|  |
WoW Memory Editing WoW Memory Editing for learning purposes only.
This section is more advanced than others on MMOwned Read the section specific rules, infractions will be given out if u break them!That is including the expectations! - If you don't meet them then don't post |
 | | 
09-12-2008
|  | Warden's Mediator Legendary User | | | Join Date: Dec 2006 Location: Raping your Stack
Posts: 879
Nominated 10 Times in 3 Posts Reputation: 822 Points: 30,261, Level: 25 | Level up: 86%, 239 Points needed |    | | Quote:
Originally Posted by Cypher  Protip: Hook warden like you would the login checksum.
Pseudocode
Code: void WardenScan_Hook()
{
RemoveAllPatches();
oWardenScan();
ApplyAllPatches();
}
o.O | If you're going for that kind of hook, you're going to want to make sure warden is going to perform a scan by checking the last packet size. Otherwise that function is called after each frame.
Or, reverse warden and find the scan functions vtable ^__^. |
Donate to remove ads, get your "DONATOR title, and get access to the MMOwned community's elite Shoutbawx.
09-14-2008
|  | Knight-Lieutenant | | | Join Date: Jan 2008 Location: South Pole
Posts: 347
Reputation: 47 Level up: 21%, 553 Points needed | | | | I'd say doing some per byte scanns for the opcodes that load the bytes for the scanns out of memory and patching the Adress wouldn't consume as much cpu as dispatching before a warden scann and patching again afterwards, you'd just need an algorithm to find and patch those offsets dynamical and copy the bytes you want to patch before you do it.
Even if you'd use Wardens Vtable to find out when a function is called it'd still consume a lot of cpu if you did alot of patching.
But I'm shure it's easier to check if warden scanns than redirecting its' scanns to some faked bytes.
__________________ I hacked 127.0.0.1 |
09-14-2008
| | Warden's Mediator Legendary User | | | Join Date: Dec 2006 Location: Raping your Stack
Posts: 879
Nominated 10 Times in 3 Posts Reputation: 822 Points: 30,261, Level: 25 | Level up: 86%, 239 Points needed | | | Quote:
Originally Posted by Xarg0 I'd say doing some per byte scanns for the opcodes that load the bytes for the scanns out of memory and patching the Adress wouldn't consume as much cpu as dispatching before a warden scann and patching again afterwards, you'd just need an algorithm to find and patch those offsets dynamical and copy the bytes you want to patch before you do it.
Even if you'd use Wardens Vtable to find out when a function is called it'd still consume a lot of cpu if you did alot of patching.
But I'm shure it's easier to check if warden scanns than redirecting its' scanns to some faked bytes. | What the ****? Can you please re-read that? |
09-15-2008
|  | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,577
Nominated 64 Times in 5 Posts  TOTM/W Award(s): 1 Reputation: 1120 Points: 64,180, Level: 37 | Level up: 47%, 2,020 Points needed | | | Quote:
Originally Posted by Xarg0 I'd say doing some per byte scanns for the opcodes that load the bytes for the scanns out of memory and patching the Adress wouldn't consume as much cpu as dispatching before a warden scann and patching again afterwards, you'd just need an algorithm to find and patch those offsets dynamical and copy the bytes you want to patch before you do it.
Even if you'd use Wardens Vtable to find out when a function is called it'd still consume a lot of cpu if you did alot of patching.
But I'm shure it's easier to check if warden scanns than redirecting its' scanns to some faked bytes. |
.....
WoW is compiled with heaps of debug info and no platform specific optimizations. Furthermore the ASM output the compiler generates is far from heavily optimized.
Modern CPUs perform millions of instructions per second (or more). The overhead generated from a few function hooks is for all points and purposes 0. I suggest you acquaint yourself with a book on IA-32 ASM and the x86 architecture in the context of high level languages and the output they generate because you obviously have no idea what you're on about.
Protip: 99.99999% of code in applications does not need to be optimized heavily to run as fast as possible. The only exceptions is things that are used VERY often (in games an example would be a Vector class) and code that executes every frame. Even then, WoW is so light on resources I wouldn't be worried about a page or two of assembly caused by a large function hook, as I said, overhead is zero. Always know when to optimize as most of the time it will just reduce code readability and maintainablilty for two or three clock cycles (about a millionth of a second worth of CPU time).
Quote from the wise:
Quote: |
"We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil." (Knuth, Donald. Structured Programming with go to Statements, ACM Journal Computing Surveys, Vol 6, No. 4, Dec. 1974. p.268.)
|
Last edited by Cypher; 09-15-2008 at 02:19 AM.
|
09-15-2008
| | Knight-Lieutenant | | | Join Date: Jan 2008 Location: South Pole
Posts: 347
Reputation: 47 Level up: 21%, 553 Points needed | | | | I guess I shouldn't try to think about programming and post something when I'm high :>
after re-reading my post I think I should stop using certain drugs ^.^
Anyways, there are some good Ideas on how to protect from warden, maybe I'll release a warden protected wallclimb and jumphack in the next few days
__________________ I hacked 127.0.0.1 |
09-15-2008
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,577
Nominated 64 Times in 5 Posts TOTM/W Award(s): 1 Reputation: 1120 Points: 64,180, Level: 37 | Level up: 47%, 2,020 Points needed | | | Quote:
Originally Posted by Xarg0 I guess I shouldn't try to think about programming and post something when I'm high :>
after re-reading my post I think I should stop using certain drugs ^.^
Anyways, there are some good Ideas on how to protect from warden, maybe I'll release a warden protected wallclimb and jumphack in the next few days |
Why would you reverse warden and work out a bypass just to release it publicly at which point it would probably get nerfed by the next patch. You don't need to hook warden to protect a wallclimb or jump hack, just modify the places in code where the constants are referenced to point to your new variable (which you can dynamically allocate or throw in a code cave somewhere). |
09-15-2008
| | Knight-Lieutenant | | | Join Date: Jan 2008 Location: South Pole
Posts: 347
Reputation: 47 Level up: 21%, 553 Points needed | | | | just for poc
__________________ I hacked 127.0.0.1 |
09-15-2008
|  | Legendary Legendary User | | | Join Date: Nov 2006 Location: Germany (DE)
Posts: 2,531
Nominated 17 Times in 4 Posts Reputation: 679 Points: 19,334, Level: 19 | Level up: 3%, 1,466 Points needed | | | | Isn't everything proof of concept only? |
09-15-2008
|  | Contributor | | | Join Date: May 2008
Posts: 387
Reputation: 87 Level up: 51%, 348 Points needed | | | | Proof of concept != intended for use. |
09-16-2008
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,577
Nominated 64 Times in 5 Posts TOTM/W Award(s): 1 Reputation: 1120 Points: 64,180, Level: 37 | Level up: 47%, 2,020 Points needed | | | Quote:
Originally Posted by schlumpf Isn't everything proof of concept only? |
o.O
Errrrr...... what?
Most certainly not.
|
09-20-2008
| | Knight-Lieutenant | | | Join Date: Jan 2008 Location: South Pole
Posts: 347
Reputation: 47 Level up: 21%, 553 Points needed | | |
__________________ I hacked 127.0.0.1 |
09-21-2008
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,577
Nominated 64 Times in 5 Posts TOTM/W Award(s): 1 Reputation: 1120 Points: 64,180, Level: 37 | Level up: 47%, 2,020 Points needed | | | Quote:
Originally Posted by Xarg0 |
That won't work on multi-core processors afaik. (ie 99% of modern processors) |
09-21-2008
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,577
Nominated 64 Times in 5 Posts TOTM/W Award(s): 1 Reputation: 1120 Points: 64,180, Level: 37 | Level up: 47%, 2,020 Points needed | | | | Okay, just confirmed my suspicions. (Thank you Greyman!)
This will only work on single-core/single-processor systems unless you change WoW's process affinity mask to force it to run on a single processor/core.
|
09-21-2008
| | Knight-Lieutenant | | | Join Date: Jan 2008 Location: South Pole
Posts: 347
Reputation: 47 Level up: 21%, 553 Points needed | | | | Why does it only work on single core? I tought it changes the way Virtuall Adresses are calculated to physikal ones in the Kernel, so where's the problem with multicore?
__________________ I hacked 127.0.0.1 |
09-21-2008
|  | Site n00b.. (A leecher if I've been here for more than a month and can't earn 5 rep) | | | Join Date: Aug 2007
Posts: 54
Reputation: 3 | | Quote:
Originally Posted by Cypher Okay, just confirmed my suspicions. (Thank you Greyman!)
This will only work on single-core/single-processor systems unless you change WoW's process affinity mask to force it to run on a single processor/core.
| In no means I want to attack your theory Cypher, I did not take a look at this specific driver memory modification thingy But I guarantee you Ring 0 memory modification is possible on multi core systems. POC can be seen in "Memory Hacking Software by L.Spiro". BSOD is howeva likely, but chances are pretty low | | |
Posting Rules
| You may not post new threads You may not post replies You may not post attachments You may not edit your posts
HTML code is Off
| | |
All times are GMT -4. The time now is 02:28 AM.
|
