Does WOW scan titles and sigs?

[Namingo]

Does wow actively scan titles and sigs for known debuggers? For example, x64dbg? Assuming you can bypass their warden, would rebuilding x64dbg bypass the title/sig scans?

Which functions does WOW use to scan titles? Would hooking NtUserBuildHwndList be enough?

Looking at rebuilding x64dbg seems annoying... is there an easier way?

Thanks!

[Dupheadss]

Yes WoW does - You can watch wow open every process that has a handle to WoW (and Bnet) with a System Monitor driver.

Also WoW remaps the NTDLL so hooking the standard ntdl likely won't work.

As for rebuilding the x64dbg it's far easier to just rebuild CE there are countless guides online regarding that - that will allow you to attach and read values / structs but not set break points.

I'd encourage you to learn to read WoW IDA dumps as you'll learn a lot more mean fulling information.

[Hazzbazzy]

Yes WoW does - You can watch wow open every process that has a handle to WoW (and Bnet) with a System Monitor driver.

Also WoW remaps the NTDLL so hooking the standard ntdl likely won't work.

As for rebuilding the x64dbg it's far easier to just rebuild CE there are countless guides online regarding that - that will allow you to attach and read values / structs but not set break points.

I'd encourage you to learn to read WoW IDA dumps as you'll learn a lot more mean fulling information.

Relevant thread from 2018 for educational purposes on how to not iterate process handles.
https://www.ownedcore.com/forums/wor...xecutable.html (Process / File locking by WoW executable?)