EAC Architecture
Easy Anti-Cheat is developed by Epic Games and operates in two layers: user-mode and kernel-mode. When a game launches, EAC loads both a user-space service and a kernel driver.
The kernel driver can monitor system calls (syscalls), scan memory, and check driver signatures. This means simple user-mode hooks are easily detected by EAC.
EAC also collects server-side data: in-game behavior, aim patterns, and statistics are sent to the server. Some cheats that can't be directly detected are caught this way.
What Does EAC Scan?
Main categories EAC detects:
Memory manipulation: Code injected into the game process or memory writes.
Driver signatures: Unsigned or suspicious kernel drivers. Attempts to detect vulnerable drivers loaded via BYOVD.
Process names and file paths: Process and file names of known cheat tools.
HWID collection: Disk serial, MAC address, SMBIOS, GPU, and system UUID. These are compared against the ban list.
Screenshot and memory scan: Some EAC versions can take screenshots for overlay detection.
How Does EAC Enforce HWID Bans?
Upon detection, EAC sends collected hardware identifiers (disk serial, MAC, GPU, etc.) to its server and these are added to the ban database. On the next game launch, EAC re-collects these IDs and compares them against the ban list.
Account ban: Steam/Epic account is banned. HWID ban: IDs are added to the ban list, blocking access even with a new account.
HWID Core breaks this process: Run before the game launches, it rotates disk serial, MAC, SMBIOS, GPU and other IDs at kernel level. When EAC starts and collects IDs, they no longer match the ban list — access is granted.