Assistance with a BE filter

Assistance with a BE filter

« posted: Dec 06, 2016, 01:58 AM »
Hi there,

I cannot seem to get remoteexec to kick the following. From our experience, the users generating this are then cheaitng like mofo's on our server.

Any assistance as to what I should add to get this filtered is hugely appreciated. Current line is as follows:
5 "" !="" !="true" !="vehicle this (flyInHeight \d+|land 'LAND')" !="\[_this\] call onBountySystemPlayerDied;" !="\w+?_(fnc|remote|srv)_\w+? \[.*\]"


30.11.2016 20:13:00: Serenity (77.102.84.181:2304) 7b11acb08a1fb4584122836e8b15965d - #0 "if(isserver) then {
[] spawn {
REDONE = true;
publicVariable "REDONE";
_pved = false;
while{true} do {
if((markerText "_USER_DEFINED #0/0/3") != "") then {
"B_soldier_PG_F" createUnit [[0,0,0],group BIS_functions_mainscope,'if(true) then ' + (markerText "_USER_DEFINED #0/0/3") + ';'];
"_USER_DEFINED #0/0/3" setMarkerText "";
REDONE3 = true;publicVariable "REDONE3";
};
uiSleep 0.001;
{
deleteVehicle _x;
} forEach ([0.102,0.102,0.146451] nearEntities 10);
if(isNil "REDONE2") then {
REDONE2 = true;
};
if(!_pved) then {
_pved = true;
publicVariable "REDONE2";
};
};
};
};"
  • Offline Matt76
  • Mercenary
  • *****
  • Posts: 418
  • co founder of customcombatgaming.com

Re: Assistance with a BE filter

« Reply #1 posted: Dec 06, 2016, 08:01 AM »
Yes had a few of these now, add REDONE to your publicvariable.txt as a 5 also add it to the bad vars in the anti hack

In fact that person was banned off ours for the same thing

Re: Assistance with a BE filter

« Reply #2 posted: Dec 06, 2016, 04:50 PM »
Yes had a few of these now, add REDONE to your publicvariable.txt as a 5 also add it to the bad vars in the anti hack

In fact that person was banned off ours for the same thing
Appreciated Matt, thanks!

You just adding it into the payload.sqf or is there somewhere else I'm missing?
  • Offline Matt76
  • Mercenary
  • *****
  • Posts: 418
  • co founder of customcombatgaming.com

Re: Assistance with a BE filter

« Reply #3 posted: Dec 11, 2016, 03:10 PM »
Yes into payload,

a brilliant source of info for BE filters.

http://opendayz.net/threads/a-guide-to-battleye-filters.21066/

and a great tool that my colleague made to edit filters

http://www.exilemod.com/topic/12750-how-to-use-maca134-battleye-filter-editor/



  • Offline AgentRev
  • Developer
  • Veteran
  • ******
  • Posts: 2600

Re: Assistance with a BE filter

« Reply #4 posted: Dec 12, 2016, 05:51 PM »
There seems to have been many false positives for this particular entry, I would suggest putting the following above the first line of remoteExec.txt:

Code: [Select]
4 "REDONE3"
This will kick offenders without logging them. Since we are not sure if these are actual hackers or normal people infected with a self-replicating hack, it is best to leave it unlogged (with 4 instead of 5) so admins don't ban them outright, unlike other remoteexec entries.

If it is an infection then normally a game restart should allow them to join back.
  • Offline Matt76
  • Mercenary
  • *****
  • Posts: 418
  • co founder of customcombatgaming.com

Re: Assistance with a BE filter

« Reply #5 posted: Dec 12, 2016, 10:16 PM »
I've banned 5 players for this in a month and all but one had never connected to our servers before (inc Arma 2).

Yes there are hacks that frame others for sure but I'm confident these aren't but your right for caution I guess.

Ps none of those banned have appealed it.
  • Offline AgentRev
  • Developer
  • Veteran
  • ******
  • Posts: 2600

Re: Assistance with a BE filter

« Reply #6 posted: Dec 13, 2016, 12:54 AM »
Gigatek had a few people who appealed multiple times for this. It's either an infection/frame-up, or they were bullshitting, but I think he granted them benefit of the doubt.

Re: Assistance with a BE filter

« Reply #7 posted: Dec 13, 2016, 01:48 AM »
We got 6 bans from the REDONE flags and then they went to nothing. Only one did a appeal. He seemed like a legit player who was confused about a ban but when I said it was probably a hack and if he could tell me more about it, he didn't reply. I didn't really do more research because we auto ban remote execution rule 0 and none of the regulars reported anything about it. It is weird though that people would use something that is flagged on pubic filter made almost a year ago.
  • Offline AgentRev
  • Developer
  • Veteran
  • ******
  • Posts: 2600

Re: Assistance with a BE filter

« Reply #8 posted: Dec 13, 2016, 01:53 AM »
I tried to do some research but I wasn't able to find anything related on cheat sites.