How Does NeacSafe (Marvel Rivals Anti-Cheat) Work?

NeacSafe is the most-misidentified anti-cheat in the western press. Multiple competitor blogs and even some mainstream gaming-news outlets have published "Marvel Rivals uses EAC" articles. Marvel Rivals does not use EAC. NetEase ships their own first-party kernel anti-cheat called NeacSafe, and the practical implications differ from EAC significantly.

What NeacSafe ships as

The NeacSafe stack is: NeacSafe64.sys (signed kernel driver), a user-mode protector packed with VMProtect (a commercial code-virtualization product widely used by Chinese AC vendors), and a client-side service that connects to NetEase''s backend. The use of VMProtect on the user-mode component makes the binary deliberately hostile to static analysis — VMProtect virtualizes instruction sequences into a custom bytecode interpreter, which is why reverse-engineering NeacSafe requires considerably more effort than reverse-engineering EAC.

Kernel surface

NeacSafe registers standard Windows kernel callbacks: process creation, thread creation, image load, registry. It hashes loaded driver modules and reports anomalies to its backend. It walks loaded module lists for residue of recently-loaded suspicious drivers, similar in pattern to BEDaisy and vgk.sys. It strips handle access rights to the Marvel Rivals process so that user-mode external readers cannot freely open VM_READ handles.

HWID and cross-game correlation

NeacSafe collects SMBIOS data, NIC MACs, disk serials, GPU device IDs, and TPM-derived identifiers. The fingerprint feeds into NetEase''s backend HWID ban system, and bans correlate across all NetEase titles — Marvel Rivals, Naraka: Bladepoint, Identity V, Knives Out, and the broader NetEase catalog share infrastructure. A HWID ban earned in Marvel Rivals can light up future NetEase title accounts using the same fingerprint. See Will my Marvel Rivals ban affect other NetEase games.

Behavioral telemetry and the "incentivized throwing" policy

NetEase exports gameplay telemetry — input timing, view-angle data, kill rates, headshot distributions — and runs server-side ML against it. Marvel Rivals also enforces an unusual policy: "incentivized throwing" (deliberately losing matches as part of rank manipulation or for tournament-fixing) is treated as a bannable offense, distinct from cheating. This is enforced server-side via behavioral pattern detection. See What is the Marvel Rivals incentivized throwing policy.

What competitor blogs get wrong

Several SEO-driven cheat-marketing sites publish "Marvel Rivals EAC" content. This is incorrect. The game has never shipped with Easy Anti-Cheat. Verifying is trivial — look at the NeacSafe64.sys driver in your Marvel Rivals install folder. The misreporting exists because EAC is the more commonly-discussed AC, and the writers were guessing. Authoritative reference: NetEase''s own Marvel Rivals security pages and the file presence on shipped game installs.

Practical impact for cheaters

NeacSafe is meaningfully harder to bypass than VAC or Defense Matrix, comparable in difficulty to mid-tier kernel ACs (EAC and BattlEye are the benchmark, Vanguard is harder). The combination of VMProtect packaging and NetEase''s aggressive HWID correlation means cheaters in Marvel Rivals need the same operational hygiene as in other kernel-AC titles: clean HWID, no main-account exposure, no behavioral-ML hits. RawCheats sells external Marvel Rivals cheats with Raw Spoofer support — see our Marvel Rivals Cheats Guide for the player-side timeline.

Forward look

NeacSafe is expected to continue tightening through 2026. NetEase has been investing in their AC division, and the Marvel Rivals success has given them budget. Expect IOMMU and TPM-attestation enforcement to land at parity with the western AAA titles within the next 12 months. Marvel Rivals is the AAA proving ground for whether NetEase''s AC division can hit western-publisher technical parity — and right now, the answer is approximately yes.

NeacSafe vs EAC vs BattlEye — technical comparison

Compared against EAC and BattlEye, NeacSafe sits in the middle of the kernel-AC stack. EAC has the deepest Unreal Engine integration (engine licensee hooks, RPC validation, replay re-simulation infrastructure) which makes it stronger on Unreal-engine titles than NeacSafe is on its hybrid Marvel Rivals build. BattlEye has the most aggressive PCI/AER/IOMMU surveillance in 2026, partly because BattlEye Innovations has been the AC most publicly committed to the hardware-protection roadmap. NeacSafe''s competitive advantage is the VMProtect-protected user-mode layer making static reverse-engineering significantly more expensive, and NetEase''s aggressive HWID-correlation infrastructure across their catalog.

The cheating market response

The Marvel Rivals cheat market grew rapidly through 2025-2026 as the game became a top-five competitive multiplayer title. NeacSafe''s detection cadence has tightened across 2026; multiple cheat providers have reported detection waves in early and mid-2026, and the consumer pricing tier has risen accordingly. RawCheats'' Marvel Rivals product sits in the "external software + hardware spoofing + behavioral tuning" segment that consistently survives NeacSafe better than aggressive kernel-tier or DMA-tier approaches do. The trade-off is feature scope versus survival — see our Marvel Rivals vs Competitors breakdown.