Question: Warden on Europe?

[Daemeat]

Hello everybody I have a question I would like to ask which is 'does Warden run on europe servers/(europe clients if there is such a thing)'?

Apparantly warden is supposed to scan WoWs memory using ReadProcessMemory and scan through windows/processes/modules/virtualmemory and such using the required functions but I have had not one single call to those functions (Except for the 'scan' module which runs only once as far as I know and is not Warden)

So I looked around the net and these forums about what other people found about Warden and how It functions and I read that it is downloaded and then run/loaded whenever (and there supposedly are many many versions of the same Warden) so I decided to leave my WoW client running with the necessary function logging on.

After some time I decided I am either doing something wrong or there has been no Warden running at all (or warden is scanning memory with opcodes and not calling ReadProcessMemory) but then that still doesnt explain why other functions are not firing.

So does Warden run on WoW europe at all or are there certain things I have not been paying attention to?


Any constructive comments are appreciated :wave:

[2dgreengiant]

Inbe4cypher

Yes itson EU and US

[Danne206]

There is already several threads of this in the memory edit section, I also believe one of them is a sticky.

Good luck.

[Cypher]

Hello everybody I have a question I would like to ask which is 'does Warden run on europe servers/(europe clients if there is such a thing)'?

Yes, it does. There, that was easy.

Apparantly warden is supposed to scan WoWs memory using ReadProcessMemory and scan through windows/processes/modules/virtualmemory and such using the required functions but I have had not one single call to those functions (Except for the 'scan' module which runs only once as far as I know and is not Warden)

No, just... no.

Please read the sticky thread entitled "Warden and 'The Governor'"

So I looked around the net and these forums about what other people found about Warden and how It functions and I read that it is downloaded and then run/loaded whenever (and there supposedly are many many versions of the same Warden) so I decided to leave my WoW client running with the necessary function logging on.

Again, read the sticky. That's why its there.

After some time I decided I am either doing something wrong or there has been no Warden running at all (or warden is scanning memory with opcodes and not calling ReadProcessMemory) but then that still doesnt explain why other functions are not firing.

You're doing something wrong. Warden is definitely present and running. You're just not looking in the right spots because you're misunderstanding how Warden is implemented.

So does Warden run on WoW europe at all or are there certain things I have not been paying attention to?

Warden definitely runs on the EU servers.

Any constructive comments are appreciated :wave:

Read the f'ing sticky. Kthx.

Inbe4cypher

Yes itson EU and US

InAfterFailMod.

[Daemeat]

Yes, it does. There, that was easy.

No, just... no.

Please read the sticky thread entitled "Warden and 'The Governor'"

Again, read the sticky. That's why its there.

You're doing something wrong. Warden is definitely present and running. You're just not looking in the right spots because you're misunderstanding how Warden is implemented.

Read the f'ing sticky. Kthx.

I appreciate all responses so far

I _HAVE_ read that sticky and yes the Wiki link is the most relevant source I could find it still doesnt answer the question why I am not catching any of Warden's actions.

Everything else in your sticky comments about how outdated 'The Governor' is and badmouthing its creator ( neither did I ever refer to that out-dated application).

The Warden wiki page "Page is based on WoW 2.4.3 01/9/08 by kynox " is about 1.5 years old and I think that is a bit outdated seeing that everybody keeps claiming Warden is constantly changing (and that WoW is currently at 3.3.3).

So I havnt really gathered anything that I didnt already know(other than that your sticky should provide me with everything I need to know).

No, I can't find any trace of warden hooking ZwVirtualQuery (only calls have been through functions inside ntdll that were being called from WoW because it couldnt find a texture) and no, there are no queries for modules either.


Does warden run in ring0? that would help me alot (I dont have that much experience in ring0 activity but it's nothing out of my league)

Does my necklace I am currently wearing protect me from Warden?

Am I really missing out on something here?
I completely understand that information is preferred to be kept in closed doors but I dont seem to be able to find a hint of how I can backtrace anything back to warden.

Again any information is appreciated :wave:

[Apoc]

I appreciate all responses so far

I _HAVE_ read that sticky and yes the Wiki link is the most relevant source I could find it still doesnt answer the question why I am not catching any of Warden's actions.

Everything else in your sticky comments about how outdated 'The Governor' is and badmouthing its creator ( neither did I ever refer to that out-dated application).

The Warden wiki page "Page is based on WoW 2.4.3 01/9/08 by kynox " is about 1.5 years old and I think that is a bit outdated seeing that everybody keeps claiming Warden is constantly changing (and that WoW is currently at 3.3.3).

So I havnt really gathered anything that I didnt already know(other than that your sticky should provide me with everything I need to know).

No, I can't find any trace of warden hooking ZwVirtualQuery (only calls have been through functions inside ntdll that were being called from WoW because it couldnt find a texture) and no, there are no queries for modules either.


Does warden run in ring0? that would help me alot (I dont have that much experience in ring0 activity but it's nothing out of my league)

Does my necklace I am currently wearing protect me from Warden?

Am I really missing out on something here?
I completely understand that information is preferred to be kept in closed doors but I dont seem to be able to find a hint of how I can backtrace anything back to warden.

Again any information is appreciated :wave:

Given that WoW manually maps some of ntdll, I doubt your 'research' has gone much further than reading a few wiki pages. (The manual mapping started ~4-5 months ago if memory serves me correctly)

You don't know what you're talking about. Please, stop being another tool, and giving out false information.

[Daemeat]

Given that WoW manually maps some of ntdll, I doubt your 'research' has gone much further than reading a few wiki pages. (The manual mapping started ~4-5 months ago if memory serves me correctly)

You don't know what you're talking about. Please, stop being another tool, and giving out false information.

As far as I know im not giving out any information other than what I gathered.
And the reason I created this thread was in the hope of some helpful information and not to be flamed at.

If anyone has anything remotely informative to say I will really appreciate it, flaming doesnt help and if this thread is inappropriate then I'm sure it will be closed/removed or _ignored_.

I will be having a look in your Dump thread which will probably have what I need

PS: The excuse I have for not poking around more than I feel comfortable with is that I don't want to poke my hand in WoW's places where other people have and got bitten(by warden) and want to prevent myself from being banned

[Cypher]

I appreciate all responses so far

I _HAVE_ read that sticky and yes the Wiki link is the most relevant source I could find it still doesnt answer the question why I am not catching any of Warden's actions.

Everything else in your sticky comments about how outdated 'The Governor' is and badmouthing its creator ( neither did I ever refer to that out-dated application).

The Warden wiki page "Page is based on WoW 2.4.3 01/9/08 by kynox " is about 1.5 years old and I think that is a bit outdated seeing that everybody keeps claiming Warden is constantly changing (and that WoW is currently at 3.3.3).

So I havnt really gathered anything that I didnt already know(other than that your sticky should provide me with everything I need to know).

No, I can't find any trace of warden hooking ZwVirtualQuery (only calls have been through functions inside ntdll that were being called from WoW because it couldnt find a texture) and no, there are no queries for modules either.


Does warden run in ring0? that would help me alot (I dont have that much experience in ring0 activity but it's nothing out of my league)

Does my necklace I am currently wearing protect me from Warden?

Am I really missing out on something here?
I completely understand that information is preferred to be kept in closed doors but I dont seem to be able to find a hint of how I can backtrace anything back to warden.

Again any information is appreciated :wave:

You missed what I was trying to point out to you. (Read: Why hooking ReadProcessMemory, window scanning apis, etc is pointless)

Warden does not work how you think it works. It's actually relatively 'low level', and you won't get very far with such high-level hooks.

Also, 'ZwQueryMemory' is not an API. Do you mean 'ZwQueryVirtualMemory'? If so, then Warden most definitely uses that API (well, technically in usermode you're supposed to call it 'NtQueryVirtualMemory', though that's more of a 'good practice' issue than anything else, as both names point to the exact same export).

The fact that you even need to ask whether "Warden runs in ring0" shows that what you're trying to do is more than a little out of your league. I'm not trying to be a dick or anything, I'm just being frank and honest. You should probably do some more research on the 'fundamentals' before attempting to tackle Warden.

[MaiN]

Does warden run in ring0? that would help me alot (I dont have that much experience in ring0 activity but it's nothing out of my league)

Warden doesn't. My proxies do.

[Cypher]

Warden doesn't. My proxies do.

Double win. Win post, win post count (666).

[Daemeat]

Alright @Cypher I am not sure if I should see your posts are a hint in a direction (if it is thank you for bothering)

@Danne206 thanks for directing me to that part of the forum

And to anyone who wants to find Warden and poke around in it here are some hints:

VirtualAlloc
VirtualProtect

Warden is loaded from a cache file and isnt loaded with LoadLibrary its placed in allocated memory instead and then protected.

If you go to Apoc's thread in memory editing (the DUMP thread) you can find some interesting function locations as well.

Warden__Tick for example is constantly executed when warden is running (Which is as soon as WoW is loading)
Packet_PACKET_SMSG_WARDEN_DATA is executed every 20 seconds (AFTER logging onto your character)
Warden__SendPacket is executed 20 seconds as well(might be a bit off on this one) (AFTER logging onto your character)

Cheers..