{"id":2257,"date":"2024-06-20T13:29:35","date_gmt":"2024-06-20T16:29:35","guid":{"rendered":"https:\/\/reversingthread.info\/?p=2257"},"modified":"2024-06-20T13:29:35","modified_gmt":"2024-06-20T16:29:35","slug":"battleye-analysis-part-1-window-detection","status":"publish","type":"post","link":"https:\/\/reversingthread.info\/index.php\/2024\/06\/20\/battleye-analysis-part-1-window-detection\/","title":{"rendered":"Battleye Analysis Part 1 – Window Detection"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Introduction<\/h2>\n\n\n\n

This research delves into Battleye’s detection mechanisms, this part 1 is focused on identifying and analyzing suspicious windows. This analysis aims to understand these methods for research purposes only, not to bypass or attack the software. The provided code was extracted and has been beautified for clarity.<\/p>\n\n\n\n

Those detection were analysed from the game DayZ, at date 06\/20\/2024.<\/mark><\/p>\n\n\n\n

<\/div>\n\n\n\n

Window detection overview<\/h2>\n\n\n\n

BattlEye employs three primary methods for detecting suspicious windows. The first method involves scanning for blacklisted window names and class names, while the second method focuses on analyzing window styles and attributes, such as topmost or transparent properties, the third one is a check for validating if the enumerated windows was actually run. Additionally, its implements a fourth layer of protection by verifying the integrity of the functions used to perform these checks, ensuring that they have not been hooked or tampered with. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Breakdown <\/h2>\n\n\n\n

1. Report Buffer and Report Function<\/h3>\n\n\n\n

BattlEye employs a 0x5400<\/strong>-byte report buffer to store detection data. The buffer’s first byte is always 0, the second identifies the report type, and the rest contains detection details. BattlEye uses malloc <\/strong>for dynamic allocation. A separate 0x5000<\/strong>-byte buffer temporarily holds detection data before copying it to the report buffer prior to sending.<\/p>\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
struct<\/span> <\/span>Report<\/span><\/span>\n{<\/span><\/span>\n    BYTE       Unknown;<\/span><\/span>\n    ReportType ReportType;<\/span><\/span>\n    BYTE       <\/span>ReportData<\/span>[<\/span>21502<\/span>];<\/span><\/span>\n};<\/span><\/span>\n<\/span>\nusing<\/span> <\/span>BattleyeReport_t<\/span> = <\/span>void<\/span>(BYTE* reportBuffer, <\/span>uint32_t<\/span> reportSize, <\/span>uint32_t<\/span> Unknown);<\/span><\/span>\n<\/span>\nBattleyeReport_t<\/span> BattleyeReport = <\/span>nullptr<\/span>;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
<\/p>\n\n\n\n
2. Report Types<\/h3>\n\n\n\n
While this enum is incomplete and will be expanded upon later, it contains the three primary report types relevant to window detection. It is important to note that the DetectedAbnormalWindow_Handle_File<\/code> <\/strong>report type also includes checks for blacklisted window names, opened handles and files, which will be discussed in further detail later in this analysis.<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
enum<\/span> <\/span>class<\/span> <\/span>ReportType<\/span> : <\/span>uint8_t<\/span><\/span>\n{<\/span><\/span>\n    <\/span>DetectedBlackListedWindow<\/span>          = <\/span>0x33<\/span>,<\/span><\/span>\n    <\/span>DetectedAbnormalWindow_Handle_File<\/span> = <\/span>0x3C<\/span>,<\/span><\/span>\n    <\/span>DetectedFailToEnumerateWindow<\/span>      = <\/span>0x44<\/span><\/span>\n};<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
<\/p>\n\n\n\n
3. Window Iteration<\/h3>\n\n\n\n
BattlEye initiates the window detection process by retrieving the topmost window using the GetTopWindow<\/code> <\/strong>function. It then enters an infinite loop, iterating through the windows by calling GetWindow<\/strong><\/code> with the current topWindow<\/code> <\/strong>as the first argument and GW_HWNDNEXT<\/code> <\/strong>as the second. The loop continues until the parentWindow<\/code> becomes NULL<\/strong>. The indexAtBufferReport<\/code> <\/strong>is incremented by 0x1C<\/code> <\/strong>plus the size of the data added to the report buffer for each window. The detection process persists as long as indexAtBufferReport<\/code> <\/strong>remains smaller than 0x4E80<\/strong><\/code>. The detection’s only occurs on windows that do not belong to the game process itself. <\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
void<\/span> <\/span>CheckWindows<\/span>()<\/span><\/span>\n{<\/span><\/span>\n    DWORD processId       = <\/span>0<\/span>;<\/span><\/span>\n    <\/span>char<\/span>  <\/span>windowName<\/span>[<\/span>220<\/span>] = {};<\/span><\/span>\n    HWND  parentWindow    = <\/span>nullptr<\/span>;<\/span><\/span>\n    HWND  currentWindow;<\/span><\/span>\n<\/span>\n<\/span>\n    HWND topWindow = <\/span>GetTopWindow<\/span>(<\/span>nullptr<\/span>);<\/span><\/span>\n    <\/span>bool<\/span> exitLoop  = <\/span>false<\/span>;<\/span><\/span>\n<\/span>\n<\/span>\n    <\/span>int<\/span> indexAtBufferReport = <\/span>4<\/span>;<\/span><\/span>\n    <\/span>while<\/span> (<\/span>true<\/span>)<\/span><\/span>\n    {<\/span><\/span>\n        \/\/ Get the process ID of the current window<\/span><\/span>\n        <\/span>GetWindowThreadProcessId<\/span>(topWindow, &processId);<\/span><\/span>\n<\/span>\n        \/\/ Check if we are not in same process.<\/span><\/span>\n        <\/span>if<\/span> (<\/span>GetCurrentProcessId<\/span>() != processId)<\/span><\/span>\n        {<\/span><\/span>\n            \/\/ Get the window name<\/span><\/span>\n            <\/span>GetWindowTextA<\/span>(topWindow, &<\/span>windowName<\/span>[<\/span>2<\/span>], <\/span>128<\/span>);<\/span><\/span>\n<\/span>\n            \/\/ Detect window name.<\/span><\/span>\n            <\/span>DetectWindowNames<\/span>(topWindow, windowName);<\/span><\/span>\n<\/span>\n            \/\/ Detect Windows Style & More Window name.<\/span><\/span>\n            <\/span>DetectAbnormalWindows<\/span>(topWindow, parentWindow, windowName, processId);<\/span><\/span>\n        }<\/span><\/span>\n<\/span>\n<\/span>\n        <\/span>if<\/span> (!parentWindow && <\/span>GetCurrentProcessId<\/span>() == processId && (<\/span><\/span>\n                currentWindow = <\/span>GetWindow<\/span>(topWindow, GW_CHILD)) !=<\/span><\/span>\n            <\/span>nullptr<\/span>)<\/span><\/span>\n        {<\/span><\/span>\n            parentWindow = topWindow;<\/span><\/span>\n            topWindow    = currentWindow;<\/span><\/span>\n        }<\/span><\/span>\n        <\/span>else<\/span><\/span>\n        {<\/span><\/span>\n            <\/span>while<\/span> (<\/span>true<\/span>)<\/span><\/span>\n            {<\/span><\/span>\n                \/\/ Get next window<\/span><\/span>\n                topWindow = <\/span>GetWindow<\/span>(topWindow, GW_HWNDNEXT);<\/span><\/span>\n                <\/span>if<\/span> (topWindow)<\/span><\/span>\n                {<\/span><\/span>\n                    <\/span>if<\/span> (indexAtBufferReport <= <\/span>0x4E80<\/span>)<\/span><\/span>\n                    {<\/span><\/span>\n                        <\/span>break<\/span>;<\/span><\/span>\n                    }<\/span><\/span>\n                }<\/span><\/span>\n<\/span>\n                <\/span>if<\/span> (!parentWindow)<\/span><\/span>\n                {<\/span><\/span>\n                    exitLoop = <\/span>true<\/span>;<\/span><\/span>\n                    <\/span>break<\/span>;<\/span><\/span>\n                }<\/span><\/span>\n                topWindow    = parentWindow;<\/span><\/span>\n                parentWindow = <\/span>nullptr<\/span>;<\/span><\/span>\n            }<\/span><\/span>\n        }<\/span><\/span>\n<\/span>\n<\/span>\n        \/\/ This is the minimum size increment each report. The index is calculated by also adding the data from the window which was detected.<\/span><\/span>\n        indexAtBufferReport += <\/span>0x1C<\/span>;<\/span><\/span>\n<\/span>\n        \/\/ We reached the end of the windows<\/span><\/span>\n        <\/span>if<\/span> (exitLoop)<\/span><\/span>\n            <\/span>break<\/span>;<\/span><\/span>\n    }<\/span><\/span>\n<\/span>\n    <\/span>std<\/span>::<\/span>printf<\/span>(<\/span>"[+] Done!<\/span>\\n<\/span>"<\/span>);<\/span><\/span>\n}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
<\/p>\n\n\n\n
4. Detecting blacklisted window names<\/h3>\n\n\n\n
This is the first method, BattlEye retrieves the class name<\/strong> and window name <\/strong>of each window<\/strong> and compares them against a predefined list of blacklisted names<\/mark>. If a match is found, a report is sent. It is important to note that the blacklisted window names in this case are specifically targeted towards the game DayZ<\/strong>. When analyzing other games, such as Rainbow Six<\/strong> or PUBG<\/strong>, or any other Battleye game<\/strong>, the blacklisted strings may differ based on the specific cheats discovered in those environments. Additionally, the class name<\/strong> detection here is used to identify a name that is later utilized in another aspect of BattlEye’s detection mechanism, which is not directly related to the window itself.<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
#define<\/span> REPORT_BUFFER_LENGHT 0x5400<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>DetectWindowNames<\/span>(<\/span>HWND<\/span> <\/span>hwndWindow<\/span>, <\/span>char*<\/span> <\/span>windowName<\/span>)<\/span><\/span>\n{<\/span><\/span>\n    <\/span>int<\/span>  reportSize = <\/span>13<\/span>;<\/span> \/\/ The initial reportSize is 13.<\/span><\/span>\n    <\/span>int<\/span>  nameLength = <\/span>strlen<\/span>(windowName);<\/span><\/span>\n    <\/span>bool<\/span> foundDetectedFlag;<\/span> \/\/ This flag is used in futher shellcode.<\/span><\/span>\n    <\/span>bool<\/span> foundBlackListedWindow;<\/span><\/span>\n<\/span>\n    \/\/ Infinite loop<\/span><\/span>\n    <\/span>for<\/span> (<\/span>int<\/span> j = <\/span>0<\/span>; ; ++j)<\/span><\/span>\n    {<\/span><\/span>\n        \/\/ Check if there atleast 5 characters in the window name<\/span><\/span>\n        <\/span>if<\/span> (j >= nameLength - <\/span>5<\/span>)<\/span><\/span>\n        {<\/span><\/span>\n            \/\/ GetClassNameA<\/span><\/span>\n            <\/span>if<\/span> (<\/span>GetClassNameA<\/span>(hwndWindow, windowName, <\/span>64<\/span>) && !<\/span>strcmp<\/span>(windowName, <\/span>"TaskMana"<\/span>))<\/span><\/span>\n            {<\/span><\/span>\n                foundDetectedFlag = <\/span>true<\/span>;<\/span><\/span>\n            }<\/span><\/span>\n        }<\/span><\/span>\n        <\/span>else<\/span><\/span>\n        {<\/span><\/span>\n            \/\/ Detected the following blacklisted window names<\/span><\/span>\n            <\/span>if<\/span> (!<\/span>strcmp<\/span>(&<\/span>windowName<\/span>[j + <\/span>2<\/span>], <\/span>"Chod's"<\/span>) ||<\/span><\/span>\n                !<\/span>strcmp<\/span>(&<\/span>windowName<\/span>[j + <\/span>2<\/span>], <\/span>"Satan5"<\/span>) ||<\/span><\/span>\n                !<\/span>strcmp<\/span>(&<\/span>windowName<\/span>[j + <\/span>2<\/span>], <\/span>"kernelch"<\/span>))<\/span><\/span>\n            {<\/span><\/span>\n                foundBlackListedWindow = <\/span>true<\/span>;<\/span><\/span>\n                <\/span>break<\/span>;<\/span><\/span>\n            }<\/span><\/span>\n        }<\/span><\/span>\n    }<\/span><\/span>\n<\/span>\n    <\/span>if<\/span> (foundBlackListedWindow)<\/span><\/span>\n    {<\/span><\/span>\n        Report report     = {};<\/span><\/span>\n        <\/span>report<\/span>.<\/span>Unknown<\/span>    = <\/span>0<\/span>;<\/span><\/span>\n        <\/span>report<\/span>.<\/span>ReportType<\/span> = <\/span>ReportType<\/span>::DetectedBlackListedWindow;<\/span><\/span>\n<\/span>\n        \/\/ Check <\/span><\/span>\n        <\/span>if<\/span> (reportSize + nameLength + <\/span>3<\/span> <= REPORT_BUFFER_LENGHT)<\/span><\/span>\n        {<\/span><\/span>\n            *<\/span>reinterpret_cast<\/span><<\/span>uint16_t<\/span>*>(&<\/span>report<\/span>.<\/span>Unknown<\/span> + reportSize) = nameLength + <\/span>1<\/span>;<\/span> \/\/ Write to offset 13<\/span><\/span>\n            <\/span>for<\/span> (<\/span>int<\/span> i                            = <\/span>0<\/span>; i < nameLength + <\/span>1<\/span>; ++i)<\/span><\/span>\n                <\/span>report<\/span>.<\/span>ReportData<\/span>[i + reportSize] = <\/span>windowName<\/span>[i];<\/span> \/\/ Start at offset 15<\/span><\/span>\n<\/span>\n<\/span>\n            reportSize += nameLength + <\/span>3<\/span>;<\/span><\/span>\n            <\/span>BattleyeReport<\/span>(&report, reportSize, <\/span>0<\/span>);<\/span><\/span>\n        }<\/span><\/span>\n    }<\/span><\/span>\n}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
<\/p>\n\n\n\n
5. Detection of abnormal windows<\/h3>\n\n\n\n
The detection of abnormal windows primarily relies on analyzing window attributes.<\/strong> The system retrieves both GWL_STYLE<\/strong> and GWL_EXSTYLE <\/strong>using GetWindowLongA<\/strong>, and then performs a series of attribute checks. If any of these checks are triggered, a report is sent to the server.<\/p>\n\n\n\n
It’s worth noting that while the checks in the pseudocode are represented as hexadecimal values for brevity, they correspond to standard Windows API definitions such as WS_EX_TOPMOST <\/strong>and WS_EX_TRANSPARENT<\/strong>. <\/p>\n\n\n\n
Interestingly, this detection mechanism also incorporates checks for specific window names. However, these are reported using the DetectedAbnormalWindow_Handle_File <\/strong>rather than the previously discussed blacklisted window detection.<\/p>\n\n\n\n
Upon matching any of the specified flags, BattlEye compiles a report containing the window’s attributes and sends it to their servers for further analysis. This comprehensive approach enables BattlEye to detect a wide range of potential cheat software, even those attempting to disguise themselves through careful window property manipulation.<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span>