BattlEye Update Information

*Thanks to tim0n for this!*

They recently added a new function in the 1.171-1.173 update, which adds another external reader using OpenProcess and ReadProcessMemory.

OpenProcess is called with the access of QueryInformation and VMRead as shown:

Code:

.text:10001F81                 mov     edx, stru_1001D908.th32ProcessID
.text:10001F87                 push    edx             ; dwProcessId
.text:10001F88                 push    ebx             ; bInheritHandle
.text:10001F89                 push    410h            ; dwDesiredAccess
.text:10001F8E                 call    ds:OpenProcess

Push 410h = 0x400 and 0x10 meaning QueryInfo and VMread.

The difference is that this new OpenProcess/RPM can actually get exit code, tokens and priority class information.

The next difference is that it VirtualQuery's this memory as well, meaning it is most definitely scanning through the memory of the process and not just looking for blacklisted application CRC32's.

Being honest I don't know what it's for completely yet but I would be careful with your external hacks. It appears it can actually scan web browsers I think so be very careful with what you use for the time being!

~Silentkill

But wouldn't monitoring our web browser's be illegal?

Originally Posted by Superjail3

But wouldn't monitoring our web browser's be illegal?

i hope so... but i highly doubt. they are just running a scan seeing what proccesses are runnin cant really steal your info or anything.

Originally Posted by Superjail3

But wouldn't monitoring our web browser's be illegal?

Everything they're doing is already fucking illegal. It's a violation of the 4th ammendment (here) and they have no goddamn right to fucking scan my computer. I don't care if they want to make the game a firewall and prevent it from being tampered with, but you can't invade privacy to do that.

Still an invasion of privacy. First Origin, then Windows now Battleye. (I know there probably more) But i mean come on this is getting sad now that every we do is being monitored.

Battle EYE sucks. They are want to ban every player that connect to server)

Originally Posted by Chameleon12

Battle EYE sucks. They are want to ban every player that connect to server)

I think he ment "Battleye Sucks. They just want to ban every single player that connects to a server."

At least say you got this from tim0n of off *************

chameleon speak english i can barely understand you

it is not detected

dayz nav &&& dayz survial

"But let this be a warning for anyone using Navigator or Survival Hack, they may be able to detect this and we know they will delay the ban wave because so many people use it and want to grab everyone they can."

To this point, i'm very skeptical it is really efficient. I mean, a LOT of people are using hacks on DayZ... I think as long as they don't completely change the way their protection we can be confident. But as always, better safe than sorry.

There might be a delayed ban-phase going on. Generally I would advice to not use hacks in the next couple of days.

Ya what they are doing is illegal, blizz lost a lawsuit for doing the exact same thing (scanning your open/running processes/reading your mem). It was determined that doing this is considered running malware.. and seeing as how we payed for the game they cant just decide that its their right to snoop our computers with their shitty malware 'battleye'. However... only way to stop them would be get a lawyer and have the lawyer send them a nasty letter so they know to cut it out or be sued.... and I'm not gonna do that soooo, time to make some more work around hacks? lol

Hmmm... so BE finally found a way to find out if we are using Dayznav by reading what processes are running?

I'm not very good with tech, but I wonder. If I rename "plugin container.exe" (which I am assuming what they are scanning for), and rename it to like... chrome.exe.. would I be free?

BattlEye Update Information

Post a Reply

Similar Threads

Tags for this Thread