内容简介:The popular anti-cheatBattlEye is dynamically loaded by the respective game on startup to initialize the software service (“BEService”) and kernel driver (“BEDaisy”). These two components are critical in ensuring the integrity of the game, but the most cri
The popular anti-cheat BattlEye is widely used by modern online games such as Escape from Tarkov and is considered an industry standard anti-cheat by many. In this article I will demonstrate a method I have been utilizing for the past year, which enables you to play any BattlEye-protected game online without even having to install BattlEye.
BattlEye initialisation
BattlEye is dynamically loaded by the respective game on startup to initialize the software service (“BEService”) and kernel driver (“BEDaisy”). These two components are critical in ensuring the integrity of the game, but the most critical component by far is the usermode library (“BEClient”) that the game interacts with directly. This module exports two functions: GetVer
and more importantly Init
.
The Init routine is what the game will call, but this functionality has never been documented before, as people mostly focus on BEDaisy or theirshellcode. Most important routines in BEClient , including Init , are protected and virtualised by VMProtect , which we are able to devirtualise and reverse engineer thanks to vtil by secret club memberCan Boluk, but the inner workings of BEClient is a topic for a later part of this series, so here is a quick summary.
Init and its arguments have the following definitions:
// BEClient_x64!Init __declspec(dllexport) battleye::instance_status Init(std::uint64_t integration_version, battleye::becl_game_data* game_data, battleye::becl_be_data* client_data); enum instance_status { NONE, NOT_INITIALIZED, SUCCESSFULLY_INITIALIZED, DESTROYING, DESTROYED }; struct becl_game_data { char* game_version; std::uint32_t address; std::uint16_t port; // FUNCTIONS using print_message_t = void(*)(char* message); print_message_t print_message; using request_restart_t = void(*)(std::uint32_t reason); request_restart_t request_restart; using send_packet_t = void(*)(void* packet, std::uint32_t length); send_packet_t send_packet; using disconnect_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length, char* reason); disconnect_peer_t disconnect_peer; }; struct becl_be_data { using exit_t = bool(*)(); exit_t exit; using run_t = void(*)(); run_t run; using command_t = void(*)(char* command); command_t command; using received_packet_t = void(*)(std::uint8_t* received_packet, std::uint32_t length); received_packet_t received_packet; using on_receive_auth_ticket_t = void(*)(std::uint8_t* ticket, std::uint32_t length); on_receive_auth_ticket_t on_receive_auth_ticket; using add_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length); add_peer_t add_peer; using remove_peer_t = void(*)(std::uint8_t* guid, std::uint32_t guid_length); remove_peer_t remove_peer; };
以上所述就是小编给大家介绍的《BattlEye client emulation》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!
猜你喜欢:本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们。
垃圾回收的算法与实现
中村成洋、相川光 / 丁灵 / 人民邮电出版社 / 2016-7-1 / 99.00元
★ Ruby之父Matz作推荐语:上古传承的魔法,彻底揭开垃圾回收的秘密! ★ 日本天才程序员兼Lisp黑客竹内郁雄审校 本书前半介绍基本GC算法,包括标记-清除GC、引用计数、复制算法的GC、串行GC的算法、并发GC的算法等。后半介绍V8、Rubinius、Dalvik、CPython等几种具体GC的实现。本书适合各领域程序员阅读。一起来看看 《垃圾回收的算法与实现》 这本书的介绍吧!