|  |
WoW Memory Editing WoW Memory Editing for learning purposes only.
This section is more advanced than others on MMOwned Read the section specific rules, infractions will be given out if u break them!That is including the expectations! - If you don't meet them then don't post |
 | | 
05-14-2009
|  | Site Donator | | | Join Date: Apr 2008
Posts: 303
Reputation: 62 Level up: 31%, 488 Points needed |    | | Quote:
Originally Posted by Cypher  YOU can't. But others can. It's called reverse engineering... | ++ that. Right now, I'm too lazy/ignorant to find and steal and use the code that examines the Warden modules on the fly (wasn't that Shynd's work?). But once I get that working it's just a simple bit of disassembly to understand exactly what it's doing, and the fear level will go way, way down.
Don't ascribe magic powers to Warden; it's still running in user mode on YOUR box, which means that given enough time and patience and knowledge, it WILL ultimately obey your will. Hell, if you want, you can just yank your net cable (although that might seriously detract from your gaming experience). This isn't the Matrix, folks.
Hmm, wonder if I could use shimeng to... hmm.
__________________ Don't believe everything you think. |
Donate to remove ads, get your "DONATOR title, and get access to the MMOwned community's elite Shoutbawx.
05-15-2009
| | New User | | | Join Date: Apr 2009
Posts: 11
Reputation: 0 | | Quote:
Originally Posted by Cypher Quote:
Originally Posted by DaemonOnFire Right.
We can not proof what blizz is putting into warden and wow, maybe they just have fun seeing us trying to cloak our hacks.....
I do not think that a company which earns millions over millions makes a game that can be hacked that easily without any notice of the owners. |
YOU can't. But others can. It's called reverse engineering... | False. Reverse engineering can only tell you what has been put into released warden and wow. It can't tell you what blizz is putting into warden and wow. |
05-15-2009
| | Knight-Lieutenant | | | Join Date: Jan 2008
Posts: 275
Reputation: 17 Level up: 21%, 558 Points needed | | | Quote:
Originally Posted by luthien23 False. Reverse engineering can only tell you what has been put into released warden and wow. It can't tell you what blizz is putting into warden and wow. | Oh boy  Can't wait for this |
05-15-2009
|  | MaiN's Biatch Legendary User | | | Join Date: Mar 2007 Location: VirtualAllocEx
Posts: 1,115
Nominated 26 Times in 3 Posts  TOTM/W Award(s): 1 Reputation: 727 Points: 36,094, Level: 28 | Level up: 92%, 206 Points needed | | | Quote:
Originally Posted by ramey Oh boy Can't wait for this | *grab's some popcorns and wait's for the action to start* |
05-15-2009
|  | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,167
Nominated 63 Times in 4 Posts TOTM/W Award(s): 1 Reputation: 1074 Points: 55,433, Level: 35 | Level up: 12%, 3,267 Points needed | | | Quote:
Originally Posted by luthien23 False. Reverse engineering can only tell you what has been put into released warden and wow. It can't tell you what blizz is putting into warden and wow. |
Are you retarded? If it's never pushed to the public why does it even matter what they put in it?
Also, you're referring to an impossibility. If noone ever has a copy of the software to inspect, then NOONE can see what it does through ANY MEANS.
Sigh, I'm much too tired to deal with this shit right now. Suffice to say, you're a ****ing moron. |
05-15-2009
|  | Warden's Mediator Legendary User | | | Join Date: Dec 2006 Location: Raping your Stack
Posts: 773
Nominated 2 Times in 1 Post Reputation: 794 Points: 28,073, Level: 24 | Level up: 52%, 827 Points needed | | | Quote:
Originally Posted by luthien23 False. Reverse engineering can only tell you what has been put into released warden and wow. It can't tell you what blizz is putting into warden and wow. | Your poor English is obscuring his point. You haven't worded your posts correctly and it's leading to confusion.
What he said was, we can see what is currently in the module. Obviously we can't see what doesn't exist. For that would require the ability to bent the space time continuum. I'm not going to expose my methods for time bending, as i don't want to do get nerfed! |
05-15-2009
| | New User | | | Join Date: Apr 2009
Posts: 11
Reputation: 0 | | Quote:
Originally Posted by Cypher
Are you retarded? If it's never pushed to the public why does it even matter what they put in it?
| Who said anything about never being pushed to the public?
I just pointed out that your statement was wrong because DaemonOnFire said "We can not proof what blizz is putting into warden and wow". Is putting is present continuous which expresses something that is happening now, at this very moment. Whatever blizz is putting into warden at this very moment you can't know so his phrase, orthography aside, is true. Quote:
Originally Posted by Cypher
Also, you're referring to an impossibility. If noone ever has a copy of the software to inspect, then NOONE can see what it does through ANY MEANS.
| Yes, exactly, it's impossible, no one can see what it does.
That is why DaemonOnFire is right when he says "We can not proof what blizz is putting into warden and wow" and why you were wrong when you said others can. |
05-15-2009
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,167
Nominated 63 Times in 4 Posts TOTM/W Award(s): 1 Reputation: 1074 Points: 55,433, Level: 35 | Level up: 12%, 3,267 Points needed | | | Quote:
Originally Posted by luthien23 Who said anything about never being pushed to the public?
I just pointed out that your statement was wrong because DaemonOnFire said "We can not proof what blizz is putting into warden and wow".
Is putting is present continuous which expresses something that is happening now, at this very moment. Whatever blizz is putting into warden at this very moment you can't know so his phrase, orthography aside, is true.
Yes, exactly, it's impossible, no one can see what it does.
That is why DaemonOnFire is right when he says "We can not proof what blizz is putting into warden and wow" and why you were wrong when you said others can. | Sigh. You do realize that with a little bit of work you can detect when new versions of Warden are pushed. Right?
Tripwire and WardenNET are two examples of such projects. |
05-15-2009
| | New User | | | Join Date: Apr 2009
Posts: 11
Reputation: 0 | | | I do realize such a thing is true.
DaemonOnFire's statement keeps being true though. |
05-16-2009
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,167
Nominated 63 Times in 4 Posts TOTM/W Award(s): 1 Reputation: 1074 Points: 55,433, Level: 35 | Level up: 12%, 3,267 Points needed | | | Quote:
Originally Posted by luthien23 I do realize such a thing is true.
DaemonOnFire's statement keeps being true though. |
Only because you're adhering to it in such a strict sense. And in that sense, it's a retarded ****ing statement to make in the first place.
Its impossible to see into the future given our current knowledge and technology. <-- HURRRR. LUK GUIZE! IM RITE! |
06-04-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 763
Reputation: 20 Level up: 30%, 636 Points needed | | | | In the topic of warden..., will SEH through the DR0-7 registers work to hook warden's checksums? I was thinking about trying it out, but I don't want to risk my account since I don't think that trials are treated like real accounts. My main thoughts would be setting a read BP on the LuaProtection check and on QueryPerformanceCounter(). WoW/warden doesn't use GetThreadContext to check these BPs does it? If so, i would hate to waste a BP on hooking that =/ |
06-04-2009
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,167
Nominated 63 Times in 4 Posts TOTM/W Award(s): 1 Reputation: 1074 Points: 55,433, Level: 35 | Level up: 12%, 3,267 Points needed | | | Quote:
Originally Posted by lanman92 In the topic of warden..., will SEH through the DR0-7 registers work to hook warden's checksums? I was thinking about trying it out, but I don't want to risk my account since I don't think that trials are treated like real accounts. My main thoughts would be setting a read BP on the LuaProtection check and on QueryPerformanceCounter(). WoW/warden doesn't use GetThreadContext to check these BPs does it? If so, i would hate to waste a BP on hooking that =/ | 1. You typically don't catch HW BPs with SEH, you catch them with VEH.
2. You typically only use DR0->DR3 (which hold the actual addresses) and DR7 (which holds the mask of which out of DR0->DR3 are enabled).
3. HW BP hooking is nothing new, and is very easy to detect. Warden only need to do a GetThreadContext and you're gone. There are also several other methods they can use. If you want to protect yourself you're going to need to hook NtGetContextThread, NtContinue, NtRaiseException, RtlAddVectoredExceptionHandler, etc. The number of APIs you need to hook to protect HW BPs is greater than the number of available HW BPs themselves. And that's ignoring the fact they could attempt to use HW BPs as part of Warden's logic and if the registers are unavailable then obviously someone is using them so at that point you could get kicked from the server.
4. A HW BP on QueryPerformanceCounter isn't going to help you in terms of the speedhack check. It's not based on looking for a hook on that API, so you're wasting your time.
5. Sure it would get around a "checksum" based check that looks purely for modified bytes, but its not gonna save you if they actually start looking for HW BPs (which is a trivial task). |
06-04-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 763
Reputation: 20 Level up: 30%, 636 Points needed | | | | Well then. Screw that plan. How does warden actually detect speedhacks now? I figured they just checked for API hooks. Do they send data to do movement prediction to the client and have it send back a result? |
06-04-2009
| | Kynox's sister's pimp Legendary User | | | Join Date: Apr 2006 Location: ntdll.dll
Posts: 4,167
Nominated 63 Times in 4 Posts TOTM/W Award(s): 1 Reputation: 1074 Points: 55,433, Level: 35 | Level up: 12%, 3,267 Points needed | | | Quote:
Originally Posted by lanman92 Well then. Screw that plan. How does warden actually detect speedhacks now? I figured they just checked for API hooks. Do they send data to do movement prediction to the client and have it send back a result? |
They harness the power of sunspots to produce cognitive radiation. Warden is actually skynet. Don't hook it or it will become self-aware and take over the world. |
06-04-2009
| | Site Donator | | | Join Date: Mar 2007
Posts: 763
Reputation: 20 Level up: 30%, 636 Points needed | | | | .............................Okay?
I know where the load function is for warden, but it's going to suck hooking it. Gonna say good-bye to return value hi-jacking...
Last edited by lanman92; 06-04-2009 at 01:24 AM.
| | |
Posting Rules
| You may not post new threads You may not post replies You may not post attachments You may not edit your posts
HTML code is Off
| | |
All times are GMT -4. The time now is 10:33 PM.
|
