BattlEye client emulation - Bottleye - 100% complete bypass
Posted: Tue Jul 07, 2020 9:42 pm
The popular anti-cheat BattlEye is widely used by modern online games such as Escape from Tarkov and is considered an industry standard anti-cheat by many. In this article I will demonstrate a method I have been utilizing for the past year, which enables you to play any BattlEye-protected game online without even having to install BattlEye.
BattlEye initialisation
BattlEye is dynamically loaded by the respective game on startup to initialize the software service (“BEService”) and kernel driver (“BEDaisy”). These two components are critical in ensuring the integrity of the game, but the most critical component by far is the usermode library (“BEClient”) that the game interacts with directly. This module exports two functions: GetVer and more importantly Init.
The Init routine is what the game will call, but this functionality has never been documented before, as people mostly focus on BEDaisy or their shellcode. Most important routines in BEClient, including Init, are protected and virtualised by VMProtect, which we are able to devirtualise and reverse engineer thanks to vtil by secret club member Can Boluk, but the inner workings of BEClient is a topic for a later part of this series, so here is a quick summary.
Init and its arguments have the following definitions:
As seen, these are quite simple containers for interopability between the game and BEClient. becl_game_data is defined by the game and contains functions that BEClient needs to call (for example, send_packet) while becl_be_data is defined by BEClient and contains callbacks used by the game after initialisation (for example, received_packet). Note that these two structures slightly differ in some games that have special functionality, such as the recently introduced packet encryption in Escape from Tarkov that we’ve already cracked. Older versions of BattlEye (DayZ, Arma, etc.) use a completely different approach with function pointer swap hooks to intercept traffic communication, and therefore these structures don’t apply.
this article is written by vmcall, continue reading @ secret.club...
[Link]
Github
[Link]
BattlEye initialisation
BattlEye is dynamically loaded by the respective game on startup to initialize the software service (“BEService”) and kernel driver (“BEDaisy”). These two components are critical in ensuring the integrity of the game, but the most critical component by far is the usermode library (“BEClient”) that the game interacts with directly. This module exports two functions: GetVer and more importantly Init.
The Init routine is what the game will call, but this functionality has never been documented before, as people mostly focus on BEDaisy or their shellcode. Most important routines in BEClient, including Init, are protected and virtualised by VMProtect, which we are able to devirtualise and reverse engineer thanks to vtil by secret club member Can Boluk, but the inner workings of BEClient is a topic for a later part of this series, so here is a quick summary.
Init and its arguments have the following definitions:
Code: Select all
// BEClient_x64!Init
__declspec(dllexport)
battleye::instance_status Init(std::uint64_t integration_version,
battleye::becl_game_data* game_data,
battleye::becl_be_data* client_data);
enum instance_status
{
NONE,
NOT_INITIALIZED,
SUCCESSFULLY_INITIALIZED,
DESTROYING,
DESTROYED
};
struct becl_game_data
{
char* game_version;
std::uint32_t address;
std::uint16_t port;
// FUNCTIONS
using print_message_t = void(*)(char* message);
print_message_t print_message;
using request_restart_t = void(*)(std::uint32_t reason);
request_restart_t request_restart;
using send_packet_t = void(*)(void* packet, std::uint32_t length);
send_packet_t send_packet;
using disconnect_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length, char* reason);
disconnect_peer_t disconnect_peer;
};
struct becl_be_data
{
using exit_t = bool(*)();
exit_t exit;
using run_t = void(*)();
run_t run;
using command_t = void(*)(char* command);
command_t command;
using received_packet_t = void(*)(std::uint8_t* received_packet, std::uint32_t length);
received_packet_t received_packet;
using on_receive_auth_ticket_t = void(*)(std::uint8_t* ticket, std::uint32_t length);
on_receive_auth_ticket_t on_receive_auth_ticket;
using add_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length);
add_peer_t add_peer;
using remove_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length);
remove_peer_t remove_peer;
};this article is written by vmcall, continue reading @ secret.club...
[Link]
Github
[Link]
Guess that works too..