- Game Name
- N/A
- Anticheat
- Battleye, duh!
- How long you been coding/hacking?
- N/A
- Coding Language
- N/A
Battleye Anticheat Introduction
Battleeye is a popular, mature kernel mode anticheat. That makes it very difficult to bypass, for expert hackers only.
Battleye is used by many games:
ARMA II, ARMA III, DAYZ, H1Z1, Ark Survival Evolved, Surivial Of the Fittest, PlanetSide 2, Rainbow Six Siege, Survarium, Project Argo, Unturned, Insurgency, Day of Infamy, The Isle, Line of Sight, Conan Exiles, Blacshot, Tibia, PUBG, Black Squad, Pantomers, Fortnite, S4League, Zula, Islands of Nyne, BlackLight Retribution, SOS, PIxark, Heroes & Generals, Bless Online & more
We have two guides on general anticheat and general kernel mode drivers which preface this guide:
https://guidedhacking.com/threads/how-to-get-started-with-anticheat-bypass.9882/
https://guidedhacking.com/threads/kernel-mode-drivers-info-for-anticheat-bypass.11325/
Battleye Anticheat is a Kernel Mode Anticheat
Because it is a kernel mode anticheat you will need to be either be below the kernel via a hypervisor/virtual machine or be inside the kernel using a driver.
You can use a VM or hypervisor to dump the Battleye module or to reverse engineer it. Once you have reverse engineering it and you want to make a bypass for a game using the information you learned by reverse engineering Battleye you have two choices:
Make a hack entirely in kernel or make a kernel driver which effectively bypasses Battleye, allowing your usermode module to work without being detected. Your kernel driver will have to allow you to read and write to the game process, maybe allow you to get a process handle so you can inject your DLL. Your bypass must not only bypass the things which block your ability to interact with the process but you must also hide your own hack module so they don't build a signature for your modules.
Battleye games don't allow you to run the game with driver signature enforcement disabled, so you can't simply write your own driver and hack the game. You would have to bypass that detection first. Alternatively you can buy your own code signing certificate but then you can get easily sigged.
Instead you want to use vulnerable drivers including Capcom and others to get your code into the kernel, then bypass Battleye and enable your code to access the game process.
Battleye Features
ObRegisterCallbacks
Battleye blocks usermode access to a process by conventional means via ObRegisterCallbacks, essentially when you call OpenProcess() it will not let you get a handle to the game process so you can't read or write memory or attach a debugger. In order to circumvent that, you'd want to find one of the methods that works in usermode, or write a driver and circumvent it that way, you can do that in a few ways, hook their driver, collide with their callbacks, or simply remove their callbacks, read Douggem's article.
You can see it being called in @iPower 's log
Battleye has upgraded, updated & it's protection has been improved over many years, just fixing ObRegisterCallbacks is no longer enough to bypass on most games.
Here is a driver source code to disable the process and thread callbacks from anher0:
Battleye Blacklists certain modules by using different signatures to identify them, such as timestamps.
Here is an example of some of iPower's logs from his hypervisor, which show you what BE is doing in Fortnite:
Detection of Manually Mapped Drivers
@iPower shared some quick infos with me regarding how they detect manually mapped drivers, they do so by searching for system threads which do not belong to any regular kernel module. You can find it in his logs by searching for PsLookupThreadByThreadId & RtlWalkFrameChain
More info : Guide - Anticheat Battleye Bypass Overview
Temporary Bypass for improperly implemented Battleye
It's happened a few times on a couple games where you can just unload the Battleye driver and the game doesn't stop running, it's easy to do, but unlikely it will work on most new games. @gulerardaeren posted this a while back, it has worked previously on Zula, Crossfire, Apex Legends and others as well
STEP 1 : Open The Game
STEP 2 : Open Process Hacker And Find BEService.exe
STEP 3 :Right Click To BEService.exe and click suspend(this will require administator permission)
STEP 4 :Open The Process Hunter and go to the Kernel Module
STEP 4 :Find BEDaisy.sys , right click and click unload driver
STEP 5 :If they didn't patched this method, You can even use cheat engine
Carl Schou vm_call articles
This guy is a wizard when it comes to reverse engineering, he has written a ton of up to date new information. Daax has also co-authored some articles with him
https://vmcall.blog/category/battleye/
secret.club Battleye articles
https://secret.club/2020/02/26/be_umode.html
https://secret.club/2020/03/31/battleye-developer-tracking.html
HyperVisors
Here is just a sample of one of his articles where he talked about hypervisors
The cat and mouse game of game-hacking continues to fuel the innovation of exploitation and mitigation. The usage of virtualization technology in game-hacking has exploded ever since copy-pastable hypervisors such as Satoshi Tanda’s DdiMon and Petr Beneš’ hvpp hit the scene. These two projects are being used by most of the paid cheats in the underground hacking scene, due to their low barrier of entry and extensive documentation. These releases have with high certainty sped up the hypervisor arms race that is now beginning to show its face in the gamehacking community. Here’s what the administrator at one of the worlds largest game-hacking communities, wlan, says about the situation:
BattlEye has recently implemented a detection of generic hypervisors such as the previously mentioned platforms (DdiMon, hvpp) using time-based detection. This detection aims to spot abnormal time values in the instruction CPUID. CPUID is a relatively cheap instruction on real hardware, and will generally only require two hundred cycles, where as in a virtualized environment it may take up to ten times as long due to the overhead incurred by an introspective engine. An introspective engine is not like any real hardware which just performs the operation as is expected, it monitors and conditionally changes the data returned to the guest based on arbitrary criteria.
vm_call shared with the community a incomplete list of functions they put a vectored exception handle on and analyze including:
The first thing you need to do to reverse engineer battleeye is to dump the system driver from memory, you will find a couple pre-made dumps below. Once you have the dumps you can load them into IDA Pro and start looking around.
GH Resources
iPower BE Logs & BEDaisy.sys Module Dump
iPower Fortnite BE Logs
02/07/2020 BEDaisy.sys dump
Old Battleye Bypass Source Code
Release - BattlEye Bypass [+Tested on Rainbow Six Siege] (Driver) (Source)
c5's old IDA Scripts for Analyzing BE
External Resources
The most important thing you can do to learn about BattleEye is to watch this video made by the DayZ developers about how Battleye helps them stop cheaters. This is also an excellent video for anyone wanting to learn about anticheat.
Checkout Douggem's site for good info and his video:
Attachments
I have attached a bunch of files from github and other places in case they get deleted, many of these are copies of the files in the links above
Battleeye is a popular, mature kernel mode anticheat. That makes it very difficult to bypass, for expert hackers only.
Battleye is used by many games:
ARMA II, ARMA III, DAYZ, H1Z1, Ark Survival Evolved, Surivial Of the Fittest, PlanetSide 2, Rainbow Six Siege, Survarium, Project Argo, Unturned, Insurgency, Day of Infamy, The Isle, Line of Sight, Conan Exiles, Blacshot, Tibia, PUBG, Black Squad, Pantomers, Fortnite, S4League, Zula, Islands of Nyne, BlackLight Retribution, SOS, PIxark, Heroes & Generals, Bless Online & more
We have two guides on general anticheat and general kernel mode drivers which preface this guide:
https://guidedhacking.com/threads/how-to-get-started-with-anticheat-bypass.9882/
https://guidedhacking.com/threads/kernel-mode-drivers-info-for-anticheat-bypass.11325/
Battleye Anticheat is a Kernel Mode Anticheat
Because it is a kernel mode anticheat you will need to be either be below the kernel via a hypervisor/virtual machine or be inside the kernel using a driver.
You can use a VM or hypervisor to dump the Battleye module or to reverse engineer it. Once you have reverse engineering it and you want to make a bypass for a game using the information you learned by reverse engineering Battleye you have two choices:
Make a hack entirely in kernel or make a kernel driver which effectively bypasses Battleye, allowing your usermode module to work without being detected. Your kernel driver will have to allow you to read and write to the game process, maybe allow you to get a process handle so you can inject your DLL. Your bypass must not only bypass the things which block your ability to interact with the process but you must also hide your own hack module so they don't build a signature for your modules.
Battleye games don't allow you to run the game with driver signature enforcement disabled, so you can't simply write your own driver and hack the game. You would have to bypass that detection first. Alternatively you can buy your own code signing certificate but then you can get easily sigged.
Instead you want to use vulnerable drivers including Capcom and others to get your code into the kernel, then bypass Battleye and enable your code to access the game process.
Battleye Features
ObRegisterCallbacks
Battleye blocks usermode access to a process by conventional means via ObRegisterCallbacks, essentially when you call OpenProcess() it will not let you get a handle to the game process so you can't read or write memory or attach a debugger. In order to circumvent that, you'd want to find one of the methods that works in usermode, or write a driver and circumvent it that way, you can do that in a few ways, hook their driver, collide with their callbacks, or simply remove their callbacks, read Douggem's article.
You can see it being called in @iPower 's log
Code:
[ LuluVisor ] TM -> KM Transition! Function called: ObRegisterCallbacks
[ LuluVisor ] Function called at: BEDaisy.sys+0028919cHere is a driver source code to disable the process and thread callbacks from anher0:
C++:
#include <ntifs.h>
#include <windef.h>
// Pre-Processor definitions for our I/O control codes.
#define REMOVE_BEOBJECT_CALLBACKS_IOCTL CTL_CODE(FILE_DEVICE_KS, 0x806, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
#define RESTORE_BEOBJECT_CALLBACKS_IOCTL CTL_CODE(FILE_DEVICE_KS, 0x807, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
// Global variable to our device.
PDEVICE_OBJECT deviceObj = NULL;
// QWORD
typedef unsigned __int64 QWORD;
// OLD_CALLBACKS
typedef struct _OLD_CALLBACKS {
QWORD PreOperationProc;
QWORD PostOperationProc;
QWORD PreOperationThread;
QWORD PostOperationThread;
} OLD_CALLBACKS, *POLD_CALLBACKS;
// CALLBACK_ENTRY
typedef struct _CALLBACK_ENTRY {
WORD Version; // 0x0
WORD OperationRegistrationCount; // 0x2
DWORD unk1; // 0x4
PVOID RegistrationContext; // 0x8
UNICODE_STRING Altitude; // 0x10
} CALLBACK_ENTRY, *PCALLBACK_ENTRY; // header size: 0x20 (0x6C if you count the array afterwards - this is only the header. The array of CALLBACK_ENTRY_ITEMs is useless.)
// CALLBACK_ENTRY_ITEM
typedef struct _CALLBACK_ENTRY_ITEM {
LIST_ENTRY CallbackList; // 0x0
OB_OPERATION Operations; // 0x10
DWORD Active; // 0x14
CALLBACK_ENTRY *CallbackEntry; // 0x18
PVOID ObjectType; // 0x20
POB_PRE_OPERATION_CALLBACK PreOperation; // 0x28
POB_POST_OPERATION_CALLBACK PostOperation; // 0x30
QWORD unk1; // 0x38
} CALLBACK_ENTRY_ITEM, *PCALLBACK_ENTRY_ITEM; // size: 0x40
// Dummy object callback functions.
OB_PREOP_CALLBACK_STATUS DummyObjectPreCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) {
return(OB_PREOP_SUCCESS);
}
VOID DummyObjectPostCallback(PVOID RegistrationContext, POB_POST_OPERATION_INFORMATION OperationInformation) {
return;
}
QWORD GetCallbackListOffset(void) {
POBJECT_TYPE procType = *PsProcessType;
__try {
if (procType && MmIsAddressValid((void*)procType)) {
for (int i = 0xF8; i > 0; i -= 8) {
QWORD first = *(QWORD*)((QWORD)procType + i), second = *(QWORD*)((QWORD)procType + (i + 8));
if (first && MmIsAddressValid((void*)first) && second && MmIsAddressValid((void*)second)) {
QWORD test1First = *(QWORD*)(first + 0x0), test1Second = *(QWORD*)(first + 0x8);
if (test1First && MmIsAddressValid((void*)test1First) && test1Second && MmIsAddressValid((void*)test1Second)) {
QWORD testObjectType = *(QWORD*)(first + 0x20);
if (testObjectType == (QWORD)procType)
return((QWORD)i);
}
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
return(0);
}
}
void DisableBEObjectCallbacks(POLD_CALLBACKS oldCallbacks) {
POBJECT_TYPE procType = *PsProcessType;
if (procType && MmIsAddressValid((void*)procType)) {
__try {
QWORD callbackListOffset = GetCallbackListOffset();
if (callbackListOffset && MmIsAddressValid((void*)((QWORD)procType + callbackListOffset))) {
LIST_ENTRY *callbackList = (LIST_ENTRY*)((QWORD)procType + callbackListOffset);
if (callbackList->Flink && MmIsAddressValid((void*)callbackList->Flink)) {
CALLBACK_ENTRY_ITEM *firstCallback = (CALLBACK_ENTRY_ITEM*)callbackList->Flink;
CALLBACK_ENTRY_ITEM *curCallback = firstCallback;
do {
// Make sure the callback is valid.
if (curCallback && MmIsAddressValid((void*)curCallback) && MmIsAddressValid((void*)curCallback->CallbackEntry)) {
ANSI_STRING altitudeAnsi = { 0 };
UNICODE_STRING altitudeUni = curCallback->CallbackEntry->Altitude;
RtlUnicodeStringToAnsiString(&altitudeAnsi, &altitudeUni, 1);
if (!strcmp(altitudeAnsi.Buffer, "363220")) { // Check if this is BattlEye. If it is, disable the callback.
if (curCallback->PreOperation) {
oldCallbacks->PreOperationProc = (QWORD)curCallback->PreOperation;
curCallback->PreOperation = DummyObjectPreCallback;
}
if (curCallback->PostOperation) {
oldCallbacks->PostOperationProc = (QWORD)curCallback->PostOperation;
curCallback->PostOperation = DummyObjectPostCallback;
}
RtlFreeAnsiString(&altitudeAnsi);
break;
}
RtlFreeAnsiString(&altitudeAnsi);
}
// Get the next callback.
curCallback = curCallback->CallbackList.Flink;
} while (curCallback != firstCallback);
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
return;
}
}
POBJECT_TYPE threadType = *PsThreadType;
if (threadType && MmIsAddressValid((void*)threadType)) {
__try {
QWORD callbackListOffset = GetCallbackListOffset();
if (callbackListOffset && MmIsAddressValid((void*)((QWORD)threadType + callbackListOffset))) {
LIST_ENTRY *callbackList = (LIST_ENTRY*)((QWORD)threadType + callbackListOffset);
if (callbackList->Flink && MmIsAddressValid((void*)callbackList->Flink)) {
CALLBACK_ENTRY_ITEM *firstCallback = (CALLBACK_ENTRY_ITEM*)callbackList->Flink;
CALLBACK_ENTRY_ITEM *curCallback = firstCallback;
do {
// Make sure the callback is valid.
if (curCallback && MmIsAddressValid((void*)curCallback) && MmIsAddressValid((void*)curCallback->CallbackEntry)) {
ANSI_STRING altitudeAnsi = { 0 };
UNICODE_STRING altitudeUni = curCallback->CallbackEntry->Altitude;
RtlUnicodeStringToAnsiString(&altitudeAnsi, &altitudeUni, 1);
if (!strcmp(altitudeAnsi.Buffer, "363220")) { // Check if this is BattlEye. If it is, disable the callback.
if (curCallback->PreOperation) {
oldCallbacks->PreOperationThread = (QWORD)curCallback->PreOperation;
curCallback->PreOperation = DummyObjectPreCallback;
}
if (curCallback->PostOperation) {
oldCallbacks->PostOperationThread = (QWORD)curCallback->PostOperation;
curCallback->PostOperation = DummyObjectPostCallback;
}
RtlFreeAnsiString(&altitudeAnsi);
break;
}
RtlFreeAnsiString(&altitudeAnsi);
}
// Get the next callback.
curCallback = curCallback->CallbackList.Flink;
} while (curCallback != firstCallback);
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
return;
}
}
}
void RestoreBEObjectCallbacks(POLD_CALLBACKS oldCallbacks) {
POBJECT_TYPE procType = *PsProcessType;
if (procType && MmIsAddressValid((void*)procType)) {
__try {
QWORD callbackListOffset = GetCallbackListOffset();
if (callbackListOffset && MmIsAddressValid((void*)((QWORD)procType + callbackListOffset))) {
LIST_ENTRY *callbackList = (LIST_ENTRY*)((QWORD)procType + callbackListOffset);
if (callbackList->Flink && MmIsAddressValid((void*)callbackList->Flink)) {
CALLBACK_ENTRY_ITEM *firstCallback = (CALLBACK_ENTRY_ITEM*)callbackList->Flink;
CALLBACK_ENTRY_ITEM *curCallback = firstCallback;
do {
// Make sure the callback is valid.
if (curCallback && MmIsAddressValid((void*)curCallback) && MmIsAddressValid((void*)curCallback->CallbackEntry)) {
ANSI_STRING altitudeAnsi = { 0 };
UNICODE_STRING altitudeUni = curCallback->CallbackEntry->Altitude;
RtlUnicodeStringToAnsiString(&altitudeAnsi, &altitudeUni, 1);
if (!strcmp(altitudeAnsi.Buffer, "363220")) { // Check if this is BattlEye. If it is, restore the callback.
if (curCallback->PreOperation && oldCallbacks->PreOperationProc)
curCallback->PreOperation = (POB_PRE_OPERATION_CALLBACK)oldCallbacks->PreOperationProc;
if (curCallback->PostOperation && oldCallbacks->PostOperationProc)
curCallback->PostOperation = (POB_POST_OPERATION_CALLBACK)oldCallbacks->PostOperationProc;
RtlFreeAnsiString(&altitudeAnsi);
break;
}
RtlFreeAnsiString(&altitudeAnsi);
}
// Get the next callback.
curCallback = curCallback->CallbackList.Flink;
} while (curCallback != firstCallback);
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
return;
}
}
POBJECT_TYPE threadType = *PsThreadType;
if (threadType && MmIsAddressValid((void*)threadType)) {
__try {
QWORD callbackListOffset = GetCallbackListOffset();
if (callbackListOffset && MmIsAddressValid((void*)((QWORD)threadType + callbackListOffset))) {
LIST_ENTRY *callbackList = (LIST_ENTRY*)((QWORD)threadType + callbackListOffset);
if (callbackList->Flink && MmIsAddressValid((void*)callbackList->Flink)) {
CALLBACK_ENTRY_ITEM *firstCallback = (CALLBACK_ENTRY_ITEM*)callbackList->Flink;
CALLBACK_ENTRY_ITEM *curCallback = firstCallback;
do {
// Make sure the callback is valid.
if (curCallback && MmIsAddressValid((void*)curCallback) && MmIsAddressValid((void*)curCallback->CallbackEntry)) {
ANSI_STRING altitudeAnsi = { 0 };
UNICODE_STRING altitudeUni = curCallback->CallbackEntry->Altitude;
RtlUnicodeStringToAnsiString(&altitudeAnsi, &altitudeUni, 1);
if (!strcmp(altitudeAnsi.Buffer, "363220")) { // Check if this is BattlEye. If it is, disable the callback.
if (curCallback->PreOperation && oldCallbacks->PreOperationThread)
curCallback->PreOperation = (POB_PRE_OPERATION_CALLBACK)oldCallbacks->PreOperationThread;
if (curCallback->PostOperation && oldCallbacks->PostOperationThread)
curCallback->PostOperation = (POB_POST_OPERATION_CALLBACK)oldCallbacks->PostOperationThread;
RtlFreeAnsiString(&altitudeAnsi);
break;
}
RtlFreeAnsiString(&altitudeAnsi);
}
// Get the next callback.
curCallback = curCallback->CallbackList.Flink;
} while (curCallback != firstCallback);
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
return;
}
}
}
NTSTATUS ioRecieved(PDEVICE_OBJECT pDeviceObject, PIRP IRP) {
PIO_STACK_LOCATION pIoStackLocation = IoGetCurrentIrpStackLocation(IRP);
size_t size = 0;
// Handle the I/O request if we need to.
if (pIoStackLocation->Parameters.DeviceIoControl.IoControlCode == REMOVE_BEOBJECT_CALLBACKS_IOCTL){
OLD_CALLBACKS oldCallbacks = { 0 };
DisableBEObjectCallbacks(&oldCallbacks);
memcpy(IRP->AssociatedIrp.SystemBuffer, &oldCallbacks, sizeof(OLD_CALLBACKS));
size = sizeof(OLD_CALLBACKS);
}
if (pIoStackLocation->Parameters.DeviceIoControl.IoControlCode == RESTORE_BEOBJECT_CALLBACKS_IOCTL) {
RestoreBEObjectCallbacks((POLD_CALLBACKS)IRP->AssociatedIrp.SystemBuffer);
size = 0;
}
// Finish off.
IRP->IoStatus.Status = STATUS_SUCCESS;
IRP->IoStatus.Information = size;
IofCompleteRequest(IRP, IO_NO_INCREMENT);
return(STATUS_SUCCESS);
}
NTSTATUS CatchCreate(PDRIVER_OBJECT pDriverObject) {
return(STATUS_SUCCESS);
}
NTSTATUS CatchClose(PDRIVER_OBJECT pDriverObject) {
return(STATUS_SUCCESS);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath) {
// Create the device and get everything set up.
UNICODE_STRING deviceNameUnicodeString = { 0 }, deviceSymLinkUnicodeString = { 0 };
RtlInitUnicodeString(&deviceNameUnicodeString, L"\\Device\\mmarkdrv");
RtlInitUnicodeString(&deviceSymLinkUnicodeString, L"\\DosDevices\\mmarkdrv");
IoCreateDevice(pDriverObject, 0, &deviceNameUnicodeString, FILE_DEVICE_KS, FILE_DEVICE_SECURE_OPEN, 0, &deviceObj);
IoCreateSymbolicLink(&deviceSymLinkUnicodeString, &deviceNameUnicodeString);
// Get all the major functions set up.
pDriverObject->MajorFunction[IRP_MJ_CREATE] = CatchCreate;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = CatchClose;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = ioRecieved;
return(STATUS_SUCCESS);
}Here is an example of some of iPower's logs from his hypervisor, which show you what BE is doing in Fortnite:
Code:
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] PsGetThreadProcessId - BEDaisy.sys+002ad3ff
[ LuluVisor ] IoThreadToProcess - BEDaisy.sys+002ad435
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad44c
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af705
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af747
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af75d
[ LuluVisor ] ExFreePool - BEDaisy.sys+002af768
[ LuluVisor ] KeWaitForMutexObject - BEDaisy.sys+002af773
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af829
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] ObfDereferenceObject - BEDaisy.sys+002af83f
[ LuluVisor ] ZwClose - BEDaisy.sys+002af84a
[ LuluVisor ] ZwQueryDirectoryObject - BEDaisy.sys+002af86b
[ LuluVisor ] RtlCompareUnicodeString - BEDaisy.sys+002af5af
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] RtlInitUnicodeString - BEDaisy.sys+002af5d0
[ LuluVisor ] ObOpenObjectByName - BEDaisy.sys+002af5f7
[ LuluVisor ] ObReferenceObjectByHandle - BEDaisy.sys+002af602
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af60d
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af618
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af62e
[ LuluVisor ] ZwOpenFile - BEDaisy.sys+002af655
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] ObReferenceObjectByHandle - BEDaisy.sys+002af660
[ LuluVisor ] IoQueryFileDosDeviceName - BEDaisy.sys+002af66b
[ LuluVisor ] ObfDereferenceObject - BEDaisy.sys+002af676
[ LuluVisor ] ZwClose - BEDaisy.sys+002af681
[ LuluVisor ] KeWaitForMutexObject - BEDaisy.sys+002af6ef
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af705
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af747
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af75d
[ LuluVisor ] ExFreePool - BEDaisy.sys+002af768
[ LuluVisor ] KeWaitForMutexObject - BEDaisy.sys+002af773
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af829
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002b29b3
[ LuluVisor ] ObfDereferenceObject - BEDaisy.sys+002af83f
[ LuluVisor ] ZwClose - BEDaisy.sys+002af84a
[ LuluVisor ] ZwQueryDirectoryObject - BEDaisy.sys+002af86b
[ LuluVisor ] RtlCompareUnicodeString - BEDaisy.sys+002af5af
[ LuluVisor ] ZwQueryDirectoryObject - BEDaisy.sys+002af86b
[ LuluVisor ] RtlCompareUnicodeString - BEDaisy.sys+002af5af
[ LuluVisor ] RtlInitUnicodeString - BEDaisy.sys+002af5d0
[ LuluVisor ] ObOpenObjectByName - BEDaisy.sys+002af5f7
[ LuluVisor ] ObReferenceObjectByHandle - BEDaisy.sys+002af602
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af60d
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af618
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af62e
[ LuluVisor ] ZwOpenFile - BEDaisy.sys+002af655
[ LuluVisor ] ObReferenceObjectByHandle - BEDaisy.sys+002af660
[ LuluVisor ] IoQueryFileDosDeviceName - BEDaisy.sys+002af66b
[ LuluVisor ] ObfDereferenceObject - BEDaisy.sys+002af676
[ LuluVisor ] ZwClose - BEDaisy.sys+002af681
[ LuluVisor ] KeWaitForMutexObject - BEDaisy.sys+002af6ef
[ LuluVisor ] PsGetProcessInheritedFromUniqueProcessId - BEDaisy.sys+002ad08d
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af6fa
[ LuluVisor ] _wcsnicmp - BEDaisy.sys+002af705
[ LuluVisor ] MmIsAddressValid - BEDaisy.sys+002af747
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af75d
[ LuluVisor ] ExFreePool - BEDaisy.sys+002af768
[ LuluVisor ] KeWaitForMutexObject - BEDaisy.sys+002af773
[ LuluVisor ] KeReleaseMutex - BEDaisy.sys+002af829@iPower shared some quick infos with me regarding how they detect manually mapped drivers, they do so by searching for system threads which do not belong to any regular kernel module. You can find it in his logs by searching for PsLookupThreadByThreadId & RtlWalkFrameChain
More info : Guide - Anticheat Battleye Bypass Overview
Temporary Bypass for improperly implemented Battleye
It's happened a few times on a couple games where you can just unload the Battleye driver and the game doesn't stop running, it's easy to do, but unlikely it will work on most new games. @gulerardaeren posted this a while back, it has worked previously on Zula, Crossfire, Apex Legends and others as well
STEP 1 : Open The Game
STEP 2 : Open Process Hacker And Find BEService.exe
STEP 3 :Right Click To BEService.exe and click suspend(this will require administator permission)
STEP 4 :Open The Process Hunter and go to the Kernel Module
STEP 4 :Find BEDaisy.sys , right click and click unload driver
STEP 5 :If they didn't patched this method, You can even use cheat engine
Carl Schou vm_call articles
This guy is a wizard when it comes to reverse engineering, he has written a ton of up to date new information. Daax has also co-authored some articles with him
https://vmcall.blog/category/battleye/
secret.club Battleye articles
https://secret.club/2020/02/26/be_umode.html
https://secret.club/2020/03/31/battleye-developer-tracking.html
HyperVisors
Here is just a sample of one of his articles where he talked about hypervisors
The cat and mouse game of game-hacking continues to fuel the innovation of exploitation and mitigation. The usage of virtualization technology in game-hacking has exploded ever since copy-pastable hypervisors such as Satoshi Tanda’s DdiMon and Petr Beneš’ hvpp hit the scene. These two projects are being used by most of the paid cheats in the underground hacking scene, due to their low barrier of entry and extensive documentation. These releases have with high certainty sped up the hypervisor arms race that is now beginning to show its face in the gamehacking community. Here’s what the administrator at one of the worlds largest game-hacking communities, wlan, says about the situation:
The reason hypervisors are so wide-spread now is because of recent developments in kernel anti-cheats leaving very little room for hackers to modify games through traditional means. The popularity of hypervisors could be explained by the simplicity of evasion, since virtualization enables you to more easily hide information from the anti-cheat, through mechanisms such as syscall hooks and MMU virtualization.
BattlEye has recently implemented a detection of generic hypervisors such as the previously mentioned platforms (DdiMon, hvpp) using time-based detection. This detection aims to spot abnormal time values in the instruction CPUID. CPUID is a relatively cheap instruction on real hardware, and will generally only require two hundred cycles, where as in a virtualized environment it may take up to ten times as long due to the overhead incurred by an introspective engine. An introspective engine is not like any real hardware which just performs the operation as is expected, it monitors and conditionally changes the data returned to the guest based on arbitrary criteria.
vm_call shared with the community a incomplete list of functions they put a vectored exception handle on and analyze including:
- GetAsyncKeyState
- GetCursorPos
- IsBadReadPtr
- NtUserGetAsyncKeyState
- GetForegroundWindow
- CallWindowProcW
- NtUserPeekMessage
- NtSetEvent
- sqrtf
- __stdio_common_vsprintf_s
- CDXGIFactory::TakeLock
- TppTimerpExecuteCallback
The first thing you need to do to reverse engineer battleeye is to dump the system driver from memory, you will find a couple pre-made dumps below. Once you have the dumps you can load them into IDA Pro and start looking around.
GH Resources
iPower BE Logs & BEDaisy.sys Module Dump
iPower Fortnite BE Logs
02/07/2020 BEDaisy.sys dump
Old Battleye Bypass Source Code
Release - BattlEye Bypass [+Tested on Rainbow Six Siege] (Driver) (Source)
c5's old IDA Scripts for Analyzing BE
External Resources
The most important thing you can do to learn about BattleEye is to watch this video made by the DayZ developers about how Battleye helps them stop cheaters. This is also an excellent video for anyone wanting to learn about anticheat.
Checkout Douggem's site for good info and his video:
- https://vmcall.blog/category/battleye/
- secret club
- vmcall/battleye_emulation - battleye usermode emulator
- vmcall/eye_mapper - BattlEye x64 usermode injector (patched)
- ArcherPeng/FuckBattlEye - Anticheat Bypass exploiting leaked handles.
- Tai7sy/BE_Fuck - BattlEye Emulator
- gigabitwize/dank - windows 8.1 battleye bypass
- daswareinfach/Battleye-VAC-EAC-Kernel-Bypass
- https://github.com/huoji120/battleye/blob/master/code.c random battleye code
- ContionMig/LSASS-Usermode-Bypass
- ACmagic/ByPass_BattleEye
- Schnocker/HLeaker
- yunseok/HWIDbypass
- Neijwiert/Feeder
Attachments
I have attached a bunch of files from github and other places in case they get deleted, many of these are copies of the files in the links above
Last edited:
![[GH]Bot](/data/avatars/s/61/61902.jpg?1532202364){kind=avatar}
