1. For some specific setups of ARK servers, it may be required to disable the built-in BattlEye Anti-Cheat. This guide shows you how to do so by disabling it using your server's properties file. Stop your server. This is required before making any changes to server configuration files.
2. The Easy Anti-Cheat by Epic Games is a popular and reliable software used by over 120 games. Given its track record, we are hopeful that the new Fall Guys anti-cheat solution will also be able to finally help us get rid of the Fall Guys cheating problem.
3. Riot Games takes its anti-cheating technology seriously. So seriously, in fact, that unless you’ve got its Vanguard software installed and switched on, you won’t be able to play its.
4. BattlEye is a proactive anti-cheat protection system which puts a strong shield around the entire game. This way, most of the hacking is blocked to begin with. BattlEye is constantly evolving to cover new forms of attacking games.
5. Most games have an 'anti-cheat' which try to detect people who use cheats and ban them from the game. As a cheat developer, you have to bypass these counter measures, and sometimes these counter measures are present in the executable in the form of packing / obfuscation which just makes it harder to analyze.
6. Quick video to help anyone that is having issues with their Fortnite launcher not working. Easy Anti Cheat is causing issues with opening some player's game.

Starting out as an external 3rd-party anti-cheat for Battlefield Vietnam, first versions were quickly released and it rapidly gained first acknowledgement. In early 2005, it was integrated in the first professional leagues. Due to request by the community, BattlEye was then ported to Battlefield 1942 and again used by some leagues.

* This document was partially created using product description and frequently asked questions from the BattlEye website.
What is BattlEye?
What do you mean by a preliminary integration of BattlEye (Beta)?
How does BattlEye work?
Why is it on my computer?
Is BattlEye always active on my computer?
What is BattlEye scanning for and should I be concerned about privacy?
What happens when BattlEye detects a cheat on a player’s computer?
What messages will I get when I get kicked out of a game?
What happens if BattlEye prevents me from launching the game, but I wasn’t running a cheating or hacking program? (False Positives)
Will BattlEye reduce the performance quality of my game?
Will it block programs I use like Discord, Teamspeak, Fraps, OBS, Xsplit, or anything else like that?
Can I uninstall BattlEye and still play the game?
Troubleshooting BattlEye
What is BattlEye?
BattlEye is a proactive anti-cheat protection system which puts a strong shield around the entire game. This way, most of the hacking is blocked to begin with. BattlEye is constantly evolving to cover new forms of attacking games. The remaining hacking is covered by an intelligent dynamic active detection system, ensuring that unrelenting cheaters are unable to play the game.
You can learn more about BattlEye on their website, here.
What do you mean by a preliminary integration of BattlEye (Beta)?
To ensure that BattlEye runs smoothly with our game and prevents cheating, we will be performing tests on a large scale with all our PC players, and so for several weeks. We will keep you informed as we make sure that this anti-cheating client-side product is best adapted to our needs. We thank you in advance for your patience and feedback.
How does BattlEye work?
BattlEye is a pro-active protection, so it blocks cheats before hooking into the game. It also has an active detection system that scans your computer’s memory for cheating software. For more information on how BattlEye works, please visit the BattlEye website.
Why is it on my computer?
In patch 3.4.1, BattlEye has been deployed to all players who owns Rainbow Six Siege as a way to prevent cheating. It has been integrated with Rainbow Six Siege and is part of our plan to stop hackers from ruining your experience.
Is BattlEye always active on my computer?
The BattlEye protection and system scan is only active when Rainbow Six Siege is running. When active, you will see it running in the system processes.
What is BattlEye scanning for and should I be concerned about privacy?
Everything that BattlEye does is aimed at blocking and detecting hacks. That’s the only thing it is looking for. When Rainbow Six Siege is running, BattlEye is able to scan all memory (RAM) and all game- and system-related files on disk. However, this does not mean that BattlEye is looking through your personal files, personal details, or other such information. Furthermore, it doesn’t store any of your personal data on its servers. It is solely searching for cheats. Also, BattlEye is only running when Rainbow Six Siege is running.
If you do have any concerns, you may contact BattlEye support directly: https://www.battleye.com/support/
What happens when BattlEye detects a cheat on a player’s computer?
It will prevent that player from playing the game. Bans will be issued following the Code of Conduct’s banning penalties for cheating.
Players should be aware that they should not play the game while still having hack-related Rainbow Six Siege software running in the background (even if the hack software was not actively used for Rainbow Six Siege).

Easy Anti Cheat Games

What messages will I get when I get kicked out of a game?
What happens if BattlEye prevents me from launching the game, but I wasn’t running a cheating or hacking program? (False Positives)
If you cannot run the game client, and you don't believe you are running a cheating or hacking program please follow these steps before contacting support. First, verify your PC files, install the latest Uplay or Steam client, and make sure all your drivers are up-to-date.
If you are still encountering an issue, please see the Troubleshooting steps listed below. Even after all those steps, if the game still does not launch, please contact BattlEye at: https://www.battleye.com/support/
Will BattlEye reduce the performance quality of my game?
BattlEye is designed to run with a very small footprint on your computer. It needs very few resources regarding CPU, RAM, and network bandwidth. Your PC’s performance should not experience any degradation. If you do experience performance issues that you think are related to BattlEye, please follow the Troubleshooting steps below. we are in a testing period, so if you do experience any performance issues, please contact Ubisoft Support.

Easy Anti Cheats

From BattlEye: If you get constant stuttering/freezing whenever you press mouse/keyboard buttons, this is typically caused by malware/adware/PUP constantly reloading into your game. Please try to scan your entire system with anti-malware software such as Malwarebytes Anti-Malware.
Will it block programs I use like Discord, Teamspeak, Fraps, OBS, Xsplit, or anything else like that?
No, it will not block popular programs that many PC gamers use. BattlEye has been around for 12 years on other games, and so it has gone through extensive live testing. While there is a possible chance for a false positive, it is unlikely. If that does occur, please contact BattlEye’s support at: https://www.battleye.com/support/
Can I uninstall BattlEye and still play the game?
No. Since there are file validation steps, uninstalling BattlEye would prevent you from launching the game.
Troubleshooting BattlEye
As a reminder, before doing the following steps it is recommended that you verify your PC files, install the latest versions of Uplay or Steam, and to update your drivers. For the latest solutions please also refer to the BattlEye FAQ: https://www.battleye.com/support/faq/.
Steam Verification:
Uplay Verification:
When launching the game I get a “Failed to initialize BattlEye Service: Driver Load Error (577).” error. How can I solve this?
You are most likely using a stock version of Windows 10 Home or the bugged pre-release Windows 10 Insider Preview build 10074. To fix this please search and install all available Windows updates.
My BE Launcher window shows “[INFO] Blocked loading of file: …” messages. What’s wrong?
If these messages don’t cause any issues with your game please just ignore them (note that in-game kicks are not related to them). Otherwise please check the following FAQ entry for further help. If the message is related to the “wow64.dll” file in your Windows system directory the main solution is to uninstall Windows update “KB3004394” from your system (see below).
My game doesn’t start / I get a Windows error (e.g. “The application was unable to start correctly (0xc000009a)”) when launching with BE enabled. How do I fix this?
Please try the steps below (the followings are taken from the BattlEye FAQ):

When launching the game I get a “Failed to initialize BattlEye Service: Windows Test-Signing Mode not supported.” error. How can I solve this?
Please disable test-signing mode by following this guide: http://support.microsoft.com/kb/2509241. Alternatively you can follow the manual instructions provided here: https://msdn.microsoft.com/en-us/library/windows/hardware/ff553484%28v=vs.85%29.aspx
When launching the game I get a “Failed to install BattlEye Service.” / “BattlEye Service installation failed.” / “Failed to start BattlEye Service.” / “BattlEye Service startup failed.” / “Failed to initialize BattlEye Service: …” error. How can I solve this?
First of all, please ensure that you have the latest BE Service files in the BattlEye folder of your game directory. Verify your game cache in Steam or download the latest files from the download page. Otherwise something on your system prevents the installation/startup of the BE Service, which is required to play on BE-enabled servers.
Please ensure that any security software (anti-virus, etc.) running on your system doesn’t block the BE Service (both BEService.exe/BEService_x64.exe in your game’s “BattlEye” directory as well as the entire BE Service directory, which is usually “C:Program Files (x86)Common FilesBattlEye”) in any way.
You might have to add it to your security software’s exception list. If that doesn’t help or you don’t use any sort of security software there might be a permission issue with your BattlEye Service directory or the files within it.
To solve this delete the BE Service directory (usually “C:Program Files (x86)Common FilesBattlEye”) and then try to launch your game again. If you still get the same error at this point please try to manually set the BE Launcher in your game directory (usually the executable file with “_BE” at the end) to run with administrative privileges (normally this should happen automatically).
To do so right-click on the BE Launcher executable, choose “Properties”, go to the “Compatibility” tab, check the “Run this program as an administrator” option and click OK to apply your changes.
If you still can’t get it to work some unknown software running on your system might be blocking BattlEye somehow. Open a ticket with BattlEye.
What should I do if I get failed to initialize BattlEye Service: Windows Test-Signing Mode not supported?
Please follow these instructions: https://support.microsoft.com/en-ca/kb/2509241
I am getting kicked for the following violation(s). I don’t use hacks, so what can I do to resolve this?
Client not responding
This can happen if the server’s or your connection times out for quite a while or breaks up completely. A common solution is to update your modem/router’s firmware. Also, make sure that you aren’t running “Cucusoft Net Guard” which is incompatible with BE. Other than that, please ensure that there are no problems with your internet connection (you might want to contact your ISP).
Corrupted Memory #X
BattlEye detects that your game’s memory is not what it is supposed to be. Scan your system for viruses/trojans/spyware and check your RAM for possible defects (using tools like Memtest86). If that doesn’t help, the game’s installation on your harddisk is possibly corrupted – therefore, try to reinstall the game.

The popular anti-cheat BattlEye is widely used by modern online games such as Escape from Tarkov and is considered an industry standard anti-cheat by many. In this article I will demonstrate a method I have been utilizing for the past year, which enables you to play any BattlEye-protected game online without even having to install BattlEye.

BattlEye is dynamically loaded by the respective game on startup to initialize the software service (“BEService”) and kernel driver (“BEDaisy”). These two components are critical in ensuring the integrity of the game, but the most critical component by far is the usermode library (“BEClient”) that the game interacts with directly. This module exports two functions: GetVer and more importantly Init.

The Init routine is what the game will call, but this functionality has never been documented before, as people mostly focus on BEDaisy or their shellcode. Most important routines in BEClient, including Init, are protected and virtualised by VMProtect, which we are able to devirtualise and reverse engineer thanks to vtil by secret club member Can Boluk, but the inner workings of BEClient is a topic for a later part of this series, so here is a quick summary.

Init and its arguments have the following definitions:

As seen, these are quite simple containers for interopability between the game and BEClient. becl_game_data is defined by the game and contains functions that BEClient needs to call (for example, send_packet) while becl_be_data is defined by BEClient and contains callbacks used by the game after initialisation (for example, received_packet). Note that these two structures slightly differ in some games that have special functionality, such as the recently introduced packet encryption in Escape from Tarkov that we’ve already cracked. Older versions of BattlEye (DayZ, Arma, etc.) use a completely different approach with function pointer swap hooks to intercept traffic communication, and therefore these structures don’t apply.

A simple Init implementation would look like this:

This would allow our custom BattlEye client to receive packets sent from the game server’s BEServer module.

The function received_packet is by far the most important routine used by the game, as it handles incoming packets from the BattlEye server component. BattlEye communication is extremely simple compared to how important the integrity of it is. In recent versions of BattlEye, packets follow the same general structure:

All packets have an identifier and a sequence number (which is used by the requests/response communication and the heartbeat). Requests and responses have a fragmentation mode which allows BEServer and BEClient to send packets in chunks of 0x400 bytes (seemingly arbitrary) instead of sending one big packet.

In the current iteration of BattlEye, the following packets are used for communication:

INIT (00)

This packet is sent to the BEClient module as soon as the connection with the game server has been established. This packet is only transmitted once, contains no data besides the packet id 00 and the response to this packet is simply 00 05.

START (‘02’)

This packet is sent right after the ‘INIT’ packets have been exchanged, and contains the server-generated guid of the client. The response of this packet is simply the header: 02 00

REQUEST (04) / RESPONSE (05)

This type of packet is sent from BEServer to BEClient to request (and in rare cases, simply transmit) data, and BEClient will send back data for that request using the RESPONSE packet type.

The first request contains crucial information such as service- and integration version, not responding to it will get you disconnected by the game server. Afterwards, requests are game specific.

HEARTBEAT (09)

This type of packet is used by the BEServer module to ensure that the connection hasn’t been dropped. It is sent every 30 seconds using a sequential index, and if the client doesn’t respond with the same packet, the client is disconnected from the game server. This heartbeat packet is only three bytes long, with the sequential index used for synchronization being incremental and therefore easily emulated. An example heartbeat could be: 09 01 00, which is the second heartbeat (sequence starts at zero) transmitted.

With this knowledge, it is possible by emulating the entire BattlEye anti-cheat with only two proprietary points of data: the responses for request sequence one and two. These can be intercepted using a tool such as wireshark and replayed as many times as you want for the respective game, because the packet encryption used by BattlEye is static and contextless.

Emulating the INIT packet is as stated simply responding with the sequence number five:

Emulating the START packet is done by replying with the received packet’s header:

Emulating the HEARTBEAT packets is done by replying with the received packet:

Emulating the REQUEST packets can be done by replaying previously generated responses, which can be logged with code hooks or man-in-the-middle software. These packets are game specific and some games might disconnect you for not handling a specific request, but most games only require the first two requests to be handled, afterwards simply replying with the packet header is enough to not get disconnected by the game server. It is important to notice that all REQUEST packets are immediately responded to with the header, to let the server know that the client is aware of the request. This is how BottlEye emulates them:

Which uses the following helper function for responses:

The full BottlEye project can be found on our GitHub repository. Below you can see this specific project being used in various popular video games.

Fortnite

The following video contains a live demonstration of my BottlEye project being used in the BattlEye-protected game Fortnite. In the video I live debug fortnite while playing online to prove that BattlEye is not loaded.

Insurgency

The following screenshot shows the BattlEye-protected game Insurgency running on Arch in Wine.

Escape from Tarkov

The following screenshot shows the usage of Cheat Engine in the popular, battleye-protected game Escape from Tarkov. This is possible because BattlEye has been replaced with BottlEye on disk.

• Sabotage
• Tamimego
• Atex
• namazso