Driver that performs an IAT attack on Battleye's BEDaisy.sys
you need:
Build the driver using Visual Studio and map it using a manual mapper like KDMapper or modify it to start via Windows SC manager.
This driver performs an IAT attack on BEDaisy.sys to gain control over calls to statically and dynamically imported windows kernel functions.
- We need to register a LoadImage callback in kernel
- we place 2 code hooks in a codecave of a legitimate driver, one will be used to register our callback and one will be the callback address itself.
- we have to modify the LDR_DATA_TABLE flags so the MmVerifyCallbackFunction(that is called for every registered callback) passes.
- Our callback will IAT hook BEDaisy.sys every time it is loaded.
Battleye has decided to only half-bake their switch from static imports to dynamic imports; They now dynamically import most of the functions but they do that by calling MmGetSystemRoutineAddress, which is still statically linked. This means we can just IAT hook MmGetSystemRoutineAddress and pass our pointer for every function imported this way. PS: EasyAntiCheat didn't half bake their dynamic imports and they coded their own MmGetSystemRoutineAddress that parses the drivers to get the function pointer, with some creativity one can still attack EAC in a similar fashion.
Now, with control over imported functions, even though BEDaisy is heavily obfuscated and virtualized, we gained control over a great part of its functionalities. With that power we can, for example, disable its communication with the usermode BEService.exe(they have a heartbeat system in place though, so simply cutting comms isn't a good idea).
https://github.com/zouxianyu/BlindEye and https://github.com/rogerxiii/kernel-codecave-poc