BattlEye Server Filters for DayZ Mod 1.8.4

[facoptere 180]

Edit: After server restart we have the exact same problem. What should I do ? I temporarily disable the setVehicleInit kick.

Could you check that the code above is in init.sqf from your mission file?

Then start your server with a password, and log in alone. Are you kicked because setvehiceinit?

[DJ_Teschmi 31]

Hi Faco,

I'll reply because Ameo is not available for the moment.

"BIS" message disappeared after our reboot at 11H this morning, that's good, but it means that there was another invisible hack last night ...

With the new script.txt filter we shouldn't see anything in the script.log under normal conditions, that's right?

Here my script.log after 3 hours with the new filter and few players:

25.06.2013 04:44:56: Oalik1979 (IP_removed) Guid_Removed - #138 "_id = 'MeleeHatchet' spawn player_dropWeapon;;"
25.06.2013 04:44:56: Oalik1979 (IP_removed) Guid_Removed - #138 "#line 1 "z\addons\dayz_code\actions\player_dropWeapon.sqf"
private["_item","_config","_onLadder","_consume","_meleeNum","_bag",""
25.06.2013 04:44:56: Oalik1979 (IP_removed) Guid_Removed - #146 "] + getArray (_config >> "magazines")) select 0;
player removeMagazines _consume;

player removeWeapon _item;

if (_droppedtype "
25.06.2013 04:44:56: Oalik1979 (IP_removed) Guid_Removed - #148 "nes")) select 0;
player removeMagazines _consume;

player removeWeapon _item;

if (_droppedtype == "") then { _item = _this; } e"

Thanks for your help

Edited June 25, 2013 by DJ_Teschmi

[facoptere 180]

Hi Faco,

I'll reply because Ameo is not available for the moment.

"BIS" message disappeared after our reboot at 11H this morning, that's good, but it means that there was another invisible hack last night ...

With the new script.txt filter we shouldn't see anything in the script.log under normal conditions, that's right?

Few pieces of code are still logged in scripts.log, since all commands have not been reviewed (for example here removeMagazine removeWeapon). So don't ban for everything in this file.

I log also intentionally players who drop weapons, players who trigger explosion.

There are at least 2 other hacks that reset BIS libs.

I have a mission file that fix all this, and I don't have any attacks since even I am not sure it's related. It's on test for now.

The best is to restart the server for now.

[DJ_Teschmi 31]

Few pieces of code are still logged in scripts.log, since all commands have not been reviewed (for example here removeMagazine removeWeapon). So don't ban for everything in this file.

I log also intentionally players who drop weapons, players who trigger explosion.

There are at least 2 other hacks that reset BIS libs.

I have a mission file that fix all this, and I don't have any attacks since even I am not sure it's related. It's on test for now.

The best is to restart the server for now.

Thanks for the explanation.

----------------------------------------

Another idea i want to share with you, on our server we changed a little bit the createvehicle.txt filter to monitor some things in the log.

We are now logging "Pipebomb", "Sandbag", "HedgeHog" and "WireCat" to avoid any abuse or malicious things.

What do you think about generalize that?

Thanks

Edited June 25, 2013 by DJ_Teschmi

[polli 57]

If I´m right, I could ban the Player oi but speenkiller is just having a helicrash or similar. Am I right?

25.06.2013 18:02:29: oi (IP) UID - #216 "CMD_NEXT_WAYPOINT"
25.06.2013 18:02:29: oi (IP) UID - #108 "CMD_JOIN"
25.06.2013 18:02:29: oi (IP) UID - #67 " (IsLeader * (1 - CursorOnGroupMember))"
25.06.2013 18:02:29: oi (IP) UID - #108 "CMD_JOIN_AUTO"
25.06.2013 18:02:29: oi (IP) UID - #67 "IsLeader * CursorOnGroupMember * (CursorOnNotEmptySubgroups)"
25.06.2013 18:02:29: oi (IP) UID - #67 "IsLeader * CursorOnGroupMember * (1 - CursorOnNotEmptySubgroups)"
25.06.2013 18:02:29: oi (IP) UID - #67 "(IsLeader * (1 - CursorOnGroupMember))"
25.06.2013 18:02:29: oi (IP) UID - #67 "IsLeader * CursorOnGroupMember * CursorOnHoldingFire"
25.06.2013 18:02:29: oi (IP) UID - #67 "IsLeader * CursorOnGroupMember * (1 - CursorOnHoldingFire)"
25.06.2013 18:02:29: oi (IP) UID - #68 "(IsLeader * (1 - CursorOnGroupMember) * (1 - CursorOnGroupMemberSelected))"
25.06.2013 18:02:29: oi (IP) UID - #67 "IsLeader * CursorOnGroupMember * (1 - IsSelectedToAdd)"
25.06.2013 18:02:29: oi (IP) UID - #68 "IsLeader * CursorOnGroupMember * (1 - CursorOnGroupMemberSelected) * IsSelectedToAdd"
25.06.2013 18:02:29: oi (IP) UID - #68 "IsLeader * (CursorOnGroupMemberSelected) * IsSelectedToAdd"
25.06.2013 18:25:59: Speenkiller (IP) UID - #24 "_this call BIS_Effects_EH_Killed;"
25.06.2013 18:25:59: Speenkiller (IP) UID - #27 "indof "plane")
then
{


["AirDestruction", _v] call BIS_Effects_globalEvent;
};
if (_v iskindof "tank")
then
{
_int = (fuel _v)*"
25.06.2013 18:25:59: Speenkiller (IP) UID - #51 "ASL _v) select 2) < 0)) exitwith {};
_b="SmallSecondary" createvehicle (_v modelToWorld _effect2pos);
} foreach (_list);"

Any suggestions?

[facoptere 180]

The first lines with isleader and CMD: I don't know what is it, and why it happens for few players and not others. So these logs are not filtered.

The lines with AirDestruction and SmallSecondary are linked to a vehicle so damaged that it explodes. Not only helicopters. I was driving a tractor yesterday, it was in a bad shape, I bumped to a wall and it exploded. The same lines appeared. By default I don't consider these lines as cheats.

[polli 57]

The first lines with isleader and CMD: I don't know what is it, and why it happens for few players and not others. So these logs are not filtered.

The lines with AirDestruction and SmallSecondary are linked to a vehicle so damaged that it explodes. Not only helicopters. I was driving a tractor yesterday, it was in a bad shape, I bumped to a wall and it exploded. The same lines appeared. By default I don't consider these lines as cheats.

Thanks faco.

Was just confused about the first player. Never seen that before. If you or someone from BIS can look into it why this happens, would be fine. Just to get sure that it is a legit entry.

The second player has just the new filtered explosions for my opinion. Would only get sure about this.

[d-foster@hotmail.com 0]

June 25, 2013 Still getting Public variable Value Restriction #150 and #10 then KICKED when 2 people try to bloodbag each other. I'm using the latest BE filters every day there are updated filters. no one can seem to help and Support just says to download latest filters. Running Dayz Official server 1.7.7.1, all updates are installed. Here is the log. Value Restriction #10 "remExField" = [<NULL-object>,<NULL-object>,"loc","titleText","Transfusion in progress, remain still...","PLAIN DOWN"]

Value Restriction #150 "remExField" = [<NULL-object>,<NULL-object>,"loc","titleText","Transfusion in progress, remain still...","PLAIN DOWN"]

[facoptere 180]

June 25, 2013 Still getting Public variable Value Restriction #150 and #10 then KICKED when 2 people try to bloodbag each other. I'm using the latest BE filters every day there are updated filters.

You are not using latest BE filters. #10 and #150 correspond to TitleText and are properly addressed.

Download latest filters here https://github.com/DayZMod/Battleye-Filters/archive/Release_1.7.7.1.zip

[d-foster@hotmail.com 0]

You are not using latest BE filters. #10 and #150 correspond to TitleText and are properly addressed.

Download latest filters here https://github.com/D...ase_1.7.7.1.zip

[d-foster@hotmail.com 0]

I have been using the filters from the Github site. But will try again using the link you provided above for me.. installed up and running. will check logs when i get home from work to see what happens. Will post results when i can. Thank You

[TWMN 0]

Facopter Hello, first of all sorry for my English.

I touch you because I have a prblème on my server with restricition # 204, which takes place after a death or a return to the lobby, let me explain.

the player plays, he is killed by another player, "you are dead".

therefore it is "abandon" => "logout" => it comes to the lobby => it reconnects => and there is restriction to kick # 204. :(

you have an idea about the problem?

I use the PBO and BattlEye 1.7.7.1

Thank you for your response. :)

[facoptere 180]

the player plays, he is killed by another player, "you are dead".

therefore it is "abandon" => "logout" => it comes to the lobby => it reconnects => and there is restriction to kick # 204. :(

I need more information. What is printed on before "restriction"? script? remoteexec?

Then I need the log line in the corresponding log file

For a "setVehicleInit" related problem (which correspond to script restriction #204), you have to restart your server since it's a persistent hack on the serverside.

[d-foster@hotmail.com 0]

Issue resolved. It wasn't the BE filters at all. When i updated to 1.7.7.1 my server was supposed to replace mission and server files but for some reason it did not. after installing the Latest Files manually the server is running properly. Thanks for all who helped.

[-Se7eN- 874]

Hello all.

i recently made a thread regarding this and was sent here, as far as im aware Backpackcargo restriction #12 is still an issue for some server hosters, not only does it kick for a silly reason but opens up a duplication exploit.

Admins fix to the bacpackcargo restriction:

in "backpackcargo.txt" change line 13 from "5 DZ_" to "1 DZ_" (without quoatation)

this will still log the action in question but wont kick people for putting a backpack in storage.

Edited June 27, 2013 by TMW Se7eN

[facoptere 180]

Hello all.

i recently made a thread regarding this and was sent here, as far as im aware Backpackcargo restriction #12 is still an issue for some server hosters, not only does it kick for a silly reason but opens up a duplication exploit.

Admins fix to the bacpackcargo restriction:

in "backpackcargo.txt" change line 13 from "5 DZ_" to "1 DZ_" (without quoatation)

this will still log the action in question but wont kick people for putting a backpack in storage.

I don't understand.

There is only 1 line in addbackpackcargo.txt, so this can't be restriction #12.

Other filters, addmagazinecargo.txt and addweaponcargo.txt, have rules for backpacks, but their figure is already "1" and not "5".

So you are not using regular filters.

Edited June 27, 2013 by facoptere

[-Se7eN- 874]

i see.

when i saw a newer version of backpackcargo.txt and saw that it was only one line it kind of confused me seen as the current one we have is like 130 lines.

is the one line backpackcargo file viable?

[facoptere 180]

is the one line backpackcargo file viable?

you should try the one provided.

[R.J. 70]

Players are getting kicked for : Player #16 has been kicked by BattlEye: Script Restriction #205

Script 205 is : 1 setPosition !ctrlSetPosition

Stumped

[facoptere 180]

#205 = setvehicleinit.

Restart your server.

[DJ_Teschmi 31]

#205 = setvehicleinit.

Restart your server.

Hi Faco,

Regarding this issue, i was investigating on our server for a couple of days and in our case that couldn't be a hack.

And when I'm looking to your gametracker server graph, i guess you get the same issue as us ;)

The server was fine and 2 minutes after the 2AM server restart, all players was doing "BIS effect" .... etc..

The same for yesterday and the day before, at each restart...

Here the log, the server was restarting at 2AM and the first log came at 2:02, players was not really in game that's why i believe that this not a hack:

28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #24 "[this] spawn BIS_Effects_AirDestruction"
28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #24 "[this] spawn BIS_Effects_AirDestruction"
28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #25 "[this, 0, 14.644]spawn BIS_Effects_AirDestructionStage2"
28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #25 "[this, 0, 14.689]spawn BIS_Effects_AirDestructionStage2"
28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #25 "
_v setVehicleInit format ["[this, %1, %2]spawn BIS_Effects_AirDestructionStage2",_int, _t];
processInitCommands;
};
};"
28.06.2013 02:02:29: Spirit (xxxxx) xxxxx - #205 "s select 2) + 1];
sleep 0.05;

_v setVehicleInit format ["[this, %1, %2]spawn BIS_Effects_AirDestructionS"

Thanks for your help

Edited June 28, 2013 by DJ_Teschmi

[facoptere 180]

Please check your server RPT logs. Maybe a vehicle exploded while spawning.

I will check whether the BIS functions (which use setvehicleinit) are overwritten after of before server_monitor (which spawns vehicles&tents).

Edit: I checked the code and the server should never trigger setvehicleinit. So I suppose it's a hack.

Edited June 28, 2013 by facoptere

[DJ_Teschmi 31]

Please check your server RPT logs. Maybe a vehicle exploded while spawning.

I will check whether the BIS functions (which use setvehicleinit) are overwritten after of before server_monitor (which spawns vehicles&tents).

Edit: I checked the code and the server should never trigger setvehicleinit. So I suppose it's a hack.

I can't see any vehicle explosion in the RPT, all seems good.

You had the same problem this night (midnight) on your FR34 right?

http://cache.www.gam...03424&start=-1d

Edited June 28, 2013 by DJ_Teschmi

[facoptere 180]

No I don't have any setvehicleinit lines during the night.

[DJ_Teschmi 31]

No I don't have any setvehicleinit lines during the night.

Ok because i can see in the graph that all your players was leaving at midnight ;)

I don't know what to do with our issue, maybe we will restart the server with password lock and connect into to see if the same behavior happens.

If yes, we will be sure that is not a hack.