gmh5225/bedaisy-bypassKernel-mode hook that intercepts, decrypts, and nullifies BEDaisy-to-service report traffic to suppress anti-cheat detection on UEFI and non-UEFI systems.
bedaisy-bypass is a kernel driver designed to bypass reports sent from BEDaisy.sys to BEService.exe. For users not on a UEFI, the project utilizes Infinity Hook. The driver intercepts data communicated through the named pipe between the two services. On receiving a request, the driver inspects the type of request, decrypts the returned data, and processes it accordingly. Due to the absence of expected data in the report buffers (as opposed to the main usermode shellcode), this mechanism can be exploited to decrypt, nullify, and then re-encrypt data. This ensures that no reports are sent back to the service, while still allowing for a response to be transmitted.
main.cpp as per the provided instructions.KiSystemServiceCopyEnd). If so, you should be familiar with the subsequent steps.This project employs FindWDK for cmake, available at this repository.