Fragpunk's Neac Protect Anticheat Technical Overview

[Nokia Angel]

No Persistent Driver in Autoruns

If Neac Protect were a permanent kernel anti-cheat, it would typically have a driver entry in Autoruns under “Drivers.” The fact that nothing appears suggests it does not install persistently, also a reboot isn't required after installing the game.

Process Running Under the Game

The Neac Protect process spawns under the game’s process tree, it’s possible that the anti-cheat itself runs in user mode but uses a temporary kernel driver while the game is active.

DLL Driver Embedded in the System Process

A DLL (NeacSafe.sys) gets attached to the System process while the game is running, suggesting that Neac Protect loads a kernel component on demand. However, since it disappears after a while when the game is closed, this means the driver is not installed persistently—it’s probably just loaded dynamically during runtime.

So, Is It Kernel-Level?

Yes, but temporarily.

• The presence of a driver inside the System process means it interacts at the kernel level (likely via a signed kernel-mode driver).
  
• However, since it unloads when the game closes and isn’t persistent, it’s not an always-on kernel anti-cheat like Vanguard (Valorant) or Ricochet (Call of Duty).

Potential for RCE-Like Exploits

• Even though it unloads after the game closes, the fact that it runs with kernel privileges while the game is active means it could be exploited if there are vulnerabilities.
  
• Neac Protect had weak security (Marvel Rivals) in the past.

Please feel free to correct me if I have made any mistakes, tested using Fragpunk.