- Status
- Offline
- Joined
- Mar 3, 2026
- Messages
- 421
- Reaction score
- 7
Got my hands on a kernel-mode driver setup that's been circulating for EAC-protected titles. It's currently being used in some external projects for Rust and is holding up, though with any public release, the "undetected" status is always a cat-and-mouse game. Use your head and test on a burner.
This package includes the driver, a mapper, and a communication example to get you started. It handles the heavy lifting of memory operations and physical address translation, which is essential if you're trying to dodge CR3 protections.
Technical IOCTL Interface:
Core Implementation Details:
As always, keep an eye on your handle stripping and don't leave the device object sitting out if you can help it. If you're hitting BSODs during the VA to PA translation, double-check your directory table base offsets.
who's tested this on their main yet?
You cant view this link please login.
You cant view this link please login.
This package includes the driver, a mapper, and a communication example to get you started. It handles the heavy lifting of memory operations and physical address translation, which is essential if you're trying to dodge CR3 protections.
Technical IOCTL Interface:
Code:
0x300 - GetModuleBase
0x310 - ReadProcessMemory (Requires PID, VA, DirectoryTableBase)
0x320 - WriteProcessMemory
0x340 - Virtual Address to Physical Address (VA to PA)
0x350 - GetDirectoryTableBaseCore Implementation Details:
- The driver uses MmCopyMemory logic for its RPM/WPM routine.
- Communication is handled via a standard symlink:
Code:
\\.\loaderfittydrv - Includes VA to PA translation — critical for bypassing certain anti-cheat memory auditing techniques.
- The RPM implementation (0x310) expects a pointer to a local buffer and the size, alongside the directory table base for proper context switching.
If you're planning to use this for Rust or any BattlEye/EAC game, remember that the mapper's signatures are likely flagged if you don't mutate them. I'd recommend swapping the mapper for a custom one or at least stripping the strings. The driver itself is a solid base for anyone looking to build a custom external.
As always, keep an eye on your handle stripping and don't leave the device object sitting out if you can help it. If you're hitting BSODs during the VA to PA translation, double-check your directory table base offsets.
who's tested this on their main yet?
