BattlEye driver bypass (Source)

Originally Posted by UnknownImp

I have this mangled, compiled, signed, and installed. I can confirm that the driver is currently loaded and running.

I cannot however read the memory of any BattleEye protected process which leads me to believe something did not work as expected.

Any advice?

BE changed something. Brent1000 noted the changes, look in his SIEP thread.

How to use it?

- - - Updated - - -

But how can i use it? sorry am just started the programing and the hack writing!
PLs help me!!!

Does this still work with some heavy modification? for a game such as H1Z1 Kotk?

I have VS 2015 and WDK 10 installed, and I get this error:
"The Windows SDK version 8.1 was not found. Install the required version of Windows SDK or change the SDK version in the project property pages or by right-clicking the solution and selecting "Retarget solution"."
So I installed SDK 8.1...
The next error I got was:
Severity Code Description Project File Line Suppression State
"Compiling Desktop applications for the ARM platform is not supported."
and the two includes cannot be found: "#include <ntifs.h> #include <windef.h>", which results in a lot of unknown references from the two libs.
I do understand the code, but can not understand why it won't compile - btw, why would I need to rename references to BE and BEKiller if I am going to obfuscate the code? only the inf should have traces of BE or BeKiller changed as the obfuscator should take care of the main?

BTW, this is a brilliant way of bypassing BE, and I can see why it would be incredible hard for them to detect this method, as long as the code is obfuscated, then I can't really see why this would ever stop working in the near future.

Originally Posted by zassadgh2

I have VS 2015 and WDK 10 installed, and I get this error:
"The Windows SDK version 8.1 was not found. Install the required version of Windows SDK or change the SDK version in the project property pages or by right-clicking the solution and selecting "Retarget solution"."
So I installed SDK 8.1...
The next error I got was:
Severity Code Description Project File Line Suppression State
"Compiling Desktop applications for the ARM platform is not supported."
and the two includes cannot be found: "#include <ntifs.h> #include <windef.h>", which results in a lot of unknown references from the two libs.
I do understand the code, but can not understand why it won't compile - btw, why would I need to rename references to BE and BEKiller if I am going to obfuscate the code? only the inf should have traces of BE or BeKiller changed as the obfuscator should take care of the main?

BTW, this is a brilliant way of bypassing BE, and I can see why it would be incredible hard for them to detect this method, as long as the code is obfuscated, then I can't really see why this would ever stop working in the near future.

I had your first error myself. You need to download and install the Windows 10 SDK files, then right click on the project properties and where it says "target platform" change it from 8.1 to 10.x.x.xxx[it will have a long string of numbers typically].

This Heavy modification "tutorial" thread is honestly one of the worst tutorials I have ever worked with.

First thing to note people is that this was done in Visual Studio 2013 with SDK 8.1 drivers for WINDOWS 8.1. This is why so many people on 10 are having such huge problems. You have to convert the project from 8.1 to 10 by having the SDK files for 10 targeted.

I managed to have the .inf file built through VB. Now however after running DSEfix, and attempting to install the driver, I am having the "system cannot find the specified file" error.

Checking through the backlog on setupapi.dev I noted the following:

Copying '...\BEKiller\x64\Release\cripplecallbacks.inf' to '...\AppData\Local\Temp\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx}\cripplecallbacks.inf'.
Error installing file (0x00000002)
Error 2: The system cannot find the file specified.
SourceFile - ...\BEKiller\x64\Release\[removed].sys'
TargetFile - ...\AppData\Local\Temp\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx}\[removed].sys'

There are no .sys files in the new x64 folders...

Any ideas?

What is callback offset for win 7 x64?
0xC0?

Hi everyone!

Got this error while trying to install the .inf file :

" The INF file you selected does not support this method of installation. "

I saw someone else had this problem but nobody posted a solution or a hint that could help me... so here I am..

What's the method to install the driver? ty and sorry for my noobiness

So someone if this still works? cuz one Replyer was writing that it didnt work since a few weeks??

This is the greatest thing ever.

Originally Posted by RTEGRWEYHGWA$RywywG

Yeah,
sdf76bdfhtd9gfh67fh

- - - Updated - - -

A lot of this thread is loaded with freaking amazing information. Someone should trim the fat at put it up on the beginner page.

Originally Posted by niceone26

Okay a short resume:

- I compiled the driver (don't touched the main.c, only modifyed the .inf) as release x64
- optinal: I signed it with a certificate
- I enabled dsefix
- I instelled it with pnputil
- I added device in device manager
- I startet it with "sc start"
- I disabled dsefix

And its still not working - tried to inject a dll with extreme injector and it fails with the message: "Unable to find kernel32.dll in the specified process."

Can someone please tell me what im doing wrong?

Rainbow Six siege doesnt have kernel32.dll in the main game anymore so you can not use hacks that require this like inject hacks

Thanks dude

I do not get it. People release cheats and hacks that can get you banned and issue warnings about it. Then why bother even releasing it in the first place if it isn't 100% undetected?

Does this method still work? Also how heavily should i modify the code. I have renamed all be and bekiller names in the code and obfuscated it. Should I do more?

care to share? i might be able to provide some chams.. (ESP wallhack) only though.

I can share but im not even sure this method still works. Im looking for an esp if I do get it working too.

Post a Reply

Similar Threads

Tags for this Thread