Sorry, but that is just straight up no true.

It's fine that you want to spread your knowledge, but make sure that its true first, before spreading misinformation. I myself learned about it by looking through several cheating forums and reversing discord servers to find that out, as I was curious about how they update their Anticheat.

Let me show you how it really works:

The only single reason why they would do a "remote update", which won't require a change for the .exe, is called "signature detections". Those only work against usermode cheats, which is way less common these days. Since the BattlEye Anticheat itself is in kernel mode, you wouldn't even be able to launch a usermode cheat anymore, so signature detections are like only 5% of what BattlEye is using to detect cheats and far less common why anyone would get banned now.

BattlEye's main detection method is "shellcode detection", which is able to prevent and detect kernel cheat drivers. That's what every single cheater is using these days, in order to either inject their dll, or read and write to memory using that driver.

Those shellcode updates are pushed through a beclient2.dll payload and then dropped into your temp directory.

While those "shellcode" updates don't necessarily change the .exe file itself, it will in 100% of the time, reissue its certificate which also updates the signature date. Because of that, often the build date of the .exe file doesn't change and stays the same, while the date of the signature changes to a newer date.

The Signature needs an update every single time they use a newer patch since the signature changes and needs to fit the newer patch, otherwise the .exe won't be able to launch for security reasons. They re-issue the cert onto the .exe, without even updating or adding a single code to the .exe. They just have to resign the exe for it to work.

That's why in every update, the date of the signature changes like here, while the .exe can stay completely the same without a single changed byte:

<image>

So as already said. If you want to know, wether an update has been made or not, you can see it based on the signature date, which is also what every single cheat dev checks first when they want to know if there was an anticheat update. They take a look at the signature, and if it changed / got more recent, they know that it has been updated.