Guide DayZ SA — Automated BattlEye Skip Patcher for Server_x64

[byte_corvus]

If you are running a custom environment or just tired of BattlEye baggage on your local DayZ server builds, this automated PowerShell patcher is what you need. It handles the tedious task of hunting for the LEA references and conditional jumps that trigger the BE initialization.

How it works:
The script parses the PE headers of DayZServer_x64.exe, identifies the code sections, and scans for instructions that reference the BattlEye strings. Once found, it backtracks to find the nearest branch (JZ/JNZ) and nukes it with either a JMP or NOPs depending on the logic flow. This is a much cleaner approach than static hex editing because it attempts to resolve RVAs dynamically.

Instructions:

1. Target your DayZServer_x64.exe file.
2. Ensure you keep the BattleEye folder but delete all files inside it.
3. Run the PowerShell script below to apply the patch.

$exePath = "DayZServer_x64.exe"
$backupPath = "DayZServer_x64.exe.bak"

Write-Host "=== DayZ BattlEye Skip Patcher ==="
$bytes = [System.IO.File]::ReadAllBytes($exePath)

$peOff = [BitConverter]::ToInt32($bytes, 0x3C)
$numSections = [BitConverter]::ToInt16($bytes, $peOff + 6)
$optSize = [BitConverter]::ToInt16($bytes, $peOff + 0x14)
$secStart = $peOff + 0x18 + $optSize

$sections = @()
for ($s = 0; $s -lt $numSections; $s++) {
    $off = $secStart + ($s * 40)
    $n = [System.Text.Encoding]::ASCII.GetString($bytes, $off, 8).TrimEnd("`0")
    $va = [BitConverter]::ToInt32($bytes, $off + 12)
    $rawSize = [BitConverter]::ToInt32($bytes, $off + 16)
    $rawAddr = [BitConverter]::ToInt32($bytes, $off + 20)
    $sections += @{ Name=$n; VA=$va; Raw=$rawAddr; RawSize=$rawSize }
}

$stringFileOff = 0xC34B38
$stringRVA = 0
foreach ($sec in $sections) {
    if ($stringFileOff -ge $sec.Raw -and $stringFileOff -lt ($sec.Raw + $sec.RawSize)) {
        $stringRVA = $stringFileOff - $sec.Raw + $sec.VA
        break
    }
}

$textSec = $sections | Where-Object { $_.Name -eq ".text" }
$textStart = $textSec.Raw
$textSize = $textSec.RawSize
$foundRefs = @()

for ($i = $textStart; $i -lt ($textStart + $textSize - 10); $i++) {
    if (($bytes[$i] -eq 0x48 -or $bytes[$i] -eq 0x4C) -and $bytes[$i+1] -eq 0x8D) {
        $modrm = $bytes[$i+2]
        if (($modrm -band 0xC7) -eq 0x05) {
            $disp = [BitConverter]::ToInt32($bytes, $i + 3)
            $instrRVA = $i - $textSec.Raw + $textSec.VA
            if (($instrRVA + 7 + $disp) -eq $stringRVA) { $foundRefs += $i }
        }
    }
}

if ($foundRefs.Count -eq 0) { Write-Host "No refs found!"; exit }
$ref = $foundRefs[0]
$patchOffset = -1

for ($k = $ref - 1; $k -ge ($ref - 0x40); $k--) {
    if ($bytes[$k] -eq 0x84 -and $bytes[$k+1] -eq 0xC0) {
        if ($bytes[$k+2] -eq 0x75) { $bytes[$k+2] = 0xEB; $patchOffset = $k+2; break }
        if ($bytes[$k+2] -eq 0x74) { $bytes[$k+2] = 0x90; $bytes[$k+3] = 0x90; $patchOffset = $k+2; break }
    }
}

[System.IO.File]::WriteAllBytes($exePath, $bytes)
Write-Host "Patch applied to offset $patchOffset"

Spoiler: Technical Notes

This script specifically targets the server binary. If the offset 0xC34B38 changes in a future update, you'll need to re-dump the strings and update the $stringFileOff variable. The logic assumes a standard x64 instruction set for the LEA operations within the .text section. Always keep a backup before running any hex-modifying scripts on your binaries.

Anyone tested this on the latest experimental build yet?