I've been messing with the source of everscan and changed it to hook right before the call to the known warden scanning asm. The only problem I'm having is that wow instantly closes once I've injected it. Does anyone know what I might be doing wrong? (Account doesn't get banned, game just closing before I can see anything.)
Strangely enough, if I inject it with an invalid byte array and then rework the jmp's to go to the code on the .dll and then back to where the call starts it won't crash. But I also don't end up seeing any text appear.
Edit: got something working, still end up getting banned even though I'm hooking prior to the function. Something just tells me they're scanning the whole warden section to make sure nothing changes...