[Warden & Glider] Come Undone's Experience

[Come Undone]

Hello again!

I've recently been looking over the security for glider.
And as everyone else, I'm puzzled about warden.

I've encountered some strange behaviours in-game... I'll list two of them.
Might be warden detection methods.

Third is the regular known detection method.

NOTE: I'm completely lacking warden
knowledge, this is just speculations.

Conclusions and How To avoid are
completely my own thoughts on it.

Let's start with Number One. My personal favorite.
The 30-minute fake playtime // Phasing
I had never glided on my hunter. I was questing and grinding.
Also training my leatherworking skill. This session was 2 hours.
I didn't see ANY other players for the last 30 minutes where my story begins.

I keep killing mobs like usual, to complete my quest in area 1.
After a while when the area is clear of mobs they won't respawn.
I decide to wait, maybe 5 minutes, so I let my character sit down
and I go grab a cup of coffee. I come back and no mobs are back.
I leave area 1, but I still need to kill two of a specific mob.

Figured, next quest is near so I go complete that. It's just to pick up
an item on the ground and the reward is neat for my char.
Said and done, the guarding mobs are dead and I have the item in my inventory.

I walk back to area 1 to see if the mobs have respawned but no, they havn't.
Estimated time between killing the last mob in area 1: 15 minutes.
What the hell? I'm surprised. There has never been such a long delay.

I go to another area for another quest, aswell skinning mobs.
Quest completed. I leave to the town because the bags are full.
I turn in several completed quests and get rewards that I equip.

I go back to area 1 again because I don't want to leave a quest undone.
NO RESPAWNS. Really odd I thought and went to the second area I visited.
No respawns there either. Not anywhere where I had been killing.
No players seen. Friendlist did work.

I get disconnected.
Not the usual way, but the way when you just get thrown out
to the login screen.
I log straight in again to my beloved hunter just to see
EVERY quest I had completed was BACK IN MY LOG.
Items I had equipped where gone from the slots. My old items
I used to wear was back in my inventory.

There had been no down time for any of my friends and they were not all in raids.
There was no world server down, rollback or restart.

Conclusion
I guess I was being watched and transferred to an alternate world server.
That explains why I still could still see my friends coming on-and offline
and why my quests wasn't complete on the world server when I came back on.
I think this is a method used for phasing or layering botters from one server
to another where they scan with warden, and perhaps other illegal
methods. Have you experienced this? I have twice, on the same IP.

How to avoid
There's no way to protect yourself against this.
Im not even sure that this was not just a bug. Most likely not.


Number two. You can avoid it.
Screenshot'd?

Sometimes it feels like keeping my glider shortcut on my desktop
or in my taskbar a stupid and very visible idea.
If blizzard wanted to I think they could use their basic print screen
button whenever they wanted. Not just to take screens in-game
but aswell on it all if using windowed mode as most of us botters are.

If they sent a keystroke to our client (wow.exe) and we're using
background mode in glider and wow is currently not the active window
in theory it could result in a screenshot over our entire desktop.
Most likely it doesn't work that way, but perhaps they can see
windows above the wow window aswell as our mouse position.

Conclusion
It is possible, but very unlikely blizzard would take screenshots with warden.
It's simple but it would prove much more efficient than detecting
a program with maximum security such as glider.

How to avoid
Don't create a desktop shortcut and each time you run glider right click
the windows start-button > Properties > Taskbar > Customize and select
always hide for Glider and eventual add-ons. This will hide the icon in taskbar.



This is actual. Much like an anti-virus or anti-spyware scan.
Warden scan
Warden does scan your active programs for WoW memory reading.
This scan is active when you start up WoW. You might have heard
WoW speaking sometime and thought you were just nuts.
That's not the case, it alarms for detected keyloggers and malicious software.
The warden scan can aswell run while in-game. If you see wow.exe taking
a lot of memory in the Task Manager, it might be because it's scanning.
Or loading a huge area :-)

Conclusion
You're screwed if warden detects your bot. It usually changes after patches.
Auto-ban. It might aswell report you for suspicous behavior.

How to avoid
You can't. Launch glider before WoW might help though.
It did back in the days. Test your profiles etc. on private servers,
if you get an error window warden might pick up the window title.
That equals no good. Prepare to be watched if not instantly banned.
Make sure you choose to randomly rename the glider process.


Sorry for the lack of screenshots & videos. It's hard to capture these moments. If it does happen again, I will shoot... A screenshot.

[iradiation]

most likely a server crash then a reroll. also im pretty sure they don't take screenshots and if they did wouldn't we all get banned lol. launch glider before or after wow doesnt make a difference. im not a genius with glider and warden either but ive read most of this stuff from hamut. also you won't get banned for having it installed if your wondering its only if you use it is when they can ban. please don't take this as a flame just saying

[Cypher]

No offense. But you have absolutely no idea what you're talking about.

[weekendwars]

yea.... the first thing about the mobs not respawning that was probly lag and you were lagging for so long you just got cut off

[Ferag]

I actually run in to similar situations with no respawns while farming the boats at the Isle. No idea why, probably not related to warden as Chaz says, he is god when it comes to these things.

[iradiation]

Ferag do you have good ping with the server? (ms)

[Apoc]

I'm with Chazzwazza on this one. People REALLY should stop talking about Warden if they haven't a clue what it's actually doing. (Hint, it's only scanning select things. [Known hacking offsets, and a few other scans])

[kynox]

Warden scan
Warden does scan your active programs for WoW memory reading.
This scan is active when you start up WoW. You might have heard
WoW speaking sometime and thought you were just nuts.
That's not the case, it alarms for detected keyloggers and malicious software.
The warden scan can aswell run while in-game. If you see wow.exe taking
a lot of memory in the Task Manager, it might be because it's scanning.
Or loading a huge area :-)

This is 110% incorrect.

The warden scan can aswell run while in-game.

It runs in the WoW Memory Space >_>.

If blizzard wanted to I think they could use their basic print screen
button whenever they wanted. Not just to take screens in-game
but aswell on it all if using windowed mode as most of us botters are.

Do you know how many screenshots they would have to go through each day? That's just silly.

Warden does scan your active programs for WoW memory reading.

Warden doesn't appear to be reading any processes other than its self lately, and it cannot detect when a 3rd party application is reading memory from it, Warden isn't a ring0 driver.

This scan is active when you start up WoW. You might have heard
WoW speaking sometime and thought you were just nuts.
That's not the case, it alarms for detected keyloggers and malicious software.

Scan.dll IS NOT WARDEN, Warden isn't downloaded and run until you select a realm to connect to.

If you see wow.exe taking
a lot of memory in the Task Manager, it might be because it's scanning.
Or loading a huge area :-)

Oh come on, now thats just horse shit.

You're screwed if warden detects your bot. It usually changes after patches.
Auto-ban. It might aswell report you for suspicous behavior.

Warden can be updated whenever THEY feel like doing so, not after patches.

[Cypher]

I knew you'd pop up and set things straight so I didn't bother expanding on my post.

I really wish people would stop posting speculation when they have absolutely no idea what they're talking about.

[Nilrac]

Yeah I have used glider for a while now and have had NO problem.

[Apoc]

I knew you'd pop up and set things straight so I didn't bother expanding on my post.

I really wish people would stop posting speculation when they have absolutely no idea what they're talking about.

Well good sir, I think it's time we post the truth behind warden where everyone can see it. So no more stupid threads like this come up again.

[Krazzee]

Wow, I actually think my brain fried a bit reading Kynox's explanation. That's the reason I avoid the programming section, you guys are amazing at what you do, but to people like me, once you start talking then we can actually feel our brains frying.

Also in regards to the warden thing, I have no ****ing idea what it does, but I'll agree with Kynox on this one

[[Blaze]]

Warden is just a series of tubes.

[kynox]

warden is just a series of tubes.

its not a big truck!

[Come Undone]

This is 110% incorrect.

It runs in the WoW Memory Space >_>.


Do you know how many screenshots they would have to go through each day? That's just silly.

Warden doesn't appear to be reading any processes other than its self lately, and it cannot detect when a 3rd party application is reading memory from it, Warden isn't a ring0 driver.

Scan.dll IS NOT WARDEN, Warden isn't downloaded and run until you select a realm to connect to.

Oh come on, now thats just horse shit.

Warden can be updated whenever THEY feel like doing so, not after patches.

Thanks for the update. This is what I've been looking for.
Late night speculations, sorry if I offended with my lack of warden experience.

So, Scan.dll is for detecting malicious software and not connected to warden
in any way? Makes sense.

Warden is simply anti-cheat detective then. Not for detecting the malware.

Can you explain WoW Memory Space?

Aswell, I'll completly remove the topic when it's been fully explained so you
can put up a detailed topic about this, so no more, as Apoc said, topics like
this pop up.


Warden Cannot read any other process than itself? Do you refer to wow.exe
and it's content or just wow.exe or am I completly lost?