Warden upgrade! Be careful!!!

[Zynshiro]

Hello guys, i just wanted to inform you, that warded has been upgraded a lot with the patch 5.3. So please be careful by using ANY Hacks / Bots without tripwire protection. I hope i could help you guys our and beware you of some bans!! This Information is an official post in the Honorbuddy Forum. Attached ill post you guys the original link of this: [Official] Honorbuddy Update Status for Build #17055

[KuRIoS]

The bot has been updated guys. We're doing some extra research on some... "stuff" Blizz added recently. We'll make you guys wait a month if we have to, to ensure the bot is safe to use. We're not some half-assed company selling you a bot then leaving you high and dry when any form of detection is involved.

We have to manually update about 850 addresses, 100 or so structures, and 80+ enums. That's not including the "big" and "obscure" changes that Blizzard does.

We will not release anything (beta or otherwise) unless we feel it's safe to do so. And right now, we don't. So you guys will just have to wait until we're positive nobody is going to lose all their investments.

Sorry to put it this way, but our customers have no bearing on our release timeline. We'll release when we feel it's safe to do so, and we're happy with the stability of the bot. That doesn't mean we take our time doing things. We usually have the bot updated within ~2 hours of receiving the patch. But we don't release that quickly unless we're sure we caught all the new stuff.

..............

[raphus]

It is not warden btw, new stuff is in the client itself

[gippy]

Sounds like a lot of work, at least there's time and effort going into making hb safe again. I've trusted it with my main for years and it hasn't failed me yet :P

[ginuwine12]

Kurzgesagt, Blizzard hat ihr Anti-Betrug-System stark verbessert, und solange wir uns nicht sicher sind, dass unsere Gegenmaßnahmen ausreichen, gibt es aus Sicherheitsgründen keine öffentliche HB Fassung. Desweiteren wird von Cheats/Hacks/Bots andrer Hersteller abgeraten. Sollten deren Autoren Hilfe benötigen mit Blizzards Änderungen, könnt ihr sie gerne an uns verweisen. Wir waren uns nicht sicher ob diese Änderungen direkt uns galten oder nicht, und haben darum erst jetzt nach eingehender Prüfung das Ganze bekanntgegeben. Es betrifft wie oben erwähnt nicht nur uns. Das in etwa hat Raphus auf Englisch geschrieben


In short, Blizzard has greatly improved their anti-cheat system, and unless we are sure that our counter-measures are sufficient, there is no public safety reasons HB version.
Furthermore hacks / bots of other manufacturers is not recommended Cheats /. If their authors need help with Blizzard changes, you may like to refer them to us.
We were not sure whether these changes were directly it or not, and therefore have only just posted the whole thing after a thorough examination.
It affects not only us, as mentioned above

Moderator laria
german HB forum

[Shaitan051]

Maybe I'm missing something but it seems really stupid that Blizzard would ramp up the bot detection now when they're losing subs at a noticeable pace instead of a few years ago.

[surfman]

They are losing Subs because of Botting epidemic especially in BGs

[Shaitan051]

That doesn't seem very likely. Especially after the removal of follow killed most of the crappy not honorbuddylike bots.

[Bearkin]

They are losing Subs because of Botting epidemic especially in BGs

They are losing subs because the game is 10 years old and their balance changes are always shooting themselves in the foot by giving PvPers to look for other games.

Flex-raid, 65% resil for all, PvP gear being a lesser item level than PvE gear. The list goes on.

[Giwin]

It is not warden btw, new stuff is in the client itself

2008, May.

They've tried this before about 6 years ago when they put the detection stuff in the Patch for MMOGlider, they weren't so lucky.

[mastercheem]

I'm wondering exactly what they have stepped up in order to try to detect certain bots?

[vitalic]

I assume that means PQR is safe because it uses FrameScript_GetLocalizedText.

Great information though thanks VesperCore

[MaiN]

The HB text is a part lie, because not so much bot or hacks used to have Fs_Load or Fs_LoadBuffer, my project TheNoobBot don't use it at all for instance.
And the goal of that detection was trully for Honorbuddy as blizzard named the opcode as is. (EnableHonorbuddyDetection)

You know all now.

This is correct, but as we don't have the source of all other bots on the market, we don't know if other bots used lua_load. This is why we said that in the beginning we believed it was only for Honorbuddy, but when we found out what it was doing we said it could hit other bots too. If other bots are using lua_load, it will hit them too. That's all we're saying. Don't try to make us bad guys for publicly announcing that people should be extra careful this patch.

It's somehow part of the warden, the function FrameScript_Load haven't changed -at all-, it's dynamicly hooked when receiving the opcode.

And the opcode handler is part of WoW, not Warden. Everything for this is in the client, nothing of it is in Warden. How can you say this is part of Warden?

Don't stress yourself just because Honorbuddy say something, most of the bot don't even use these. What they mean by "alot" is "ONE" value. no big deals

Yes, excuse us for believing that other bots might be using standard LUA API for handling return values.

In any case we just care for all of users, and this is why we warn them for this stuff. We even said that other bot writers can contact us for more information.

[MaiN]

It's not the warden... yes and no, the opcode handle activate something that may be considered as part of the warden.
Since even scan.dll that is something totally outside of wow.exe is part of the warden too (yes), I don't know why this wont be considered as part of the warden, even if not "absolutly" true technically talking.
Not the opcode handling, but the action of hooking lua_load + send back infos.

Last time I checked we don't define Warden as anything that can hook a function and send back info. Warden is very specifically the module that Blizzard manually maps into their games, and which can be unmapped and a new one mapped any time Blizzard pleases. That way, I don't regard this as Warden. Although I do agree it might help people understand it better, I think it suffices to say that even though this is part of Blizzards anti-cheat system as a whole, this is not part of Warden.

EDIT: Just so you understand, I'm not making an attack at you. I reversed Warden almost completely over two years ago. I don't consider what they added into the client, completely isolated from the existing bits, as Warden.

[dadude123]

... The check range is recursivly n + 1 ...

What does that mean?
Does it unwind the stack as far as it can or does it only check the 1. caller?

I didn't get a chance to observe the hook yet.
So could someone please answer the following:
1. Where is the jmp placed?
2. At the function start or further down?
3. Is the hook always inside the 0xD6BF0 or is it placed inside a subfunction too?

Thank you for the information VesperCore!