How to bypass EAC EAAC Javelin anti-cheat?

Private bypass user-mode and kernel source code: https://overlayhack.com/eac-eaac-anti-cheat-bypass/1038

EA started using its own anti-cheat EAAC on 10th Oct 2023 in BF2042. Similarly to EAC's hidden system threads. EAAC creates one and spoof the start address. The only way to find a hidden system thread is to use the kernel thread notify callbacks or by stackwalking each system thread. When you stalkwalk system threads, you just check is there a frame that points to their kernel driver memory range.


Code integrity checks in the anti-cheat that attempts to detect any tampering in the kernel are in EAAC are somewhat equal to EAC. If it detects any tampering. The anti-cheat will terminate the game process and the following popup will appear:

489:225


Their anti-cheat also pools a DPC whose deferred routine points to their kernel driver text section. Pointers to deferred routines in the DPC pool are obfuscated in the kernel. It is worth noting that the DPC is in the text section of the driver. Any tampering can be easily detected unless you disable their checks. The less you disable anti-cheats code integrity checks (self-defense), the better.
1039:274


Once EAAC driver has been initialized. The anti-cheat also blocks any new driver from loading that use ("Nt"ZwLoadDriver) kernel API using a clever method. Code injection will neither work because of a mitigation flags that prevents dynamic code injection (manually mapped DLL's) from loading. The result is 0xC0000604 (STATUS_DYNAMIC_CODE_BLOCKED) if you try to allocate executable memory or alter memory protection from RW to RWX. This is a built-in security feature in the kernel.

More about flags: https://www.unknowncheats.me/forum/3540472-post31.html

To overcome the issue without triggering their integrity checks. You'll need to allocate a RW section and copy the payload. Enable execution via a PTE and it will execute even though the section was allocated RW. If it's a large page (more than 4096 bytes), then you must use the PDE instead.

EAC bypass RtlCreateUserThread

How to bypass EAC's thread creation checks? Both anti-cheats "blocks" any newly created thread outside the protected process. One anti-cheat bypassing technique is to hijack an existing thread. If you hijack the wrong thread, or if there is an error in the shellcode, the game process will crash.

It's also worth mentioning that after you've hijacked a thread, that thread executes code outside of modules (non backed) and this is going to get you either flagged or banned after the anti-cheat stackwalk threads. An additional anti-cheat evasion techniques are required. To keep the author's private bypass undetectable in EAC and EAAC. I leave that as an exercise for the reader. The article is to be updated...

The trick is to allocate executable memory (RWX) in the context of a process thread. That eliminates the need to disable mitigation flags that may trigger anti-cheat's integrity checks. The very same method enables you to create a new dedicated thread but that thread is still executing non backed dynamic code. You'll need to DKOM your newly created thread. The DKOM method the author uses is private and bypasses EAC as well. It's worth to mention that most of DKOM's are subject to PatchGuard bug check but there is a working solution to bypass PatchGuard at runtime for the latest versions of windows https://overlayhack.com/patchguard-bypass.

EAC / EAAC

The author did not found any inline hooks in the text section but I did not checked the IAT pointers yet.


The lab was performed on Windows 10 Pro 22H2 Build: 19045.3324

CREDITS: IChooseYou vmcall