Craspad under Epic's "Easy Anti-Cheat" about sentry-native HOT 6 OPEN

I'll attach the diff here, you can see for yourself.
crashpad.diff.txt

Thanks. That is a sensible approach; I could imagine merging something like this. We could be even more defensive and open the process with limited access only after we fail with full access. But I like limiting access as long as we don't need it.

There is also a provision there to handle a failure to suspend a thread (for some reason which I did not analyze in depth).

From the docs you linked, the EAC watchdog/supervisor has already suspended threads in the application. In that case, the suspension from the crashpad_handler would fail. So they bypass the error path for threads they already suspended so that the crashpad_handler can take the context snapshots.

from sentry-native.

Integrating changes directly into our fork of crashpad is a good idea. Otherwise, I’m surprised that this did never come up upstream, as I believe there must be other games that use upstream crashpad instead of our fork.
Either way, fixing this upstream or in our fork is definitely a good idea.

It basically limits the permission of created processes and promotes a process when necessary.

Do you have any more details here? Does it restrict the operation of crashpad, or the possibility / fidelity of the collected minidump in any way?

from sentry-native.

I guess people aren't using crashpad much, but rely on breakpad. This is the default, for example, for your own UE plugin (we are still using our own, which was used as a model for yours, I believe). We want this to get immediate results from CI environments etc.
I'll attach the diff here, you can see for yourself.
crashpad.diff.txt

from sentry-native.

Basically, it optains a limited handle to the parent process, until such time as it has to examine its stack, when it can promote the handle. The watchdog process prohibits memory access to the process until and if it crashes, at which time it will produce a short time window where the crash handler can access the process memory.
There is also a provision there to handle a failure to suspend a thread (for some reason which I did not analyze in depth).

More info on EAC and crash handlers is here:
https://dev.epicgames.com/docs/game-services/anti-cheat/using-anti-cheat#external-crash-dumpers

from sentry-native.