Question about warden and Blackmagic

[SwInY]

Good morning all, ( noon for others )

i have a quick question id like to find out as much info as possible, tryed searching high and low.

my question is,
How safe is it to use blackmagic to write a value to wow..
last night i was just experimenting with diffrent kinds of ways to make my Radian = my next waypoint, yes i know about click to move. but i was just experimenting with this and that.


' lol wtf this shit works without DC??
Managers.cProcessManager.WoWProcess.WriteFloat( _
(Globals.pPlayerBase + Globals.PlayerLocation.R) _
, WaypointRad)

does warden actualy look for memory writes?, im assuming so.
my hack doesnt inject not one bit, its only memory reads.
and possibly memory writes now

also will be using this to focus on my target using memory writes,
just wondering how safe it is before i use it on a account i go and purchase

Thanks guys

[lanman92]

No. Warden doesn't check for memory writes. No efficient or practical way to do it.

EDIT: Other than a few special cases where warden will check memory locations to ensure that they are not modified.

[SwInY]

alright so its perfectly fine to do what im doing. seems a bit dodgy, but hey, if its gunna work i guess why not.

[amadmonk]

You cannot reasonably check for memory writes.

All you can reasonably check for is "is this memory location different than I expect?"

People give Warden waaaay too much credit.

[Cypher]

You cannot reasonably check for memory writes.

All you can reasonably check for is "is this memory location different than I expect?"

People give Warden waaaay too much credit.

I like the ones where people ask "can waden detect memory READS". Usually I answer that with "Warden runs in usermode". Most of the time they just ask again though and qq with "wtf does that have to do with anything".

Sigh.

[amadmonk]

Of course it opens the interesting question of "how would you actually detect direct memory reads/writes if you were writing anti-cheat code?" I'm sure the answer has something to do with a hypervisor.

But that's not what they're asking...

[Cypher]

Of course it opens the interesting question of "how would you actually detect direct memory reads/writes if you were writing anti-cheat code?" I'm sure the answer has something to do with a hypervisor.

But that's not what they're asking...

On x86 you could just do a kernelmode hook of NtReadVirtualMemory/NtWriteVirtualMemory, that would work for non-injected apps.

On x64 yeah you'd have to do the same thing, but with a hypervisor.

[amadmonk]

Well, sure, but how would you do it for *injected* apps?

That's where it gets super interesting (to me, at least)... You'd have to play with the interrupt table and tweak the shit out of the VMM so that essentially everything in the process was a guard page (and that would simply KILL performance).

[Cypher]

Well, sure, but how would you do it for *injected* apps?

That's where it gets super interesting (to me, at least)... You'd have to play with the interrupt table and tweak the shit out of the VMM so that essentially everything in the process was a guard page (and that would simply KILL performance).

Waste of time imo. Better off trying to detect the injected code itself.