Warden and 'The Governor'

[Cypher]

The governor ... are we back to 2007 ?
oh well nice sticky as usual

According to WoWinsider, yes we are.

Absolutely, it was out of bounds and in the wrong, but isn't anymore. I was just re-enforcing Cypher's point in that people still believe warden works the way it originally did.

I'm 50/50 on the topic. Whilst I can understand why people would object, I don't think that its really an issue as long as all they send back is a 1 or a 0 (and the hash list is 'appropriate' -- ie only cheats etc).

[hsurce12]

Still dont get it..

[BoogieManTM]

I'm 50/50 on the topic. Whilst I can understand why people would object, I don't think that its really an issue as long as all they send back is a 1 or a 0 (and the hash list is 'appropriate' -- ie only cheats etc).

I personally don't really care, it's just out of bounds imo for a AC to be scanning my browser, etc. It doesn't need to do that in order to find cheats. It should be looking for win32 hooks, code injections (as it is now), etc, etc.. who cares what my browser title is?

[Cypher]

I personally don't really care, it's just out of bounds imo for a AC to be scanning my browser, etc. It doesn't need to do that in order to find cheats. It should be looking for win32 hooks, code injections (as it is now), etc, etc.. who cares what my browser title is?

I see your point, but take completely passive out-of-process stuff for example. Like a radar that just uses RPM to pull out objects. Short of boosting into the kernel and hooking APIs to watch for the RPM call (MUCH more intrusive) there's no way for Warden to know a cheat is being used. Its not like it KNOWS its your browser title, it's fairly indiscriminate, but its just the only real way it could detect stuff like that (hashing process memory, reading titles, etc).

technically you could transmit a lot more data. for example ingame "/script BG_DESERTER = "hey blizzard";" would send the whole string to the warden server. But don't expect a reply ; )

Haha, maybe if you're lucky they'll send back another rickroll?

[kynox]

I see your point, but take completely passive out-of-process stuff for example. Like a radar that just uses RPM to pull out objects. Short of boosting into the kernel and hooking APIs to watch for the RPM call (MUCH more intrusive) there's no way for Warden to know a cheat is being used. Its not like it KNOWS its your browser title, it's fairly indiscriminate, but its just the only real way it could detect stuff like that (hashing process memory, reading titles, etc).



Haha, maybe if you're lucky they'll send back another rickroll?

I'm still hoping for another ERROR_TOO_MANY_SECRETS.

[Cypher]

I'm still hoping for another ERROR_TOO_MANY_SECRETS.

Updated the emulator yet ******?

[amynnet93]

go get them cypher!

[fearedtoast]

Sorry to ask a question on this thread, but do you know how long Blizzard keeps track of in-game player conversations? I hear 3 months get tossed around alot for that. If you don't deem that to be related to your myth-busting, then please just pretend I didn't say anything.

[BoogieManTM]

Sorry to ask a question on this thread, but do you know how long Blizzard keeps track of in-game player conversations? I hear 3 months get tossed around alot for that. If you don't deem that to be related to your myth-busting, then please just pretend I didn't say anything.

That's impossible for anyone to answer except for blizzard, as that is all server side.

Could be forever, as far as we know.

[Cypher]

haha yes the rickroll scan was brilliant. We had a good laugh while reversing it. I wonder if they ever saw the characters in a logfile who responded a different / positive result for the rickroll scan ; )

To bad the warden guy seems to be really busy. Changes after 6 month without code update are really disappointing.

I think it's funny that there's just one guy doing all the code changes.

[Kartio]

My new wallpaper, ty.

[Coraci]

...there's always a chance that Warden could see you doing something you don't want it to.

I find that statement funny.. :P

[valiliv]

Is this an early April's Fool? Cause searching for "Governor" on this website brings up THREE threads, with the last reply mid-2007. Thank God for this sticky designed to stem the "constant creation of threads about Governor"! Man i was getting sick of those, almost one thread every 2 years or so, unacceptable.

From Blizzard:

In an effort to combat the efforts of those individuals who are willing to violate the EULA and/or the TOU, Blizzard Entertainment utilizes an “anti-cheating” utility that runs as part of World of Warcraft. This “anti cheating” utility performs limited scans of:

(i) the Random Access Memory (“RAM”) that is occupied by the World of Warcraft program to confirm that the World of Warcraft program has not been altered or “hacked” in violation of the World of Warcraft Terms of Use;
(ii) the World of Warcraft ‘process’ to determine if any unauthorized third party programs or computer code has been attached to the World of Warcraft process; and
(iii) the Windows Process List to determine if any confirmed hacking or cheating programs are presently open in violation of the World of Warcraft Terms of Use.

Part 3 seems to be at odds with "Fact #1" of this sticky.

[shingetterrobo]

[TEXT] read 5 bytes at 004B3EB6 // frame xml patch
[TEXT] read 6 bytes at 00613CB0 // Set Move State patch
[TEXT] read 7 bytes at 00670ADC // follow unit patch
[TEXT] read 7 bytes at 004A4492 // lua protection patch
[TEXT] read 5 bytes at 0077E47E // lua protection patch
[TEXT] read 5 bytes at 006ED528 // unknown (camera related?)
[TEXT] read 8 bytes at 00699FFC // movement related (fall time?)
[TEXT] read 12 bytes at 00495E60 // PrintChatMessage
[TEXT] read 5 bytes at 00491B6D // Language Patch
[TEXT] read 10 bytes at 00420116 // WS2_32.Send
[TEXT] read 12 bytes at 008DB3AB // movement related (set movestate)
[TEXT] read 6 bytes at 008DAA37 // No Fall Damage patch
[TEXT] read 12 bytes at 00498EC0 // SendChatMessage
[TEXT] read 6 bytes at 008D8926 // movement related

[RDATA] read 8 bytes at 00972F88 // wall climb
[RDATA] read 8 bytes at 009A9A7C // jump velocity
[RDATA] read 8 bytes at 0096E180 // gravity

[DATA] read 8 bytes at 00FC194C // blizz authenticator

[Baelzebub]

Lazy...i dunno about that man. More like why bother? You are well aware as much as anyone that they can shut down 'almost' any botter/hacker if and when they choose to. Keep it safe, keep it hidden to paraphrase a wise man but where would capitalism and making a profit be if everyone done that?