Question about process hash & Warden.

[Sel3n]

A lot of people say that warden make hash of our running process.
And I wondered how it's possible to change hash process.

I don't think this code work, but theorically a hash is made has a date given, if an element (a variable stored in the program) change of value, the hash changes.
Or is it more complicated?

That's the code I tought, but I don't know how check if I've right.
To use it, I just have to put NoDetection () one can everywhere in the program, for example after a writing in memory, no?

        public string wardendetection;
        private string wardendetectionbis;

        public int RandomNumber(int min, int max)
        {
            Random random = new Random();
            return random.Next(min, max);
        }
        private static Random _random = new Random();
        public static string RandomString(int size)
        {
            StringBuilder builder = new StringBuilder();
            for(int i=0; i < size; i++)
            {   
            //26 letters in the alfabet, ascii + 65 for the capital letters
                builder.Append(Convert.ToChar(Convert.ToInt32(Math.Floor(26 * _random.NextDouble() + 65))));
            }
            return builder.ToString();
        }

        public void NoDetection()
        {
            int sizeofstring = RandomNumber(35, 258);
            int sizeofstring2 = RandomNumber(35, 258);
            wardendetection = RandomString(sizeofstring);
            wardendetectionbis = RandomString(sizeofstring2);
        }

RandomNumber & RandomString are not writen by me, found on web.

Just say me if this can works, or if I'd lost my time =)

Sorry for my poor english, it's not my mother tongue.

Cordially, Sel3n.

[kynox]

A) Warden doesn't do what you're describing
B) Why the **** would it hash .data?

[Cypher]

I'm speechless. No, really.

[Sel3n]

By 'hash' I means,

[quote = http://en.wikipedia.org/wiki/Warden_(software)]
While the game is running, Warden uses API function calls to collect data on open programs on the user's computer and sends it back to Blizzard servers as hash values to be compared to those of known cheating programs.
[...]
Warden now scans Warcraft game memory space only, with exception of a few tools.
[/quote]

It's just a question, but I has to ask me too much useless question ><
But, I'd just discovers the Wikipedia Warden page, and the time difference between they said, "While the game is running [...] to be compared to those of known cheating programs." and "Warden now scans Warcraft game memory space only, with exception of a few tools." is very important?

[Cypher]

The point is that even if they were trying to catch you, your code is USELESS. It doesn't hinder Warden hashing your process in the slightest.

[Sel3n]

Okay, thank you.

I'd just discover this thread http://www.mmowned.com/forums/wow-me...wiki-page.html, I skipped it because of my haste.

[furang]

Do you know how long it would take to hash the whole wow.exe process?...
I'm gonna to work on scan.dll after i create something like bot. I suppose it has some code, that warden uses.

[Cypher]

Do you know how long it would take to hash the whole wow.exe process?...
I'm gonna to work on scan.dll after i create something like bot. I suppose it has some code, that warden uses.

What the f*ck?

[alek900]

in befor close?

[vulcanaoc]

Do you know how long it would take to hash the whole wow.exe process?...
I'm gonna to work on scan.dll after i create something like bot. I suppose it has some code, that warden uses.

Lawl,

I'm pretty sure that scan.dll is used by the launcher to repair game files. Whatever it does, it is definitely not used by Warden.

AFAIK Warden is downloaded every time you log in, and only ever resides in RAM (unless you don't have enough RAM and... nvm..)

[Cypher]

Lawl,

I'm pretty sure that scan.dll is used by the launcher to repair game files. Whatever it does, it is definitely not used by Warden.

AFAIK Warden is downloaded every time you log in, and only ever resides in RAM (unless you don't have enough RAM and... nvm..)

Scan.dll is designed to look for certain cheats and malware and block WoW from running until they are shut down. According to Blizzard (based off their testimony in court in MDY v Blizzard), Scan.dll IS part of the "Warden Client" as a whole. From memory they split it up into two parts, the "resident component" (scan.dll), and the "dynamic component" (I don't actually remember what they called the second part, that's just a guess), which is the part that is received from the server.

[furang]

Just like i wrote. And there are at least 3 suspicious functions in it.
Scan_1(some args), Scan_2(some args), Scan_3(some args).
I also tried to sniff wow traffic in order to detect some flags or maybe some part of wow's process or something suspicious downloads, but i couldn't.

[vulcanaoc]

Just like i wrote. And there are at least 3 suspicious functions in it.
Scan_1(some args), Scan_2(some args), Scan_3(some args).
I also tried to sniff wow traffic in order to detect some flags or maybe some part of wow's process or something suspicious downloads, but i couldn't.

I don't think you get it.

[kynox]

Just like i wrote. And there are at least 3 suspicious functions in it.
Scan_1(some args), Scan_2(some args), Scan_3(some args).
I also tried to sniff wow traffic in order to detect some flags or maybe some part of wow's process or something suspicious downloads, but i couldn't.

Cypher and I have written countless amounts of posts about Scan.dll and its relation to warden. Search is your ****ing friend.

http://www.mmowned.com/forums/wow-me...ll-logger.html to get you started.

[joetheodd]

Do you know how long it would take to hash the whole wow.exe process?...

Speed Comparison of Popular Crypto Algorithms

According to that site, SHA-1 (which Warden uses, IIRC) can has 153MB of data per second on a 2.2GHz processor. If WoW's entire working set is 300MB, which seems about average, that'd be just under two seconds, which is very important to know, cause not only is WoW.exe a hack, it's also spyware and Sasser, mixed together with Sudden Infant Death Syndrome.