corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087d9-fe6b-72ba-8a5c-1e951d24a040

Reversing BEDaisy.sys: Static Analysis of BattlEye's Kernel Anti-Cheat Driver

s4dbrd.github.io · published 5 March 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at s4dbrd.github.io Wayback capture
1blogs citing
First cited
16 Jun 2026
Most recent
16 Jun 2026
Rank this month
not ranked
Links from this post
43
Words captured
5,804

Cited by

Blog
In the post
Date
codeneverdies.github.io
Anti-Cheat: Stopping Memory Acquisition via Crash Dumps Read at the source ↗
16 Jun 2026

Links from this post

Link
Host
How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection Read at the source ↗
s4dbrd.github.io
https://secret.club/2019/02/10/battleye-anticheat.html
secret.club
https://back.engineering/blog/2020/08/22/
back.engineering
https://github.com/Aki2k/BEDaisy
github.com
https://s4dbrd.github.io/assets/img/posts/bedaisy-sections-ida.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-fltmc.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-entrypoint.png
s4dbrd.github.io
https://github.com/eversinc33/drvtrace
github.com
https://s4dbrd.github.io/assets/img/posts/bedaisy-crashdump-lm.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-memdump.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-driver-object.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-device-object.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/bedaisy-majorfunction-table.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-irp-create.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-irp-devicecontrol.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-fltkd-filter.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-filterunload-clean.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-driverunload-obfuscated.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-process-callbacks.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-thread-callbacks.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-image-callbacks.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreatethreadnotifyroutine
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetloadimagenotifyroutine
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/bedaisy-resolved-api-table.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-resolved-api-table-2.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nc-ntddk-pcreate_process_notify_routine_ex
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-_ps_create_notify_info
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-detection.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-namematch.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-cleanup-proclist.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-cleanup-threadlist.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-init.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-pcb-exit.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-tcb-detection.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-tcb-modulecheck.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/bedaisy-tcb-report.png
s4dbrd.github.io
https://arxiv.org/pdf/2408.00500
arxiv.org
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obregistercallbacks
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltregisterfilter
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts
learn.microsoft.com
https://learn.microsoft.com/en-us/sysinternals/downloads/notmyfault
learn.microsoft.com