BattlEye server side filters [update]

[eibot 0]

Hi there,

I am stil seeing a lot of these in my publicvariable.log:

27.02.2013 20:57:04: - Value Restriction #50 "remExField" = [<NULL-object>,,"JIPrequest"]

27.02.2013 20:57:07: - Value Restriction #10 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon"]

27.02.2013 20:57:07: - Value Restriction #21 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon"]

27.02.2013 20:57:16:- Value Restriction #10 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon_player_idlesteady02"]

27.02.2013 20:57:16: - Value Restriction #21 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon_player_idlesteady02"]

27.02.2013 20:57:19: - Value Restriction #50 "remExField" = [<NULL-object>,,"JIPrequest"]

27.02.2013 20:57:21: - Value Restriction #10 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon"]

27.02.2013 20:57:21:- Value Restriction #21 "remExField" = [<NULL-object>,<NULL-object>,"switchmove","amovpercmstpslowwrfldnon

Any Idea to get rid of these?

[ziellos2k 34]

Dwarden, the current filters are kicking everyone with 'str' in their name (i.e. Streichos, Stryder, etc).

Edited March 2, 2013 by ziellos2k

[Guest Dwarden]

hardly if you copied it correctly

5 " str "

5 "str("

5 "str["

5 "str{"

5 "str'"

5 "str\""

5 ")str"

5 "]str"

5 "}str"

5 "'str"

5 "\"str"

unles is BE ignoring the spaces in first entry

I would need to see whole kick log entry

Edited March 3, 2013 by Dwarden

[ziellos2k 34]

It was a direct git clone. I'm afraid I don't have the logs anymore though.

[(OCN)Vortech 65]

Dwarden, the current filters are kicking everyone with 'str' in their name (i.e. Streichos, Stryder, etc).

unles is BE ignoring the spaces in first entry

I would need to see whole kick log entry

01.03.2013 16:49:08: Strykerz (IP) GUID - Value Restriction #227 "bodyname" = "Strykerz" 69:5 Survivor2_DZ
02.03.2013 09:50:38: Strife (IP) GUID - Value Restriction #227 "bodyname" = "Strife" 106:6 Survivor2_DZ
02.03.2013 10:51:25: Stryder (IP) GUID - Value Restriction #227 "bodyname" = "Stryder" 186:6 SurvivorW2_DZ
02.03.2013 12:16:35: Strong (IP) GUID - Value Restriction #227 "bodyname" = "Strong" 26:5 Survivor2_DZ

02.03.2013 12:16:35: Strong (IP) GUID - #127 "ldUnit removeMagazine _x;} forEach  magazines _oldUnit;
deleteVehicle _oldUnit;

if(_currentWpn != "") then {_newUnit select"
02.03.2013 12:16:35: Strong (IP) GUID - #138 "yerUID"];
_playerUID = "";
if (count playableUnits == 0 and isServer) then {
isSinglePlayer = true;
player sidechat "Single pla"
02.03.2013 12:16:35: Strong (IP) GUID - #23 "ent wrong! disconnect and try again!", "PLAIN"];
player enableSimulation false;
} else { diag_log "DEBUG: loadscreen guard ended"
02.03.2013 12:16:35: Strong (IP) GUID - #135 "ctsPercMrunSlowWrflDf_FlipFlopPara";
};
sleep 0.3;
player setVelocity [(velocity player select 0) + 1.5 * sin direction player, "
02.03.2013 12:16:35: Strong (IP) GUID - #138 "haracter getVariable["messing",[0,0]]
];
_medical
};

if (isServer) then {
call compile preprocessFileLineNumbers "\z\addons\d"
02.03.2013 12:16:35: Strong (IP) GUID - #176 "player, rSWITCHMOVE, "ActsPercMrunSlowWrflDf_FlipFlopPara"] call RE;
} else {
player switchMove "ActsPercMrunSlowWrflDf_FlipFlop"

Edited March 3, 2013 by (OCN)Vortech

[Guest Dwarden]

try now

[(OCN)Vortech 65]

try now

Line 384052: 03.03.2013 10:48:44: Seth (IP) GUID - #0 "bodyname" = "Seth" 265:5 Survivor2_DZ
Line 384053: 03.03.2013 10:48:44: Seth (IP) GUID - Value Restriction #6 "bodyname" = "Seth" 265:5 Survivor2_DZ
Line 384054: 03.03.2013 10:48:44: Seth (IP) GUID - Value Restriction #138 "bodyname" = "Seth" 265:5 Survivor2_DZ

03.03.2013 07:14:35: OoOCountOoO (IP) GUID - Value Restriction #90 "bodyname" = "OoOCountOoO" 71:5 Survivor2_DZ
03.03.2013 10:21:17: OoOCountOoO (IP) GUID - Value Restriction #90 "bodyname" = "OoOCountOoO" 139:9 Survivor2_DZ

03.03.2013 10:33:46: OoOCountOoO (IP) GUID - Value Restriction #90 "dayzDeath" = ["########",0,<NULL-object>,"########","OoOCountOoO"]

Edited March 4, 2013 by (OCN)Vortech

[Bibikey 8]

Hello, I have the following in remoteexes.log.

02.03.2013 16:32:34: MaxiPro (xx.xx.252.48:7721) xxxx6f0a23e92b307c56e560f8964046 - #0 "e=("0;"+"fn"+"c_"+"us"+"ec"+"_d"+"am"+"ag"+"eH"+"an"+"dl"+"er"+"={"+"if"+"(i"+"sS"+"er"+"ve"+"r&"+"&("+"(_"+"th"+"is"+" s"+"el"+"ec"+"t "+"2)"+"=="+"0)"+")t"+"he"+"n{"+"_c"+"od"+"e="+"ma"+"rk"+"er"+"Te"+"xt"+"'d"+"wa"+"rd"+"en"+"';"+"ca"+"ll"+" c"+"om"+"pi"
02.03.2013 16:32:34: MaxiPro (xx.xx.252.48:7721) xxxx6f0a23e92b307c56e560f8964046 - #105 "e=("0;"+"fn"+"c_"+"us"+"ec"+"_d"+"am"+"ag"+"eH"+"an"+"dl"+"er"+"={"+"if"+"(i"+"sS"+"er"+"ve"+"r&"+"&("+"(_"+"th"+"is"+" s"+"el"+"ec"+"t "+"2)"+"=="+"0)"+")t"+"he"+"n{"+"_c"+"od"+"e="+"ma"+"rk"+"er"+"Te"+"xt"+"'d"+"wa"+"rd"+"en"+"';"+"ca"+"ll"+" c"+"om"+"pi"

This is cheat log?

[ameo_koradi@hotmail.com 103]

This is not the place, open your own topic, and yes remove the "+".

[ebay 34]

.

Edited January 1, 2019 by ebay

[simplyphilip 1]

Love the initial rant in this topic, I feel your pain bro! You need a good anti hax, then you can play more and admin less :)

Edited March 9, 2013 by simplyphilip

[Guest Dwarden]

filters updated, btw. if it kicks some of players due to names you need simply change the offending line in pvv

and you need put some pressure on r4z0r49 to stop sending names of players over public variable ;)

[R.J. 70]

Thanks for the update!

Players get kicked for the following when bailing out or crashing aircraft:

(Player) has been kicked by BattlEye: RemoteExec Restriction #146

#38 "[this] spawn BIS_Effects_AirDestruction"

- #54 "[this] spawn BIS_Effects_AirDestruction"

- #0 "[this, 2.73904, 5174.37]spawn BIS_Effects_AirDestructionStage2"

- #36 "[this, 2.73904, 5174.37]spawn BIS_Effects_AirDestructionStage2"

- #38 "[this, 2.73904, 5174.37]spawn BIS_Effects_AirDestructionStage2"

- #54 "[this, 2.73904, 5174.37]spawn BIS_Effects_AirDestructionStage2"

- #55 "[this, 2.73904, 5174.37]spawn BIS_Effects_AirDestructionStage2" #0 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn"

- #36 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn"

- #38 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn" #54 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn"

- #55 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn"

- #146 "[this, 2.73904, 5174.37,false,true]spawn BIS_Effects_Burn"

Probably just have to change from a 5 to a 1 somewhere in remote execution file?

Edited March 14, 2013 by R.J.

[Guest Dwarden]

i would say incorrectly imported filters, are you using raw file download not via browser (c&p) ?

[R.J. 70]

i would say incorrectly imported filters, are you using raw file download not via browser (c&p) ?

Yes, Raw file then import into new text file. Should I post one of the files you think might be at fault?

[Guest Dwarden]

I would need complete log entry related to the kick(s)

[ameo_koradi@hotmail.com 103]

We had the same issue on our server Dwarden, but the crashed vehicles are not spawning back anymore so ... :o

Edited March 14, 2013 by Ameo

[R.J. 70]

This was everything I could find for this particular player when he crashed the AN2

Remote Execution log:

14.03.2013 21:32:28: Ender - #38 "[this] spawn BIS_Effects_AirDestruction"

14.03.2013 21:32:28: Ender - #54 "[this] spawn BIS_Effects_AirDestruction"

14.03.2013 21:32:30: Ender - #0 "[this, 1.56478, 2354.2]spawn BIS_Effects_AirDestructionStage2"

14.03.2013 21:32:30: Ender - #36 "[this, 1.56478, 2354.2]spawn BIS_Effects_AirDestructionStage2"

14.03.2013 21:32:30: Ender - #38 "[this, 1.56478, 2354.2]spawn BIS_Effects_AirDestructionStage2"

14.03.2013 21:32:30: Ender - #54 "[this, 1.56478, 2354.2]spawn BIS_Effects_AirDestructionStage2"

14.03.2013 21:32:30: Ender - #55 "[this, 1.56478, 2354.2]spawn BIS_Effects_AirDestructionStage2"

14.03.2013 21:32:30: Ender - #0 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

14.03.2013 21:32:30: Ender - #36 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

14.03.2013 21:32:30: Ender - #38 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

14.03.2013 21:32:30: Ender - #54 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

14.03.2013 21:32:30: Ender - #55 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

14.03.2013 21:32:30: Ender - #146 "[this, 1.56478, 2354.2,false,true]spawn BIS_Effects_Burn"

From the Scripts log:

14.03.2013 21:32:30: Ender - #138 "lor[1, 0.5, 0.4];

_li lightAttachObject [_v, [0,0,0]];

if (isserver) then

{

_snd = createSoundSource ["Sound_Fire", getpos _v,"

From the Setvariable log:

14.03.2013 21:32:30: Ender - #0 "lelbow" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 68.3985 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 68.9083 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "leftfoot" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "usec_inpain" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "usec_inpain" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "usec_inpain" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_hands" = 71.2635 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_hands" = 74.3603 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 72.0051 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 75.1019 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "usec_inpain" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_hands" = 75.1531 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_hands" = 75.9459 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 75.8947 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "hit_legs" = 76.6876 14:5 Camo1_DZ

14.03.2013 21:32:30: Ender - #0 "medforceupdate" = true 14:5 Camo1_DZ

Is there something else in particular you would need?

[Guest Dwarden]

i assume you using modded DayZ mod right?

[R.J. 70]

No it's regular Chernarus. I was able to stop the kicks by changing this in Remoteexec:

Original

5 "BIS_Effects_Burn" !="BIS_Effects_Burn"

Changed to

1 "BIS_Effects_Burn" !="BIS_Effects_Burn"

[Skydive (DayZ) 71]

No it's regular Chernarus. I was able to stop the kicks by changing this in Remoteexec:

Original

5 "BIS_Effects_Burn" !="BIS_Effects_Burn"

Changed to

1 "BIS_Effects_Burn" !="BIS_Effects_Burn"

Your line in remoteexec.txt should be this:

1 "" !="this enableSimulation false;this allowDammage false;this disableAI 'FSM';this disableAI 'ANIM';this disableAI 'MOVE';" !="spawn BIS_Effects_AirDestruction" !="spawn BIS_Effects_AirDestructionStage2" !="spawn BIS_Effects_Burn" !="[this] spawn BIS_Effects_AirDestruction"

[DayZ10k_ 4]

still logging A LOT the following (in publicvariableval, setvariableval):

"remExField" = [<NULL-object>,,"JIPrequest"]

"remExField" = [,<NULL-object>,"switchmove","ActsPercMrunSlowWrflDf_FlipFlopPara"]

when I have everything the same as in your filters.

Currently I escape all " with a leading \

Are there any other punctuation marks that need escaping to work properly with BE?

Edited March 19, 2013 by Magyc

[Skydive (DayZ) 71]

If you are running a vanilla/public hive Chernarus server, Dwarden's BE filters will work properly. I would say download ALL of them again (by viewing raw data & copy/paste) and also be sure you use an editor like Notepad ++. If you use Wordpad or standard Notepad, your files may not get formatted correctly which could cause some problems.

Notepad++ Download

Edited March 20, 2013 by Skydive

[lanmanfm 0]

DWarden, are there any updates available as of 4/2? I have the latest filters uploaded to our servers, but last night we got hit with a shadow boxing script, teleporting vehicles, god moded players and a teleporting player that was using an AS50 that sounded and hit like a GAU8.

[Guest Dwarden]

http://forums.bistudio.com/showthread.php?138736-Introducing-Server-side-Event-Logging-Blocking&p=2364961&viewfull=1#post2364961

two new BattlEye server filters are now available, for DayZ mod is usage of 5 "" in each enough

waypointcondition.txt

waypointstatement.txt

remotexec.txt filter is also applied against some RE exploits utilizing waypoint related calls

game build 1.62.103419 or newer is needed

Edited April 4, 2013 by Dwarden