So recently I purchased a Screamer PCIe from LambdaConcept. Personally, I would not recommend buying one of these as two of the three cards I purchased were dead on arrival. However, thanks to the one device that did work, I have been given an opportunity to once again approach attacking…
How to create a Remote Execution
Arma 3 Remote Execution is considered one of the few peaks of script-based cheating. For server owners, cheaters with remote executions can be a real pain. It is important that every script developer understand how remote executions are created so they can avoid allowing these vulnerabilities to exist in the…
TFAR Code Execution
Everyone who has played Arma for an extended period has come across TFAR, Task Force Arrowhead Radio. I am not going to go into how the mod works, you can check it out here. I am going to dive directly into the code that drives TFAR, and do my best…
Lazy Eval Execution Exploit
Recently I have been interacting directly with some guys at Bohemia Interactive. With the latest update, BIS_fnc_parseNumberSafe hasn’t been as safe as it should have been. A few great discussions later and I am hopeful that the guys at BI have it right this time, finally patching that multi-year vulnerability….
Arma 3 “Old Man” SQF Execution Exploit
With the “Old Man” update out now, I decided to take another look at the Functions and UI scripts to see what fixes they implemented, and to look for a new exploit for SQF execution. To my surprise, I was greeted with BIS_fnc_parseNumberSafe. This neat little function is a “fix”…
Pre-Connection Remote Execution
I have covered remote execution in the past. Everyone by now knows that any remote execution cheat is brutal to the security of game servers in Arma. The developers have made strides to block unlogged and unfiltered remote execution, and they have come a long way since Arma 3 Alpha….
Breaking the SQF Firewall
One of the least discussed issues with the Arma 3 Engine, Real Virtuality 4, is the Engine & the Developer’s inability to protect game servers from its own scripting language. For the last 3+ years, I have been abusing the scripting language & its intricacies to execute SQF code wherever…
SQF Genetic Algorithm
Oh yeah, it is time. So I have been looking into machine learning and decided I should dive head first into genetic algorithms. The concept was easy enough for me to wrap my head around. As a prefix, this SQF code was based on a python script written by Joeseph Misiti….
Overriding the Official Server List in ArmA 3
There is a little-used feature in the ArmA 3 Multiplayer Server list that shows all of their “Official” servers. Currently, there are ~100 players on the official servers. These host games from Endgame to Zues. Stokes figured out how to override this list with the official servers for our mods….
extDB2 Exploit And Why You Should Use SQL_CUSTOM_V2
If you run a Life Server you probably use extDB2. It is a wonderfully optimized and amazingly useful plugin used for Database connectivity. The problem with many life servers is they use SQL_RAW (mode 2), which take a string from SQF and executes it in the mySQL database. This inherently…
ArmA 3 UI Execution Exploit – In Detail
EDIT: The latest patch (0.66) has fixed these issues. This post should now be used to learn how to better prevent these forms of exploits from appearing in your missions and mods. Now that BI has fixed the issue in its latest Dev Patch I wanted to go over, in…
Blocking Scripted Remote Execution
Recently, there have been a lot of server file leaks. The way cheaters obtain server files has always been the same. Remote Execute some code up to the server that retrieves data and returns it back to the cheater’s client. Upon receiving data the cheater writes it to their log…
Server password bruteforcing
I spent the last two days working on a method for stealing server admin passwords. I figured if I used the altis life database injection that I talked about in my previous post I could inject a server and have the bruteforce run for weeks on end until it finds…
What do cheaters use on ArmA 3 servers?
This post comes after I asked /r/ArmADev for suggestions and subsequently got down voted to hell for what, in my opinion, is a fair dislike towards me in the community. I will be responding to the suggestion posted by /u/otherworldlyBuffoon Here is the post. So what kind of attacks do…
Advanced script variable hiding.
I needed to find a new way to hide global variables from being accessed (Or even found for that matter) from threads that are not created by me. This is useful for Anticheats as it allows them to access and modify values from multiple threads without subjecting those values to…
Having AI run after and kill you.
I have been working on a Zombie-like system inside arma 3 and want to have the AI chase after my player and kill me. This should be very simple to do, however I failed to find a good way of doing it with the built-in AI scripting commands. I did…
How to detect hint menus
The worst nightmare for any anticheat developer is coming across a cheat that is nearly impossible to detect. Hint menus are one such cheat. There is no way to disable the “hint” command and no way to detect what is being displayed in the current hint. So how would an…
Manipulating vehicle locality
A while ago I was working on a system that would allow me to manipulate remote objects as if they were local to me. In other words, I wanted to use commands like “setDamage” or “setVelocity” on objects that were created by the server. I found that vehicles were the…
How do Anticheats work?
A lot of people don’t understand how scripted anticheats like Infistar AntiHack work. The idea behind scripted anticheats is simple and effective. They rely on three key features. Randomizing variables Using local variables effectively Sending code to clients in a randomized heartbeat fashion Randomizing Variables Any variables that can be…
Securing publicVariableEventHandlers
A big issue with most game modes in ArmA 3 is how they handle network messages. Most servers I have come across do nothing to protect publicVariableEventHandlers and remoteExec calls. Now before I get started I will mention that there are many different ways to secure network messages and I…
C# Arma Extension command parsing
I spent a good portion of time last year working with server extensions in arma 3. I wanted to create a simple way to interface the script and the extension and to make adding functions into the extension as simple as possible. I came up with Command Requests as a…
Draw3D Interactive Menu
A few months ago I was looking into making a user interface with the draw3d mission event handler. I was looking into using keybinds to interact with the menu and found that they were, more often than not, not so user friendly. Instead I opted for a way to interact…