Warden and 'The Governor'

[Harko]

maybe a good idea to add what is scanned.

The following memory addresses are watched:

00491b6d, len: 5
004b3eb6, len: 5
006ed528, len: 5
0077e47e, len: 5
00613cb0, len: 6
008d8926, len: 6
008daa37, len: 6
004a4492, len: 7
00670adc, len: 7
00699ffc, len: 8
0096e180, len: 8
00972f88, len: 8
009a9a7c, len: 8
00fc194c, len: 8
00420116, len: 10
00495e60, len: 12
00498ec0, len: 12
008db3ab, len: 12

The following tools are detected:

CheatEngine 5.5
EmuHacker 5.0.4.5
ICanHazSpeed
WoWPorty 3.4

there are more, these are just the ones I tested

[shingetterrobo]

[TEXT] read 5 bytes at 004B3EB6 // frame xml patch
[TEXT] read 6 bytes at 00613CB0 // Set Move State patch
[TEXT] read 7 bytes at 00670ADC // follow unit patch
[TEXT] read 7 bytes at 004A4492 // lua protection patch
[TEXT] read 5 bytes at 0077E47E // lua protection patch
[TEXT] read 5 bytes at 006ED528 // unknown (camera related?)
[TEXT] read 8 bytes at 00699FFC // movement related (fall time?)
[TEXT] read 12 bytes at 00495E60 // PrintChatMessage
[TEXT] read 5 bytes at 00491B6D // Language Patch
[TEXT] read 10 bytes at 00420116 // WS2_32.Send
[TEXT] read 12 bytes at 008DB3AB // movement related (set movestate)
[TEXT] read 6 bytes at 008DAA37 // No Fall Damage patch
[TEXT] read 12 bytes at 00498EC0 // SendChatMessage
[TEXT] read 6 bytes at 008D8926 // movement related

[RDATA] read 8 bytes at 00972F88 // wall climb
[RDATA] read 8 bytes at 009A9A7C // jump velocity
[RDATA] read 8 bytes at 0096E180 // gravity

[DATA] read 8 bytes at 00FC194C // blizz authenticator

[Baelzebub]

Lazy...i dunno about that man. More like why bother? You are well aware as much as anyone that they can shut down 'almost' any botter/hacker if and when they choose to. Keep it safe, keep it hidden to paraphrase a wise man but where would capitalism and making a profit be if everyone done that?

[Cypher]

No, they can't. Warden's memory scanning is a joke, its so severely under utilized. Scanning all read-only memory would **** up a lot of the private hacks that aren't using a warden bypass. Also, it would intimidate newcomers a lot more which is always a good thing.

Currently its just "don't modify any offsets on this list and you'll be safe". Sorry, but the only reasons I can see for that is laziness, or performance concerns (aka stupidity, because they obviously haven't actually tested scans like that and realized they're not noticeable at all).

[Harko]

As written here:

[Only registered and activated users can see links. ]

I wouldn't use model edits which are based on modifications on the following files

World\Maps\HellfireRampart\HellfireRampart_28_34.adt
World\Maps\PVPZone04\PVPZone04_30_29.adt
DBFilesClient\CreatureModelData.dbc
World\Maps\PVPZone04\PVPZone04_29_30.adt
World\Maps\PVPZone01\PVPZone01_32_29.adt
World\GENERIC\PassiveDoodads\ValentinesDay\ValentineBasket_01.m2
World\Expansion02\Doodads\Stormpeaks\IceShards\FrostGiantIceShard04.M2
World\AZEROTH\ELWYNN\PASSIVEDOODADS\Campfire\ElwynnCampfire.m2
World\Maps\PVPZone01\PVPZone01_32_30.adt
world\maps\stratholme\stratholme_38_25.adt
world\maps\stratholme\stratholme_38_24.adt
World\Maps\Kalimdor\Kalimdor_29_9.adt
world\goober\g_fishingbobber.blp
World\Generic\Human\Passive Doodads\BeerKegs\BeerKeg01_NoCollide.M2
World\Generic\PASSIVEDOODADS\DuelingFlag\DuelingFlag.m2

seems they care more about some lame "lets exchange campfire with dark portal model" hacks as on real problems.

[Inphared]

Well... I feel like a newb. When I did a scan before I didn't find anything but I did another scan of the threads and found one that had a bit of information in regards to warden.
I want to post this link incase anyone wants further information not discussed in this thread. [Only registered and activated users can see links. ]

[Apoc]

Originally Posted by TheUmrba

Yes you're right it is somewhat a joke in terms of implementation.

But is it laziness they have no code to stop people loading hacks or preventing people from playing with a modified game client? Even though these technologies exist already and are not difficult to implement, Blizzard still sticks with their old ways of absolute scans and extreme punishment against those caught.

The way I see it is now Warden has become a legal tool, they require absolute scans so they have statistics behind which hacks are being used. It's difficult for them to claim damages in a court room without numbers...

In this case warden 'is' spyware. Just because hacks sit in the gray area, Blizzard believe they have the right to scan your entire PC for anything they want, and persecute depending 'if' they find what they're looking for.

No. Blizzard believes they have the right to scan anything within their own process space. Which they do.

Get your head out of your ass. Blizzard *may* have been spyware back when it was actually reading window titles and process names, but it hasn't done that for what? 3 years?

Warden is polymorphic. You DO know what that means right? It can change whenever they damned well please, and they can allow it to do whatever they damned well please. However, they will not leave WoW's process space in doing so.

[MasterGold]

Originally Posted by Harko

As written here:

[Only registered and activated users can see links. ]

I wouldn't use model edits which are based on modifications on the following files



seems they care more about some lame "lets exchange campfire with dark portal model" hacks as on real problems.

Maybe they want to prevent those easy-gold-farming-and-cheating-in-bg but don't really care if you change the world for pleasure [Only registered and activated users can see links. ].

[Cypher]

Originally Posted by MasterGold

Maybe they want to prevent those easy-gold-farming-and-cheating-in-bg but don't really care if you change the world for pleasure [Only registered and activated users can see links. ].

Did you even read his post?

He wasn't referring to cosmetic model edits as the "real problems".

[Cypher]

Originally Posted by TheUmrba

K. I'm sure you know a lot more about it than me.

I see what you did there.

Anyway, I know who you are so I'll address your concerns. (Sorry, but I disagree with you.)

"The way I see it is now Warden has become a legal tool, they require absolute scans so they have statistics behind which hacks are being used. It's difficult for them to claim damages in a court room without numbers..."

There's nothing stopping them from doing dual scans. Scan for specific hacks and count the numbers, but also do generic scans and ban off those too. You get the best of both worlds with practically zero downside (oh noez! an extra handful of precious cpu cycles! ).

"In this case warden 'is' spyware. Just because hacks sit in the gray area, Blizzard believe they have the right to scan your entire PC for anything they want, and persecute depending 'if' they find what they're looking for."

Even at its invasive point, its not like Warden sent back personally identifiable information. As long as the hashes are coming from their servers to me, and not the other way around, I don't see a problem. At any rate though, the phrase "entire PC" is a tad broad don't you think?

[amadmonk]

Of course, if someone really wanted to throw a wrench into this, they could broach the question of the dubious legality of shrink-wrap EULA's (the Glider case was a step back towards allowing ever-more-oppressive EULA's, but there's considerable pushback in the other direction, too).

Since the entire premise of the Warden is based upon the idea that "to license our software you have to agree to the EULA, and we can put ANYTHING in the EULA," this invites a one-sided and ever-increasing encroachment upon consumer rights in the name of protecting "intellectual property."

Of course, that being said, the net effect of Hoglund's hew and cry was, in my opinion, positive. Although it gave a lot of noobs a lot of bad ideas, it also had the effect of discouraging commercial bots and hacks (which is, imo, good -- bots and hacks are only really useful in that they make you "special" compared to other players... you can fly or whatever... and when EVERYONE can do it, it's not "special" anymore) and (important to a civil liberties wonk like me) letting Blizzard know that there are limits.

This last bit is important because while, true, what they're doing is not terribly invasive, there's nothing technical to stop Blizzard from getting super invasive. In fact -- since most people run most apps as admin/root due to lack of knowledge -- there's nothing technically stopping them from going a step further and saying "hey, you're a cheater! We'll wipe your hard disk!" The point isn't that they are, were, or will be actually doing that; the point is that there must be LIMITS, and the public hue and cry (and attendant threat of loss of income) alerted Blizzard (and hopefully others) to that fact. In its way, it was sort of like the Sony CD rootkit fiasco; it showed the intellectual property zealots that there must be a balance when protecting IP. Some things are simply more important than your IP.

I feel like the current situation is a good balance. Warden's scans are, it sounds like, fairly minimal, and mostly discourage the commercial bot-writers. Private bot-writers are still fairly safe if they have half a brain and do some reading (thanks for taking away some of my irrational fear btw Cypher). And Blizzard realizes that even though you're playing "their" game, there must be SOME limits on what they can and should do to protect it, even if they only understand that from a monetary, self-interested perspective.

(EDIT: forgot to post this, but there are alot of parallels between Warden and the increasingly-ridiculous DRM we all deal with on a daily basis. The root philosophy is the same: you're (listening to/watching/playing) something of MINE, so I can do (literally) ANYTHING to stop you from doing that in a way that might hurt my profits. We all gotta step back a bit from that edge, as a society, and respond by saying "well, no, some things are not acceptable, even to protect your precious intellectual property." And then decide what is unacceptable. And yes, I'm talking about regulation here )

[Cypher]

Originally Posted by amadmonk

Of course, if someone really wanted to throw a wrench into this, they could broach the question of the dubious legality of shrink-wrap EULA's (the Glider case was a step back towards allowing ever-more-oppressive EULA's, but there's considerable pushback in the other direction, too).

Since the entire premise of the Warden is based upon the idea that "to license our software you have to agree to the EULA, and we can put ANYTHING in the EULA," this invites a one-sided and ever-increasing encroachment upon consumer rights in the name of protecting "intellectual property."

Of course, that being said, the net effect of Hoglund's hew and cry was, in my opinion, positive. Although it gave a lot of noobs a lot of bad ideas, it also had the effect of discouraging commercial bots and hacks (which is, imo, good -- bots and hacks are only really useful in that they make you "special" compared to other players... you can fly or whatever... and when EVERYONE can do it, it's not "special" anymore) and (important to a civil liberties wonk like me) letting Blizzard know that there are limits.

This last bit is important because while, true, what they're doing is not terribly invasive, there's nothing technical to stop Blizzard from getting super invasive. In fact -- since most people run most apps as admin/root due to lack of knowledge -- there's nothing technically stopping them from going a step further and saying "hey, you're a cheater! We'll wipe your hard disk!" The point isn't that they are, were, or will be actually doing that; the point is that there must be LIMITS, and the public hue and cry (and attendant threat of loss of income) alerted Blizzard (and hopefully others) to that fact. In its way, it was sort of like the Sony CD rootkit fiasco; it showed the intellectual property zealots that there must be a balance when protecting IP. Some things are simply more important than your IP.

I feel like the current situation is a good balance. Warden's scans are, it sounds like, fairly minimal, and mostly discourage the commercial bot-writers. Private bot-writers are still fairly safe if they have half a brain and do some reading (thanks for taking away some of my irrational fear btw Cypher). And Blizzard realizes that even though you're playing "their" game, there must be SOME limits on what they can and should do to protect it, even if they only understand that from a monetary, self-interested perspective.

(EDIT: forgot to post this, but there are alot of parallels between Warden and the increasingly-ridiculous DRM we all deal with on a daily basis. The root philosophy is the same: you're (listening to/watching/playing) something of MINE, so I can do (literally) ANYTHING to stop you from doing that in a way that might hurt my profits. We all gotta step back a bit from that edge, as a society, and respond by saying "well, no, some things are not acceptable, even to protect your precious intellectual property." And then decide what is unacceptable. And yes, I'm talking about regulation here )

You might wanna look into the Bragg vs Linen Labs case.

[Dragonshadow]

Is it true that the mac version of wow has no warden?

[Cypher]

Originally Posted by Dragonshadow

Is it true that the mac version of wow has no warden?

I have not looked in a long time but from my very vague memory there is a small version there that is mainly to raise the bar for people attempting clientless bots (so you can't fudge your way out of warden requests/responses by faking yourself as a mac).

[Azinroth]

say wut? dont get this at all :O