Support Epic's "Easy Anti Cheat"

[kristjanvalur]

See issue #975

Two changes are made, for the Windows platform:

• The target process is opened with limited permissions, and only upgraded to full permission when required. When an anti-cheat watchdog is present, the target process is often protected until it crashes.
• The target thread may be already suspended by the watchdog process. Accept a failure to suspend the target thread.

[bitsandfoxes]

Thanks for contributing!

[supervacuus]

I also tested this with the WER module and saw no regressions. Thanks!

[p0358]

If your crash dumper also meets the requirements, then setting the executable’s file name to anything that begins with “CrashReport” will allow it to operate in the same way.

So there was no need to do that step to get it working? (from EAC's dev docs) Or perhaps it also recognizes crashpad_handler.exe as supported name? I'm considering implementing EAC at some point, so I'm a bit curious about that...

[supervacuus]

So there was no need to do that step to get it working?

I did not read it this way. To me, it reads like you need the changes in this PR and must change the name of the executable. However, you can provide the actual name of the crashpad_handler via options in the Native SDK.

Maybe @kristjanvalur can chime in.

[kristjanvalur]

Im not sure what it means for EAC to know the name of your crash dumper.
In our experience, even declaring that to eac didn't help.
It was on advice from epic that the crash reporter should only request limited access to the process regardless, and then upgrade it on demand. Requesting full access on startup would fail.

[supervacuus]

Thanks, @kristjanvalur. I think the question is whether the code changes in crashpad are enough or if a name change of the crashpad_handler is also required. Did you do both, or did the changes to the code suffice?

[kristjanvalur]

We didn't do change the name, but we did mention the correct name in the EAC config file. I think that if the process isn't listed as a crash handling process, either by name change or by providing it's name in config, it won't even get permission to open a limited process handle to the parent process. I guess both requirements need to be met.

…

On Sat, 1 Jun 2024, 10:58 Mischan Toosarani-Hausberger, < ***@***.***> wrote: Thanks, @kristjanvalur <https://github.com/kristjanvalur>. I think the question is whether the code changes in crashpad are enough or if a name change of the crashpad_handler is *also* required. Did you do both, or did the changes to the code suffice? — Reply to this email directly, view it on GitHub <#99 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABN3FR7O4M3LJ6D4IOIFBWLZFF5KTAVCNFSM6AAAAABFVJ27RGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNBTGM2DSNZXGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>