BattlEye Server Filters for DayZ Mod 1.8.4

[piffaroni 13]

I am having hackers come to my server and are able to mass kill everyone, and also,

 

 

There was a problem
cheaters started to kick users by
Then there was another one cheater and killed all the filters in the log at the time empty ...

17:14:41 Player Nikita_Rizident kicked off by BattlEye: Script Restriction #2617:14:41 Player Nikita_Rizident disconnected.17:14:42 Player Human kicked off by BattlEye: Script Restriction #2617:14:42 Player Human disconnected.17:14:43 Player HotSauce kicked off by BattlEye: Script Restriction #2617:14:43 Player HotSauce disconnected.17:14:43 Player KeeP kicked off by BattlEye: Script Restriction #2617:14:43 Player KeeP disconnected.17:14:47 Player emmy kicked off by BattlEye: Script Restriction #2617:14:47 Player emmy disconnected.17:14:48 Player XepBCTAKAHE kicked off by BattlEye: Script Restriction #2617:14:48 Player XepBCTAKAHE disconnected.17:14:49 Player gougo kicked off by BattlEye: Script Restriction #2617:14:49 Player gougo disconnected.17:14:59 Player Yarik kicked off by BattlEye: Script Restriction #26

29.08.2013 17:14:48: XepBCTAKAHE (178.49.171.147:3223) 0ad981d0aa7a1d4223618de1226b4374 - #25 "[this, 9.80957, 7816.7]spawn BIS_Effects_AirDestructionStage2"29.08.2013 17:14:48: XepBCTAKAHE (178.49.171.147:3223) 0ad981d0aa7a1d4223618de1226b4374 - #26 "[this, 9.80957, 7816.7,false,true]spawn BIS_Effects_Burn"29.08.2013 17:14:49: gougo (95.154.73.85:2304) 57c73f51de2d90e8d9f735b7d8eb28d1 - #25 "[this, 9.80957, 7816.7]spawn BIS_Effects_AirDestructionStage2"29.08.2013 17:14:49: gougo (95.154.73.85:2304) 57c73f51de2d90e8d9f735b7d8eb28d1 - #26 "[this, 9.80957, 7816.7,false,true]spawn BIS_Effects_Burn"29.08.2013 17:14:59: Yarik (95.133.88.2:2305) 0b8b510a6ab8cd839db97b22ca8931da - #24 "[this] spawn BIS_Effects_AirDestruction"29.08.2013 17:14:59: Yarik (95.133.88.2:2305) 0b8b510a6ab8cd839db97b22ca8931da - #25 "[this, 9.80957, 7816.7]spawn BIS_Effects_AirDestructionStage2"29.08.2013 17:14:59: Yarik (95.133.88.2:2305) 0b8b510a6ab8cd839db97b22ca8931da - #25 "_v setVehicleInit format ["[this, %1, %2]spawn BIS_Effects_AirDestructionStage2",_int, _t];processInitCommands; };};"

hey how are you? Hackers are able to now kick people on my server too! What can we do to fix this?

[facoptere 180]

Filters updated for 1.8. For now there are the default ones.

There will be several updates during the week.

[DJ_Teschmi 31]

Hi Faco, thanks for your job :thumbsup:

 

First issues with setvariable.txt filter, lot of setvariable #0 :

For example:

#0 "remotetargets" = [<NULL-object>] 27:644 z_hunter

or

#0 "mydest" = [6535.86,2300.59,2.09439] 33:33 z_worker2

I get also setvariable #1

#1 "usec_sepsis" = false 47:5 Survivor3_DZ

I get also createvehicle #2 when found a medbox in Berezino hospital:

#2 "MedBox1" 81:49 [11949,9113,75]

Thanks

++

Edited September 17, 2013 by DJ_Teschmi

[ameo_koradi@hotmail.com 103]

Great news Faco, got one issue for you.

A lot of SetVariable Restriction #0 since the update :

 

17.09.2013 10:47:48: XXXXXX (xxxxxxxxxx:8410) dexxxxxxxxxxxx66765d - #0 "remotetargets" = [<NULL-object>] 40:299 z_villager3

 

Ohoh DJ is faster than light !

Edited September 17, 2013 by Ameo

[facoptere 180]

strange. these patterns should be addressed already. I will have a look. thanks

[piffaroni 13]

I tried these battle eye filters, but battle kicked me, good thing I backed up the ones my provider had given me

[facoptere 180]

Hi Faco, thanks for your job :thumbsup:

 

First issues with setvariable.txt filter, lot of setvariable #0 :

For example:

#0 "remotetargets" = [<NULL-object>] 27:644 z_hunter

or

#0 "mydest" = [6535.86,2300.59,2.09439] 33:33 z_worker2

I get also setvariable #1

#1 "usec_sepsis" = false 47:5 Survivor3_DZ

I get also createvehicle #2 when found a medbox in Berezino hospital:

#2 "MedBox1" 81:49 [11949,9113,75]

Thanks

++

Check that you are using latest filters set. the URL is not the same as 1771.

[ameo_koradi@hotmail.com 103]

strange. these patterns should be addressed already. I will have a look. thanks

Thx, I temporarily added !"remotetargets" at the end of the first line.

And 1 "remotetargets" on a new line to keep monitoring it.

 

Edit: I took them from cdu, The github has changed ? This one is no more ? https://github.com/DayZMod/Battleye-Filters

Edited September 17, 2013 by Ameo

[facoptere 180]

I tried these battle eye filters, but battle kicked me, good thing I backed up the ones my provider had given me

Theses filters are only for vanilla dayzmod, version 1.8.

[facoptere 180]

Edit: I took them from cdu, The github has changed ? This one is no more ? https://github.com/DayZMod/Battleye-Filters

Maybe you were using 1771 branch. I set 1.8 has default branch now. You should check again with the same URL.

What is "cdu"? I know only http://cdn.armafiles.info/latest/1.8/ for public repo.

Edited September 17, 2013 by facoptere

[facoptere 180]

I am having hackers come to my server and are able to mass kill everyone, and also,

In 1771:

you have to restart the server when this occurs.

In 1.8:

if you are using vanilla mission file, this isssue is correcly handled, and you won't have these "[this, <coordinates>]spawn BIS_Effects_AirDestructionStage2" anymore.

For mass killing, check your createvehicle.log, you should see tons of explo logs, such:

17.09.2013 18:16:39: Doctor (178.65.181.103:12637) 057f97b858eb11d08f49ca2b80a65684 - #70 "HelicopterExploBig" 250:24 0:0 [10508,2745,49] [0,0,0]

Edited September 17, 2013 by facoptere

[ameo_koradi@hotmail.com 103]

Maybe you were using 1771 branch. I set 1.8 has default branch now. You should check again with the same URL.

What is "cdu"? I know only http://cdn.armafiles.info/latest/1.8/ for public repo.

I meant cdn ! ;)

 

Ok ll double check that. BTW we also had a mass kill.

Edited September 17, 2013 by Ameo

[ameo_koradi@hotmail.com 103]

The cdn files, when I took them, were not up to date, it seems ok now. Thx Faco !

[ameo_koradi@hotmail.com 103]

Other case of ZombieFeed: ZombieFeed1 / ZombieFeed3 / ZombieFeed4

[facoptere 180]

all cases are there already. I added zombiefeed without any number.

edit: In fact I noticed we are several to do some commits in past few hours.

Edited September 17, 2013 by facoptere

[DJ_Teschmi 31]

Hi,

 

Sorry for the filters mistake, it's ok with Ameo now, here one real issue :D

One player was kicked for this pubvar #13:

 

Value Restriction #13 "remExField" = [<NULL-object>,<NULL-object>,"loc","titleText","La transfusion s'est interrompue ! La poche de sang est perdue.","PLAIN DOWN"]

 

 

Thanks

[facoptere 180]

Hi,

 

Sorry for the filters mistake, it's ok with Ameo now, here one real issue :D

One player was kicked for this pubvar #13:

 

 

Thanks

thanks. Filters updated.

[DJ_Teschmi 31]

Hi Faco,

 

Other thing to check, we get setvariable #0 kick when wearing a ghillie from backpack of someone:

 

#0 "bis_greetedpeople" = [] 11:386 Sniper1_DZ

 

 

And PubVar #1 kick when you grab a plant:

 

#1 "PVDZ_objgather_Delete" = [<NULL-object>,<NULL-object>]

 

 

Thanks

Edited September 18, 2013 by DJ_Teschmi

[facoptere 180]

Hi Faco,

 

Other thing to check, we get setvariable #0 kick when wearing a ghillie from backpack of someone:

 

 

And PubVar #1 kick when you grab a plant:

 

 

Thanks

Filters updated, thanks.

[semi 0]

My players get kicked by "random" "SetVariable Restriction #0". I found out it is because 'remotetargets', that line is common for every kicked players:

 

Usually same players:

18.09.2013 21:19:36: temeeh #0 "remotetargets" = [<NULL-object>] 104:448 z_worker2
18.09.2013 21:20:05: Osteri-Ossi #0 "remotetargets" = [<NULL-object>] 114:163 z_new_villager3
18.09.2013 21:23:26: Osteri-Ossi #0 "remotetargets" = [<NULL-object>] 114:167 z_new_villager3
18.09.2013 21:25:54: Osteri-Ossi #0 "remotetargets" = [<NULL-object>] 128:40 z_worker3
18.09.2013 21:26:31: temeeh #0 "remotetargets" = [<NULL-object>] 104:462 z_new_worker2
18.09.2013 21:27:49: temeeh #0 "remotetargets" = [<NULL-object>] 104:454 z_policeman
18.09.2013 21:28:16: [ANAL] JiiZet #0 "remotetargets" = [<NULL-object>] 114:278 zZombie_Base
18.09.2013 21:32:16: [ANAL] JiiZet #0 "remotetargets" = [<NULL-object>] 114:276 z_new_villager3
18.09.2013 21:36:34: RefleX [FIN] #0 "remotetargets" = [<NULL-object>] 116:741 z_suit2
18.09.2013 21:43:53: RefleX [FIN] #0 "remotetargets" = [<NULL-object>] 116:909 z_villager3

 

Scripts are latest:

$ grep remotetarget setvariable.txt
1 !"USEC_" !"NORRN_" !"hit_" !=BIS_greetedPeople !=actionSet !=agentObjectCamps !=armed !=banditKills !=BIS_noCoreConversations !=characterID !=claimed !=combattimeout !=deathType !=doLoiter !=firedDamage !=firedHit !=freeTarget !=headShots !=hitRegistered !=humanity !=humanKills !=lastPos !=looted !=meatHarvested !=medForceUpdate !=messing !=myDest !=owner !=posForceUpdate !=remotetargets !remotetargets !=temperature !=unconsciousTime !=updatePlayer !=zombieKills !=zombieSpawn
1=remotetargets
 

 

- Semi

 

[facoptere 180]

this filter is not really the default one, but your players should not be kicked with it.

[semi 0]

Maybe it is because of thevisad version of server (Reality). Also there is reports on log of kicking because of #1 of setvariable.

 

18.09.2013 23:42:09: RefleX [FIN] - #1 "usec_sepsis" = false 168:347 Bandit1_DZ
19.09.2013 00:01:30: Jopez - #1 "usec_sepsis" = false 172:5 Survivor2_DZ

 

I did ask about that from user, and he told me he was using bandage, and got kicked because of that. Again, .txt filter seems to be just fine.

 

[facoptere 180]

it looks like BE is not using the filter files you think it should use.

Edit: New BE filters set update. Less verbose scripts.log, weap&ammo whitelisting.

Edited September 19, 2013 by facoptere

[DJ_Teschmi 31]

it looks like BE is not using the filter files you think it should use.

Edit: New BE filters set update. Less verbose scripts.log, weap&ammo whitelisting.

 

Hi Faco,

 

Is it possible to have less verbose in createvehicle.log? Because we still have a lot of character creation lines:

 

19.09.2013 08:43:23: LoLkiN  - #19 "Survivor1_DZ" 37:12 [-18638,25814,376]

19.09.2013 08:43:25: LoLkiN  - #19 "Survivor1_DZ" 37:14 [-18639,25825,375]

19.09.2013 08:43:43: Mulien  - #20 "Survivor2_DZ" 15:795 [-18697,25815,379]

19.09.2013 08:44:24: Wipetron  - #19 "Survivor1_DZ" 16:504 [-18614,25880,366]

19.09.2013 08:44:40: Farvel  - #15 "Bandit1_DZ" 39:5 [-18697,25815,379]

 

Thanks

[DJ_Teschmi 31]

We just encountered a massive hack, the  same as yesterday, all player died in local explosion...

 

A player was kick at the same time for spawning a local vehicle but not for the massive explosion...

Any of the filters was not able to dectect this hack..

19.09.2013 08:55:52: ya ne nagibator (195.131.110.111:2384) b9910e1c5b2e8f7640de43c74b19f039 - #0 "#line 1 "uninstal.sqf"(vehicle player) addAction ["<t color = '#20f543'>~Spawn Vehicle~", "@TheWarZ\Spawn Vehicle.sqf"];(vehic"19.09.2013 08:55:52: ya ne nagibator (195.131.110.111:2384) b9910e1c5b2e8f7640de43c74b19f039 - #74 "player) addAction ["<t color = '#20f543'>~Spawn Vehicle~", "@TheWarZ\Spawn Vehicle.sqf"];(vehicle player) addAction ["<t color "

I'm tired...