Cheat Finder (script parser for admins)

[Gogster (DayZ) 626]

Can we have this pinned please ?

Seconded.

Also, until Disorder releases a new version, people should remove:

dayz_disco

from the scripts.db

[Gogster (DayZ) 626]

Until Disorder releases an updated version, people should add:

esp.sqf
zombieshield.sqf

to their scripts.db for Cheat Finder.

[AusDayZ (DayZ) 14]

Hey, love this tool. I'm pretty new to arma scripts & I'm getting a ton of Ikarus_TK_CIV_EP1 popping up, how can I tell if it's a script?

if (!isDedicated) then {
_config =  configFile >> "CfgLoot";
"
15.08.2012 06:20:12: XXXX (XXXX) XXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXX (XXXXXXX) XXXXXXXXXXXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXXXX (XXXXXXXX) XXXXXXXXXXXXXXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXX (XXXXXXX) XXXXXXXXXXXXXXXXXXc - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXXXXX (XXXXXXXXXX) XXXXXXXXXXXXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: DXXXXXXXXXX(XXXXXXXXXXX4) XXXXXXXXXXXXXXXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXXXXXXXXX (XXXXXXXXXXXXXXX) 1XXXXXXXXXX4 - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXX (XXXXXXX4) XXXXXXXXXXXXXXX - #20 "
if (isServer) then {
_object = createVehicle ['Ikarus_TK_CIV_EP1', [2273.29, 2121.28, 0], [], 0, 'C"
15.08.2012 06:20:12: XXXXXX (XXXXXXXXX) 5XXXXXXXXXXXXXX - #41 "de\compile\object_vehicleKilled.sqf"; 
object_setHitServer =  compile preprocessFileLineNumbers "\z"
15.08.2012 06:20:12: XXXXXXXk (XXXXXXXXXXXX) XXXXXX- #130 "ddons\dayz_code\init\compiles.sqf"

Any of this not legit?

Cheers

[Gogster (DayZ) 626]

Never heard of that vehicle... the bus is just called Ikarus.

I still think it is a cheat though.

[AusDayZ (DayZ) 14]

Never heard of that vehicle... the bus is just called Ikarus.

I still think it is a cheat though.

Hmm the problem is two of those players names edited out are definitely not hacking.

Added the new lines to scripts db and there's a crap load of player setpostat1

I assume that's teleport? And that the players teleported will display it too? Is there a way to tell who's actually doing the teleporting

One example below

if (!isDedicated) then {
_config = configFile >> "CfgLoot";
"
15.08.2012 08:17:57: MXXXXXXX (XXXXXXXXXXXXX) XXXXXXXXXXXXXX - #41 "de\compile\object_vehicleKilled.sqf";
object_setHitServer = compile preprocessFileLineNumbers "\z"
15.08.2012 08:17:57: CXXXXX (XXXXXXXXX) XXXXXXXXXXXX - #44 "player setVariable['lastPos',0];
player setposatl [12528.6,50.3259,157.474];"
15.08.2012 08:17:57: CXXXXXX (XXXXXXX) 5XXXXXXXXXXXXXXX - #171 "player setVariable['lastPos',0];
player setposatl [12528.6,50.3259,157.474];"
15.08.2012 08:17:57:MaXXXXX (XXXXXX4) XXXXXXXXXXXXX - #130 "ddons\dayz_code\init\compiles.sqf"

Edited August 16, 2012 by AusDayZ

[Gogster (DayZ) 626]

Hmm the problem is two of those players names edited out are definitely not hacking.

What makes you say that?

Added the new lines to scripts db and there's a crap load of player setpostat1

I assume that's teleport? And that the players teleported will display it too? Is there a way to tell who's actually doing the teleporting

One example below

if (!isDedicated) then {
_config = configFile >> "CfgLoot";
"
15.08.2012 08:17:57: MXXXXXXX (XXXXXXXXXXXXX) XXXXXXXXXXXXXX - #41 "de\compile\object_vehicleKilled.sqf";
object_setHitServer = compile preprocessFileLineNumbers "\z"
15.08.2012 08:17:57: CXXXXX (XXXXXXXXX) XXXXXXXXXXXX - #44 "player setVariable['lastPos',0];
player setposatl [12528.6,50.3259,157.474];"
15.08.2012 08:17:57: CXXXXXX (XXXXXXX) 5XXXXXXXXXXXXXXX - #171 "player setVariable['lastPos',0];
player setposatl [12528.6,50.3259,157.474];"
15.08.2012 08:17:57:MaXXXXX (XXXXXX4) XXXXXXXXXXXXX - #130 "ddons\dayz_code\init\compiles.sqf"

I believe they're doing it to themselves, 'player' is the keyword rather than a variable. Could be wrong, but I don't think so.

[AusDayZ (DayZ) 14]

What makes you say that?

Well I was one of the players & I know I haven't been hacking lol.

I believe they're doing it to themselves, 'player' is the keyword rather than a variable. Could be wrong, but I don't think so.

Hmm this one has appeared next to everyone's name in the server at the same time, looks suss but I can't identify who actually runs the script

Edited August 16, 2012 by AusDayZ

[Gogster (DayZ) 626]

Bit worrying then as we have bans in the system for createVehicle.

On the teleport have you searched for "teleport.sqf" or similar?

[AusDayZ (DayZ) 14]

Bit worrying then as we have bans in the system for createVehicle.

On the teleport have you searched for "teleport.sqf" or similar?

Yeah I have yet to actually ban anyone from these logs but I'm storing it all for when I eventually figure it out.

Teleport.sqf turns up nothing but several teleports have definitely happened on the server.

[disorder 344]

New version is out, lots of cool stuff.

New cheats have been added from suggestions, some have been removed

A lot of the DB entries are now singular and search for a root item, so '100rnd', instead of '100rnd_x25blah'

Edited August 16, 2012 by disorder

[AusDayZ (DayZ) 14]

Cheers dude, the ban hammer is coming down as we speak. Great tool.

[AusDayZ (DayZ) 14]

New lines for the database, these are known cheat lines so far.

execVM "\ca\ui\scripts\dedicatedServerInterface.sqf"
BIS_Effects_AirDestruction
BIS_Effects_AirDestructionStage2
if (_velz>1) then (_v setvelocity [velocity _v select 0,velocity _v select 1
if (_velz>1) then {_v setvelocity [_xv/1.3,_yv/1.3,0
[_v,_int,false] spawn
BIS_Effects_Burn
_v setVehicleInit format ["[this, %1, %2,false,true]
if (_v iskindof "tank")
if (_v iskindof "plane")
openDSInterface
_ent setHit ["legs",1]
_ent setDamage 1
_ent setVariable ["hit_legs"
player setposatl

Did you not end up adding these into the latest scripts db? I added them in before the update and picked up spawned hueys, now when i scan the same log (with the db from update) they don't come up..

[disorder 344]

Did you not end up adding these into the latest scripts db? I added them in before the update and picked up spawned hueys, now when i scan the same log (with the db from update) they don't come up..

I'll double check. I actually modded the db file so might have not included them.

Just released a hotfix for 1.3 btw, everything should be working now.

[malcon 8]

I like the tool already. But when i a scan my log file. I see alot of BIS_Effects

What is that. Greets Mike

[disorder 344]

I believe that is leftovers from a destruction effect(used by crashed helicopters maybe?). It will be taken out in the next patch if its deemed unnecessary. Or you can take it out now. :)

Edited August 16, 2012 by disorder

[malcon 8]

Ok and mayby a option in de logs with your program the time and date. Its a big list of mine. But i like your tool. Greets

Edited August 16, 2012 by cobramike

[senior_hombre 1]

I get the error: Access violation at address 004473E1 ibn module 'CheatFinder.exe'. Read of address 00000000.

[malcon 8]

Ya me to if i update my scripts .

http://dayzmod.com/forum/index.php?/topic/71904-new-major-battleye-anti-cheat-features/#entry684746

And wy is that. Greets Mike

[Sanadorn 6]

Your sir are a gentleman and a scholar, my :beans: , they are yours

[shadow293 6]

Found people with these:

"BIS_EffectsprocessInitCommandsif (_v iskindof "tank")"

16.08.2012 20:05:52: Justin (IP) bb6eac902f143f3cb02e733e56cee937 - #0 "HelicopterExploSmall" 69:115 0:0 [13513,4282,1] [0,0,0]

16.08.2012 20:05:52: Justin (IP) bb6eac902f143f3cb02e733e56cee937 - #0 "HelicopterExploBig" 69:116 0:0 [13513,4282,2] [0,0,0]

Anyone have any idea what these are?

Edited August 17, 2012 by shadow293

[Sanadorn 6]

Found people with these:

"BIS_EffectsprocessInitCommandsif (_v iskindof "tank")"

16.08.2012 20:05:52: Justin (IP) bb6eac902f143f3cb02e733e56cee937 - #0 "HelicopterExploSmall" 69:115 0:0 [13513,4282,1] [0,0,0]

16.08.2012 20:05:52: Justin (IP) bb6eac902f143f3cb02e733e56cee937 - #0 "HelicopterExploBig" 69:116 0:0 [13513,4282,2] [0,0,0]

Anyone have any idea what these are?

It means Justin is a bad pilot. He crashed.

[disorder 344]

Access Violations usually occur if you don't have proper access to a file. Not sure what is causing it.

You need write access in the programs folder and also in /reports sub folder, the reports folder needs to present because it doesn't create it manually (will fix that)

[Sanadorn 6]

Just a bug on the parsing;

Players with ASCII characters in their name are causing the reporting component to die... e.g.

™ ♥ ♫ etc etc

[disorder 344]

After a scan, check if you have a file called tmpdb in your programs folder and does it have all the detection info in?

It might be XML since XML is a pain in the ass, I originally switched to it to make results easier to read but I think its causing more probs. :\

If possible send me a copy of the file that is causing it, if it can be compressed to under 15-20mb.

Edited August 17, 2012 by disorder

[boneboys 7988]

Thread restored, mystery remains.

Carry on.