New Major BattlEye Anti-Cheat Features

[byteslam (DayZ) 0]

Is 'whitelisting' a way to clear this up, or tells it something... I now uses always the latest files posted on http://code.google.c...munity-banlist/ Very nice way btw! Keep it up!

The provided ban list contains a lot of double entrys.

[KField86 237]

Anyone wanna tell me what this one is? He's not banned, and he's not online currently. Been trying to figure it out myself. These were the only two lines for him in my log, and then apparently he just logged off and never returned, since he got kicked both times for executing this line. Anyone know what it is so I can give him a reason when I do ban him? Or is this possibly legitimate in some cases?

17.08.2012 17:04:52: Matt () 8145766b8f9380ba7e76b815fa75bdde - #0 "{ if((getPlayerUID _x) == '5680384') then { _x hideObject true; }; } forEach playableUnits;"

17.08.2012 17:04:52: Matt () 8145766b8f9380ba7e76b815fa75bdde - #6 "{ if((getPlayerUID _x) == '5680384') then { _x hideObject true; }; } forEach playableUnits;"

[Torndeco (DayZ) 46]

@KField86

Not 100% sure myself but if u look @ http://forums.bistudio.com/showthread.php?138736-Introducing-Server-side-Event-Logging-Blocking&p=2207055#post2207055

There are examples of cheaters in remoteexec.log @ the very bottom of the first post & it shows that code as an example of a cheater.

If i had to guess it makes a certain player invisible to other players but i could be wrong about that...

[KField86 237]

Yes I see that, I would just like someone smarter than me to come in and verify just exactly what he did, so I have the evidence in case of an appeal. I don't want to show him the script and go "HA! Got you for this, It's cheating even though I have no idea what it means." ya know? :)

[byteslam (DayZ) 0]

17.08.2012 13:56:08: umaidez (91.103.79.216:19810) a0bf6acremoved48db5 – #122 “_i = _i+1}] do

{

[nil, _targetClient,"loc", rJIPEXEC, BIS_MPF_ServerPersistentCallsArray select _i] “

could this be cause a death of all players?

[byteslam (DayZ) 0]

Anyone wanna tell me what this one is? He's not banned, and he's not online currently. Been trying to figure it out myself. These were the only two lines for him in my log, and then apparently he just logged off and never returned, since he got kicked both times for executing this line. Anyone know what it is so I can give him a reason when I do ban him? Or is this possibly legitimate in some cases?

17.08.2012 17:04:52: Matt () 8145766b8f9380ba7e76b815fa75bdde - #0 "{ if((getPlayerUID _x) == '5680384') then { _x hideObject true; }; } forEach playableUnits;"

17.08.2012 17:04:52: Matt () 8145766b8f9380ba7e76b815fa75bdde - #6 "{ if((getPlayerUID _x) == '5680384') then { _x hideObject true; }; } forEach playableUnits;"

He makes himself invisible to all other players. Anyway, there is no reason why a player should execute scripts like this, I would say Kick an Ban if you see such behavior on your server. I do the same now, strong law and order strategy and nobody complained so far, so they are all guilty I assume.

[KField86 237]

He makes himself invisible to all other players. Anyway, there is no reason why a player should execute scripts like this, I would say Kick an Ban if you see such behavior on your server. I do the same now, strong law and order strategy and nobody complained so far, so they are all guilty I assume.

Thanks buddy. I will ban and if anything arises, I'll go from there.

[Seattle 4]

interesting convo folks.

does anyone know of a ...say example list of common cheats and what they look like n which log?

i have seen several different examples but it would be nice for people newer to arma or hosting dayz to have a sticky thats updated to compare our logs with...

is there one? as if i knew exactly what im supposed to be looking for, i would spend less tiem online searching if such and such was cheating, and more time banning cheaters.

im 90% positive my server is being used by a group... i found 5 of them in a church backyard all face to the wall and i filled heads with leaqd, i chopped knees until my arms hurt, then i shot them pointblank in the side of the head, chopped with htchet too many times to count. looted em and put it all on a dead zed, hid the zed kept the nvgs and range finder, all those pretty rifles and all that nato ammo. all those morphines and epi pens and the 5 anti biotics i kept 2.

i even took the toolbelt stuff and buried it with the dead zombie. then i grabbed uids and kick banned. but they come back. again and again. finally i just stop the server and goto bed.. next day i finally manage to get these new scripts and files onto my server and they hac=vent come back, id be pissed to come back from afk to find my self weapon and gearless in the middle of cherno along with my 4 buddies.

well now im sure that the birds they follow me. the zombies one hit and knock out and break bones. the ones in the blue overcoats seems the others are faster then me too as they keep hitting me in the back when im running, but the birds,they swoop and squawk and keepo circling above me where ever i go.

also i cant find anything in known vehicle spawns excpet blown up vehicles, no cars trucks helos etc. just boats. havent seen a bike or a atv or a car or truck in a long time.

sigh if there is anyone "pro style" admin that would like to take questions or look at my logs or tell me specifically what to do and where to write a line to exclude these pukes from jumping on my server, i got serial killer skin and audio files i cant even delete from my server cfg....lol anyone please help?

[Greg-UK4 31]

15.08.2012 16:13:42: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "G_40mm_HE" 104:37 0:0 [6606,2621,274] [0,0,0]
15.08.2012 16:13:42: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "G_40mm_HE" 104:38 0:0 [6492,2504,517] [0,0,0]
15.08.2012 16:13:42: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "G_40mm_HE" 104:39 0:0 [6674,2627,456] [0,0,0]
15.08.2012 16:13:42: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "G_40mm_HE" 104:40 0:0 [6606,2621,185] [0,0,0]
15.08.2012 16:14:11: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "Sh_125_HE" 104:41 0:0 [6586,2618,206] [0,0,0]
15.08.2012 16:14:11: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "M_AT5_AT" 104:42 0:0 [6586,2618,206] [0,0,0]
15.08.2012 16:14:26: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "Sh_125_HE" 104:43 0:0 [7211,2231,206] [0,0,0]
15.08.2012 16:14:26: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "M_AT5_AT" 104:44 0:0 [7211,2231,206] [0,0,0]
15.08.2012 16:14:37: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "Sh_125_HE" 104:45 0:0 [2120,2159,201] [0,0,0]
15.08.2012 16:14:37: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "M_AT5_AT" 104:46 0:0 [2120,2159,201] [0,0,0]
15.08.2012 16:15:36: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "Sh_125_HE" 104:47 0:0 [1515,2248,205] [0,0,0]
15.08.2012 16:15:36: Dylan (64.118.1.134:2304) 94035771f2f3fec28e86ffe270f310dd - #0 "M_AT5_AT" 104:48 0:0 [1515,2248,205] [0,0,0]

#0 does not mean "Using" over "Abusing"

This guy spawned these items, on a stream, on my server.

[Khyron_UN 14]

to add to the list feel free...

http://dayzmod.com/forum/index.php?/topic/75193-welp-its-time-here-are-some-bans-from-the-un-server/

[num3nx 1]

BRICK (Removed) #0 "SeaGull" 5:2 [-18621,25857,388]

WTF!?

Edited August 18, 2012 by num3nx

[Torndeco (DayZ) 46]

@num3nx

Its someone that turned into a seagull, it can be cause by a dayz loading bug. He/She gets kicked from server when it happens so all good.

So dont ban, and plz remove his guid & ip address aswell thx

[num3nx 1]

@num3nx

Its someone that turned into a seagull, it can be cause by a dayz loading bug. He/She gets kicked from server when it happens so all good.

So dont ban, and plz remove his guid & ip address aswell thx

Thanks for advice.

Still lot to understand in scripting ...

Removed Player info.

Edited August 18, 2012 by num3nx

[Magotchi 74]

I've been using the Community Banlist for several days now, and the vast majority of what appears in my scripts.log are lines that just say '#132 "isDedicated"' at the end, with no more information about the script. For example, I just sampled a random scripts.log from last night, and 2810/2822 lines in the file were just that, in addition to 8 more common, non-hack lines, and 4 lines for opening the dedicated server interface (maybe/probably hackers).

Is it reasonable that '#132 "isDedicated"' lines show up so often, and is it reasonable that there isn't much else in scripts.log besides those lines, or am I doing something incorrectly?

[Hampi90 0]

I've been using the Community Banlist for several days now, and the vast majority of what appears in my scripts.log are lines that just say '#132 "isDedicated"' at the end, with no more information about the script. For example, I just sampled a random scripts.log from last night, and 2810/2822 lines in the file were just that, in addition to 8 more common, non-hack lines, and 4 lines for opening the dedicated server interface (maybe/probably hackers).

Is it reasonable that '#132 "isDedicated"' lines show up so often, and is it reasonable that there isn't much else in scripts.log besides those lines, or am I doing something incorrectly?

I also almost only get "#132 isDedicated" in my script.log file since I updated the my scripts.log file to the latest version and I don't have any older since I just started up my dayz server two days ago. So it doesn't seem to log anything useful at the moment.

[(OCN)Vortech 65]

I've been using the Community Banlist for several days now, and the vast majority of what appears in my scripts.log are lines that just say '#132 "isDedicated"' at the end, with no more information about the script. For example, I just sampled a random scripts.log from last night, and 2810/2822 lines in the file were just that, in addition to 8 more common, non-hack lines, and 4 lines for opening the dedicated server interface (maybe/probably hackers).

Is it reasonable that '#132 "isDedicated"' lines show up so often, and is it reasonable that there isn't much else in scripts.log besides those lines, or am I doing something incorrectly?

We were having that issue too, I commented out the line. Since then they've updated the scripts.txt however now it just spams the log with larger chunks of information. So we commented it out again awaiting more progress.. Honestly I think of scripts as a last line of defense so I'm personally not overly concerned.

[Torndeco (DayZ) 46]

Basicly from the changes dwarden has been fine tuning scripts.txt to not log as much less spam

Plus the new createvehicles.txt & remoteexec kicks for alot of things now and makes life harder for scripter..

Anyway its working as intended atm & u are good

[hohlraum 9]

Arrgh. Using newest scripts/remoteexec/createvehicles. Had a full server of people enjoying themselves and then some douche hacker gets on and starts killing everyone. Still nothing in the remoteexec.log :/ Scripts log started showing some stuff other than the standard isDedicated while it was happening but appears to be stuff happening TO the other players.

Edit: I just noticed something. Downloading the files from the google code site directly saves them with unix crlf encoding. I wonder if maybe that's the issue? The standard BEserver bans.txt is written using Windows crlf encoding. If BE doesn't understand unix encoding then lots of people might be putting .txt files in place where the entire thing is a single line comment or not properly formatted so BE is just ignoring the entries.

Edited August 19, 2012 by Hohlraum

[umandez 139]

Love this update.

Our clan is alot happier on our server now! Been keeping really ontop of it.

One question though... is there any way for you to add an autokick for entries that come up 5+ times?

[earacorn 16]

Please help, I'm having trouble getting this stuff to work. I'm not even sure if I've created the right files. I put the scripts.txt, remoteexec and createvehicles txts in my battleeye folder in the cfgdayz folder.

(I copied and pasted everything in the green boxes and put them in the correct files from the first page of this post, I've also updated them from what I've been seeing changed in this same post over the past few days).

What am I missing here? Can someone give me a dummies guide? On how to get this working? Also I have someone on my server using hacks so I can verify that this is working. But the only file that I see logging anything is another Scripts.txt, that is just being filled with nonsense that I don't understand.. It also logs something on every player about every second. Also whenever the guy using scripts uses a teleport to me script, battleeye kicks the player he teleports but does nothing to the hacker. This is actually still beneficial to the people being teleported, but at the same time should be kicking the other guy.. Thanks in advance for any help sorry if this post is confusing.

Edited August 19, 2012 by Threelibras

[Frop 33]

Some people finally made it to my remoteexec.log.

19.08.2012 17:36:34: mike2k (62.163.213.*:2304) 558fb37b7a4bacd668faf2262403634a - #0 "
if (isServer) then {
_object = createVehicle ['Old_bike_TK_CIV_EP1', [6651.96, 3260.97, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 5426.96, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object cal"
19.08.2012 17:36:34: mike2k (62.163.213.*:2304) 558fb37b7a4bacd668faf2262403634a - #3 "
if (isServer) then {
_object = createVehicle ['Old_bike_TK_CIV_EP1', [6651.96, 3260.97, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 5426.96, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object cal"
19.08.2012 17:38:12: BZO (86.141.82.*:52766) 1446da93968aa1cbfa5776c14d0ecb95 - #0 "
if (isServer) then {
_object = createVehicle ['UH1H_DZ', [6040.97, 2229.15, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 1853.04, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object call dayz_objec"
19.08.2012 17:38:12: BZO (86.141.82.*:52766) 1446da93968aa1cbfa5776c14d0ecb95 - #3 "
if (isServer) then {
_object = createVehicle ['UH1H_DZ', [6040.97, 2229.15, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 1853.04, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object call dayz_objec"

Edited August 19, 2012 by Frop

[KField86 237]

Some people finally made it to my remoteexec.log.

19.08.2012 17:36:34: mike2k (62.163.213.53:2304) 558fb37b7a4bacd668faf2262403634a - #0 "
if (isServer) then {
_object = createVehicle ['Old_bike_TK_CIV_EP1', [6651.96, 3260.97, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 5426.96, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object cal"
19.08.2012 17:36:34: mike2k (62.163.213.53:2304) 558fb37b7a4bacd668faf2262403634a - #3 "
if (isServer) then {
_object = createVehicle ['Old_bike_TK_CIV_EP1', [6651.96, 3260.97, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 5426.96, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object cal"
19.08.2012 17:38:12: BZO (86.141.82.38:52766) 1446da93968aa1cbfa5776c14d0ecb95 - #0 "
if (isServer) then {
_object = createVehicle ['UH1H_DZ', [6040.97, 2229.15, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 1853.04, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object call dayz_objec"
19.08.2012 17:38:12: BZO (86.141.82.38:52766) 1446da93968aa1cbfa5776c14d0ecb95 - #3 "
if (isServer) then {
_object = createVehicle ['UH1H_DZ', [6040.97, 2229.15, 0], [], 0, 'CAN_COLLIDE'];
_object setVariable ['ObjectID', 1853.04, true];
dayz_serverObjectMonitor set [count dayz_serverObjectMonitor, _object];
_uid = _object call dayz_objec"

Don't post IPs on a public forum. Guids are enough. And yes, ban every one of them for creating vehicles.

Edited August 19, 2012 by KField86

[Frop 33]

No problem with editing out the last octet of the IPs, but you still quoted the logs. :XD

[Magotchi 74]

Also, who really cares? IPs aren't sensitive information. If some silly admins IP ban them all, that's their loss. Also, in a world of dynamic IPs, editing out the last octet, unless you're issuing a subpoena to an ISP, doesn't give you any less information about the person than if you hadn't, because it still generally tells you what ISP they use and in what city.

Edited August 19, 2012 by Mister_Magotchi

[icetbag 3]

Have any of you seen or know of BattlEye: Script Restriction #195?

Can't find anything on Google...which leads me to believe it doesnt exist ;)

Edited August 20, 2012 by icetbag