HOWTO: Use publicvariableval.txt to auto-kick players with hacked weapons

[Magotchi 74]

this morning, the log file is spammed with every player save and with the truncation, I can't tell who's got what.

Yeah. That's unfortunate, but I believe necessary, to get the best behavior out of it. When you see a value restriction matching the lines in your publicvariableval.txt, that's a hacked item kick.

Edit:

This is incorrect information. There is no need to add anything to publicvariable.txt for this.

Edited September 27, 2012 by Mister_Magotchi

[dolph 41]

It looks like no one has tried to connect with scripted weapons since I updated with your code.

I'll just wait it out and report back.

[dolph 41]

I had two try to join in the past half hour or so and they disconnected immediately but nothing in the log.

The log doesn't appear to be showing the playersaves of the people getting disconnected either.

EDIT:

Why doesn't this save to it's own log file?

Edited September 25, 2012 by RS-Dolph

[NarcoticSuite 2]

I take it the M4A1_Aim_camo isn't the M4A1 CCO with the woodland pattern?

[Magotchi 74]

Regarding my post for DCBL filter compatibility:

I did some experimenting. I added '1 "\""' to the end of publicvariableval.txt and removed the '1 "dayzPlayerSave"' from publicvariable.txt, and every dayzPlayerSave which included any items still showed up (as they all contain double-quote marks around each item class name). This therefore means that having an entry for dayzPlayerSave in publicvariable.txt is not necessary.

Sorry to mislead people in the first place, but I thought the dayzPlayerSave was necessary originally. I have so many layers of protection on my server, I don't often get people that trigger Venthos' detection, so it takes a bit of time to experiment with it properly.

[dolph 41]

I took out the daysPlayerSave, updated the CBL and put each item i want blocked on it's own line and I've seen the Public Variables Script Restriction kick a few times now this evening.

Also, with each item on a separate line, is the script ## reflected in the line of the .txt file minus the commented out lines?

I've seen two AS50 TWS's try to join and they had the same number.

I'm waiting for something else to show up to see if they have different restriction ##s.

[Magotchi 74]

Also, with each item on a separate line, is the script ## reflected in the line of the .txt file minus the commented out lines?

Yes, but the numbering starts with #0. The first non-commented line in publicvariableval.txt corresponds to #0. The 5th non-commented line corresponds to #4. The way the DCBL does their comments, they put the number added at the end of each comment line (like "//+4"), also. That means that if you subtract 4 from lines after it, you'll get the logged detection number. For further example, as the current publicvariableval.txt has 44 lines, 4 of which are comments, for your 45th line (where your hacked item detection entries start), you subtract 4 (due to 4 comments) and 1 (due to numbering starting with 0), which means your first hacked item detection (on line 45) should be #40.

Edited September 26, 2012 by Mister_Magotchi

[Torndeco (DayZ) 46]

No need to add anything in publicvariable.txt, incase anyone else is slighty confused..

I ended up testing it out by kicking & logging for itempainkillers, while the server was empty.

Works very nicely, now i just need to whip up a list of hacked in items for lingor and i am all set

[polli 57]

I have tested the file and use Mister Magotchis files to merge them together. All is fine and i had a kick for an AKS_74_Kobra. So I commented out the line. No problem.

The script found someone with a Laserdesignator and kicked him. All good.

But today I had a player on my server with a MakarovSD and a BAF_AS50_TWS and he was not kicked. He was not in the log file like the others. I see him only in the rpt file.

Any ideas? Maybe a bypass?

The M249, AKS_74, M107 and MK_48 isn´t a good choice because it kicks also for the regular items as M107_DZ. Or am I doing somethings wrong?

Edited September 27, 2012 by Polli

[Magotchi 74]

I ended up testing it out by kicking & logging for itempainkillers, while the server was empty.

You can test on a full server; just use 1 instead of 5 for each entry.

Polli:

If you're using "\"ITEM_CLASSNAME"\", I don't believe an M249 entry should detect the regular M249_DZ, because a backslash followed by a double quote is the escape sequence for a double quote, meaning the entry is actually searching for the classname surrounded by double quotes.

If you aren't sure, you can put a 1 on that entry instead of a 5 and check the inventories of the people as they're detected for it.

Edit:

Should be "\"ITEM_CLASSNAME\"", not "\"ITEM_CLASSNAME"\".

Edited September 27, 2012 by Mister_Magotchi

[polli 57]

Ok. Then there must be an other entry which is not shown in the log. The lines in publicvariableval.log are shorter than the rpt entrys.

But whats going on for the AKS_74_Kobra kick? And why wasn´t there a kick for a BAF_AS50_TWS?

[Magotchi 74]

I'm not sure. With the exact settings in my current instruction post, a lot of people on my server get kicked for BAF_AS50_TWS (currently #41), and I haven't seen anybody get kicked for AKS_74_Kobra.

[Magotchi 74]

I figured it out. People are being kicked for normal stuff. There was an error in my filter example.

Where it should be ' \"" ' at the end of each line, I have ' "\" ' at the end of each line.

Once again I gave out bad advice... Sorry again. It's corrected now.

Edited September 27, 2012 by Mister_Magotchi

[Magotchi 74]

I brought up-to-date the list of invalid items detected on my server since August 19th and the instructions based on it.

[eibot 0]

We loaded this on our server but don't gt any kicks for banned weapons. We are testing with the AS50 TWS.

The server is our own managed server. We added the suggested file to the Battleeye directory and restarted the server, but nothing happens.

Any suggestions? Do we need to change settings somewhere else to tell the server to load/check the .txt files in BE directory?

[Hamstafari 0]

I'm wondering why CarHorn is in this list, because, if you are in UAZ for example and you press "Esc" you will be kick from the server.

Can u explain the reason ?

Thx and nice job for your list, it's very helpful

[Bushman (DayZ) 25]

You guys should be banned for possessing an as50 tws regardless the reason why you had it,everyone should be treated equally.

[gr8-white 1]

bushman....quiet pls....the grownups are talking.

[bvrettski 2]

Can't seem to get this to work. I have a HFB server I copyed and posted it in to the file but 10min on the server with a AS50 TWS and still no kick

Same issue here...HFB server....we have added the file and run it for five days now but it has not created a log file that reports anything.

[Magotchi 74]

I'm wondering why CarHorn is in this list, because, if you are in UAZ for example and you press "Esc" you will be kick from the server.

BikeHorn is also in the list, and I know I've jingled the bike's horn quite a few times since adding this filter, and I haven't been kicked. I don't believe you should ever have CarHorn in your inventory while using a car.

[venthos 605]

I don't believe you should ever have CarHorn in your inventory while using a car.

Basically this. The only time you're going to see "CarHorn" show up in a publicvariable value is if someone is doing something wonky. Just by putting a name of something in quotes in publicvariableval.txt doesn't mean any time that text is mentioned anywhere in any code that you're booted out. I'm not at home to check the DayZ code to see if there's even a weapon/magazine of such name that could possibly be in a player's inventory. But, if so, it's worth blocking.

[Magotchi 74]

I'm not at home to check the DayZ code to see if there's even a weapon/magazine of such name that could possibly be in a player's inventory.

If you look at my list, which is just based on my RPT logs, 29 people have joined my server with an item having "Horn" in the name since August 19th, so it's certainly possible to have in one's inventory; it's just not legit.

[Torndeco (DayZ) 46]

Incase anyone interested in a list for lingor, made up a pretty full list @ http://code.google.com/r/torndeco-lingor-scripts/source/browse/filters/publicvariableval.txt

Note above is made for a lingor server....

I used the following to make up a list & then compared it against lingor code to see what is legit...

http://www.armatechsquad.com/ArmA2Class151656165165341654165165165165f/index.php &

http://bafdom.myfreeforum.org/archive/arma-2-oa-baf-pmc-weapons-list__o_t__t_39.html

edit also found another spot to look at @ http://www.ofpec.com/COMREF/index.php?action=read&id=210 has more random stuff i.e evmoney / carhorns etc... havent got a chance to add anything from it yet...

[dolph 41]

I have HFB and it's working fine.

Here's my current publicvariableval.txt

//1 "" //+2
1 "draw"
1 "hint"
1 "create"
1 "add" !"ladder"
1 "remove"
1 "delete"
1 "set"
//1 "play" !"playmove" !"player" !"dayzPlayerSave" //+3
1 "clear"
1 "disable"
1 "copy"
1 "switch" !"switchmove"
1 "text"
1 "init"
1 "hide"
1 "group"
1 "icon"
1 "marker"
1 "server"
1 "compile"
1 "loadFile"
//1 "say" //+4
1 "call"
1 "move" !"switchmove" !"playmove"
1 "chat"
1 "fade"
1 "action"
1 "exec"
1 "mission"
1 "kb" !"FoodCanFrankBeans"
1 "side"
1 "show"
1 "task"
1 "allow"
1 "enable"
1 "spawn"
1 "for"
1 "this"
1 "format"
5 "_YakB"
5 "callVar"
5 "rspawn"
5 "\"G36C\""
5 "\"M4A1_Aim_camo\""
5 "\"m107_TWS_EP1\""
5 "\"M8_sharpshooter\""
5 "\"G36_C_SD_eotech\""
5 "\"Laserbatteries\""
5 "\"BAF_AS50_TWS\""
5 "\"AK_107_kobra\""
5 "\"AK_107_GL_kobra\""
5 "\"AK_107_GL_pso\""
5 "\"AK_107_pso\""
5 "\"AK_74_GL\""
5 "\"AKS_74_pso\""
5 "\"AKS_74_UN_kobra\""
5 "\"G36K\""
5 "\"M16A4_GL\""
5 "\"M16A4_ACG_GL\""
5 "\"M4A1_HWS_GL_SD_camo\""
5 "\"M4A1_RCO_GL\""
5 "\"M4A1_Aim_camo\""
5 "\"Saiga12K\""
5 "\"Pecheneg\""
5 "\"RPK_74\""
5 "\"KSVK\""
5 "\"M40A3\""
5 "\"M4SPR\""
5 "\"MakarovSD\""
5 "\"M4A3_RCO_GL_EP1\""
5 "\"m240_scoped_EP1\""
5 "\"M249_EP1\""
5 "\"M249_m145_EP1\""
5 "\"M60A4_EP1\""
5 "\"Mk_48_DES_EP1\""
5 "\"M24_des_EP1\""
5 "\"SVD_des_EP1\""
5 "\"SVD_NSPU_EP1\""
5 "\"revolver_gold_EP1\""
5 "\"Sa61_EP1\""
5 "\"UZI_SD_EP1\""
5 "\"BAF_L110A1_Aim\""
5 "\"BAF_L7A2_GPMG\""
5 "\"BAF_L85A2_RIS_ACOG\""
5 "\"BAF_L85A2_RIS_Holo\""
5 "\"BAF_L85A2_RIS_SUSAT\""
5 "\"BAF_L85A2_UGL_ACOG\""
5 "\"BAF_L85A2_UGL_Holo\""
5 "\"BAF_L85A2_UGL_SUSAT\""
5 "\"BAF_L86A2_ACOG\""
5 "\"BAF_LRR_scoped\""
5 "\"BAF_LRR_scoped_W\""
5 "\"Laserdesignator\""
5 "\"Soldier1_DZ\""
5 "\"Skin_Soldier1_DZ\""
5 "\"TruckHorn\""
5 "\"BAF_ied_v1\""
5 "\"SmokeShellOrange\""
5 "\"TimeBomb\""
5 "\"SportCarHorn\""
5 "\"M249\""
5 "\"M107\""
5 "\"Mk_48\""
5 "\"bizon\""
//1 "request"

[polli 57]

I figured it out. People are being kicked for normal stuff. There was an error in my filter example.

Where it should be ' \"" ' at the end of each line, I have ' "\" ' at the end of each line.

Once again I gave out bad advice... Sorry again. It's corrected now.

You made my DayZ. It´s working now :)