WardenNinja - An anti warden tool

[sitnspinlock]

WardeNinja is a project I have been putting together for the past couple days, it was going to be my intention to release it only in the
contributor section. Instead I decided what the hell, lets release it to the public and get it nerfed as quickly as possible.

Myself and some others have put WardeNinja to the test over the past month, writing to warden scanned memory locations in .text without
warden's knowledge, and that was of course part of the plan before releasing it to the general public.



Now you must understand the following:

WardenNinja only prevents scans within .text, nowhere else. If warden attempts a scan in .text you will see "WARDENINJA: prevented scan etc etc" However if it is outside of that region, the scan will be allowed. Thus you will of course only be able to modify known scanned .text offsets without detection.

If warden attempts to scan its own module, or if warden attempts to scan any code within WardenNinja.dll your Wow client will be crashed with a "internal battle.net error" before anything 'bad' can happen.

As of Saturday July 16, 2011 [1:29 AM PST] this tool is undetected. However in 5 minutes, or in 5 days it might be.

Download here
VirusTotal here

[Miksu]

Great program, looks very handy! +Rep

[DarkLinux]

Epic as always!

[DrakeFish]

There we go. Nice job everdox, +rep from me!
edit: Or not, I need to spread it

[Sychotix]

Although I do not play WoW currently, +Rep for releasing a public Warden protection program =)

[forceshield]

could i talk you in to adding/changing the enable/disable keys for laptop users whom don't have a numberpad or fn+numberpad combos
thank you for your work!

[sitnspinlock]

done download

-fixed sorry, accidently redirected to original ;p

-also depending on your region (us or eu) at the current time of this edit you may get an access violation. if thats the case just wait it out ;p

[BuloZB]

awesome man GJ!

[CryptoCombat]

Why .text only, if I may ask?

[DarkLinux]

B/c there is nothing important in the heap related to warden other than Warden its self. And its pointless its always changing.

[sitnspinlock]

B/c there is nothing important in the heap other than Warden its self. And its pointless its always changing.

son, I am disappoint.

[DarkLinux]

why Daddy Why!? That sounds oh so wrong lols...

[Cypher]

B/c there is nothing important in the heap related to warden other than Warden its self. And its pointless its always changing.

What about .rdata?