Discussion: Sandbox for warden

[hatawong]

As well as we know, warden scan memory/lua/model/stack and more, can we create a sandbox loader for warden? and let lt run into sandbox's env?

Here is my offsets:

<WardenOffsets>
<WowVersion>6.1.2.19865</WowVersion>
<Module_DecryptAndCreate>0x58e88b</Module_DecryptAndCreate>
<RawModule_DecryptAndCreate>0x58e5cd</RawModule_DecryptAndCreate>
<RawModule_Create>0x58e5a1</RawModule_Create>
<RawModule_Dectroy>0x58e253</RawModule_Dectroy>
<LoadWardenModule>0x58e318</LoadWardenModule>
<UnloadWardenModule>0x58e288</UnloadWardenModule>
</WardenOffsets>

[hatawong]

I do some test for memory scan:

1、Hook LoadWardenModule, after Warden Module decrypted and load, find it's baseAddress and moduleSize
2、Scan baseAddress + moduleSize, find CopyMemory method, and hook it
3、Dump original memory for WoW.exe
4、Warden call CopyMemory, it detour to MyCopyMemory, return the dumped memory to Warden, baba!

[UnmanagedFunctionPointer(CallingConvention.ThisCall,
CharSet = CharSet.Unicode,
SetLastError = true)]
delegate bool DLoadWardenModule(
IntPtr pThis,
IntPtr hModule,
int nSize);

public static readonly byte[] CopyMemoryPattern = new byte[]
{
0x56, 0x57, 0xFC, 0x8B, 0x54, 0x24, 0x14, 0x8B, 0x74, 0x24, 0x10, 0x8B, 0x44, 0x24, 0x0C, 0x8B,
0xCA, 0x8B, 0xF8, 0xC1, 0xE9, 0x02, 0x74, 0x02, 0xF3, 0xA5, 0xB1, 0x03, 0x23, 0xCA, 0x74, 0x02,
0xF3, 0xA4, 0x5F, 0x5E, 0xC3
};

[UnmanagedFunctionPointer(CallingConvention.Cdecl,
CharSet = CharSet.Unicode,
SetLastError = true)]
delegate IntPtr DMemoryCopy(
IntPtr pDst,
IntPtr pSrc,
uint count
);

And I got these address witch Warden Scan current version:
------------------------------------------------------
address data
0x00002D4E E8 D7 CE 1B 00 E8
0x0001D7BA 59 59 85 C0 74 F0 83
0x000250FE 8B 4D 10
0x00025101 89 0D C8 F7
0x0008588D 55 8B EC 8B 0D 60 67
0x00085896 FF 75 08 8B 01 FF 50 78
0x000B77BB 55 8B EC 83 EC 48 8B 45 08
0x000B794D 55 8B EC 83 EC 64 56 8B 75 08
0x000B7F99 55 8B EC 8B 45 0C 83 78 08 06
0x000EB99F 55 8B EC A1
0x00202BF6 55 8B EC 53 56 8B F1 8B 4D
0x002884F5 75 1F 8B CB
0x0028CADE 55 8B EC 83 EC 20 53 57 FF
0x00294972 55 8B EC 56 8B F1 F7 46 40 00 00 00 40
0x00297F94 55 8B EC A1 C0
0x0029A4F3 55 8B EC 83 EC 4C 53 56 57 8B
0x0029A6A9 0F 87 3F 0C 00 00 FF 24 85
0x0029B4CB 55 8B EC 83 EC 0C 8B 45 0C 83
0x0029C18C E8 6C 14 E5 FF 8B F0
0x002A80C5 75 0B F7 46 40 00 00 10 01 75 02 5E C3
0x002E617F 8B 81 B8 0A 00 00 25 00 00 80
0x002F6C11 74 24 F3 0F
0x002F9C96 55 8B EC 83 EC 24 53 56 57 6A
0x00304A1B 75 10 68 5B 01 00 00
0x00309093 55 8B EC 83 EC 24 56 8B F1
0x00309181 85 C0 74 1F
0x00309185 8B 06 8D 4D
0x0036380F 0F 2F 44 06 08 72 05
0x003663AB A9 00 00 00 04 74 24
0x003663B0 74 24 A9 00 00 10 00
0x00381469 F7 C2 00 00 10 01 75 0C 81 66 04 FF FF EF FF
0x0038AA39 7F 27 6A 20
0x0038AA60 7E 0B 8B CF
0x003D0CCB 55 8B EC 83 EC 20 53 56 57
0x003D10C6 55 8B EC 81 EC B0 00 00 00
0x0051CCAE 74 25 F6 40 2C
0x00520B61 55 8B EC FF 75 10 FF
0x00532C94 0F 85 D5 01 00 00 8D 45 D4 50 8D 45 C4
0x0056351F 55 8B EC 83 EC 2C 53 8B 5D 08
0x00563541 F7 45 1C 00 00 F0 00 74
0x00563570 F7 45 1C F0 00 03 00 74
0x00563577 74 1F FF 75 1C
0x00563588 FF 75 10 FF 75 0C 50 E8
0x005635C2 FF 75 1C 8D 83 E0 00
0x00563670 F7 45 1C 00 01 00 00 74
0x00563677 74 11 FF 75 18
0x0059D6C1 55 8B EC 81 EC F4 00 00 00
0x008FEFA9 55 8B EC 83 EC 20 8D 45 F8 53 8B
0x008FEFF6 74 7B F3 0F 10
0x008FF82F A9 00 00 10 01 75 04 33 C0 EB 3F
0x008FF884 A9 00 00 10 01 75 04 33 C0 5E C3
0x008FF95D A9 00 00 10 01 74 0A 57 8B CE E8
0x009001CA A9 00 00 00 10 74 04
0x009001FA 75 30 F6 46 44
0x009009C8 81 66 40 FF FF 9F FF 8B 46 40 8B CA
0x00900A85 75 48 D9 86 88 00 00 00
0x0093D4CA 55 8B EC 8B 45 08
0x0093D4DE 78 4A 05 C0
0x0093D629 6A 01 68 C6 BA
0x0093F29A 8B EC 83
0x0093F2B5 FF 24 85 21 F3
0x0094D01D 53 57 E8 A6 04 FF FF
0x00956FF3 55 8B EC B8 68 38 00 00 E8 C0 DF D0
0x009574FC 7D 25 83 FE 0C 7C 54 83 FE
0x0095765A 74 17 83 F8 10
0x0095A022 55 8B EC 81 EC 68 0E 00 00 6A 0A E8
0x0095A3DC 74 46 83 FE 07
0x009E3050 2F 54 9A 41 43 4D 69 73
0x009E8B10 BB 8D 24 3F
0x00BDB94C D8 93 FE C0 48 8C 11 C1
0x00C470A0 00 00 00 00
0x00C470A4 04 00 00 00 B4 02

Using my memory scan sandbox:
-------------------------------------------------------------------------------------
I modify the scan target address, like skyfly, warden can not dectect it.

[lolp1]

What stops them from simply doing a state check? You would need to copy every action to the 2nd client to deal with that.. so much work for I don't think much results.

[hatawong]

What stops them from simply doing a state check? You would need to copy every action to the 2nd client to deal with that.. so much work for I don't think much results.

if the module SHA is same, they do same logic, so maybe we can collect the address list and dump opposite data for current client and not need 2nd client.