WREX anticheat - basic tutorial

[enoch84]

As some of you know, Random54 equipped one or more of his servers with the only anti-cheat available for this game. Strangely I don't see people in the server. But if you're like me and want to try it out, I've made a little video of how to set it up. It's really really easy. It takes me about 2 minutes (maybe 5 minutes the first time).

You can't get in the server without running the anticheat, naturally. And you have to run it once (only once) before you start playing. If you play after 6 hours have past, you'll have to run it again. Rand, correct me if I'm wrong. Here you go.

http://www.youtube.com/watch?v=NsmaoxspmiU

[Random54]

EDIT: The WREX scan runs MUCH Faster if you run it before you load UT3. If you run it while UT3 is open it can take 4x as long to complete
---
If you want to have wrex run without any prompting you can edit the shortcut with the options below:
"-agree" skips the agreement text
"-language=<fr/en/it/de>" select the language
"-autoscan" launches the scan automatically at start
"-launch=<ut3/ut2004>" launches the matching game specified in the game tab (you can locate your game manually if the one found is wrong or none was found) right after the scan has ended

1. So simply create a shortcut to your "Wrex Anti-Cheat Launcher.exe"
2. Right click on the shortcut and click properties
3. In the Target field replace "MyPathToWrex\Wrex Anti-Cheat Launcher.exe"
with "MyPathToWrex\Wrex Anti-Cheat Launcher.exe" -agree -language=en -autoscan -launch=ut3
4. Click OK

So for example here is the command line I use to start wrex:
"C:\Wrex\Wrex Anti-Cheat Launcher.exe" -agree -language=en -autoscan

I put a copy of this shortcut in my startup folder so I'm ready to run UT3 when my computer starts.

*Edit*
Looks like we forgot a link to the wrex page :P
http://wrex.mangemesboules.fr/

[Random54]

Enoch to answer your qustion: After 6 hours have elapsed since the last scan the master server won't authenticate you. If this happens when you are playing then you will fail to authenticate on the next map change and will be kicked. You can now rescan with or without quiting UT3 (quitting tends to be faster) and then rejoin the server.

[DavVador]

And here's the link for downloading and all infos on the website :
http://wrex.mangemesboules.fr/

Thanks for using Wrex and thanks for the video tutorial

Do you mind if i post your video on our website ?

And a final question, could you tell me which Norton version you use, so we can try to give you a fix for the alert it sends you ?
We've been testing it with 40+ online antivirus successfully (cf. this link : http://www.virustotal.com/file-scan/...259-1325174708 ) but i guess it's more a problem with the firewall stuff included.

[enoch84]

"So for example here is the command line I use to start wrex:
"C:\Wrex\Wrex Anti-Cheat Launcher.exe" -agree -language=en -autoscan "

Neat stuff.

"Do you mind if i post your video on our website ?"

Sure go for it.

And a final question, could you tell me which Norton version you use, so we can try to give you a fix for the alert it sends you ?

18.6.0.29 Thanks.

[enoch84]

DavVador said:
"We've been testing it with 40+ online antivirus successfully (cf. this link : http://www.virustotal.com/file-scan/...259-1325174708 ) but i guess it's more a problem with the firewall stuff included."

I'm thinking most players are relucatant to try your anticheat b/c of the potential harm to their computer or privacy invasion. When I click that link it shows all the "tested" antiviruses on the page, but it doesn't show anything in the "result" column. Why is this?

Maybe you can say something else here that will relieve players of some anxiety in using your program. Thanks.

[Random54]

The page clearly states that each scanner tested the file and shows a "-" as result. This would indicate, at least to me, that nothing was found. If something was found I'm sure you'd see the name of the trojan/virus.

The only people with anxiety over using the program are most likely hacking.

[DavVador]

Random54 is right, an empty result means the antivirus didnt find anything bad with it.

Check this link :
http://www.virustotal.com/file-scan/...5ff-1304089592
In opposition to Wrex, this is a file with bad result as you can see.

I didnt manage to find your norton antivirus version online, but i found the latest release free for test (30 days trial), i'm gonna give it a try today and see if i can get the same problem as you are experiencing.

[DavVador]

Well i've been testing Wrex with latest Norton available for free on the web : Norton Internet Security 2012
This one includes firewall, antispyware and Sonar protection.

I tested with default release 19.1.0.28 and then with 19.2.0.10 after updating.

I had no warning at all with default setting, nothing being blocked, even with turning ON Sonar to "Agressive Mode".

And here is the result of the file scanning :

Scan Statistics:
Scan Time: 0 seconds
Scan Targets: C:\Temp\Wrex Anti-Cheat Launcher.exe
Counts:
Total items scanned: 1
- Files & Directories: 1
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 0
Total items resolved: 0
Total items that require attention: 0

Resolved Threats:
No risks have been resolved

Unresolved Threats:
No unresolved risks

Is the 18.6.0.29 the latest version available for your product ?
Have you tried with default settings ?

[DavVador]

Ok, i finally found Norton Internet Security 2011 as a trial, version 18.6.0.29 (same as you).
And here again with default settings nothing suspicious was found or blocked when using Wrex or when scanning the file manually.
I tried with Agressive Sonar settings, and same result.
I also made the updates (same engine 18.6.0.29 but latest virus definitions) and still the same result.

Scan Statistics:
Scan Time: 0 seconds
Scan Targets: C:\Temp\Wrex Anti-Cheat Launcher.exe
Counts:
Total items scanned: 1
- Files & Directories: 1
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 0
- Skipped Files: 0

Total security risks detected: 0
Total items resolved: 0
Total items that require attention: 0

Resolved Threats:
No risks have been resolved

Unresolved Threats:
No unresolved risks

http://www.mangemesboules.fr/divers/..._18_6_0_29.png

Seems you really need to restore default settings


Btw Norton 2012 seems to be available as a free update for 2011 users, you could give it a try maybe.

[NickG]

Hi, this is the first I hear of an anti-cheat for ut3. Can anyone please tell me how does it work, how do they know it is working, and how many cycles/instructions it takes? How taxing is it for the server and client? This game is so bandwidth hungry, Random54 is errant in statement that only hackers are anxious of running this. Many server admin are earnest for anti-cheat, but disclosure and assurance in some form would be beneficial to the cause. Otherwise it is just another thing for new players to a server to download, and thus, give up connection. Furthermore, and this is not a challenge, just another concern, how easily may we keep updated, and is the process of kicking/banning foolproof to false positives in events such as packet loss, version mismatch, 3D video driver hooks, etc.

[Random54]

Admins should be wary of running this, players should not. Basically wrex is not taxing at all on the sytem. It's a 2 part solution. 1 part is the scanner on your machine. It does a scan before you play and monitors running processes but uses virtually no resources when it's not scanning. The 2nd part is the server side mutator. When anyone tries to join the server the mutator checks with the master server to make sure that the player has wrex running, there is not a second instance of the game running, and has performed a scan. If the player has not met those criteria then he/she is kicked from the server.

So admins beware. This will mean less players playing on your server. From a players point of view however there is no problem besides minor inconvenience waiting for the scan to complete. Assuming of course you aren't cheating

As far as I know wrex only kicks in the discovery of known hacks. This avoids false positives. Any suspicious files / activities are logged for the admins behind wrex to look into. DavVador can answer this better than I can as I have yet to see it kick some one for cheating.

[DavVador]

I finally had the same problem as you Enoch with an old launcher, maybe you can try redownloading latest one here :
http://getwrex.mangemesboules.fr/

[DavVador]

Yes, Random54 explained quite well how it works.
For the server itself, there won't be any extra CPU or brandwith load (it's so little that you won't notice it).
The checks are ran clientside BEFORE you start your game, so unless you load a cheat for example after your scan, you won't feel any fps drop or lag while playing due to Wrex anticheat.

As for the kicks/ban, no kick/ban will be issued before a Wrex admin checks the logs, we have a webinterface ready for checking logs but we're testing/improving it a bit more before making a public release. This interface will allow you (us at the moment) to check if someone has been detecting cheating or having a cheat on his PC. When someone is being detected as a cheater, this information is of course 100% sure and reliable.
PL, version mismatch or 3D video hooks driver (legal ones at least) as long as they dont come with cheat related stuff wont make you be a cheater.

[NickG]

Sounds wonderful, thanks to you both for explaining.

[enoch84]

I finally had the same problem as you Enoch with an old launcher, maybe you can try redownloading latest one here :
http://getwrex.mangemesboules.fr/

Thank you for your dedication in figuring out my issue. I'll have to look into that Norton upgrade you mentioned. Did you have to add WREX to the Norton sonar exclusion list to prevent issues? I think the player called Subliminal said he also had a problem with Norton. Maybe we can find out what it was.

So it would seem WREX is virus free. The only other concern I can imagine is people's privacy...like what information you gather from their computers. In the WREX privacy policy it says these things may be gathered:

"...your IP address, MAC address, GUID, operating system informations, computer informations, game informations, screenshots and any references (path + name, encrypted hash) to suspicious files or activity..."

There's no way that WREX would be uploading people's personal documents and files, right? Their antivirus would notice this, right? I'm not too worried about this, but I'd say some people are.

[enoch84]

Norton still seems to be choking on WREX. I updated to the 2012 version, got all the recent virus etc. updates, and set all the settings at default. And even tried the other loader. The SONAR still seems to be detecting "suspicious" .tmp files like I showed you in the email. The version is now 19.2.0.10.

I made a little video so everyone else will know what we're talking about:
http://www.youtube.com/watch?v=nZ_sA...=youtube_gdata

[DavVador]

Since i redownloaded Wrex launcher, i have no more issue with the Sonar, without even adding Wrex to Exclusion List...
Did you try adding wrex launcher to the exclusion list ?
http://www.mangemesboules.fr/divers/...r_Settings.png

Did you rename Wrex Launcher (i advise you dont) ? i found out that Norton kind of blacklisted my old launcher because this file was unknown in their database...

"There's no way that WREX would be uploading people's personal documents and files, right? Their antivirus would notice this, right? I'm not too worried about this, but I'd say some people are."
Wrex doesnt even scan personal files like pictures (.jpg, .png, etc.), movies (.avi, .mkv, etc.), office documents (.doc, .xls, etc.), it scans only the files which could potentially be a cheat.
Then if and only if the file is suspicious, Wrex will log some informations about this file, but will NEVER read the content of this file (except some game files only) or upload it to us.
If somefiles were ulploaded, it would be killing too much your brandwith and would fullfill our server's hdd too fast.
We don't need your files and we don't need to have the file at our side to be sure this file is a real cheat, we have other way to detect it without needing to upload your files.

[DavVador]

When the popup from the sonar comes, can you try clicking it, i've found an option link where you can restore the file and add to exclusion right after, maybe it could be a solution too.

[DavVador]

Another solution maybe :
http://www.mangemesboules.fr/divers/Norton1.png (click Options on the top right side)
http://www.mangemesboules.fr/divers/Norton2.png (click Restore)
http://www.mangemesboules.fr/divers/Norton3.png (check Exclude and click Yes)
http://www.mangemesboules.fr/divers/Norton4.png (and close)

[DavVador]

And a final try when Wrex launcher is running :
http://www.mangemesboules.fr/divers/Norton5.png (Click Application Ratings)
http://www.mangemesboules.fr/divers/Norton6.png (Select Wrex Launcher and click it)
http://www.mangemesboules.fr/divers/Norton7.png (Click Trust)

[enoch84]

It doesn't look like I can get around what Norton is doing. WREX doesn't seem to be a threat, but just the .tmp files it creates. I might just have to let it run while I play, it might not slow things down (the constant .tmp file detections). In response to what you suggested...

http://www.youtube.com/watch?v=urMhQAUIIx0

[DavVador]

Elcrolonosios is trying to find another solution without any tmp files needed.
We'll keep you informed.

[Elcrolonosios]

I released a new version. Wrex doesn't use .tmp files anymore on Windows Vista and 7.
However there's no solution on Windows XP, thus .tmp will still be used by Wrex on this OS.

[enoch84]

All right, that's good...for us Norton users. Many thanks.

[enoch84]

I used WREX today...not a single issue. It's weird b/c I didn't download another WREX launcher. I guess I didn't have to. I'm glad, regardless. Thanks.

[DavVador]

The launcher has an auto update feature, that's why you didnt have to download the new release

[enoch84]

Got a few questions for you.
1. How do we know you're program really works? (detects hacks)

2. Will you be posting a list of active WREX users anywhere...like who is currently running it?

*unless I go to the CQ Chicago server no one knows I'm running it.

3. Are server admins able to avoid using WREX while playing at their WREX protected server?

Thanks.

[Random54]

1. Because it's detected hacks on peoples machines who have hacks. Emek for example.

2. There is a log system but its currently only for admins to look at and I'd say its alpha at the moment

3. No. You can tell an admin is running wrex because when he joins the server wrex lets you know it validates him. What you are suggesting is the wrex script flat out lies. That would defeat the purpose.

4. Yes. I really am that good at ut3.

[DavVador]

Random54 answered quite well again, thanks

1) We have a few cheaters caught already. The list will be published soon with the webinterface letting you access the logs and see who got caught or who was clean.

2) If you run Wrex on a server without Wrex mutator, people can't know you use it, unless you give them a link to your log (once the webinterface is published).
The purpose is to use Wrex on the server where you play aswell, so people can be sure who use it or not, but it's a decision of the server admins, not mine.

3) Being admin or not, the scan process is the exact same for everyone and hopefully. There is no special treatment for certain people, when you join a server with Wrex running, it means everyone here got scanned the same way.
Wrex can't detect 100% of the cheats, but it's working quite well

[Taffy]

I need the list please. Thanks.

[DavVador]

I'm sorry Taffy, the list isnt available for the public atm. This will be released as soon as the log interface will be published to public, but you'll have to wait a bit more for the moment.

[enoch84]

Random54 said:
1. Because it's detected hacks on peoples machines who have hacks. Emek for example
- I'm suprised a hacker would dare use the program, unless they think their programming is that good.

4. Yes. I really am that good at ut3.
- You look good near the end of my work week Still waiting for that youtube vid, bro. We want to see them pricey ear buds.

DavVador said:
Wrex can't detect 100% of the cheats, but it's working quite well
- So the friggin pro hackers might slip by. Like Emek I've seen some evidence that jjz hacked. I wonder if WREX would have caught him...back in 2008 when he was so "amazing."

[enoch84]

I need the list please. Thanks.

- Oh yeah. Admin crackin down on the hacksters. Now we just need Taffy to require WREX on his server...laff. There's a few people on the server that just seem to run in a straight line at me, firing with pretty deadly accuracy. Hmm.

[DavVador]

Random54 said:
1. Because it's detected hacks on peoples machines who have hacks. Emek for example
- I'm suprised a hacker would dare use the program, unless they think their programming is that good.

We had our 1st cheater caught with the very first public release when it wasnt used anywhere than on our server... and now we got a few more ones caught with cheats on their PC, so yes some people are dumb enough or just don't care, i can't tell...

DavVador said:
Wrex can't detect 100% of the cheats, but it's working quite well
- So the friggin pro hackers might slip by. Like Emek I've seen some evidence that jjz hacked. I wonder if WREX would have caught him...back in 2008 when he was so "amazing."

They might, nothing can be 100% secured, but cheaters are humans and make some mistakes like everyone at a time or another

[enoch84]

DavVador, you guys don't update the privacy policy and software license agreement frequently, right? I mainly trust you guys, but I usually don't look over those two documents every time I run WREX.

[DavVador]

Nope we didnt update it since the public release and i doubt we'll have to update it frequently.

[NitzerEbb]

I think this tool is not that suitable for public ffa-server. Most gamers just want to join as fast as possible and have some fun. Nevertheless experience shows that admins are not capable to clearly draw a strict line between high skill, pure luck or some real cheats (aimbot) and get hammered with accusations from lame players who shout cheat every map. Some good players are under "suspect" cause of that or get banned for nothing. Is is possible to make WREX anticheat mandatory for special players only as an option? So the server is still open for everybody else but the WREX tool can be updated with a player list who have to prove that they dont cheat? I think this could help admins to get better results. Just an idea...

[jomi294]

- So the friggin pro hackers might slip by. Like Emek I've seen some evidence that jjz hacked. I wonder if WREX would have caught him...back in 2008 when he was so "amazing."

You mind providing a source? I'm just curious on how conclusive this 'evidence' is.

[Oldskool0482]

JJZ was said to be caught in quakelive, I seen this big writeup on it but then again its the internet and I'm not part of that community so I can't say for sure.. As far as UT no clue but it makes you wonder.