Besides the client dlls, the Windows version of PunkBuster consists of system services and a kernel driver.

C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\drivers\PnkBstrK.sys

For further information see: here. You can verify the functioning of the services with this tool from EvenBalance: here

Test with GUI:

$ wine pbsvc.exe­

Silent (unattended) installation of services without GUI:

$ wine pbsvc.exe /i --no-display --i-accept-the-pb-eula­

EvenBalance instructs the PB client to carry out several integrity checks.
One of those checks determines if certain components of the operating system have been modified in memory - so called API fingerprinting.

Third party software and hacks modify parts of operating system in memory for their own reasoning.
To detect this modifications, Punkbuster takes fingerprints from operating system API entry code.
A number of system libraries (dlls) and their respective API are verified.

Each fingerprint is compared with a list of signatures on PB server.
If the fingerprint does not match, a kick is issued for the player along with the following infamous message:

"UNKNOWN WINDOWS API FUNCTION [131xxx]"

Depending on PB server/client versions and game, this specific check might be executed immediately upon join or several minutes thereafter.
There have been rare occurrences where this specific check was never executed thus letting the player remain on server without being kicked.

Because of this specific API integrity check, PunkBuster will not work with wine in most PB-enabled multiplayer games.

The API entry code generated by (wine)gcc compiler differs from Windows, resulting in signature mismatches.
There is no way to mimick/generate all the required API entry code to keep the signature check succeeding due to technical limitations and legal reasons.

Technically there are ways (client hacks) to circumvent those checks even in Wine - but this is out of the scope of Wine. Such manipulations defeat the purpose of PunkBuster.

Following is a small part of my own list of most common [131xxx] kick id's (EvenBalance considers them a hook target by hacks).
The complete API fingerprinting list is larger and extended by EvenBalance from time to time.

Kick #	Library	API (signature fail)
131124	kernel32.dll	IsBadReadPtr
131125	user32.dll	CreateWindowExA
131126	user32.dll	GetForegroundWindow
131131	kernel32.dll	GetTickCount
131133	d3d9.dll	Direct3DCreate9
131134	kernel32.dll	DeviceIoControl
131136	ddraw.dll	DirectDrawCreate
131932	kernel32.dll	VirtualQuery

­Bug 16946­ was fixed by commit 540fe928424063b930c6076758822b382e734ad7­. Upgrade your Wine version to >= 1.1.14

The following message in console while running the pbsvc test tool can be safely ignored:

err:ole:CoGetClassObject class {304ce942-6e39-40d8-943a-b913c40c9cd4} not registered
err:ole:CoGetClassObject no class object {304ce942-6e39-40d8-943a-b913c40c9cd4} could be created for context 0x1­

The missing interface doesn't prevent the application from functioning.

The application is querying the Windows firewall manager (CSLID_NetFwMgr). Many internet applications use Windows Firewall NetFwMgr to programmatically add themselves to the list of authorized applications and register incoming ports.

You can show PunkBuster server messages in-game and log them to a file. To do that, create a file named "pbcl.cfg" in the "pb" folder of the game. Put the following in the "pbcl.cfg" file:

pb_msgprefix "PunkBuster Client"
pb_sleep 60
pb_logtofile 1
­pb_sslog 1
pb_sssave 1­­

­This will print PB messages to your on screen console area, so kicks can be easily seen instead of being hidden in the pull-down console. You can disable the screenshot notifications with the pb_sslog setting, if you receive to much messages on large servers.

PB_MsgPrefix [New Prefix]
Holds the text that PunkBuster displays in front of every output line displayed; the default is "[skipnotify]PunkBuster Client".

PB_LogToFile [0=no, 1=yes]
When set to 1, PunkBuster will log activity to the pbcl.log file; the default is 0 which means only errors are logged.

PB_Sleep [Period]
Holds the period of time (milliseconds) that PunkBuster "sleeps" between processing cycles; the default is 60; lower numbers will cause PunkBuster to process events more times each second which also has the effect of increasing the bandwidth used by PunkBuster; Players with a modem connection will probably want to set this as high as possible.

PB_SsLog [0=no, 1=yes]
When set to 1 (which is the default), PunkBuster will create an entry in the pbsslog.htm log file every time a PunkBuster Server requests a screenshot to be taken and delivered; this log file is designed to be viewed with a web browser and contains information about the size of the image, when it was taken, and also a digital signature of the image itself.

PB_SsSave [0=no, 1=yes]
When set to 1 (0 is the default), PunkBuster will save all Server-requested Screenshots to the local hard drive so that Players can see the actual screenshots that have been delivered to Game Servers that they were connected to; if this setting and the PB_SsLog setting are both set to 1, then the pbsslog.htm log file will automatically have links created for local viewing directly from the log file.

Automatic in-game update of PB client files doesn't always work correctly. To work around that, update the PB files manually with "PBSetup" tool provided by EvenBalance.

Visit EvenBalance homepage for instructions. Download the Windows version of the updater and run it for the PB-enabled games you have installed.