WELCOME TO INFOCHEATS.NET

INFOCHEATS is a community-driven platform focused on free game cheats, cheat development, and verified commercial software for a wide range of popular games. We provide a large collection of free cheats shared by the community. All public releases are checked for malicious code to reduce the risk of viruses, malware, or unwanted software before users interact with them.

Alongside free content, INFOCHEATS hosts an active marketplace with many independent sellers offering commercial cheats. Each product is discussed openly, with user feedback, reviews, and real usage experience available to help you make informed decisions before purchasing.

Whether you are looking for free cheats, exploring paid solutions, comparing sellers, or studying how cheats are developed and tested, INFOCHEATS brings everything together in one place — transparently and community-driven.

Click to expand...
Register Log in

Guide Apex Legends — Analyzing EAC Detection Vectors via Kernel Symbol Offsets & Import Mapping

byte_corvus

Newbie
Newbie
byte_corvus

byte_corvus

Newbie
Newbie
Status
Offline
Joined
Mar 3, 2026
Messages
113
Reaction score
7
EAC DETECTION VECTORS: NTOSKRNL SYMBOL ANALYSIS

Was going through some logs and decided to do a deep dive into the ntoskrnl symbols currently being resolved by EAC. If you are developing your own driver or trying to maintain an internal-to-external bridge without getting hit by a manual ban, you need to see what they are watching.

TECHNICAL BREAKDOWN
The logic here clearly points to EAC monitoring specific memory ranges and kernel dispatch tables to catch hooks or unauthorized read/write operations. They are resolving symbols via PDB, which makes standard pattern scanning for MmCopyVirtualMemory or KeStallExecutionProcessor significantly easier for them to flag.

  1. IMPORT MAP: EAC is actively importing from the ntoskrnl base. If your loader or driver maps itself into these memory regions without proper obfuscation, it is a one-way ticket to a HWID ban.
  2. SYMBOL TRACKING: The list includes critical functions like HalPrivateDispatchTable and KdLogDbgPrint. Any interaction with these is suspicious and monitored by their heartbeat.
  3. XREF ANALYSIS: Note the cross-references to MmUserProbeAddress. They are likely using this to validate if a memory address being accessed is actually in user mode or if someone is trying to force kernel-mode access from an unauthorized module.

Code: 
EAC ntoskrnl Resolved Symbols (via PDB)
ntoskrnl base: 0xFFFFF8049F000000
 
=== ALL RESOLVED ===
.data+0x25FAB8  ->  ntoskrnl!???(0x0)  (nt+0x0)
.data+0x27F1E0  ->  ntoskrnl!???(0x1000)  (nt+0x1000)
.data+0x25EC98  ->  ntoskrnl!CcFastMdlReadWait+0x34C40  (nt+0xFC30E0)
.data+0x25E140  ->  ntoskrnl!CcMdlRead+0x6560  (nt+0xAC7440)
.data+0x25E130  ->  ntoskrnl!CcMdlRead+0x6560  (nt+0xAC7440)
.data+0x25E108  ->  ntoskrnl!CcMdlRead+0x6560  (nt+0xAC7440)
.data+0x25E148  ->  ntoskrnl!CcMdlRead+0x76BF  (nt+0xAC859F)
.data+0x25E138  ->  ntoskrnl!CcMdlRead+0x76BF  (nt+0xAC859F)
.data+0x25ECC8  ->  ntoskrnl!ExAcquireRundownProtectionEx+0x9D0  (nt+0x3D05D0)
.data+0x25E240  ->  ntoskrnl!FsRtlAcknowledgeEcp+0x3F1B  (nt+0xA1CB8B)
.data+0x25E230  ->  ntoskrnl!FsRtlAcknowledgeEcp+0x3F1B  (nt+0xA1CB8B)
.data+0x25E238  ->  ntoskrnl!FsRtlAcknowledgeEcp+0x1950  (nt+0xA1A5C0)
.data+0x25E228  ->  ntoskrnl!FsRtlAcknowledgeEcp+0x1950  (nt+0xA1A5C0)
.data+0x219068  ->  ntoskrnl!HalPrivateDispatchTable+0x398  (nt+0xE00B68)
.data+0x25EC90  ->  ntoskrnl!KdComPortInUse+0x56198  (nt+0xE662A0)
.data+0x25F1A0  ->  ntoskrnl!KdLogDbgPrint+0x1EA5  (nt+0xB78AC5)
.data+0x25F1B0  ->  ntoskrnl!KdLogDbgPrint+0x1EA5  (nt+0xB78AC5)
.data+0x25F1A8  ->  ntoskrnl!KdLogDbgPrint+0x1D4C  (nt+0xB7896C)
.data+0x25F198  ->  ntoskrnl!KdLogDbgPrint+0x1D4C  (nt+0xB7896C)
.data+0x25F490  ->  ntoskrnl!KeClockInterruptNotify+0x1090  (nt+0x2E3EE0)
.data+0x25F498  ->  ntoskrnl!KeClockInterruptNotify+0x10B7  (nt+0x2E3F07)
.data+0x25F480  ->  ntoskrnl!KeClockInterruptNotify+0x13D9  (nt+0x2E4229)
.data+0x25F488  ->  ntoskrnl!KeClockInterruptNotify+0x1620  (nt+0x2E4470)
.data+0x21A010  ->  ntoskrnl!KeClockInterruptNotify+0x160C  (nt+0x2E445C)
.data+0x282AB8  ->  ntoskrnl!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xC69  (nt+0x303E09)
.data+0x282AC8  ->  ntoskrnl!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xB60  (nt+0x303D00)
.data+0x282AD0  ->  ntoskrnl!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xB8A  (nt+0x303D2A)
.data+0x282AC0  ->  ntoskrnl!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xD90  (nt+0x303F30)
.data+0x25ECA8  ->  ntoskrnl!KeRevertToUserGroupAffinityThread+0x220  (nt+0x2E2CE0)
.data+0x25E128  ->  ntoskrnl!KeSaveStateForHibernate+0x81B0  (nt+0x6B28A0)
.data+0x25F3A0  ->  ntoskrnl!KeStallExecutionProcessor+0x92  (nt+0x2E2932)
.data+0x25F390  ->  ntoskrnl!KeStallExecutionProcessor+0x92  (nt+0x2E2932)
.data+0x25F388  ->  ntoskrnl!KeStallExecutionProcessor  (nt+0x2E28A0)
.data+0x25F398  ->  ntoskrnl!KeStallExecutionProcessor  (nt+0x2E28A0)
.data+0x2829D8  ->  ntoskrnl!MmCopyVirtualMemory+0xA6F  (nt+0x9B26AF)
.data+0x2829C8  ->  ntoskrnl!MmCopyVirtualMemory+0xA6F  (nt+0x9B26AF)
.data+0x2829D0  ->  ntoskrnl!MmCopyVirtualMemory+0x40  (nt+0x9B1C80)
.data+0x2829C0  ->  ntoskrnl!MmCopyVirtualMemory+0x40  (nt+0x9B1C80)
.data+0x25E0F8  ->  ntoskrnl!MmUserProbeAddress+0x1C5750  (nt+0x200000)
.data+0x219008  ->  ntoskrnl!MmUserProbeAddress+0x1C5750  (nt+0x200000)
.data+0x2828E8  ->  ntoskrnl!MmUserProbeAddress+0x63014  (nt+0x9D8C4)
.data+0x25E248  ->  ntoskrnl!MmUserProbeAddress+0x70D80  (nt+0xAB630)
.data+0x2829E0  ->  ntoskrnl!MmUserProbeAddress+0x63080  (nt+0x9D930)
.data+0x25F0C0  ->  ntoskrnl!MmUserProbeAddress+0x4D480  (nt+0x87D30)
.data+0x282AD8  ->  ntoskrnl!MmUserProbeAddress+0x368A8  (nt+0x71158)
.data+0x25F4A0  ->  ntoskrnl!MmUserProbeAddress+0x33E0C  (nt+0x6E6BC)
.data+0x25F3A8  ->  ntoskrnl!MmUserProbeAddress+0x33BB0  (nt+0x6E460)
.data+0x2827F0  ->  ntoskrnl!MmUserProbeAddress+0x27B78  (nt+0x62428)
.data+0x25E438  ->  ntoskrnl!MmUserProbeAddress+0x25D14  (nt+0x605C4)
.data+0x25E340  ->  ntoskrnl!MmUserProbeAddress+0x91590  (nt+0xCBE40)
.data+0x25F1B8  ->  ntoskrnl!MmUserProbeAddress+0x206F4  (nt+0x5AFA4)
.data+0x25F2B0  ->  ntoskrnl!MmUserProbeAddress+0x820D0  (nt+0xBC980)
.data+0x25E150  ->  ntoskrnl!MmUserProbeAddress+0x92114  (nt+0xCC9C4)
.data+0x25E320  ->  ntoskrnl!NtQuerySystemInformationEx+0x5048  (nt+0xAE1B98)
.data+0x25E330  ->  ntoskrnl!NtQuerySystemInformationEx+0x5048  (nt+0xAE1B98)
.data+0x25E338  ->  ntoskrnl!NtQuerySystemInformationEx+0x52FD  (nt+0xAE1E4D)
.data+0x25E328  ->  ntoskrnl!NtQuerySystemInformationEx+0x52FD  (nt+0xAE1E4D)
.data+0x25F0A0  ->  ntoskrnl!PsAllocateAffinityToken+0x4360  (nt+0x4D5170)
.data+0x25F0B0  ->  ntoskrnl!PsAllocateAffinityToken+0x4360  (nt+0x4D5170)
.data+0x25F0A8  ->  ntoskrnl!PsAllocateAffinityToken+0x44F2  (nt+0x4D5302)
.data+0x25F0B8  ->  ntoskrnl!PsAllocateAffinityToken+0x44F2  (nt+0x4D5302)
.data+0x25F2A0  ->  ntoskrnl!PsAllocateAffinityToken+0x4C50  (nt+0x4D5A60)
.data+0x25F2A8  ->  ntoskrnl!PsAllocateAffinityToken+0x5002  (nt+0x4D5E12)
.data+0x25F298  ->  ntoskrnl!PsAllocateAffinityToken+0x5002  (nt+0x4D5E12)
.data+0x25F290  ->  ntoskrnl!PsAllocateAffinityToken+0x4C50  (nt+0x4D5A60)
.data+0x27F1E8  ->  ntoskrnl!PsGetSiloContainerId+0x480  (nt+0xAA2000)
.data+0x2827E0  ->  ntoskrnl!PsGetThreadExitStatus+0x50  (nt+0x9B15B0)
.data+0x2827E8  ->  ntoskrnl!PsGetThreadExitStatus+0x76  (nt+0x9B15D6)
.data+0x2827D8  ->  ntoskrnl!PsGetThreadExitStatus+0x76  (nt+0x9B15D6)
.data+0x2828D8  ->  ntoskrnl!PsGetThreadExitStatus+0xB0  (nt+0x9B1610)
.data+0x2828D0  ->  ntoskrnl!PsGetThreadExitStatus+0x392  (nt+0x9B18F2)
.data+0x2827D0  ->  ntoskrnl!PsGetThreadExitStatus+0x50  (nt+0x9B15B0)
.data+0x2828E0  ->  ntoskrnl!PsGetThreadExitStatus+0x392  (nt+0x9B18F2)
.data+0x2828C8  ->  ntoskrnl!PsGetThreadExitStatus+0xB0  (nt+0x9B1610)
.data+0x25E428  ->  ntoskrnl!RtlSidHashInitialize+0x538  (nt+0x378698)
.data+0x25E418  ->  ntoskrnl!RtlSidHashInitialize+0x538  (nt+0x378698)
.data+0x25E118  ->  ntoskrnl!RtlSidHashInitialize+0x5A6  (nt+0x378706)
.data+0x25E420  ->  ntoskrnl!RtlSidHashInitialize+0x5DB  (nt+0x37873B)
.data+0x25E430  ->  ntoskrnl!RtlSidHashInitialize+0x5DB  (nt+0x37873B)
.data+0x25E120  ->  ntoskrnl!SeCreateAccessStateEx+0x2658  (nt+0x8A7028)
.rdata+0x17F010  ->  ntoskrnl!_chkstk  (nt+0x6B3600)
.data+0x25E100  ->  ntoskrnl!strncpy+0x33D2B  (nt+0x6F3D8B)
.data+0x25ECD8  ->  ntoskrnl!x86BiosWriteMemory+0x1A850  (nt+0x561000)
.data+0x25ECB8  ->  ntoskrnl!x86BiosWriteMemory+0x19DC0  (nt+0x560570)
 
=== UNIQUE SYMBOLS ===
???(0x0)
???(0x1000)
CcFastMdlReadWait
CcMdlRead
ExAcquireRundownProtectionEx
FsRtlAcknowledgeEcp
HalPrivateDispatchTable
KdComPortInUse
KdLogDbgPrint
KeClockInterruptNotify
KeReleaseInStackQueuedSpinLockFromDpcLevel
KeRevertToUserGroupAffinityThread
KeSaveStateForHibernate
KeStallExecutionProcessor
MmCopyVirtualMemory
MmUserProbeAddress
NtQuerySystemInformationEx
PsAllocateAffinityToken
PsGetSiloContainerId
PsGetThreadExitStatus
RtlSidHashInitialize
SeCreateAccessStateEx
_chkstk
strncpy
x86BiosWriteMemory

Code: 
0x0224AB07 [VM] -> KeStallExecutionProcessor (RVA 0x25F398)
0x00029F62 [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x0002A57C [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x0002B29B [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x0002B35D [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x000AE3F8 [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x0028D2C0 [.text] -> MmUserProbeAddress+0x1C5750 (RVA 0x25E0F8)
0x00029F6B [.text] -> strncpy+0x33D2B (RVA 0x25E100)
0x0002A2FD [.text] -> strncpy+0x33D2B (RVA 0x25E100)
0x000EA604 [.text] -> strncpy+0x33D2B (RVA 0x25E100)
0x0028EC88 [.text] -> strncpy+0x33D2B (RVA 0x25E100)

Code: 
EAC Resolved Import Map
EAC Base: 0xFFFFF8047B1C0000  Size: 0x25BF000
ntoskrnl: 0xFFFFF8049F000000  hal: 0xFFFFF804A0800000  fltmgr: 0xFFFFF80430B60000
 
???+0x0000B0  ->  EasyAntiCheat_EOS.sys!(+0x0)  (0xFFFFF8047B1C0000)
.data+0x2604F0  ->  EasyAntiCheat_EOS.sys!(+0x0)  (0xFFFFF8047B1C0000)
.rdata+0x1E00F8  ->  EasyAntiCheat_EOS.sys!(+0x10420)  (0xFFFFF8047B1D0420)
.rdata+0x1E0100  ->  EasyAntiCheat_EOS.sys!(+0x104A0)  (0xFFFFF8047B1D04A0)
.rdata+0x1E0108  ->  EasyAntiCheat_EOS.sys!(+0x10520)  (0xFFFFF8047B1D0520)
.rdata+0x1E0110  ->  EasyAntiCheat_EOS.sys!(+0x10580)  (0xFFFFF8047B1D0580)
.rdata+0x1E0118  ->  EasyAntiCheat_EOS.sys!(+0x10640)  (0xFFFFF8047B1D0640)
.rdata+0x1E0120  ->  EasyAntiCheat_EOS.sys!(+0x106C0)  (0xFFFFF8047B1D06C0)
.rdata+0x1F1918  ->  EasyAntiCheat_EOS.sys!(+0x114A40)  (0xFFFFF8047B2D4A40)
.rdata+0x1F1900  ->  EasyAntiCheat_EOS.sys!(+0x114A40)  (0xFFFFF8047B2D4A40)
.data+0x2628C0  ->  EasyAntiCheat_EOS.sys!(+0x1218A0)  (0xFFFFF8047B2E18A0)
.data+0x2628C8  ->  EasyAntiCheat_EOS.sys!(+0x121C60)  (0xFFFFF8047B2E1C60)
.data+0x2628D0  ->  EasyAntiCheat_EOS.sys!(+0x121E40)  (0xFFFFF8047B2E1E40)
.rdata+0x1F18F8  ->  EasyAntiCheat_EOS.sys!(+0x14DA50)  (0xFFFFF8047B30DA50)
.rdata+0x1F1930  ->  EasyAntiCheat_EOS.sys!(+0x153B20)  (0xFFFFF8047B313B20)
.rdata+0x1F1938  ->  EasyAntiCheat_EOS.sys!(+0x154000)  (0xFFFFF8047B314000)
.rdata+0x1F1940  ->  EasyAntiCheat_EOS.sys!(+0x154600)  (0xFFFFF8047B314600)
.rdata+0x1F1948  ->  EasyAntiCheat_EOS.sys!(+0x154CA0)  (0xFFFFF8047B314CA0)
.rdata+0x1F1950  ->  EasyAntiCheat_EOS.sys!(+0x1556C0)  (0xFFFFF8047B3156C0)
.rdata+0x1F1958  ->  EasyAntiCheat_EOS.sys!(+0x155E80)  (0xFFFFF8047B315E80)
.rdata+0x1F1960  ->  EasyAntiCheat_EOS.sys!(+0x156B60)  (0xFFFFF8047B316B60)
.rdata+0x1EE2C0  ->  EasyAntiCheat_EOS.sys!(+0x1EB3E8)  (0xFFFFF8047B3AB3E8)
.rdata+0x1EE2D0  ->  EasyAntiCheat_EOS.sys!(+0x1EB3FC)  (0xFFFFF8047B3AB3FC)
.rdata+0x1EE2E0  ->  EasyAntiCheat_EOS.sys!(+0x1EB410)  (0xFFFFF8047B3AB410)
.rdata+0x1EE2F0  ->  EasyAntiCheat_EOS.sys!(+0x1EB424)  (0xFFFFF8047B3AB424)
.rdata+0x1EE300  ->  EasyAntiCheat_EOS.sys!(+0x1EB438)  (0xFFFFF8047B3AB438)
.rdata+0x1EE310  ->  EasyAntiCheat_EOS.sys!(+0x1EB44C)  (0xFFFFF8047B3AB44C)
.rdata+0x1EE320  ->  EasyAntiCheat_EOS.sys!(+0x1EB460)  (0xFFFFF8047B3AB460)
.rdata+0x1EE330  ->  EasyAntiCheat_EOS.sys!(+0x1EB474)  (0xFFFFF8047B3AB474)
.rdata+0x1EE340  ->  EasyAntiCheat_EOS.sys!(+0x1EB488)  (0xFFFFF8047B3AB488)
.rdata+0x1F0DC8  ->  EasyAntiCheat_EOS.sys!(+0x20127C)  (0xFFFFF8047B3C127C)
.rdata+0x1F0DD0  ->  EasyAntiCheat_EOS.sys!(+0x201284)  (0xFFFFF8047B3C1284)
.rdata+0x1F0D98  ->  EasyAntiCheat_EOS.sys!(+0x20128C)  (0xFFFFF8047B3C128C)
.rdata+0x1F0DA0  ->  EasyAntiCheat_EOS.sys!(+0x201294)  (0xFFFFF8047B3C1294)
.rdata+0x1F0DA8  ->  EasyAntiCheat_EOS.sys!(+0x20129C)  (0xFFFFF8047B3C129C)
.rdata+0x1F0DB0  ->  EasyAntiCheat_EOS.sys!(+0x2012A4)  (0xFFFFF8047B3C12A4)
.rdata+0x1F0DF8  ->  EasyAntiCheat_EOS.sys!(+0x2012AC)  (0xFFFFF8047B3C12AC)
.rdata+0x1F0E00  ->  EasyAntiCheat_EOS.sys!(+0x2012B4)  (0xFFFFF8047B3C12B4)
.rdata+0x1F0E08  ->  EasyAntiCheat_EOS.sys!(+0x2012BC)  (0xFFFFF8047B3C12BC)
.rdata+0x1F0E10  ->  EasyAntiCheat_EOS.sys!(+0x2012C4)  (0xFFFFF8047B3C12C4)
.rdata+0x1F0DD8  ->  EasyAntiCheat_EOS.sys!(+0x2012CC)  (0xFFFFF8047B3C12CC)
.rdata+0x1F0DE0  ->  EasyAntiCheat_EOS.sys!(+0x2012D4)  (0xFFFFF8047B3C12D4)
.rdata+0x1F0DE8  ->  EasyAntiCheat_EOS.sys!(+0x2012DC)  (0xFFFFF8047B3C12DC)
.rdata+0x1F0DF0  ->  EasyAntiCheat_EOS.sys!(+0x2012E4)  (0xFFFFF8047B3C12E4)
.rdata+0x1F0E38  ->  EasyAntiCheat_EOS.sys!(+0x2012EC)  (0xFFFFF8047B3C12EC)
.rdata+0x1F0E40  ->  EasyAntiCheat_EOS.sys!(+0x2012F4)  (0xFFFFF8047B3C12F4)
.rdata+0x1F0E48  ->  EasyAntiCheat_EOS.sys!(+0x2012FC)  (0xFFFFF8047B3C12FC)
.rdata+0x1F0E18  ->  EasyAntiCheat_EOS.sys!(+0x201304)  (0xFFFFF8047B3C1304)
.rdata+0x1F0E20  ->  EasyAntiCheat_EOS.sys!(+0x20130C)  (0xFFFFF8047B3C130C)
.rdata+0x1F0E28  ->  EasyAntiCheat_EOS.sys!(+0x201314)  (0xFFFFF8047B3C1314)
.rdata+0x1F0E30  ->  EasyAntiCheat_EOS.sys!(+0x20131C)  (0xFFFFF8047B3C131C)
.rdata+0x1F19B0  ->  EasyAntiCheat_EOS.sys!(+0x202924)  (0xFFFFF8047B3C2924)
.rdata+0x1F19B8  ->  EasyAntiCheat_EOS.sys!(+0x202930)  (0xFFFFF8047B3C2930)
.rdata+0x1F19C0  ->  EasyAntiCheat_EOS.sys!(+0x202938)  (0xFFFFF8047B3C2938)
.rdata+0x1F19C8  ->  EasyAntiCheat_EOS.sys!(+0x202940)  (0xFFFFF8047B3C2940)
.rdata+0x1F19A0  ->  EasyAntiCheat_EOS.sys!(+0x202948)  (0xFFFFF8047B3C2948)
.rdata+0x1F19A8  ->  EasyAntiCheat_EOS.sys!(+0x20294C)  (0xFFFFF8047B3C294C)
.rdata+0x203B18  ->  EasyAntiCheat_EOS.sys!(+0x20D030)  (0xFFFFF8047B3CD030)
.data+0x25E050  ->  EasyAntiCheat_EOS.sys!(+0x215EE0)  (0xFFFFF8047B3D5EE0)
.data+0x217700  ->  EasyAntiCheat_EOS.sys!(+0x2176F8)  (0xFFFFF8047B3D76F8)
.data+0x2176F8  ->  EasyAntiCheat_EOS.sys!(+0x2176F8)  (0xFFFFF8047B3D76F8)
.data+0x25E040  ->  EasyAntiCheat_EOS.sys!(+0x2184D0)  (0xFFFFF8047B3D84D0)
.data+0x21A040  ->  EasyAntiCheat_EOS.sys!(+0x21A040)  (0xFFFFF8047B3DA040)
.data+0x21A048  ->  EasyAntiCheat_EOS.sys!(+0x21A040)  (0xFFFFF8047B3DA040)
.data+0x21A080  ->  EasyAntiCheat_EOS.sys!(+0x21A080)  (0xFFFFF8047B3DA080)
.data+0x21A088  ->  EasyAntiCheat_EOS.sys!(+0x21A080)  (0xFFFFF8047B3DA080)
.data+0x21A140  ->  EasyAntiCheat_EOS.sys!(+0x21A150)  (0xFFFFF8047B3DA150)
.data+0x25BF10  ->  EasyAntiCheat_EOS.sys!(+0x25BF10)  (0xFFFFF8047B41BF10)
.data+0x25BF18  ->  EasyAntiCheat_EOS.sys!(+0x25BF10)  (0xFFFFF8047B41BF10)
.data+0x25BF58  ->  EasyAntiCheat_EOS.sys!(+0x25BF58)  (0xFFFFF8047B41BF58)
.data+0x25BF60  ->  EasyAntiCheat_EOS.sys!(+0x25BF58)  (0xFFFFF8047B41BF58)
.data+0x25BFC0  ->  EasyAntiCheat_EOS.sys!(+0x25BFC0)  (0xFFFFF8047B41BFC0)
.data+0x25BFC8  ->  EasyAntiCheat_EOS.sys!(+0x25BFC0)  (0xFFFFF8047B41BFC0)
.data+0x25C020  ->  EasyAntiCheat_EOS.sys!(+0x25C020)  (0xFFFFF8047B41C020)
.data+0x25C028  ->  EasyAntiCheat_EOS.sys!(+0x25C020)  (0xFFFFF8047B41C020)
.data+0x25E060  ->  EasyAntiCheat_EOS.sys!(+0x25E060)  (0xFFFFF8047B41E060)
.data+0x25E068  ->  EasyAntiCheat_EOS.sys!(+0x25E060)  (0xFFFFF8047B41E060)
.data+0x25E070  ->  EasyAntiCheat_EOS.sys!(+0x25E070)  (0xFFFFF8047B41E070)
.data+0x25E078  ->  EasyAntiCheat_EOS.sys!(+0x25E070)  (0xFFFFF8047B41E070)
.data+0x25E0A8  ->  EasyAntiCheat_EOS.sys!(+0x25E0A8)  (0xFFFFF8047B41E0A8)
.data+0x25E0B0  ->  EasyAntiCheat_EOS.sys!(+0x25E0A8)  (0xFFFFF8047B41E0A8)
.data+0x25EB40  ->  EasyAntiCheat_EOS.sys!(+0x25EB40)  (0xFFFFF8047B41EB40)
.data+0x25EB48  ->  EasyAntiCheat_EOS.sys!(+0x25EB40)  (0xFFFFF8047B41EB40)
.data+0x25EB80  ->  EasyAntiCheat_EOS.sys!(+0x25EB80)  (0xFFFFF8047B41EB80)
.data+0x25EB88  ->  EasyAntiCheat_EOS.sys!(+0x25EB80)  (0xFFFFF8047B41EB80)
.data+0x25EBE0  ->  EasyAntiCheat_EOS.sys!(+0x25EBD8)  (0xFFFFF8047B41EBD8)
.data+0x25EBD8  ->  EasyAntiCheat_EOS.sys!(+0x25EBD8)  (0xFFFFF8047B41EBD8)
.data+0x25EC20  ->  EasyAntiCheat_EOS.sys!(+0x25EC18)  (0xFFFFF8047B41EC18)
.data+0x25EC18  ->  EasyAntiCheat_EOS.sys!(+0x25EC18)  (0xFFFFF8047B41EC18)
.data+0x25EC68  ->  EasyAntiCheat_EOS.sys!(+0x25EC68)  (0xFFFFF8047B41EC68)
.data+0x25EC70  ->  EasyAntiCheat_EOS.sys!(+0x25EC68)  (0xFFFFF8047B41EC68)
.data+0x25FB10  ->  EasyAntiCheat_EOS.sys!(+0x25FB08)  (0xFFFFF8047B41FB08)
.data+0x25FB08  ->  EasyAntiCheat_EOS.sys!(+0x25FB08)  (0xFFFFF8047B41FB08)
.data+0x25FF00  ->  EasyAntiCheat_EOS.sys!(+0x25FEF8)  (0xFFFFF8047B41FEF8)
.data+0x25FEF8  ->  EasyAntiCheat_EOS.sys!(+0x25FEF8)  (0xFFFFF8047B41FEF8)
.data+0x260560  ->  EasyAntiCheat_EOS.sys!(+0x260560)  (0xFFFFF8047B420560)
.data+0x260568  ->  EasyAntiCheat_EOS.sys!(+0x260560)  (0xFFFFF8047B420560)
.data+0x2607B0  ->  EasyAntiCheat_EOS.sys!(+0x2607B0)  (0xFFFFF8047B4207B0)
.data+0x2607B8  ->  EasyAntiCheat_EOS.sys!(+0x2607B0)  (0xFFFFF8047B4207B0)
.data+0x2607F0  ->  EasyAntiCheat_EOS.sys!(+0x2607E8)  (0xFFFFF8047B4207E8)
.data+0x2607E8  ->  EasyAntiCheat_EOS.sys!(+0x2607E8)  (0xFFFFF8047B4207E8)
.data+0x260818  ->  EasyAntiCheat_EOS.sys!(+0x260818)  (0xFFFFF8047B420818)
.data+0x260820  ->  EasyAntiCheat_EOS.sys!(+0x260818)  (0xFFFFF8047B420818)
.data+0x260830  ->  EasyAntiCheat_EOS.sys!(+0x260830)  (0xFFFFF8047B420830)
.data+0x260838  ->  EasyAntiCheat_EOS.sys!(+0x260830)  (0xFFFFF8047B420830)
.data+0x260840  ->  EasyAntiCheat_EOS.sys!(+0x260840)  (0xFFFFF8047B420840)
.data+0x260848  ->  EasyAntiCheat_EOS.sys!(+0x260840)  (0xFFFFF8047B420840)
.data+0x260880  ->  EasyAntiCheat_EOS.sys!(+0x260880)  (0xFFFFF8047B420880)
.data+0x260888  ->  EasyAntiCheat_EOS.sys!(+0x260880)  (0xFFFFF8047B420880)
.data+0x262A60  ->  EasyAntiCheat_EOS.sys!(+0x262A58)  (0xFFFFF8047B422A58)
.data+0x262A58  ->  EasyAntiCheat_EOS.sys!(+0x262A58)  (0xFFFFF8047B422A58)
.data+0x25EAF8  ->  EasyAntiCheat_EOS.sys!(+0x2B720)  (0xFFFFF8047B1EB720)
.rdata+0x1E0770  ->  EasyAntiCheat_EOS.sys!(+0x3EB70)  (0xFFFFF8047B1FEB70)
.rdata+0x1E0778  ->  EasyAntiCheat_EOS.sys!(+0x3EBC4)  (0xFFFFF8047B1FEBC4)
.rdata+0x1E0780  ->  EasyAntiCheat_EOS.sys!(+0x3EC18)  (0xFFFFF8047B1FEC18)
.rdata+0x1E0788  ->  EasyAntiCheat_EOS.sys!(+0x3EC40)  (0xFFFFF8047B1FEC40)
.rdata+0x1E0790  ->  EasyAntiCheat_EOS.sys!(+0x3ECE0)  (0xFFFFF8047B1FECE0)
.rdata+0x1E0798  ->  EasyAntiCheat_EOS.sys!(+0x3ED60)  (0xFFFFF8047B1FED60)
.rdata+0x1EAC60  ->  EasyAntiCheat_EOS.sys!(+0x46D30)  (0xFFFFF8047B206D30)
.rdata+0x1F1908  ->  EasyAntiCheat_EOS.sys!(+0x46D30)  (0xFFFFF8047B206D30)
.rdata+0x1E07E8  ->  EasyAntiCheat_EOS.sys!(+0x49DE0)  (0xFFFFF8047B209DE0)
.rdata+0x1E07F8  ->  EasyAntiCheat_EOS.sys!(+0x49F00)  (0xFFFFF8047B209F00)
.rdata+0x1E07F0  ->  EasyAntiCheat_EOS.sys!(+0x4A060)  (0xFFFFF8047B20A060)
.rdata+0x1E0D30  ->  EasyAntiCheat_EOS.sys!(+0x51F40)  (0xFFFFF8047B211F40)
.data+0x2181B8  ->  EasyAntiCheat_EOS.sys!(+0x51F40)  (0xFFFFF8047B211F40)
.rdata+0x17F058  ->  EasyAntiCheat_EOS.sys!(+0x9FC0)  (0xFFFFF8047B1C9FC0)
.rdata+0x17F060  ->  EasyAntiCheat_EOS.sys!(+0xA000)  (0xFFFFF8047B1CA000)
.rdata+0x17F068  ->  EasyAntiCheat_EOS.sys!(+0xA048)  (0xFFFFF8047B1CA048)
.rdata+0x1E94F8  ->  EasyAntiCheat_EOS.sys!(+0xBB298)  (0xFFFFF8047B27B298)
.rdata+0x1E9518  ->  EasyAntiCheat_EOS.sys!(+0xBB298)  (0xFFFFF8047B27B298)
.rdata+0x1E9538  ->  EasyAntiCheat_EOS.sys!(+0xBB558)  (0xFFFFF8047B27B558)
.rdata+0x1E95C8  ->  EasyAntiCheat_EOS.sys!(+0xBB560)  (0xFFFFF8047B27B560)
.data+0x2628D8  ->  EasyAntiCheat_EOS.sys!(+0xCAB80)  (0xFFFFF8047B28AB80)
.data+0x216E60  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216EF0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216F80  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217010  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217130  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2171C0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217250  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2172E0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216830  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217400  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217490  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217520  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2160E0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216050  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216170  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216320  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2163B0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216440  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2165F0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x217370  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2167A0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x2168C0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216A70  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216B00  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216B90  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216C20  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216CB0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216D40  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x216DD0  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.rdata+0x1F1910  ->  EasyAntiCheat_EOS.sys!(+0xD530)  (0xFFFFF8047B1CD530)
.data+0x215F30  ->  EasyAntiCheat_EOS.sys!(+0xD538)  (0xFFFFF8047B1CD538)
.data+0x216290  ->  EasyAntiCheat_EOS.sys!(+0xD538)  (0xFFFFF8047B1CD538)
.data+0x216200  ->  EasyAntiCheat_EOS.sys!(+0xD538)  (0xFFFFF8047B1CD538)
.data+0x2169E0  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x216950  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x216710  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x216680  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x216560  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x2164D0  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x215FC0  ->  EasyAntiCheat_EOS.sys!(+0xD560)  (0xFFFFF8047B1CD560)
.data+0x2170A0  ->  EasyAntiCheat_EOS.sys!(+0xD5A0)  (0xFFFFF8047B1CD5A0)
.data+0x2175B0  ->  EasyAntiCheat_EOS.sys!(+0xD6C0)  (0xFFFFF8047B1CD6C0)
.rdata+0x1EA800  ->  EasyAntiCheat_EOS.sys!(+0xDC350)  (0xFFFFF8047B29C350)
.rdata+0x1EA808  ->  EasyAntiCheat_EOS.sys!(+0xDC360)  (0xFFFFF8047B29C360)
.rdata+0x1EA810  ->  EasyAntiCheat_EOS.sys!(+0xDC370)  (0xFFFFF8047B29C370)
.rdata+0x1EA818  ->  EasyAntiCheat_EOS.sys!(+0xDC380)  (0xFFFFF8047B29C380)
.rdata+0x1EA820  ->  EasyAntiCheat_EOS.sys!(+0xDC420)  (0xFFFFF8047B29C420)
.rdata+0x1EA828  ->  EasyAntiCheat_EOS.sys!(+0xDC480)  (0xFFFFF8047B29C480)
.rdata+0x1EAC38  ->  EasyAntiCheat_EOS.sys!(+0xF25A0)  (0xFFFFF8047B2B25A0)
.rdata+0x1EAC40  ->  EasyAntiCheat_EOS.sys!(+0xF25B0)  (0xFFFFF8047B2B25B0)
.rdata+0x1EAC48  ->  EasyAntiCheat_EOS.sys!(+0xF25C0)  (0xFFFFF8047B2B25C0)
.rdata+0x1EAC50  ->  EasyAntiCheat_EOS.sys!(+0xF2620)  (0xFFFFF8047B2B2620)
.rdata+0x1EAC58  ->  EasyAntiCheat_EOS.sys!(+0xF2B70)  (0xFFFFF8047B2B2B70)
.rdata+0x17F000  ->  FLTMGR.SYS!(unknown+0x72BE0)  (0xFFFFF80430BD2BE0)
.data+0x218500  ->  mouclass.sys!(+0xF790)  (0xFFFFF8047211F790)
.data+0x25FAB8  ->  ntoskrnl.exe!(unknown+0x0)  (0xFFFFF8049F000000)
.data+0x27F1E0  ->  ntoskrnl.exe!(unknown+0x1000)  (0xFFFFF8049F001000)
.data+0x219008  ->  ntoskrnl.exe!(unknown+0x200000)  (0xFFFFF8049F200000)
.data+0x25E0F8  ->  ntoskrnl.exe!(unknown+0x200000)  (0xFFFFF8049F200000)
.data+0x25F3A0  ->  ntoskrnl.exe!(unknown+0x2E2932)  (0xFFFFF8049F2E2932)
.data+0x25F390  ->  ntoskrnl.exe!(unknown+0x2E2932)  (0xFFFFF8049F2E2932)
.data+0x25ECA8  ->  ntoskrnl.exe!(unknown+0x2E2CE0)  (0xFFFFF8049F2E2CE0)
.data+0x25F490  ->  ntoskrnl.exe!(unknown+0x2E3EE0)  (0xFFFFF8049F2E3EE0)
.data+0x25F498  ->  ntoskrnl.exe!(unknown+0x2E3F07)  (0xFFFFF8049F2E3F07)
.data+0x25F480  ->  ntoskrnl.exe!(unknown+0x2E4229)  (0xFFFFF8049F2E4229)
.data+0x21A010  ->  ntoskrnl.exe!(unknown+0x2E445C)  (0xFFFFF8049F2E445C)
.data+0x25F488  ->  ntoskrnl.exe!(unknown+0x2E4470)  (0xFFFFF8049F2E4470)
.data+0x282AC8  ->  ntoskrnl.exe!(unknown+0x303D00)  (0xFFFFF8049F303D00)
.data+0x282AD0  ->  ntoskrnl.exe!(unknown+0x303D2A)  (0xFFFFF8049F303D2A)
.data+0x282AB8  ->  ntoskrnl.exe!(unknown+0x303E09)  (0xFFFFF8049F303E09)
.data+0x282AC0  ->  ntoskrnl.exe!(unknown+0x303F30)  (0xFFFFF8049F303F30)
.data+0x25E428  ->  ntoskrnl.exe!(unknown+0x378698)  (0xFFFFF8049F378698)
.data+0x25E418  ->  ntoskrnl.exe!(unknown+0x378698)  (0xFFFFF8049F378698)
.data+0x25E118  ->  ntoskrnl.exe!(unknown+0x378706)  (0xFFFFF8049F378706)
.data+0x25E420  ->  ntoskrnl.exe!(unknown+0x37873B)  (0xFFFFF8049F37873B)
.data+0x25E430  ->  ntoskrnl.exe!(unknown+0x37873B)  (0xFFFFF8049F37873B)
.data+0x25ECC8  ->  ntoskrnl.exe!(unknown+0x3D05D0)  (0xFFFFF8049F3D05D0)
.data+0x25F0A0  ->  ntoskrnl.exe!(unknown+0x4D5170)  (0xFFFFF8049F4D5170)
.data+0x25F0B0  ->  ntoskrnl.exe!(unknown+0x4D5170)  (0xFFFFF8049F4D5170)
.data+0x25F0A8  ->  ntoskrnl.exe!(unknown+0x4D5302)  (0xFFFFF8049F4D5302)
.data+0x25F0B8  ->  ntoskrnl.exe!(unknown+0x4D5302)  (0xFFFFF8049F4D5302)
.data+0x25F2A0  ->  ntoskrnl.exe!(unknown+0x4D5A60)  (0xFFFFF8049F4D5A60)
.data+0x25F290  ->  ntoskrnl.exe!(unknown+0x4D5A60)  (0xFFFFF8049F4D5A60)
.data+0x25F298  ->  ntoskrnl.exe!(unknown+0x4D5E12)  (0xFFFFF8049F4D5E12)
.data+0x25F2A8  ->  ntoskrnl.exe!(unknown+0x4D5E12)  (0xFFFFF8049F4D5E12)
.data+0x25ECB8  ->  ntoskrnl.exe!(unknown+0x560570)  (0xFFFFF8049F560570)
.data+0x25ECD8  ->  ntoskrnl.exe!(unknown+0x561000)  (0xFFFFF8049F561000)
.data+0x25F1B8  ->  ntoskrnl.exe!(unknown+0x5AFA4)  (0xFFFFF8049F05AFA4)
.data+0x25E438  ->  ntoskrnl.exe!(unknown+0x605C4)  (0xFFFFF8049F0605C4)
.data+0x2827F0  ->  ntoskrnl.exe!(unknown+0x62428)  (0xFFFFF8049F062428)
.data+0x25E128  ->  ntoskrnl.exe!(unknown+0x6B28A0)  (0xFFFFF8049F6B28A0)
.data+0x25F3A8  ->  ntoskrnl.exe!(unknown+0x6E460)  (0xFFFFF8049F06E460)
.data+0x25F4A0  ->  ntoskrnl.exe!(unknown+0x6E6BC)  (0xFFFFF8049F06E6BC)
.data+0x25E100  ->  ntoskrnl.exe!(unknown+0x6F3D8B)  (0xFFFFF8049F6F3D8B)
.data+0x282AD8  ->  ntoskrnl.exe!(unknown+0x71158)  (0xFFFFF8049F071158)
.data+0x25F0C0  ->  ntoskrnl.exe!(unknown+0x87D30)  (0xFFFFF8049F087D30)
.data+0x25E120  ->  ntoskrnl.exe!(unknown+0x8A7028)  (0xFFFFF8049F8A7028)
.data+0x2827D0  ->  ntoskrnl.exe!(unknown+0x9B15B0)  (0xFFFFF8049F9B15B0)
.data+0x2827E0  ->  ntoskrnl.exe!(unknown+0x9B15B0)  (0xFFFFF8049F9B15B0)
.data+0x2827E8  ->  ntoskrnl.exe!(unknown+0x9B15D6)  (0xFFFFF8049F9B15D6)
.data+0x2827D8  ->  ntoskrnl.exe!(unknown+0x9B15D6)  (0xFFFFF8049F9B15D6)
.data+0x2828C8  ->  ntoskrnl.exe!(unknown+0x9B1610)  (0xFFFFF8049F9B1610)
.data+0x2828D8  ->  ntoskrnl.exe!(unknown+0x9B1610)  (0xFFFFF8049F9B1610)
.data+0x2828E0  ->  ntoskrnl.exe!(unknown+0x9B18F2)  (0xFFFFF8049F9B18F2)
.data+0x2828D0  ->  ntoskrnl.exe!(unknown+0x9B18F2)  (0xFFFFF8049F9B18F2)
.data+0x2829D0  ->  ntoskrnl.exe!(unknown+0x9B1C80)  (0xFFFFF8049F9B1C80)
.data+0x2829C0  ->  ntoskrnl.exe!(unknown+0x9B1C80)  (0xFFFFF8049F9B1C80)
.data+0x2829C8  ->  ntoskrnl.exe!(unknown+0x9B26AF)  (0xFFFFF8049F9B26AF)
.data+0x2829D8  ->  ntoskrnl.exe!(unknown+0x9B26AF)  (0xFFFFF8049F9B26AF)
.data+0x2828E8  ->  ntoskrnl.exe!(unknown+0x9D8C4)  (0xFFFFF8049F09D8C4)
.data+0x2829E0  ->  ntoskrnl.exe!(unknown+0x9D930)  (0xFFFFF8049F09D930)
.data+0x25E228  ->  ntoskrnl.exe!(unknown+0xA1A5C0)  (0xFFFFF8049FA1A5C0)
.data+0x25E238  ->  ntoskrnl.exe!(unknown+0xA1A5C0)  (0xFFFFF8049FA1A5C0)
.data+0x25E230  ->  ntoskrnl.exe!(unknown+0xA1CB8B)  (0xFFFFF8049FA1CB8B)
.data+0x25E240  ->  ntoskrnl.exe!(unknown+0xA1CB8B)  (0xFFFFF8049FA1CB8B)
.data+0x27F1E8  ->  ntoskrnl.exe!(unknown+0xAA2000)  (0xFFFFF8049FAA2000)
.data+0x25E248  ->  ntoskrnl.exe!(unknown+0xAB630)  (0xFFFFF8049F0AB630)
.data+0x25E108  ->  ntoskrnl.exe!(unknown+0xAC7440)  (0xFFFFF8049FAC7440)
.data+0x25E130  ->  ntoskrnl.exe!(unknown+0xAC7440)  (0xFFFFF8049FAC7440)
.data+0x25E140  ->  ntoskrnl.exe!(unknown+0xAC7440)  (0xFFFFF8049FAC7440)
.data+0x25E138  ->  ntoskrnl.exe!(unknown+0xAC859F)  (0xFFFFF8049FAC859F)
.data+0x25E148  ->  ntoskrnl.exe!(unknown+0xAC859F)  (0xFFFFF8049FAC859F)
.data+0x25E320  ->  ntoskrnl.exe!(unknown+0xAE1B98)  (0xFFFFF8049FAE1B98)
.data+0x25E330  ->  ntoskrnl.exe!(unknown+0xAE1B98)  (0xFFFFF8049FAE1B98)
.data+0x25E328  ->  ntoskrnl.exe!(unknown+0xAE1E4D)  (0xFFFFF8049FAE1E4D)
.data+0x25E338  ->  ntoskrnl.exe!(unknown+0xAE1E4D)  (0xFFFFF8049FAE1E4D)
.data+0x25F198  ->  ntoskrnl.exe!(unknown+0xB7896C)  (0xFFFFF8049FB7896C)
.data+0x25F1A8  ->  ntoskrnl.exe!(unknown+0xB7896C)  (0xFFFFF8049FB7896C)
.data+0x25F1A0  ->  ntoskrnl.exe!(unknown+0xB78AC5)  (0xFFFFF8049FB78AC5)
.data+0x25F1B0  ->  ntoskrnl.exe!(unknown+0xB78AC5)  (0xFFFFF8049FB78AC5)
.data+0x25F2B0  ->  ntoskrnl.exe!(unknown+0xBC980)  (0xFFFFF8049F0BC980)
.data+0x25E340  ->  ntoskrnl.exe!(unknown+0xCBE40)  (0xFFFFF8049F0CBE40)
.data+0x25E150  ->  ntoskrnl.exe!(unknown+0xCC9C4)  (0xFFFFF8049F0CC9C4)
.data+0x219068  ->  ntoskrnl.exe!(unknown+0xE00B68)  (0xFFFFF8049FE00B68)
.data+0x25EC90  ->  ntoskrnl.exe!(unknown+0xE662A0)  (0xFFFFF8049FE662A0)
.data+0x25EC98  ->  ntoskrnl.exe!(unknown+0xFC30E0)  (0xFFFFF8049FFC30E0)
.data+0x25F398  ->  ntoskrnl.exe!KeStallExecutionProcessor  (0xFFFFF8049F2E28A0)
.data+0x25F388  ->  ntoskrnl.exe!KeStallExecutionProcessor  (0xFFFFF8049F2E28A0)
.rdata+0x17F010  ->  ntoskrnl.exe!__chkstk  (0xFFFFF8049F6B3600)
 
1289 imports

WHY THIS MATTERS FOR YOUR BUILD
If you are running an external tool (RPM), you know that MmCopyVirtualMemory is the classic way to go, but relying on standard Windows APIs for this is practically asking for a detection during a wave. I have seen too many people using standard mapping techniques that get caught because they do not clean up their handles in the PsGetThreadExitStatus or ignore the silo container ID validation.

BOTTOM LINE
If you are working on a custom driver, make sure you are not just blindly calling these resolved symbols. If you do not have a robust method for handling SeCreateAccessStateEx or if your driver signature is sitting in plain sight, expect a frog ban or a manual review on your main account.

Anyone else digging into the latest EasyAntiCheat_EOS.sys updates? Curious if anyone has found a reliable way to spoof the HalPrivateDispatchTable without crashing the system under heavy load. Drop your findings or common crash points below.
 
You must log in or register to reply here.
Top