BattlEye driver bypass (Source)

Yes 100% does.

I would assume some sort of global counter or variable that does a set of calculations on random numbers than randomly does some sort of math on the global variable that is done all throughout the code utilizing about 15-30 extra functions with return values? (arithmatic on a random switch for instance)

I am proficient enough with C..... Do you only suggest modifying the main.c functions or will modifying the header be suggested as well?

Would code obfuscation be needed (will variable names carry over to the compiled driver?)

Thanks

And for those still using this method; still working?

Um... me thinks you do not comprehend what this code does or you would realize that BeeEee doesn't ever get any signals showing bad things are happening to its defender process, and secondly, if the bypass structures get changed and do many things, in the beginning middle and end of the actually crippling function; it will be a 100% independent and different type of thing to detect (different signature for functions as a whole).

I am just wanting to be sure that this methodology I spoke of in my original reply, and the act of removing and reinstating callbacks is still an undetected activity.

I personally will still go through the process to code this, and try it on an app/driver with a different altitude just to see whats what.... Id rather stay completely incognegro by running the whole protected processes in a VM, and snooping the mem of the VM in the host OS. I can't see how this would ever be detected, unless the VM passes host callbacks/data to the child/emulated pc in a way we don't know about.

If you're able to bypass this I'll pay you good $$$.

Skype: defal.t

nooope... wouldn't ever happen. Sorry.

He wanted a copy of what someone compiles..... not something anyone would probably do at this point IMHO. I.E. Not gonna happen. The point is to stay unique; and props up to you for posting steps to achieve this.
Also I won't be handing out something with my digital signature on it.

But, I just checked Codemorph's website, and it does not provide download links for the c++ obfuscator. Only unclickable placeholders. This will not help the newbies that are just learning about this stuff Via the: /download-codemorph.html page. (can't remember if external linking is allowed on this site)

I myself went a LOT further on my test project by adding un-necessary counters and random generated choices to the driver all throughout the process of crippling the callbacks. This way there is a LOT more going on under the hood than just disabling the callbacks and re-enabling them. I went as far as to make one of them identical in size and structure to the stored callbacks to be restored.... but just filled with useless data that's generated at random and done math against a value passed to the driver when being called.

I doubt they would ever be able to figure out what is actually happening in the driver.

I may go as far in a different rendition as have it send direct commands to and from a AHA2940 controller that's installed in my pc... It's legacy hardware, and there are no official drivers for it for win7x64+. I have several unsigned legacy drivers I have had to "make work" in win10; and have never had any issues with them being a problem to BE. It's not hard to fall under this category if your driver behaves in certain ways and is so convoluted that it's hard for you to even make sense of what you did with it......


I don't do this to actually use it, I use it to study and understand the coding of it. I have always been drawn towards software but keep getting pulled to the physical nature of hardware and working with my hands creating. But with microcontrollers and other such things like a Pi; the necessity for the software backing is very much necessary. I originally took C++ back in highschool, but computer's weren't exactly in schools much then. In the mid-late 00's, I decided to reverse engineer a softwares serialization routine just out of pure curiosity... "how can something be unknown in the end if it can be followed through it's math each step?".

This project in itself; has opened my eyes to the things I truthfully wanted (and did) ignore back when Visual C++ was first released, and then some.

I miss the Borland 3.5 days, and Mode13 graphics. The world was changing fast.

Sorry I thought you meant be would never be bypassed.