From f66b6ef6f26e04926074c47d8615511bb2b700d0 Mon Sep 17 00:00:00 2001 From: xerox Date: Mon, 17 Aug 2020 22:35:13 +0000 Subject: [PATCH] Update README.md --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index d812168..152e2f2 100644 --- a/README.md +++ b/README.md @@ -27,4 +27,6 @@ the handle to the driver we can start sending IOCTL's to BattlEye. The IOCTL dat # limitations Now that we can ask BEDaisy to read/write for us, what are the limitations? Well first off you cannot use this to read/write the process that battleye is protecting but you can use -this to read/write any other process you can open a simple handle too. `Rust`, `Valorant`, you name it, just open a `PROCESS_QUERY_LIMITED_INFORMATION` handle and pass it to `BEDaisy`. \ No newline at end of file +this to read/write any other process you can open a simple handle too. `Rust`, `Valorant`, you name it, just open a `PROCESS_QUERY_LIMITED_INFORMATION` handle and pass it to `BEDaisy`. The reason +this works is two fold, firstly BattlEye assumes that the handle already has this access, secondly BattlEye only uses the handle to get the `EPROCESS` so they can call `MmCopyVirtualMemory`. You can see +this in my runtime logs of `BEDaisy`. \ No newline at end of file