[WoW] [3.1.0] Addon Blacklist

[Cypher]

Ah k. Never cared for addons. Well, then its the same fix. How are the c-r-c addons banned? Hardcoded?

I'm not 100% sure tbh. I never looked into it back then.

I'll try and dig one up and check if it's still blacklisted.

I'm kinda busy right now though so if you wanna beat me to it go for it. Just search for 'cross realm communication addon' or something. I think it was called "babelfish".

EDIT:

Just thought I'd point out too, that Blizzard can sign addons to execute any protected functions etc. Who feels like setting up a distributed cracker? Who knows, we might get REALLY lucky.

[schlumpf]

As Blizzard addons are loaded with a wildcard (sub_45F000("Interface\\AddOns\\", "Blizzard*", sub_69A470, &v3, 0), it may also be possible to just name your addon Blizzard_MyAddon. But thats just speculative.

Release it, Blizzard! We want to test it. .___.

[Cypher]

Ah k. Never cared for addons. Well, then its the same fix. How are the c-r-c addons banned? Hardcoded?

Addons/Lua are awesome. You can write most of a fairly decent bot in LUA. Just need to fill in a handful of gaps.

As Blizzard addons are loaded with a wildcard (sub_45F000("Interface\\AddOns\\", "Blizzard*", sub_69A470, &v3, 0), it may also be possible to just name your addon Blizzard_MyAddon. But thats just speculative.

Release it, Blizzard! We want to test it. .___.

Nah. I KNOW they can sign addons so I'm nearly 100% sure their addons are signed.

[schlumpf]

I'm not 100% sure tbh. I never looked into it back then.

I'll try and dig one up and check if it's still blacklisted.

I'm kinda busy right now though so if you wanna beat me to it go for it. Just search for 'cross realm communication addon' or something. I think it was called "babelfish".

EDIT:

Just thought I'd point out too, that Blizzard can sign addons to execute any protected functions etc. Who feels like setting up a distributed cracker? Who knows, we might get REALLY lucky.

The signed addons should just be checked by some simple function. As the GlueXML-check (CheckFileSignature is the function), it should be possible to just return true; it.

There is also a new DBC: DBFilesClient\BannedAddOns.dbc

[Cypher]

Nono, you misunderstand what I'm saying.

You can easily patch the protected function check to effectively 'emulate' that behaviour.

I'm talking about cracking their private key so you can sign addons and the game will verify it with their public key and say "oh yep, that's a blizzard addon, let it do whatever" without any hooks or anything.

Also, awesome find, anything in it?

[schlumpf]

Nah. I KNOW they can sign addons so I'm nearly 100% sure their addons are signed.

They are signed in the .TOC.SIG files. There is a single occurance of "%s.sig" in the binaries.

One of the calls to that function is short after a "Interface\\AddOns\\%s\\%s.toc". I guess, it loads all .toc.sigs there and checks it afterwards.

-> Search the most confusing function after that piece of code and set that one to return true.

EDIT:

Also, awesome find, anything in it?

I only have your binary. Open your locale-enUS.mpq to extract the file. :P

[Cypher]

Whoops forgot.

And yeah I know how to extract the file (its not rocket science ^_^), I was just asking because I assumed you already had it. Forgot I posted the binary.

[Cypher]

Just to point out, I'm using the enGB client. But at any rate, the file isn't there. I guess they havn't added it yet, just some of the code for it.

EDIT:

Whoops, its in patch-enGB.mpq, forgot to check there. Uploading it.

[Cypher]

There we are.

http://dl.getdropbox.com/u/74751/BannedAddOns.dbc

Yes I know, another double/triple post. Silly buggy nightly build.

[schlumpf]

Too bad that it does not contain any useful data (as of this time.).

[Cypher]

Carbonite will probably be on the list when 3.1 hits.

[schlumpf]

The function useing that DBC is sub_699D50. Its called when AUTH_CHALLENGEing.

.text:0069A060 startCheckingForBADDONS

It seems like the DBC is holding static lists updated every patch and the baddons file is a temporary added list for on-the-fly fixes.

[SKU]

Execute: 0x004A6520 http://img18.imageshack.us/img18/29/luaexecutew.jpg
GetTop: 0x00943D80 http://img15.imageshack.us/img15/1825/luagettopl.jpg
Register: 0x004A5210 http://img16.imageshack.us/img16/1359/luaregisterm.jpg
ToString: 0x00944290 http://img17.imageshack.us/img17/8314/luatostringd.jpg

No guarantee though :P Just looked for similarities.

[Cypher]

Ah cool.

I guess you could just use a DBC edit to bypass most of the check then.

Pseudocode using my DB API:

WoWDB* pBaddons = WoWDBMgr::Get()->GetDatabase(DB_BannedAddons);
for (i = pBaddons->GetMin(); i < pBaddons->GetMax(); i++)
{
unsigned int CRCField = 3; // <-- example. whatever.
unsigned int& MyField;
 if (!pBaddons->GetField(i,CRCField, MyField)) continue;
MyField = 0; // null out
}