Warden FAQ

[Apoc]

I'm tired of all the stupid questions, and comments people seem to have about Warden, what it does, and how it works. So I'm going to write up a quick little FAQ to answer 90% of the questions I see asked daily, and debunk 99% of the idiots claiming they know what it does.

What is Warden?

Warden is Blizzard's anti-cheat system for WoW, and other Blizzard games. (It has recently been updated to work on SC, D2, WC3, etc.) It is a usermode anti-cheat system, so you will never have to install some driver, like other anti-cheat systems.

Does Warden read my emails (or any other personal information)?

No, Warden does not leave the process space of WoW. (This means, it only scans the memory that WoW takes up. It never looks at your taskbar, window titles, etc.)

Isn't Warden spyware?

No. Not even by the longest stretch of the word. A few years ago, it did have scans in place that would hash window titles to see if they matched a pre-defined set of hashes to known hacking titles. A hash is 1 way, which means they can never tell what you're viewing, unless they personally hashed the name of the window. Warden only ever sends back either a 'yes' or 'no' reply. (Grossly simplified here, but this is all you really need to worry about.) It does not send any other information back.

Doesn't Warden only update during a patch?

No. Warden can be updated at any time, for any reason. Once you log in game, Warden starts scanning every ~15 seconds. During any one of those 'scans', Warden can be updated with new, different, scans. It's entirely up to Blizzard.

How often does Warden scan?

As I said above, about every 15 seconds. (Lag obviously effects this.)

Doesn't running WoW in guest mode disable Warden? (Make it useless)

No. A very popular myth, which has been debunked MANY times. Running WoW in guest mode only restricts WoW to reading memory from it's own process. Since it never scans anything but it's own memory, this obviously has no effect whatsoever on whether or not you run it in guest mode.

What is 'The Governor'?

It was an old program, (badly written, and executed) that didn't do a whole lot except hook very widely used Windows APIs.

More info here: http://www.mmowned.com/forums/bots-p...-governor.html (Warden and 'The Governor')

How does it work?

I'm honestly not sure any one person knows exactly how it works. However, there are quite a few people who understand most of how it works. In short; Blizzard sends a 'packet' to your client requesting that Warden loads up, and does a specific scan, it then sends back the results of the scan, which then either flags your account, or shows that you are clean. It is polymorphic, which means that it can, and will change at any given time. More information can be found in other resources, this isn't really the place to explain everything.

How do we know Warden isn't just some make believe thing?

You know how your teachers would say "there's no such thing as a stupid question"?

Well, this is a stupid question.

Can't I get rid of Warden by deleting Scan.dll?

No. A very popular misconception (and fun joke for those who know better). Scan.dll is only called at WoW's startup, to check for popular things that may get you flagged as a cheater. (CheatEngine, ASpeeder, etc)

What can I do to get around Warden?

Unless you are very knowledgable in reverse engineering, and programming (including cryptography to some degree), I suggest you not do anything that would tip off Warden. Simply put; don't cheat. Period.

How do the anti-Warden systems work?

If I told you, I'd have to kill you. (Or they'd kill me...)

Seriously though, that's not something that those who create the systems, want public, for fairly obvious reasons.

More to come....


Credits: Cypher, kynox, Lax, Harko, BoogieMan, Greyman, etc... (the list goes on...)

[polackpl123]

+rep
Good post

[luciferc]

Good info now i can link people to it when they tell me well i am running in Guest mode..

Edit:: Be sure to include if the bot uses engine functions Click to Move it can be detected etc... and about somewhat stack tracing and all that hub bub.