IDontCode
/
BELog
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
reverse engineering of bedaisy.sys (battleyes kernel driver)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
14 Commits
1 Branch
0 Tags
22 MiB
 
 
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '6cd6663224'
${ noResults }
Go to file
xerox 6cd6663224
Update README.md 		4 years ago
BEDaisy init commit 4 years ago
DumpLog added runtime log! (3 games) 4 years ago
RuntimeLog drivers are from windows 10 2004 4 years ago
LICENSE Add LICENSE 4 years ago
README.md Update README.md 4 years ago

README.md

BEDaisy

reverse engineering of bedaisy.sys (battleyes kernel driver). By registering on image load callbacks and IAT hooking BEDaisy's MmGetSystemRoutineAddress we can simply hook any imports we want and have control flow over subsequent functions.

APCS

The below function will be executed in each thread that bedaisy registers an APC on.

__int64 __usercall apc_callback@<rax>(char _CL@<cl>, char _BH@<bh>, __int64 *a3@<r9>)
{
  __int64 v4; // rbx

  __asm { rcl     bh, cl }
  v4 = *a3;
  *(_DWORD *)(v4 + 2160) = RtlWalkFrameChain(*a3 + 0x70, 256i64, 0i64);
  return KeSetEvent(v4 + 88, 0i64, 0i64);
}

Registeration of APCS:

    status = PsLookupThreadByThreadId(thread_id, &some_pethread);
    v17 = 0;
    if ( (int)status >= 0 )
    {
      allocated_pool = ExAllocatePool(0x200i64, 0x878i64);
      allocated_pool_1 = allocated_pool;
      allocated_pool_2 = allocated_pool;
      if ( allocated_pool )
      {
        allocated_pool_plus_58 = allocated_pool + 0x58;
        KeInitializeEvent((PRKEVENT)(allocated_pool + 0x58), NotificationEvent, 0);
        __asm { rcl     cx, 0C6h }
        LOBYTE(v77) = 0;
        KeInitializeApc(allocated_pool_2, some_pethread, 0i64, j_apc_callback, 0i64, 0i64, v77, 0i64);
        if ( (unsigned __int8)KeInsertQueueApc(allocated_pool_2, allocated_pool_2, 0i64, 2i64) )

HWID

02646072	190.99209595	[GoodEye]ZwDeviceIoControlFile Called From 0xFFFFF804DEFDB9B1	
02646073	190.99211121	[GoodEye]     - FileHandle: 0xFFFFFFFF80003E28	
02646074	190.99211121	[GoodEye]     - IoControlCode: 0x000000000007C088	
02646075	190.99211121	[GoodEye]     - OutputBufferLength: 0x0000000000000211	
02646076	190.99211121	[GoodEye]     - InoutBufferLength: 0x0000000000000021