Warden on OS X - More information

[Tanaris4]

I know it's not a LOT of information, but hopefully this will help some people/spark some discussions:
Warden on OS X – What I know – 0x126A90C

I'm going to try to post a list of what functions are actually called in the modules during login soon.

Let me know how wrong I am/if you have any questions

[TOM_RUS]

Are you sure it's warden modules and not battle.net auth modules? On windows client not downloading any warden modules during login, any after you logged in and connected to world server...
Also on Windows warden modules loaded by wow.exe, not by battle.net.dll.
Most likely you are confused by battle.net authentication modules...

[Tanaris4]

Yea I'm sure There are 3 auth modules that are streamed, then 2 warden modules. Might just be a different process on OS X. Proof:

-- dlopen --
 0x6 /Users/Shared/Blizzard/Battle.net/Cache/63/bc/63bc118937e6ea2faa7b7192676daeb1b7ca87a9c24ed9f5acd60e630b4dd7a4.auth
--- doModInitFunctions ---
dyld: calling initializer function 0x275d26a0 in /Users/Shared/Blizzard/Battle.net/Cache/63/bc/63bc118937e6ea2faa7b7192676daeb1b7ca87a9c24ed9f5acd60e630b4dd7a4.auth
-- dlopen --
 0x6 /Users/Shared/Blizzard/Battle.net/Cache/54/8b/548b5ef9e0dd5c2f89f59c3e0979249b27505c51f0c77d2b27133726eaee0ad0.auth
--- doModInitFunctions ---
dyld: calling initializer function 0x2760da6e in /Users/Shared/Blizzard/Battle.net/Cache/54/8b/548b5ef9e0dd5c2f89f59c3e0979249b27505c51f0c77d2b27133726eaee0ad0.auth
dyld: calling initializer function 0x2760dab0 in /Users/Shared/Blizzard/Battle.net/Cache/54/8b/548b5ef9e0dd5c2f89f59c3e0979249b27505c51f0c77d2b27133726eaee0ad0.auth
dyld: calling initializer function 0x2760daf2 in /Users/Shared/Blizzard/Battle.net/Cache/54/8b/548b5ef9e0dd5c2f89f59c3e0979249b27505c51f0c77d2b27133726eaee0ad0.auth
-- dlopen --
 0x6 /Users/Shared/Blizzard/Battle.net/Cache/20/76/207640724f4531d3b2a21532224d1486e8c4d2d805170381cbc3093264157960.auth
--- doModInitFunctions ---
--- NSLinkModule ---
 loading module MachOLoader1 with options 0x2
--- doModInitFunctions ---
dyld: calling initializer function 0x256f5fee in MachOLoader1
--- NSLinkModule ---
 loading module MachOLoader2 with options 0x2
--- doModInitFunctions ---
dyld: calling initializer function 0x27d1ffca in MachOLoader2

[caytchen]

Why would you even care about the battle.net modules? From what I understand they don't aim at botter.

[BoogieManTM]

Looks like auth to me.

Mac's warden still existed in the same form as windows, and the windows version doesn't appear to have changed much - i doubt the mac one would.

Bnet does stream up to 3 modules. password.dll, gameaccountselect.dll and one other i don't recall. but usually it only uses 2. It makes more sense that it's bnet and not warden. There's no reason for warden to even be initialized at login (as opposed to once in-game.)

[Tanaris4]

They're 100% warden modules, not battlenet modules. Look at what I posted, those are hooked functions then printed to a log. I'm 100% sure they are. These are all the warden functions I've found on the mac binary (thanks to all the work by the windows peeps, I just compared + eventually found them):



The battle.net module is loaded, then the 3 you refer to, then after login is complete (while sitting on char select), 2 warden modules are streamed, it's like 3 seconds after you're on the charselect screen.

Edit: Does anyone know what the actual warden module does? I've been trying to better understand what functions are called IN the warden module (not via debugging unfortunately, but by using the sample program to dump the functions that are called over a time period). I know that after 2 functions are called in the module, suddenly the Warden_SendPacket function starts firing (after Warden_GenerateKeys), I just wish I could emulate this piece (is this realistic or should I stop trying to find a way?)

Obviously preventing the module from loading is getting me no where, no warden packets are sent, and i'm disconnected after 3 minutes of being in the game world.

[Tanaris4]

Great post, thanks for all the info :-) One question on hooking warden tick, isn't that called a RIDICULOUS amount, I hooked it + just printed to a log when it was called and it was multiple times per second