Add fix-rechecker-kicking-legit-players/en.md
Browse Source
1 changed file
with 96 additions and 0 deletions
fix-rechecker-kicking-legit-players/en.md
A
| @@ -0,0 +1,96 @@ | ||
| 1 | +--- | |
| 2 | +title: "Fix: ReChecker Kicking Legitimate Players" | |
| 3 | +excerpt: "ReChecker kicking your regulars? Stop the kicks in a minute, prove ReChecker is the cause, then rebuild resources.ini from real player hashes so only cheats trip it." | |
| 4 | +category: "errors" | |
| 5 | +tags: "rechecker, anticheat, resources.ini, kick, non-steam" | |
| 6 | +image: "" | |
| 7 | +read_time: "8 min read" | |
| 8 | +--- | |
| 9 | +<p>You enabled ReChecker, or a client update landed, and now regulars are kicked on join with "WallHack Detected" or "OpenGL32 Detected". ReChecker is not malfunctioning: it does exactly what <code>resources.ini</code> says, and the rules do not match the clients your players run. This page stops the kicks, proves ReChecker is the cause, then rebuilds the rules with the log-first approach from <a href="/tutorials/install-rechecker">the ReChecker install guide</a>.</p> | |
| 10 | + | |
| 11 | +<h2>How a ReChecker rule reads</h2> | |
| 12 | +<p>Every rule in <code>cstrike/addons/rechecker/resources.ini</code> has the same shape: a client file path, a hash or keyword, a server command, and an optional flag.</p> | |
| 13 | +<pre><code>; "path" hash "command" flag | |
| 14 | +"../opengl32.dll" UNKNOWN "kick [userid] 'OpenGL32 Detected'" BREAK</code></pre> | |
| 15 | +<ul> | |
| 16 | +<li><strong>Path</strong> is relative to the client's <code>cstrike</code> folder; <code>../</code> reaches the game root where <code>hl.exe</code> lives.</li> | |
| 17 | +<li><strong>Hash</strong> is the first 8 hex characters of the file's MD5, or a keyword. <code>UNKNOWN</code> fires when the file exists with any hash not whitelisted above it. <code>MISSING</code> fires when the file is absent.</li> | |
| 18 | +<li><strong>Command</strong> is an ordinary server command, run when the rule fires. Single quotes become double quotes, and <code>[userid]</code>, <code>[name]</code>, <code>[steamid]</code>, <code>[ip]</code>, <code>[id]</code>, <code>[file_name]</code>, <code>[file_hash]</code> and <code>[file_md5hash]</code> are filled in. Writing <code>IGNORE</code> in place of a command whitelists that hash.</li> | |
| 19 | +<li><strong>BREAK</strong> stops ReChecker running any later rule's command for that player once this one fires.</li> | |
| 20 | +</ul> | |
| 21 | +<p>So there is no "log" or "kick" keyword: the third column is run as a console command, and logging means a command that only prints, such as <code>echo</code>. Anything else in the hash column is read as a (wrong) hex hash. A rule naming one specific bad hash only hits that exact file; legitimate players get kicked by <code>UNKNOWN</code> and <code>MISSING</code> rules.</p> | |
| 22 | + | |
| 23 | +<h2>1. If it is kicking everyone, stop it now</h2> | |
| 24 | +<p>Do not debug while regulars are bouncing off the server. Unload the plugin first:</p> | |
| 25 | +<pre><code>meta list | |
| 26 | +meta unload rechecker</code></pre> | |
| 27 | +<p>ReChecker allows unloading at any time (the plugin's number from <code>meta list</code> works too), and the kicks stop immediately. Do not use <code>meta pause</code>: ReChecker works through ReHLDS hooks, which a Metamod pause does not switch off.</p> | |
| 28 | +<p>Metamod re-reads <code>plugins.ini</code> at map change and restart, so a plugin that is still listed can come back. Before the map changes, fix the rules or put a <code>;</code> in front of ReChecker's line in <code>cstrike/addons/metamod/plugins.ini</code>.</p> | |
| 29 | +<p>Fixing the rules needs no restart. ReChecker re-reads <code>resources.ini</code> at every map load, so switch the guilty rules to <code>echo</code> (section 4) or comment them out, then reload the current map:</p> | |
| 30 | +<pre><code>changelevel de_dust2</code></pre> | |
| 31 | +<p>A comment must start in the very first column with <code>;</code>, <code>#</code> or <code>//</code>. An indented comment is read as a rule.</p> | |
| 32 | + | |
| 33 | +<h2>2. Confirm ReChecker is the one kicking</h2> | |
| 34 | +<ul> | |
| 35 | +<li><strong>It is loaded.</strong> If <code>meta list</code> does not show ReChecker as <code>RUN</code>, it is not kicking anyone.</li> | |
| 36 | +<li><strong>The message.</strong> ReChecker's kick text is whatever your rule says. Search for the exact words the player saw: <code>grep -n "OpenGL32 Detected" /home/steam/hlds/cstrike/addons/rechecker/resources.ini</code>. No match, not ReChecker.</li> | |
| 37 | +<li><strong>The timing.</strong> The file check is part of the connection and the commands run as the player spawns in, so ReChecker kicks land on join or right after a map change. A player kicked mid-round was kicked by something else.</li> | |
| 38 | +<li><strong>The server log.</strong> Each kick appears in <code>cstrike/logs/</code> as a <code>Kick:</code> line with <code>was kicked by "Console"</code> and the message. AMXX plugins and rcon kick through the console too, so the message is what identifies the rule.</li> | |
| 39 | +<li><strong>ReChecker's own log.</strong> Add <code>rch_log 1</code> to <code>server.cfg</code> and ReChecker writes <code>cstrike/addons/rechecker/logs/L_DD_MM_YYYY.log</code>: a line for every rule that fires (file, player, the client's hash as <code>md5hex</code>) and an <code>ExecuteCMD</code> line with the exact command run. <code>rch_log 2</code> adds whitelist hits and the full rule list at each map load.</li> | |
| 40 | +<li><strong>Not ReChecker:</strong> a disconnect reading <code>Bad file</code> plus a file name, with "Server is enforcing file consistency for" that file in the console, comes from the engine's own consistency check (<code>mp_consistency</code> and the files the game or a plugin forces).</li> | |
| 41 | +</ul> | |
| 42 | + | |
| 43 | +<h2>3. The usual causes</h2> | |
| 44 | +<ul> | |
| 45 | +<li><strong>The sample file went live as shipped.</strong> The <code>resources.ini</code> in the release archive is not a commented-out template: its rules are active and set to kick, including <code>UNKNOWN</code> catch-alls on generic names such as <code>"../log.txt"</code> ("Intelligent Detected"), which any tool writing a <code>log.txt</code> into the game folder trips. Treat it as a list of ideas and start from echo.</li> | |
| 46 | +<li><strong><code>MISSING</code> used backwards.</strong> <code>MISSING</code> fires when the file is <em>absent</em>. A rule meant to catch a cheat file written with <code>MISSING</code> fires on every clean client. To act when a file is present, use <code>UNKNOWN</code>.</li> | |
| 47 | +<li><strong>A whitelist built from one client.</strong> You hashed the file on your own install, added it as <code>IGNORE</code>, and kicked <code>UNKNOWN</code>. Every other build has a different hash: the current Steam build, <a href="/tutorials/cs16-steam-legacy-beta">steam_legacy</a>, and every non-Steam pack in circulation (<a href="/tutorials/steam-vs-nonsteam-servers">Steam vs non-Steam servers</a> explains why one server sees so many). Those players fall through to the kick.</li> | |
| 48 | +<li><strong>Rules on files that legitimately differ.</strong> Client binaries such as <code>../hw.dll</code> and <code>cl_dlls/client.dll</code> differ per build, <code>config.cfg</code> and <code>userconfig.cfg</code> differ per player, and models or sprites players may replace differ per taste. None of these can carry an <code>UNKNOWN</code> kick on a mixed server.</li> | |
| 49 | +<li><strong>A stale whitelist after a client update.</strong> Valve's updates (the <a href="/tutorials/25th-anniversary-update-recap">25th Anniversary update</a> is the big example) and new non-Steam packs change binary hashes overnight. The players who update first are the first ones kicked.</li> | |
| 50 | +<li><strong>A broken whitelist entry.</strong> Use <code>md5hex</code> from the log or <code>[file_md5hash]</code>; the log's <code>got</code> value and <code>[file_hash]</code> are the same bytes reversed. <code>md5hex</code> also drops leading zeros, so pad 7-character hashes back to 8. <code>IGNORE</code> lines must sit above the <code>UNKNOWN</code> line for that file, because ReChecker reads top to bottom. And a line that fails to parse is skipped with a <code>Failed to load "resources.ini"</code> console message at map load.</li> | |
| 51 | +</ul> | |
| 52 | + | |
| 53 | +<h2>4. The safe workflow: echo, collect, whitelist, then kick</h2> | |
| 54 | +<h3>Switch every kick to echo</h3> | |
| 55 | +<p>Keep the rule, change only the command, and drop <code>BREAK</code> while logging (on an echo line it still suppresses the rules after it). Keep <code>[name]</code> inside the quoted text, because the player's name is pasted into the command as is:</p> | |
| 56 | +<pre><code>; was: "../hw.dll" UNKNOWN "kick [userid] 'Modified hw.dll'" BREAK | |
| 57 | +"../hw.dll" UNKNOWN "echo '[rch] [file_name] [file_md5hash] [steamid] [name]'"</code></pre> | |
| 58 | +<p>With <code>rch_log 1</code> set, every hit lands in ReChecker's log even when nobody is watching the console. <code>changelevel</code> to load the edited file.</p> | |
| 59 | + | |
| 60 | +<h3>Collect for a few days</h3> | |
| 61 | +<p>Run through at least one weekend peak so you see your whole player base. Then count which hashes your <code>UNKNOWN</code> rules saw:</p> | |
| 62 | +<pre><code>grep -h "md5hex" /home/steam/hlds/cstrike/addons/rechecker/logs/L_*.log \ | |
| 63 | + | sed -E 's/.*-> file: \(([^)]*)\).*md5hex: \(([0-9a-f]+)\).*/\1 \2/' \ | |
| 64 | + | awk '{h=$NF; while (length(h) < 8) h = "0" h; $NF = h; print}' \ | |
| 65 | + | sort | uniq -c | sort -rn</code></pre> | |
| 66 | +<p>Each line is a count, a file and a hash padded to 8 characters. A few hashes with large counts are the real client builds. A hash seen from one player only is worth a look, not an automatic ban.</p> | |
| 67 | + | |
| 68 | +<h3>Whitelist the legitimate variants</h3> | |
| 69 | +<pre><code>; legitimate builds seen in our logs (example hashes: use your own) | |
| 70 | +"../hw.dll" 1a2b3c4d IGNORE | |
| 71 | +"../hw.dll" 0e5f6a7b IGNORE | |
| 72 | +; everything else: still echo only for now | |
| 73 | +"../hw.dll" UNKNOWN "echo '[rch] [file_name] [file_md5hash] [steamid] [name]'"</code></pre> | |
| 74 | +<p>After a <code>changelevel</code>, the log should go quiet for the common builds and show only the leftovers. Check the console for parse errors after every edit.</p> | |
| 75 | + | |
| 76 | +<h3>Only then kick, one rule at a time</h3> | |
| 77 | +<p>Convert a rule to kick only when the remaining unknown hashes are ones you would genuinely ban for. Change one rule, keep <code>BREAK</code> on kick lines, and read a few days of logs before the next. For client binaries on a mixed server, the honest answer is often to never kick on <code>UNKNOWN</code> and to kick only on specific known-bad hashes. Re-run the collection after every client update: a whitelist only covers the builds that existed when you made it.</p> | |
| 78 | + | |
| 79 | +<h2>Common errors</h2> | |
| 80 | +<ul> | |
| 81 | +<li><strong>Everyone kicked right after a map change</strong> - you edited <code>resources.ini</code> mid-map and the new rules loaded with the new map. <code>meta unload rechecker</code>, then fix the rule.</li> | |
| 82 | +<li><strong>Only non-Steam players kicked</strong> - a whitelist built from a Steam install, or a <code>MISSING</code> rule on a file only Steam installs have. Log their hashes and whitelist them, or drop the rule.</li> | |
| 83 | +<li><strong>Kicks started after a client update</strong> - stale whitelist. Back to echo for that file, collect, whitelist again.</li> | |
| 84 | +<li><strong>The hash is whitelisted but the player is still kicked</strong> - see "A broken whitelist entry" above; <code>rch_log 2</code> shows the rules ReChecker actually loaded.</li> | |
| 85 | +<li><strong>Kicks continue after <code>meta pause</code></strong> - pause does not stop ReChecker's hooks. Unload it.</li> | |
| 86 | +</ul> | |
| 87 | + | |
| 88 | +<h2>Verification checklist</h2> | |
| 89 | +<ul> | |
| 90 | +<li><code>meta list</code> shows ReChecker <code>RUN</code>, and <code>server.cfg</code> sets <code>rch_log 1</code>.</li> | |
| 91 | +<li>No <code>Failed to load "resources.ini"</code> lines in the console after a map change.</li> | |
| 92 | +<li>Every <code>UNKNOWN</code> and <code>MISSING</code> rule has been through a few days of echo-only logging.</li> | |
| 93 | +<li>Every legitimate hash from the log is an <code>IGNORE</code> line above its <code>UNKNOWN</code> rule.</li> | |
| 94 | +<li>After converting a rule to kick, the next few days of logs show kicks only for hashes you meant to ban.</li> | |
| 95 | +</ul> | |
| 96 | +<p>ReChecker is a file check, not a full anti-cheat. Once the false positives are gone, see <a href="/tutorials/install-cs16-server-anticheat">anti-cheat options</a> for the other layers.</p> | |
| 0 | 97 |
