How Easy Anti-Cheat and BattEye function under Linux and Proton compared to Windows kernel drivers.

The fundamental difference between how Easy Anti-Cheat (EAC) and BattEye operate on Windows versus Linux comes down to privilege levels and OS architecture:

• On Windows: They operate primarily as Kernel-Mode Drivers (Ring 0) with unrestricted system hardware and memory access.

• On Linux (via Proton): They operate as Native User-Space Libraries (Ring 3) interacting via a translation bridge.

Because Wine and Proton run strictly in user space, Windows kernel drivers (.sys files) cannot be loaded into the Linux kernel. To allow Windows games to run on Linux without rewriting game code, Valve worked with Epic and BattEye to re-architect their anti-cheat pipelines.

1. How Windows Kernel Anti-Cheats Work (Ring 0)

On Windows, when you boot a game protected by EAC or BattEye:

1. Kernel Driver Initialization: The game service loads a ring-0 Windows kernel driver (such as EasyAntiCheat_x64.sys or BEDaisy.sys) directly into the operating system kernel.

2. Unrestricted OS Visibility: Operating at the highest system privilege level allows the anti-cheat driver to:

   • Scan physical system RAM across all active processes.

   • Intercept system memory allocation and process handle requests (NtOpenProcess, VirtualAllocEx).

   • Verify that no unauthorized third-party kernel drivers or hypervisors are hooked into Windows.

   • Prevent unauthorized programs from reading or writing to the game’s memory space.

The Windows Philosophy: Ensure that no user-space cheat program (Ring 3) can manipulate game memory without a higher-privileged kernel driver seeing it.

2. How EAC and BattEye Work on Linux & Proton (Ring 3)

Because Linux forbids loading closed-source Windows kernel drivers, Valve, Epic, and BattEye developed a native user-space runtime bridge:

[ Windows Game (.exe) ] ──(Wine/Proton API Calls)──► [ Proton Runtime Bridge ]
                                                             │
                                                             ▼
[ Game Server ] ◄───────(Signed Network Tokens)─────── [ Native Linux .so ]
                                                      (User-Space / Ring 3)

The Native .so Shared Library

Instead of executing Windows .sys driver binaries inside Proton, Steam routes anti-cheat checks to a native Linux shared object (easyanticheat_x64.so or beclient_x64.so):

1. Proton Runtime Tools: Steam installs the official Proton EasyAntiCheat Runtime or Proton BattlEye Runtime compatibility tool.

2. API Translation: When the Windows game binary (.exe) initializes anti-cheat functions inside Wine/Proton, Proton intercepts those calls and delegates them outside the Wine prefix to the native Linux .so module.

3. User-Space Inspection: The native Linux module checks game file signatures, monitors memory permissions via standard Linux interfaces (like /proc/$PID/mem), and verifies binary integrity.

4. Server Attestation: The native Linux module generates cryptographic signatures and transmits heartbeats directly to the game’s authentication servers to verify client legitimacy.

3. Structural Comparison: Windows vs. Linux

Feature / Dimension	Windows Execution	Linux / Proton Execution
Privilege Level	Ring 0 (Kernel Mode)	Ring 3 (User Mode)
Binary Types	Windows Kernel Driver (.sys)	Native Linux Shared Object (.so)
Memory Access	Direct physical RAM & kernel state inspection	User-level process inspection via /proc and standard APIs
OS Stability Risk	High (Driver bugs cause Windows Blue Screens / BSODs)	Zero (Runs as a standard user process; cannot crash the kernel)
Kernel Tampering Protection	Protected via Windows Secure Boot & Kernel Patch Protection	Vulnerable to custom, compiled Linux kernels

4. The Developer Dilemma: Why Some Games Block Linux

The reduction from Ring 0 to Ring 3 on Linux creates an asymmetrical security model that makes certain competitive developers hesitant to support Proton:

• The Open-Source Kernel Threat: On Linux, users can compile custom kernels, alter kernel source code, or load custom modules. A bad actor can modify their Linux kernel to forge data returned to /proc or hide memory scanning hooks.

• Asymmetrical Visibility: An anti-cheat module running in user space (Ring 3) cannot reliably detect a cheat operating inside a customized Linux kernel (Ring 0), because an anti-cheat cannot inspect an layer operating at a higher privilege level than itself.

For titles like Elden Ring or Apex Legends, developers accept this trade-off because server-side telemetry and behavioral heuristics supplement client-side checks. However, for ultra-competitive games like Valorant (Riot Vanguard) or Call of Duty (Ricochet), developers refuse to enable the Proton toggle, viewing user-space anti-cheat as insufficient for competitive integrity.

Share on Google Plus

About Giampaolo Rossi.

Fond of computer and video games. Stay informed of the latest news on games for Linux and Android. The future of gaming is in Linux. All you need to know about How to play Windows games on Linux.