 11 24H2 box looks like this:

1. The game launcher starts EasyAntiCheat_EOS.exe (the service).
2. The service starts the kernel-mode driver via the standard SCM path.
3. EasyAntiCheat.sys registers with the game process via a shared handle and an IOCTL channel.
4. The game refuses to progress past its initial handshake until the driver acknowledges.
5. On game exit the service is stopped and the driver is unloaded.

Open Services.msc and look for EasyAntiCheat_EOS. It is set to Manual, not Automatic. That is deliberate. Epic does not want the driver resident when you are not playing, because a persistent driver is a much larger attack surface and PR liability than a session-scoped one.

# Inspect the EAC service state and its backing driver
Get-Service EasyAntiCheat_EOS | Select-Object Name, Status, StartType

# Show the signed driver file that gets loaded when the service starts
Get-AuthenticodeSignature `
  "C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.sys" |
  Format-List Status, SignerCertificate

Between sessions this returns Status: Stopped and StartType: Manual. Launch Apex Legends, run it again, and the service flips to Running. The signer chain terminates at "Epic Games Inc." At KyTech we track the driver hash across every EOS SDK release (1.17.1.3 in Aug 2025, 1.18.0.4 in Sept 2025, 1.18.1.2 in Nov 2025, 1.19.0.3 in Feb 2026), because a bumped signer or a new export can shift what our kernel driver avoids.

EOS SDK 1.17.1.3 (August 2025) added first-party Windows on ARM support, with Fortnite as the launch title on Snapdragon devices. Epic recompiled the x64 kernel driver to ARM64 rather than shipping an emulated blob, and "the EAC driver" is now three binaries: x64 Windows, ARM64 Windows, and a Linux user-space shim.

The EAC kernel driver architecture

EasyAntiCheat.sys is a straightforward Windows kernel driver. It registers a device object, exposes an IOCTL surface, and installs kernel notification callbacks that let it observe activity across the entire system while it is loaded. No rootkit magic. The driver stays inside documented Microsoft kernel APIs, which is what a driver has to do to survive PatchGuard and HVCI on a modern box. On Linux and Steam Deck (through Wine and Proton), EAC ships as a user-space library only. There is no kernel driver on Linux at all, which is one of the least-understood facts about how Valve got Deck compatibility over the line in 2022.

Three callback types do most of the heavy lifting on Windows.

Object callbacks for handle stripping

When any process on the box tries to open a handle to the protected game, the request goes through the object manager. EAC uses ObRegisterCallbacks to intercept that path and downgrade or deny handle rights before the caller ever gets a HANDLE back. This is the single most important detection surface for classic userland cheats. If you cannot open the game with PROCESS_VM_READ or PROCESS_VM_WRITE, ReadProcessMemory returns access denied and the whole external-cheat category dies at the front door. Our companion post on usermode versus kernel versus hybrid anti-cheat covers why this specific choke point maps so poorly to the older usermode-scanner model.

A minimal skeleton of what EAC's registration looks like at the API level:

// Simplified skeleton: what a handle-stripping callback registration looks like.
// Same API surface that EAC, BattlEye, and Vanguard all sit on top of.
OB_CALLBACK_REGISTRATION reg = { 0 };
OB_OPERATION_REGISTRATION opReg[1] = { 0 };

opReg[0].ObjectType   = PsProcessType;
opReg[0].Operations   = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
opReg[0].PreOperation = HandlePreOperationCallback;

reg.Version                    = OB_FLT_REGISTRATION_VERSION;
reg.OperationRegistrationCount = 1;
reg.RegistrationContext        = NULL;
reg.OperationRegistration      = opReg;
RtlInitUnicodeString(&reg.Altitude, L"321000");

PVOID hRegistration = NULL;
NTSTATUS status = ObRegisterCallbacks(&reg, &hRegistration);

The pre-operation callback receives an OB_PRE_OPERATION_INFORMATION, identifies the caller, and clears bits in DesiredAccess for anything that is not the game itself. Microsoft documents the behavior in the ObRegisterCallbacks reference. The altitude string decides callback ordering relative to other filter drivers on the system, and EAC picks values high enough to run before most competing hooks.

Process notifications

PsSetCreateProcessNotifyRoutineEx gives EAC a callback every time a process is created or exits anywhere on the system. That produces a full timeline of what launched during a game session, which is exactly what an analyst wants when they are triaging a ban wave three weeks later and need to correlate a suspicious PE with a specific match.

Image load notifications

PsSetLoadImageNotifyRoutine fires whenever any binary is mapped into any process, kernel drivers included. EAC uses this to see kernel driver loads in real time. Any driver arriving after EAC sits on the wrong side of that notification, which is one reason the kernel-mode side of the industry has spent the last several years pushed toward properly-signed load paths that do not require racing the anti-cheat.

Detection surfaces EAC actually uses

The public narrative that anti-cheat is "just signature-based" is only half the story. EAC does run signature scans, but the more valuable telemetry is behavioral.

Signature and memory scans

EAC maintains an internal signature database against which it scans loaded modules inside the game process and, more selectively, foreign process memory. Signatures are pushed server-side over the EOS channel. A private cheat with no public presence survives much longer than a $10 pastebin injector. A representative pattern structure:

// Illustrative pattern format. Real EAC signatures live in encrypted blobs
// pushed from the EOS backend; this is a stand-in, not a leak.
struct CheatSignature {
    uint32_t   id;
    uint8_t    pattern[64];   // byte pattern to match
    uint8_t    mask[64];      // 0xFF where byte matters, 0x00 for wildcards
    size_t     length;
    uint32_t   severity;      // 0 = telemetry only, 1 = warn, 2 = ban candidate
};

// Scan is a linear sliding window over a mapped region.
// EAC runs it against game-process modules first, hooked overlays second.
bool ScanRegion(const uint8_t* base, size_t len, const CheatSignature& sig) {
    for (size_t i = 0; i + sig.length <= len; ++i) {
        bool hit = true;
        for (size_t j = 0; j < sig.length; ++j) {
            if (sig.mask[j] && base[i + j] != sig.pattern[j]) { hit = false; break; }
        }
        if (hit) return true;
    }
    return false;
}

At KyTech our detection-avoidance work starts with staying out of the address ranges EAC's scanner touches most often, and the memory-layout choices in the KyTech Apex build reflect that directly.

Integrity self-check

The EAC driver periodically hashes its own .text section and validates that its IAT has not been redirected. If a competing driver has patched EAC out of the kernel, the integrity check fires and the game exits with an EAC error dialog. In practice the interval is short enough that any "just unhook EAC before it scans" strategy fails within seconds.

Overlay and input hook detection

EAC watches for SetWindowsHookEx globals, window class hooks, and DirectX present-chain patching. A significant fraction of low-effort cheats render their ESP through an external overlay hooked into DXGI, which is exactly the class this catches.

Behavioral telemetry per title

EAC integration is not monolithic. Each licensee configures sensitivity and ban triggers independently, so the EAC experience in Rust differs meaningfully from EAC in Fortnite. Facepunch announced recoil-scripting-specific detection built into EAC's Rust pipeline, contributing to 338,000-plus Rust bans in 2025 with median cheater removal dropping from ten hours of playtime to under seven.

What EAC misses in 2026

Coverage is strong but not complete. For a direct comparison of how the two big commercial vendors trade off differently, see our sibling post on BattlEye vs Easy Anti-Cheat. EAC's blind spots split into three categories.

DMA hardware readers

A DMA card sits in a PCIe slot on a second machine and reads the target machine's RAM over Thunderbolt or an external PCIe cable. There is no driver on the target box to detect. EAC has added DMA heuristics (anomalous PCIe device enumeration, IOMMU disable flags) but this remains a category EAC does not solve, only inconveniences.

Read-only kernel drivers

A cheat driver that only calls MmCopyVirtualMemory (or walks page tables to read game memory without touching the game process) avoids most handle-based detections. It is still visible to PsSetLoadImageNotifyRoutine if it loads while EAC is loaded. Microsoft's Windows 11 24H2 changes to MiShowBadMapper closed a large chunk of the older signed-third-party-driver techniques, and any driver relying on NonCached aliases of WriteBack kernel pages via MmMapIoSpace now fails outright. That single kernel change killed an entire class of client-side page-walking chains overnight.

Full-system hypervisors

A type-1 hypervisor installed at boot can intercept syscalls before they resolve, present a lying view of memory to any inspector including EAC, and hide arbitrary code from the guest OS. This is expensive to develop and finicky to keep working across Windows updates, but a well-maintained one is invisible to any anti-cheat that lives inside the guest.

EAC's own attack surface

EAC is not immune from being the vulnerability. CVE-2021-47739, a local privilege escalation, was publicly disclosed in December 2025 and has since been patched. Giving a game middleware SYSTEM-privileged kernel access is not a free lunch on the defender side either.

The telemetry pipeline and ban waves

EAC does not usually instant-ban. It writes evidence to a buffered pipeline that ships to the EOS backend, where Epic runs offline analysis and pushes ban decisions in waves. Two consequences: a detected cheater is not told immediately (they keep playing, keep exposing their hardware fingerprint, keep tripping more detections), and when the ban wave fires, every account tied to that hardware or Epic ID goes down together. A hypothetical telemetry packet, redacted and simplified:

{
  "session_id": "b1e6a4c9-3e7d-4b1f-9a02-cc90ff8a12c1",
  "product_id": "apex_legends",
  "product_version": "r5-live-season28",
  "hwid_hash": "sha256:7a4c8f...redacted",
  "detections": [
    { "type": "SIG_MATCH",   "sig_id": 41221, "module": "user32.dll",  "offset": "0x14c00" },
    { "type": "HANDLE_DENY", "target_pid": 8412, "requested_access": "0x1F0FFF" },
    { "type": "IMAGE_LOAD",  "driver": "\\??\\C:\\Windows\\Temp\\iqvw64e.sys", "signer": "Intel" }
  ],
  "ts": 1785042173
}

The IMAGE_LOAD entry is doing most of the work in that payload. That specific driver name (iqvw64e.sys, the historical Intel network driver associated with CVE-2015-2291) has been on every serious anti-cheat's shitlist for a decade. Microsoft's signed third-party driver Blocklist covers most of the classic signed-driver-abuse candidates now, but EAC keeps its own list in case Microsoft's is out of date on a given machine.

Apex Legends, Fortnite, Rust, and Rocket League

The Apex Legends EAC deployment is one of the most heavily instrumented in existence. Recent seasons validate the game install path (Steam, Origin, or EA App) and cross-check the r5apex.exe binary hash against an EOS-hosted manifest. Any modification of the game binary fails the integrity check before EAC even starts scanning process memory.

The Fortnite integration is the reference implementation, because Epic owns both sides of the wire. Epic uses Fortnite as the canary for new EAC detection rules before those rules roll out to third-party titles. If a rule change ships to Fortnite this week, expect it in Apex within two. (Contrary to persistent folklore, Fortnite does not run BattlEye on PC. EAC is the only client-side anti-cheat.)

Fall Guys shipped with EAC from launch and kept it after the Epic acquisition. Rust's current stance is unambiguous: EAC since 2016, EAC now, and Facepunch has committed to a new third-party detection layer sitting on top of EAC in 2026. Rust's Steam listing still calls out EAC as a system requirement. Rocket League joined the EAC roster in April 2026 with Season 22, which is a meaningful change of posture because Rocket League ran with a lightweight in-house anti-cheat for years and Psyonix's move signals Epic's willingness to enforce EAC across even their casual-adjacent portfolio.

EAC bypass detection in 2026

The current cat-and-mouse dynamic looks roughly like this:

The KyTech engineering team watches every EAC build and every EOS SDK update, because a single new field in the telemetry schema can invalidate an entire class of assumptions. Two engineers, one codebase, no shortcuts.

How KyTech handles this

KyTech was established in 2025 by two founders. Our Apex product is built specifically for EAC-protected titles, and it exists because the pattern that actually survives modern EAC is narrow and specific.

Our driver is kernel-mode. It never injects a thread into r5apex.exe, never opens a handle to the game process with PROCESS_VM_READ, and never writes to the game's address space. Reads happen through the kernel, and the render surface is external to the game window. That combination avoids the three most reliable EAC detection surfaces (handle rights, injected threads, and in-process module patches) simultaneously.

We ship a signed driver and use only Microsoft-documented kernel APIs, so we do not fall into the signed-third-party-driver trap that Windows 11 24H2's tightened MiShowBadMapper closed last summer. Our HWID spoofer is currently in beta and Apex-only, because getting spoofing right across the full range of hardware identifiers EAC's telemetry pipeline collects is a per-title problem, not a one-size-fits-all one.

You can read the current status of the Apex build on the product page: KyTech Apex. Full pricing is on the pricing page, and if you want a deeper side-by-side with the other big commercial vendor, our companion post on BattlEye vs Easy Anti-Cheat breaks that comparison down at the driver level. See the full product lineup for current availability.