aowlspt_beclient.h

Source: abi/aowlspt_beclient.h — 137 lines, 2 file-scope functions.

What this header owns

Reproduced verbatim from the header's own banner comment — these notes are frequently the only written record of why the subsystem is shaped the way it is.

 aowlspt_beclient.h -- neuter the post-1.0 BattlEye anti-cheat validation gate.

Once the menu is up the client runs `EFT.AnticheatValidationOperation.
RunValidation`, which (a) calls `BattlEye.BEClient.IsInstanceSuccessfully`
and errors if it is false, and (b) fails if the BE client calls the game's
RequestRestart callback within its ten-frame probe. Running the raw
`EscapeFromTarkov.exe` with an injected DLL -- rather than the BE-wrapped
`EscapeFromTarkov_BE.exe` -- fails both, and the client shows "Anticheat
loading failed. Game restart required" and quits.

This is NOT the service-status check `aowlspt_beguard.h` already answers (that
one is a WinAPI IAT patch on UnityPlayer); this is the managed BE *client*
gate inside `GameAssembly.dll`. It is defeated with two byte patches to the
IL2CPP AOT code -- static `.text`-class patches, not runtime method-pointer
detours (which crash this client from the host thread):

  1. `BattlEye.BEClient.IsInstanceSuccessfully` @ RVA 0x6699C0: overwrite the
     prologue with `mov al,1 ; ret` (B0 01 C3) so it always returns true and
     `BEClient.Start` reports no error. The native BE never actually inits, so
     its `Run`/`Update` forwarders stay self-gated (status != 2) and inert.
  2. `EFT.AnticheatValidationOperation.OnRequestRestart` @ RVA 0x9E9E62 is
     `mov byte [rsp+0x30], 1` (C6 44 24 30 01) -- the "a restart was asked
     for" flag. Flip the immediate 01 -> 00 (byte at RVA 0x9E9E66) so a
     restart request never marks the operation failed.

RVAs are for imagebase 0x180000000 and this exact client build
(1.1.0.1.46777); resolved from the decrypted metadata's per-module
methodPointers and verified byte-for-byte against GameAssembly.dll. Each
patch checks the bytes it expects before writing, so a wrong offset is a
skipped patch rather than corrupted code. Apply after GameAssembly.dll is
mapped (i.e. after il2cpp is up) and before the menu reaches online play.

Constants

• AOWLSPT_BECLIENT_H
• AOWL_BEC_ISINST_RVA
• AOWL_BEC_RESTART_RVA
• AOWL_BEC_RUN_RVA
• AOWL_BEC_STOP_RVA
• AOWL_BEC_UPDATE_RVA

Functions

Signature	Line
int aowl_bec_write(unsigned char* at, const unsigned char* bytes, int n)	64
int32_t aowl_beclient_neuter(void)	76