BattlEye and Windows Local Kernel-Mode Debugging (Part 1)

Windows

Nowadays, every suitable online multiplayer game needs a decent anti-cheat, thanks to many communities of cheaters (eg. MPGH and UnKnoWnCheaTs). As a game server owner, I noticed that the number of cheaters decreased drastically.

BattlEye, an anti-cheat software developed by Bastian Suter in 2004, protects many popular games including ARMA III, Fortnite, PUBG and DayZ. Let’s summarize how it works.

949fb612deaaf3040c4dea0cb4c9145c

BattlEye logo

How does BattlEye works

BattlEye is a client-side and server-side based anti-cheat. The client communicates regularly with the server, and is kicked when abnormal activity is detected (e.g. no response: BattlEye client is probably not running anymore).

BattlEye is backed by a kernel driver, BEDaisy.sys. This is what is all about: this is very complicated to monitor the driver.

It is complicated to describe how BattlEye works precisely because most anti-cheats are based on security through obscurity. However, we can describe most noticeable mechanisms.