Stop battleye detections/simple self-scanner
Stop battleye detections/simple self-scanner
If you have to ask how to use this or what it does or what it is for, then this isn't for you.
You could reverse all of Battleye's scans enough to read the sig tables out of memory and scan yourself with them (I did)
OR
You could just check the detection value and be done with it. The detection value is set after a scan matches a sig. It's obfuscated so you can't just read the value, you have to de-obfuscate it. But once you can read it, you can close before a detection report is sent to the server by crashing if the detection value is not equal to zero. This works for the main scans but not the script scan. This also doesn't stop the hook reporting scan or the self integrity scan.
Sometimes the detection value is garbled in memory while BE is loading, but the size of the output buffer (what BE sends reports in) seems to get set to 0 pretty early on, so I check both. There's a little bit of a race condition as it's theoretically possible for a detection to happen right before the server requests a report, and you don't get the detection value checked before that report is sent, but it is unlikely.
Test your code by launching 64 bit Cheat Engine. If your shit aborts, you're good. If you get kicked, you done goofed.
tl;dr: You can stop detections before they're sent to Battleye and save yourself a ban
You could reverse all of Battleye's scans enough to read the sig tables out of memory and scan yourself with them (I did)
OR
You could just check the detection value and be done with it. The detection value is set after a scan matches a sig. It's obfuscated so you can't just read the value, you have to de-obfuscate it. But once you can read it, you can close before a detection report is sent to the server by crashing if the detection value is not equal to zero. This works for the main scans but not the script scan. This also doesn't stop the hook reporting scan or the self integrity scan.
Sometimes the detection value is garbled in memory while BE is loading, but the size of the output buffer (what BE sends reports in) seems to get set to 0 pretty early on, so I check both. There's a little bit of a race condition as it's theoretically possible for a detection to happen right before the server requests a report, and you don't get the detection value checked before that report is sent, but it is unlikely.
Test your code by launching 64 bit Cheat Engine. If your shit aborts, you're good. If you get kicked, you done goofed.
Code:
#define BYTEn(x, n) (*((BYTE*)&(x)+n))
GHBE = GetModuleHandle(TEXT("BEClient.dll"));
int outputBufferSize = *(int *)((int)GHBE + 0x241E8);
int *random = (int *)((int)GHBE + 0x207B8);
unsigned __int16 detected_o = *(int *)((int)GHBE + 0x2354C);
unsigned __int16 d1 = (*random & ((BYTEn(*random, 3)) | (~(BYTEn(*random, 1))))) << 8;
int detected = (unsigned __int16)(detected_o ^ d1 ^ (unsigned __int16)(-23920 * (*random) + *((BYTE *)random + 204 * (*random) % 3)));
if(detected && outputBufferSize)
{
thatShit.abort();
}
Omfgggg... This is FUCKING AWESOME DOUGGEM! +REPPPP OMG THANK YOU SO MUCH
Originally Posted by xCyberxx
Omfgggg... This is FUCKING AWESOME DOUGGEM! +REPPPP OMG THANK YOU SO MUCH
how to use it?
Originally Posted by dayzxhackerx
how to use it?
"If you have to ask how to use this or what it does or what it is for, then this isn't for you. "
Originally Posted by Hammy2
LOL did not read
"If you have to ask how to use this or what it does or what it is for, then this isn't for you. "
"If you have to ask how to use this or what it does or what it is for, then this isn't for you. "
genius..Thanks for posting so it gets fixed soon.
Someone please explain to me how to do this haha me newb
Originally Posted by dayzxhackerx
LOL did not read
"If you have to ask how to use this or what it does or what it is for, then this isn't for you. "
"If you have to ask how to use this or what it does or what it is for, then this isn't for you. "
Originally Posted by `Rejected
I did read it and I still dont know how to do it... I want to know how so in the future I can do it by myself dickhead.
Learn how to code, you'll understand what this is !
People are all like " Yeah Thanks For This Best Thing Ever" When it's quite likely they have no idea how to use it.
@Douggem So This should allow me to run a program that has already has been detected by signature scans without Battleye knowing?
@Douggem So This should allow me to run a program that has already has been detected by signature scans without Battleye knowing?
No.
This will let you have your program crash in the event of a detection, before the report is sent to the server, avoiding a ban.
This will let you have your program crash in the event of a detection, before the report is sent to the server, avoiding a ban.
Explaining how to do this shit for nooblets would be a good way to feel good that you helped alot of people.
Thanks man really helpful 
Guys douggem doesn't NEED to explain anything, Its his choice, AND If you do NOT understand it then there is no point in you viewing this thread anymore.
I know how to use this so thank you douggem for sharing
I know how to use this so thank you douggem for sharing
This thread is closed for replies.
