[discussion] Dangers of memory-read(-only) tools

[azgul]

Blizzard dosnt scan outside of dedicated memory anymore does it? so in theory they couldnt dettect, injector.exe, but they could see memory manipulation, i doubt they look that hard tho...

But there's no memory manipulation if the program you're using is only using memory reading....

[KillerJohn]

But there's no memory manipulation if the program you're using is only using memory reading....

.... +1 ....

[DrakeFish]

Who renames something to notepad.exe? Why on Earth would notepad be an executable file 0.0

Maybe because if it wasn't an executable file it wouldn't be executable.

On topic:
I'm not exactly aware of what's up with the diablo 3 Warden, but the WoW Warden hasn't been scanning external processes for a few years now mainly because, as stated in that post about The Governor, some guy decided to alert everyone about a non-existent threat. If the current Diablo 3 Warden also respects these "rules", then you should not have to worry about tools that don't touch your game's process in any other way than reading from it. If the program injects code of any kind in the game (even if this code "doesn't modify the game's code"), it will most likely be detectable by the current Warden implementation. Now Warden protection could be implemented, but we've seen good protections getting circumvented in the past (think about LuaNinja).

ps. What I mean by detectable here is that it may not be detected, but that it could possibly eventually become detected.

[KillerJohn]

Maybe because if it wasn't an executable file it wouldn't be executable.

On topic:
I'm not exactly aware of what's up with the diablo 3 Warden, but the WoW Warden hasn't been scanning external processes for a few years now mainly because, as stated in that post about The Governor, some guy decided to alert everyone about a non-existent threat. If the current Diablo 3 Warden also respects these "rules", then you should not have to worry about tools that don't touch your game's process in any other way than reading from it. If the program injects code of any kind in the game (even if this code "doesn't modify the game's code"), it will most likely be detectable by the current Warden implementation. Now Warden protection could be implemented, but we've seen good protections getting circumvented in the past (think about LuaNinja).

ps. What I mean by detectable here is that it may not be detected, but that it could possibly eventually become detected.

yeah, my opinion is the same as yours. Btw anybody knows that memory reading is detectable? Are there any API to enumerate the processes reading my memory?

[KillerJohn]

nobody?