protonscr

Hunt EAC: Parent process detection causes SystemFileUntrusted hunt.exe

vkd3dclosed
HansKristian-Work/vkd3d-proton#3348 · opened 2026-10-04 by 0x0ade · updated 2026-10-27 · 5 comments · github
00x0ade 2026-10-04 github

For full context, I originally reported this on Proton's issue tracker before going ham with bisects: https://github.com/ValveSoftware/Proton/issues/3898#issuecomment-5937897818

Software information

Hunt: Showdown 1896, with clean prefix and USER dir.
Running in Steam Flatpak on Fedora 44 with niri and ntfsplus used as NTFS driver. I know my config is freaky, but I swear I tested both with and without VKShade and extest both before and after the parent proc merge commit.

System information

  • GPU: NVIDIA RTX 4070 Laptop + Intel iGPU not used for the game.
  • Driver: NVIDIA-SMI 615.71.09 KMD Version: 615.71.09 CUDA UMD Version: 13.4
  • Wine version: Proton Experimental, reproducible with self-build of 70b7e109e8fc0783a509805f3d1bc090b55dac3f
  • VKD3D-Proton version: Earliest repro on 142d72f17d9e15c7d63e2f38c1f200dc77992fd0 - checking out ~1 and building with that fixes it.

Log files

Logs taken with official Proton Experimental, not the self-built version, with a run with no pre-existing prefix or USER dir.

steam-594650.log
Game.log

QQuantenToast 2026-10-14 github

I can confirm this issue exists with non-flatpak Steam as well.

System information

  • Steam version: 1.0.0.87-3 native Arch Linux package
  • Filesystem: Games on EXT4, Steam on BTRFS (no NTFS)
  • GPU: RX 7800 XT + AMD iGPU not used for the game.
  • Driver: Mesa 26.2.4 & LLVM 23.1.1
  • Wine version: Proton Experimental (works on stable 11.0-2)
  • Kernel: 7.2.9-zen
Kkagadar 2026-10-18 github

I can confirm that building a newer release with 142d72f17d9e15c7d63e2f38c1f200dc77992fd0 reverted resolves the issue for me.

I haven't been able to replicate it when using Steam to launch the game (it seems like the EAC runtime resolves the issue) but running a standalone EAC game (like Star Citizen) outside of Steam triggers the issue.

Oomitrowski 2026-10-19 github

Another data point: Star Citizen (4.10.2, EAC/EOS) hits the same thing, and the logs show the parent lookup directly. This confirms what kagadar reported, with process-level evidence.

Setup: Fedora 44, kernel 7.2.10, Mesa 26.2.4, RX 7900 XTX. Non-Steam launch (RSI Launcher through Proton, StarCitizen_Launcher.exe is the parent of StarCitizen.exe). Renders through Vulkan, but the game process still loads vkd3d-proton's d3d12.dll/d3d12core.dll. Same prefix and game build for every run.

Results

Build Result
GE-Proton11-6 works
proton-cachyos 20260703 works
GE-Proton11-7 fails (first bad build)
GE-Proton11-9, with and without PROTON_NATIVE_AGS=1 fails
GE-Proton11-10 fails
proton-cachyos 20261005 fails
Proton Experimental (experimental-11.0-20261014) fails

On failing builds EAC reports Violation detected: 8 - Untrusted system file (…/StarCitizen_Launcher.exe) about 3 s after start, then error 30033.

Process log comparison (WINEDEBUG=err+all,+timestamp,+pid,+tid,+seh,+loaddll,+process,+server)

GE-Proton11-6 (works) GE-Proton11-9 (fails)
Launcher pid 094c pid 0988
Game pid 0984 pid 09b4
Game loads d3d12 / d3d12core yes / yes yes / yes
Game opens its parent launcher no yes: open_process( pid=0988, access=0x1000 ) from the thread that loaded d3d12core
EAC bootstrapper syscall workaround lines / sigsys_handler events 2 / 53 2 / 53
EAC result Login completed Violation detected: 8, then 30033

So the game process does not touch its parent on the working build, and on the failing build it opens it with PROCESS_QUERY_LIMITED_INFORMATION. The EAC syscall handling and the AMD AGS path (PROTON_NATIVE_AGS=1) are not the difference.

Caveats: this is a correlation. I have not yet swapped the pre-142d72f vkd3d-proton DLLs into a failing build. WINEDLLOVERRIDES=d3d12=d does not disable vkd3d-proton here, so that test was inconclusive.

Why it matters here: non-Steam launchers (RSI Launcher, others) hand EAC a parent process it doesn't expect, whereas a Steam launch gives it Steam, which is probably why kagadar can't reproduce it through Steam. If the detection could skip the parent lookup for non-UE titles, make it lazy, or avoid opening the process, that would probably fix both Hunt and Star Citizen. Related reports: GloriousEggroll/proton-ge-custom#858 and mactan-sc/rsilauncher#25.

Happy to run any test build or patch here and supply the full +server logs on request (~290 MB each).

Oomitrowski 2026-10-19 github

GE-Proton reverted 142d72f as a patch: https://github.com/GloriousEggroll/proton-ge-custom/commit/07925856e670bbd6ab09f6c4417d5a596ff69ca7. It fixes Star Citizen (non-Steam launch) in our tests once released. Reporting back after testing.

Oomitrowski 2026-10-19 github

Update: GE-Proton11-11 includes a revert of 142d72f as a patch (https://github.com/GloriousEggroll/proton-ge-custom/commit/07925856e670bbd6ab09f6c4417d5a596ff69ca7), and I confirmed it fixes Star Citizen (non-Steam launch via RSI Launcher): no more Violation detected: 8 - Untrusted system file (StarCitizen_Launcher.exe), login completes.

Proton Experimental and proton-cachyos still carry 142d72f and still fail for me (experimental-11.0-20261014, proton-cachyos 20261005). Would it be possible to take the same change (don't read the parent process's image for the engine version check) or an alternative that avoids mapping the parent image?

Earlier analysis with logs: GloriousEggroll/proton-ge-custom#858.

SSid127 2026-10-22 github

This also affects EAC in Helldivers 2, that was added in the latest patch (20th October)

Related threads

Proton versions

Launch options

Upstream links

DLLs