Inside FACEIT_AC.sys — What We Found Reverse Engineering the Driver
We spent weeks reverse engineering FACEIT_AC.sys — FACEIT's kernel-mode anti-cheat driver — using WinDbg and Ghidra, working from kernel crash dumps and live system analysis. We mapped over 400 functions and identified everything it monitors, how it collects evidence, and how it protects itself. This article explains what it actually does, and where its reach ends.
This is a high-level overview of our findings. We describe what the driver does conceptually — what it monitors and what it can't. We keep the implementation details in our internal research notes. The goal here is architectural understanding.
Licensed Content
This article is exclusive to users with an active license. It contains our deepest reverse engineering research and is not available to free accounts.