Funcom officially denies bug/exploit investigation

Conan Exiles General Discussion
1

With the Age of Heroes, I came back to Conan Exiles, eager to try the new content and get back into the game I really love. As with most PVP servers, newer players get the typical raids and/or theft of open items.

Everyone knows (or should) you don’t put crafting stations right up next to thin walls, sandstone through black ice, because if you get them too close… another player can just reach through the wall and steal from the station.

That exploit has been around as long as I can remember. What should be safer however, is a full blown foundation or wedge wall between you and the outside world.

I’ve been enjoying exiles since the new age came out in Oct '24, but now it’s sadly time to abandon it until Funcom fixes 2 things that I just can’t live with anymore:
• Playing the intro video twice every time I login.
• Fixing the (what I’m guessing is) the old bypass the base bug, where players could race from the edge of sight to a base before the server had time to draw the walls and get inside without any encounters from walls, thralls, or golems.

Now the second bug I encountered ages (well 3+ years ago) but it only affected me once and I built larger bases to compensate with multiple layers of defense etc… well before age of sorcery. Much of those or similar bugs were fixed.

But on Feb 17 @0335, my well-defended base was robbed. Only one room, (with the work stations on the 2nd floor… none next to outer walls) with no walls, thralls, or golems damaged or attacked.

That’s well outside of PVP building damage time: (1800-2300) and about 30 minutes after server reboot.

After noticing the theft, I reported the user to Funcom, thinking it was simply a bug or exploit, that I didn’t know about, and forgot to defend against. Funcom responsed with the following reply:

" To start the investigation we require more information from you, if that’s okay. Please provide the following:

  1. A video showcasing the suspect behavior you experienced.
    2.Make sure to check out the accepted* file types and formats here.
  • Please ensure that the accused’s FuncomID is visible on the footage.
  • If the video is longer than 5 minutes, make sure to send timestamps for a swifter investigation."

You’ll notice he asks for the impossible. I wasn’t on at 0335 on Sep 17th and if I had known someone was robbing my base I would have defended it. We’ve exchanged emails back and forth but he won’t start the investigation until I send him an impossible video.

Funcom has the event log sent in screen captures, a video walk-through of the base and workstations, and a screen capture of the userid and full funcomid of the perp.

The workstations were behind 100000 HP of doors (minimum) and 200000HP of walls. There were 2 active aggressive thralls INSIDE the same room (hyena and rocnose, both alive and well) and an undamaged stone golem, 1 door away.

Obviously anyone willing to blow a lot of resources could break down the doors and kill the thralls… during PVP building damage time 1800-2300.

But this happened @0335 and no walls, doors, ceilings, thralls or golems were damaged .

With no Funcom support to either explain the event or investigate it… it makes no sense to play if my equipment can never be protected in the slightest. Normally I’d track down the cheater… but what’s the point if he can move freely through your base… maybe he has admin rights… Attempting to fight someone with those rights is silly, and Funcom won’t investigate unless I produce a video of the event, or try to find the perp on the server and follow him around with nvidia recording activated. The 30 seconds I recorded of my walk-through was around 2 Gb, so Funcom is asking for the impossible,

which puts this game pointless to play

2 Likes
2

In the grand scheme of things this does not come across as bad as you seem to think… While there are many shortcomings of the way official servers are managed (or not managed), this incident in isolation seems fairly okay.

You have to look at the other side of things… while in your case this might be the complete truth, in a very large number of cases it’s not.
Malicious players are constantly trying to play customer support with fake reports to get people banned that they have some sort of a gripe with… heck… sometimes they even fake the video evidence that they’re asking you to send, so I would never expect them to take action based on a simple event log entry of someone taking something and you arguing that they wouldn’t normally have the opportunity.

Sure, if they had a policy of restoring items for example, then perhaps this type of evidence would be enough for that, but they have a policy to not restore items for ANY reason, which means that the only possible outcome of your report is for them to take disciplinary action against someone - and for that I agree that this alone is not enough evidence. You need to understand that Funcom doesn’t have security footage of everything that happens in the game… they have access to the same event log… the rest of it is just your story.
They have no way to know that you didn’t just open your door and baited the user to take stuff from the chest to generate a genuine event log and then make up this story to frame them, it just gets complicated, especially with the nature of people playing on these servers and all the fake mass reports they get.

As far as the other stuff about the technical issues you posted… I’m not sure what’s going on in your case but normally you wouldn’t have to watch the intro video TWICE…

Sure it plays while your game is loading and once it’s done loading you can skip it, even if your loading takes way longer you will just be looking at a black screen… but it would never play twice.

The only explanation I can think of is that you actually have a mod downloaded and activated (check the Mods tab of the launcher). This would cause your game to initially start up with the mod active and when you then try to connect to an official server it would automatically restart the game to load it up without the mod - playing the intro video a second time.

5 Likes
3

OP ^ all this.

4

Of course you can’t provide evidence of something you didn’t witness and might leave nothing behind or doesn’t give all info.

One solution is for Funcom to consider is adding FuncomIDs into logs, this would save so much time for players and the Zendesk team.

If you’re lucky and the cheater doesn’t think of everything then you can capture their info later via player list at least.

But it is good practice to either take advantage of certain recording features depending on your hardware. If there’s no flexibility for capturing the last instance then recording your play session in entirety.

It’s an extra step to play on Officials but gives you the evidence immediately at your beck and call if it is present.

2 Likes
5

Blockquote You need to understand that Funcom doesn’t have security footage of everything that happens in the game… they have access to the same event log… the rest of it is just your story.
They have no way to know that you didn’t just open your door and baited the user to take stuff from the chest to generate a genuine event log and then make up this story to frame them, it just gets complicated, especially with the nature of people playing on these servers and all the fake mass reports they get.

Blockquote

I’m not expecting they have “gopros” covering every corner of the server over time. I’ve never implied nor asked for item restoration, nor was seeking retribution as I initially thought I was reporting a re-emergence of a bug.

But I’m also a software engineer, and I’ve played around with the admin settings on the solo game. To say that they don’t have access to more information seems pretty incredible, as that which is recorded in the event log was enough to make me curious. To what end could I bait a user inside my base with over a dozen thralls at 3 am to raid my workstations?

Your implication of me performing such a strange bait and report scheme is more fantastical than the robbery itself… (occam’s razor etc). And everyone I know on PVP servers by their very nature is fairly paranoid, and would avoid such a scam.

Without personal experience or evidence, your branding of most PVP players is pretty fatuous, and lends little to the discussion. You make some pretty vast assumptions about PVP people that are probably wrong:

• PVP players are malicious…
• PVP players by nature tend to make fake mass reports…

I don’t have the data analytics to discount you, but those I’ve met tend to be like me. They tend toward PVP servers for the challenge, and less population, not to be grieved or cheated against. Once again, we know the risks, and accept them, but also expect exploits and bugs to be fixed.

Funcom is refusing to investigate and unless the person has root/admin access to the underlying server and can change the event log, the evidence is pretty obvious for at least an inquiry.

Last but not least, I wasn’t saying the world is ending… just conan exiles… for me, due to the minimum (no) effort of Funcom support without a smoking gun of me actively recording someone using an exploit.

It makes no sense for me to put effort into something that can’t be protected. And that appears to be the current state of official PVP servers right now.

3 Likes
6

Weird flex but okay :man_shrugging: Is this the point where I should be counter-bragging or something?

Yes and as you can see it was also enough to make customer support curious… which is why they asked you to provide further evidence in order for them to take action based on.

That’s the part nobody cares about… people do weird things for weird unexplained reasons, case in point there is not enough evidence to ban somebody over. This is a cold hard fact.

Think of this the other way around…
If somebody went to Funcom with a log showing someone with your name accessing a container and taking items… and they claim that at the time there was no legit way for you to do that, but that’s only their theory and they don’t have any actual evidence showing you break the rules.
Would you be like “Eh! that’s fair!.. go ahead and ban my account”?
I get that you’re upset, but I don’t think you’re actually giving this enough reasonable thought… :man_shrugging:

This is literally fact… (obviously it’s not true for everyone, but there are plenty of those types of players - this is giving me the impression that you’ve been away for way too long and haven’t been paying attention) also @Kikigirl there is a longtime exclusive PvP player who has been advocating for a LOT of constructive changes for years regarding the reporting system and the way pvp servers are handled… If what I was telling you was somehow “far fetched” or if I would be excusing Funcom in some way, she would be the first to call me out for it. That should tell you something.

I am telling you that based on what you presented here… without having any horse in this race I can tell you that this was objectively one of the cases where they indeed should request more evidence and not jump the gun and ban people based on partial information. This is also good for you in a way… as if they adapted that practice too much, sooner or later you would be on the receiving end of it with your account suspended.

1 Like
7

Thanks Kikigirl for the advice but if you’ll look back at the request… it’s pretty generic and pretty impossible to EVER occur.

It would require the following:

  1. I detect the cheater is online. It’s an official server so no (legal) mods allowed. I would need to hover over the player list indefinitely.
  2. I haven’t installed transportory stones at my 3 main bases so I’m continuously running between them on horse.
  3. I manage to find the cheater at one of my multiple bases (far and wide) without him detecting me recording him.
  4. The cheater proceeds to exploit or use their cheat to enter my base unknown to any of a dozen thralls wandering about the bar, beds, heating crucibles, shrines, or guard stations. There also happen to be 6 archers on permanent lookout and a golem.
  5. I’m recording my play at 2Gb / 30 seconds and am watching this possibly unseen or undetectable cheater WITH HIS FUNCOMID on display. Or I keep showing the player list to cross-reference the name vs the funcomid.

This all happens while I’m online and recording… somewhere in the 24 hours a day, as his robbery happened at 0325, so PVP building damage restrictions don’t matter or are not affected by this bug/exploit. Normally I could limit my search to 5 hours/day, but not now. :frowning:

So Funcom is saying, we refuse to investigate unless a self-proclaimed cheater comes forward with such a video. :confused:

1 Like
9

Xevyr,
I’m not flexing about my background, but you act and imply I haven’t thought things through.

A simple check of the event log versus my screen captures would show I’m not lying. Counterbrag all you like, but having been in the industry for more years than I care to list, there are logs and/or telemetry much more precise than the event log.

Most modern MMO games record up to 30 days of nearly every event on the server. Microsoft heavily uses HTTP to record all major events in their Flight Simulator (40th edition, but unlikely it’s changed in 2024) such that you can actually plot a player’s virtual location on the planet with latitude and longitude, speed, and altitude for every flight they perform during a play session.

Block-quote[quote=“Xevyr, post:6, topic:272001”]
That’s the part nobody cares about… people do weird things for weird unexplained reasons, case in point there is not enough evidence to ban somebody over. This is a cold hard fact.
[/quote]

I don’t know what is or is not a cold hard fact and neither do you unless you’ve personally administered an official production server.

That doesn’t mean funcom has embedded the same information on their servers or even something similar, but all it takes is a glance at the console commands available, that much of that similar information can be logged if not readily available.

I made no recommendations about the incident other than investigate it. I’ve been told by Funcom they won’t, until they get a self-proclaimed cheater sharing video of them exploiting the cheat.

So that’s where it ends at impasse. I can’t provide an impossible video to Funcom and they won’t do any further investigation until I do.

I’m just expressing my disappointment not seeking an argument with you.

1 Like
10

Dzonatas,
Are we talking about the same game? I’m not aware of any goggles or libraries or Meta being involved. I know of no server that allows more than 10 players in a clan but could be wrong.

This cheater is clanless though.

This was on an official PVP server that I won’t name as I’ve avoided any doxing or unfair accusations per Funcom’s rules.

11

I’m on the OP side on this one - for a casual player it is impossible to feel safe in such conditions - I mean cheaters going rampart and honest players have what? Be constantly online, record, check ID (good luck if it’s someone on a speedhack, for example)? I understand that support must be careful and cannot hand out bans left and right, but let’s look at it from the other side - the cautious nature of support left honest players helpless.

2 Likes
12

Technically, yes. The topic is generic, so thankfully I could use some terms that make it easier to convey.

13

I wish it were that easy, and yes I did have a mod active when they brought the patch in January. But after disabling the mod, removing the mod, then just completely re-installing the game, the intro video will play twice if left unattended. Once on boot, then on selection of the official server, or solo play. You can bypass the video once the steam overlay notification flashes.

I’m not sure what other troubleshooting to try after re-installing the game :confused:

14

I’ve been in this fight for a long time dude, I’m not dismissing how ridiculous the situation is, because it is. Like you, I agree that their logs should give them the evidence that is required in this case. But the question is, what are the limitations?

Take for instance player names. There can be 10 mega chads called “Deathblood98” and the system might only log that. Which Deathblood98 was it? Add in that you can recreate character on a server which allows all kinds of loopholes.

The FuncomID is the clincher and based on my experience from the outside looking in and other players, this probably isn’t taken into account.

Which means that their process requires proof, as unfortunate as it is.

It isn’t ok but you either learn to live with it and implement precautions and your own processes or stop playing on Officials.

Such things as never logging out with gear in any accessible container or your body. Always within locked containers. Obviously, I know, hell I freaking know, you SHOULD be able to assume protection outside of raid hours. But there’s always some exploit, new, old, reappears.

I think a lot of stuff about this XD but eh, here we are.

My suggestion re: recording was not for you to stay up and online 24/7, it was for when you were playing in case someone does something, so you do have proof if it happens in front of your eyes.

All this is unfortunate and while I am upset for you because I know what it is like I’m also of the opinion, just as @Xevyr pointed out, that the reporting system requires these checks and balances as a baseline. He gave you examples such as if the tables were turned.

I’m not going to tell you what to do but man, this has been ongoing since September with them not budging. It might be time to let this particular instance rest. Learn from it, adapt, keep informed and be vigilant. Or not. I’m surprised they’ve interacted with you for so long frankly o.o

1 Like
15

That’s a different story though, that’s not what “OPs side” is in the context of the above back and forth discussion. OP was arguing that the information they provided to Funcom should be enough to go on, but it’s not… they literally told him it’s not so it’s not like it’s a mystery and we’re guessing here.

As for what you said, I don’t think anybody here is of the opinion that the system is somehow perfect and doesn’t have major flaws. The entire way those servers function and the way administration is handled is just bad from the perspective of the player in a certain way and definitely not the golden standard of online gaming where you want to ensure fair play.

But, within the confines of the system that we do have and in the proper context, they won’t be getting any further with this report whether they accept that or not and that is just a fact based on hundreds of previous examples, Funcoms process and the fact that customer support literally told them it’s not enough information to act on.

All I was pointing out is that within the context of reality… that’s correct and it was not some ridiculous response from them like you would sometimes get in way more black and white cases, but rather reasonable if we consider all the angles.

1 Like
16

Sounds alot like the exploit or hack that people can use to basically remote access players inventories, crafting stations and chests. Been around for some time and maybe…just maybe…in this year of “improvements” well see a proper fix.

But yeah, Funcom does appear to not taking cheating/exploiting quite as serious as they should.

3 Likes
17

Yea, it does sound like that

18

I’ll log in to refresh decay timers, and I think I understood your suggestion about the video… I’ll have to figure out how to keep the last 30 seconds or minute of gameplay in my recording or my drive will fill up quite rapidly.

I was hoping to hear better news than sequestering everything off of workbenches… but I did want feedback from other players as well as see if there were better solutions or if funcom had better responses. Will I bother to keep playing? Not sure right now, but thanks for the feedback.

Knowing I’m not the only one frustrated by the response soothes the pain a bit :slight_smile:

1 Like
19

nvidia shadowplay can do that (game overlay / nvidia app), but Steam also introduced a similar system not long ago which looks like this

image
image830×703 70.3 KB

I already had the nvidia one set up before they launched this so I stuck with that, but gave it a quick test and it seems to work pretty fine.

1 Like
21

Could be someone logged off at that place a while a go. Logged in and spawn inside base. After raid hours, followers dont attack.
Did he raid locked chests, then probably hacker.

I was playing on xbox. Event log could not be used as evidence.
Someone could get friend in singleplayer. Create character with enemy name.
Get friend to do illegal stuff and report, as if it was enemy on official…

2 Likes
22

Bambere,
Those are good observations, but don’t fit the scenario. While followers do switch to scout mode if logged off or disconnected, placed fighter thralls will attack when the aggro range is met with a non-clan member (even wandering monsters). The minimum distance listed is 5 meters and all workstations in that room were within range of my hyena and/or rocnose.

The server itself doesn’t have a plethora of players and is usually empty. This is just black box observation of the event log and it appears to default to the first part of your funcomid prior to the # if you don’t specify otherwise.

Funcom is giving us a cop-out, bull-crap, response because they don’t WANT to investigate. There are not 10 or 100 or 1000’s of users named ‘joeshmoe’ and they can’t decipher whether it’s joeshmoe#1, joeshmoe#2, or joeshmoe#3 etc.

They have a list of funcomid’s that were online the server at that time and know the user who did it, but CHOOSE not to “investigate” due to (improbable but barely plausible) deniability to the rest of the server population and players at large.

I’m not sure why they think it’s a waste of time to pursue cheaters, but they do.

How you decide to react to that information is entirely up to you, but let’s not pretend a sophisticated, multiplayer, international game published worldwide does NOT have the capability to enforce the basic rules of the game. They either have accepted the exploit/bug and refuse to fix it or they simply lost the programmers that do know how. I’m sure the code is probably spaghetti after 8+ years, but giving Funcom a pass for this server mismanagement is something to accept or not.

I typically give developers benefit of the doubt, but in this case it’s too obviously a cheat or exploit… and too obvious their response which is nonsense.

Once again, how you decide to react to this information is up to you. For now, I’m taking a wait and see approach, fully aware that they aren’t supporting the game or bug reports.

But this also will determine whether or not I’ll shell out money for “Dune: Awakening” or future titles.