# BEDaisy
reverse engineering of bedaisy.sys (battleyes kernel driver). By registering on image load callbacks and IAT hooking BEDaisy's `MmGetSystemRoutineAddress` we can simply hook any imports
we want and have control flow over subsequent functions.
< img src = "https://imgur.com/NFGyGrY.png" / >
# APCS
The below function will be executed in each thread that bedaisy registers an APC on.
```cpp
__int64 __usercall apc_callback@< rax > (char _CL@< cl > , char _BH@< bh > , __int64 *a3@< r9 > )
{
__int64 v4; // rbx
__asm { rcl bh, cl }
v4 = *a3;
*(_DWORD * )(v4 + 2160) = RtlWalkFrameChain(*a3 + 0x70, 256i64, 0i64);
return KeSetEvent(v4 + 88, 0i64, 0i64);
}
```
Registeration of APCS:
```cpp
status = PsLookupThreadByThreadId(thread_id, &some_pethread);
v17 = 0;
if ( (int)status >= 0 )
{
allocated_pool = ExAllocatePool(0x200i64, 0x878i64);
allocated_pool_1 = allocated_pool;
allocated_pool_2 = allocated_pool;
if ( allocated_pool )
{
allocated_pool_plus_58 = allocated_pool + 0x58;
KeInitializeEvent((PRKEVENT)(allocated_pool + 0x58), NotificationEvent, 0);
__asm { rcl cx, 0C6h }
LOBYTE(v77) = 0;
KeInitializeApc(allocated_pool_2, some_pethread, 0i64, j_apc_callback, 0i64, 0i64, v77, 0i64);
if ( (unsigned __int8)KeInsertQueueApc(allocated_pool_2, allocated_pool_2, 0i64, 2i64) )
```
# HWID
BEDaisy opens a handle to DR0 (disk.sys).
```
02646022 190.98799133 [GoodEye]ZwOpenFile called from: 0xFFFFF804DEFDB904
02646023 190.98799133 [GoodEye] - ZwOpenFile(\Device\Harddisk0\DR0)
02646024 190.98869324 [GoodEye] - ZwOpenFile handle result: 0xFFFFFFFF80003E28
```
BEDaisy then sends a few IOCTL's to disk.sys using `ZwDeviceIoControlFile`
```
02646049 190.99142456 [GoodEye]ZwDeviceIoControlFile Called From 0xFFFFF804DEFDB94A
02646050 190.99143982 [GoodEye] - FileHandle: 0xFFFFFFFF80003E28
02646051 190.99143982 [GoodEye] - IoControlCode: 0x00000000002D1400
02646052 190.99143982 [GoodEye] - OutputBufferLength: 0x0000000000000008
02646053 190.99143982 [GoodEye] - InoutBufferLength: 0x000000000000000C
02646059 190.99192810 [GoodEye]ZwDeviceIoControlFile Called From 0xFFFFF804DEFDB960
02646060 190.99192810 [GoodEye] - FileHandle: 0xFFFFFFFF80003E28
02646061 190.99192810 [GoodEye] - IoControlCode: 0x00000000002D1400
02646062 190.99192810 [GoodEye] - OutputBufferLength: 0x0000000000000000
02646063 190.99194336 [GoodEye] - InoutBufferLength: 0x000000000000000C
02646072 190.99209595 [GoodEye]ZwDeviceIoControlFile Called From 0xFFFFF804DEFDB9B1
02646073 190.99211121 [GoodEye] - FileHandle: 0xFFFFFFFF80003E28
02646074 190.99211121 [GoodEye] - IoControlCode: 0x000000000007C088
02646075 190.99211121 [GoodEye] - OutputBufferLength: 0x0000000000000211
02646076 190.99211121 [GoodEye] - InoutBufferLength: 0x0000000000000021
```
# IRP
Below you can see that bedaisy calls `MmIsAddressValid` on every single IRP of every single driver. Below is `dxgkrnl.sys` .
```
00052032 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052033 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01510
00052034 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052035 94.91796112 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052036 94.91796112 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052037 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F011B0
00052038 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052039 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052040 94.91796875 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052041 94.91796875 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052042 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052043 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052044 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052045 94.91797638 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052046 94.91797638 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052047 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052048 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052049 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052050 94.91798401 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052051 94.91798401 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052052 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052053 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052054 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052055 94.91799164 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052056 94.91799164 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052057 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052058 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052059 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052060 94.91799927 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052061 94.91799927 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01290
00052062 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052063 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052064 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052065 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052066 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052067 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052068 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052069 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF80498F01070
00052070 94.91800690 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052071 94.91800690 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052072 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052073 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052074 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052075 94.91801453 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052076 94.91801453 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052077 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052078 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052079 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052080 94.91802216 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052081 94.91802216 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052082 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052083 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052084 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052085 94.91802979 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
00052086 94.91802979 [GoodEye]MmIsAddressValid Called From: 0xFFFFF804DEFE1116
00052087 94.91803741 [GoodEye] - NonPaged VirtualAddress: 0xFFFFF8047EF364C0
```
