Warden Update [ List Address's ]

[SwInY]

Hey guys,

it has come to my attention that warden has possibly had some updates.
could some one with a warden scanner please confirm this and put the rest up.

as ive just put together, EU is still idling, US has released a warden release
from Ryuk post, and bits and peices of other things


Known new scans,

Address: 0x4FA3E552 Bytes: 57 8B 7D F8 E8 81 E3 FE FF

also if you know what the memory address does / what uses it. please post as it would be useful!

[l0l1dk]

Hey guys,

it has come to my attention that warden has possibly had some updates.
could some one with a warden scanner please confirm this and put the rest up.

as ive just put together, EU is still idling, US has released a warden release
from Ryuk post, and bits and peices of other things


Known new scans,

Address: 0x4FA3E552 Bytes: 57 8B 7D F8 E8 81 E3 FE FF

also if you know what the memory address does / what uses it. please post as it would be useful!

The address is actually 0x4FA3E6, the only place in Wow.exe that those bytes occur. That's in the SentChatMessage Lua function, where it calls the function that sends the chat message packet. It looks like it could possibly be modified for a language hack.

[Jadd]

Hey guys,

it has come to my attention that warden has possibly had some updates.
could some one with a warden scanner please confirm this and put the rest up.

as ive just put together, EU is still idling, US has released a warden release
from Ryuk post, and bits and peices of other things


Known new scans,

Address: 0x4FA3E552 Bytes: 57 8B 7D F8 E8 81 E3 FE FF

also if you know what the memory address does / what uses it. please post as it would be useful!

Old scan. Why would it be scanning a dynamic address as if it were a static address though? Makes no sense..

[SwInY]

http://www.ownedcore.com/forums/worl...ml#post2177573 ([WoW][4.3.0.15005] Info Dump Thread)

http://www.jadd-dev.info/forum/showt...=1246#post1246


would really like some one with a warden scanner to please post something


Jadd,
id keep a eye out. i got a feeling there going to target sn0wball very hard.

[Jadd]

http://www.ownedcore.com/forums/worl...ml#post2177573 ([WoW][4.3.0.15005] Info Dump Thread)

Warden detected - project sn0wball Forums


would really like some one with a warden scanner to please post something


Jadd,
id keep a eye out. i got a feeling there going to target sn0wball very hard.

I don't go change anything near this address. But it doesn't matter anyway. I compare each warden scan with addresses I modify... including all new addresses.

[-Ryuk-]

is warden idle on US? If not il post a full list today when i get on my laptop.

The address i posted is correct and was scanned because my bot detected it and shut down.

I havent got round to checking if the warden module has changed, but i doubt it has.


As for more information on warden here is some info on the diffrent scans i have found:
Memory Scan: this is th one everyone knows about, it just reads the bytes at the address and send a hash back to the server.

There are also two dll check(it could check for injected asm too):
The first one i always running and checks a set addres in each module that is loaded into wow.exe(it does check its self)
The second one only starts to scan after you inject a forign module.

Ill post more info later

Sent from my GT-S5570 using Tapatalk

[_Mike]

The address i posted is correct and was scanned because my bot detected it and shut down.

The only thing that would make sense is (red removed, green added)

Address: 0x4FA3E552 Bytes: 52 57 8B 7D F8 E8 81 E3 FE FF

Which means that the scan is indeed correct, but your output is messed up :P
(which btw is SendChatMessage like l0l1dk said, only 1 byte earlier)

[-Ryuk-]

Haha! I have no idea how I managed that...

My output is like this:

New Warden Address:4FA3E5 Bytes: 52 57 8B 7D F8 E8 81 E3 FE FF Alert Time: 2012-01-19 11:45:21

[JuJuBoSc]

0x0003DD8B
0x001D970F
0x0038ABE7
0x0038AC32
0x00054313
0x00204855
0x004D22C1
0x0062035F
0x00621E10
0x00200F11
0x004FA3E5
0x0038AC17
0x00205509
0x004F6AC0
0x0038ABB7
0x0032FF7A

Here is what I got last past days.

[-Ryuk-]

0x0003DD8B
0x001D970F
0x0038ABE7
0x0038AC32
0x00054313
0x00204855
0x004D22C1
0x0062035F
0x00621E10
0x00200F11
0x004FA3E5
0x0038AC17
0x00205509
0x004F6AC0
0x0038ABB7
0x0032FF7A

Here is what I got last past days.

How did you get these with warden being idle?

[JuJuBoSc]

Random US server

[-Ryuk-]

The three I tried are also idle .

Did the warden module change? I havent had time to check it yet.

Sent from my GT-S5570 using Tapatalk

[SwInY]

wow, so it looks like warden has been "busy" lately last couple of days...
about time...

could some one possibly tell what these offsets do / what bots would be using these

[-Ryuk-]

Yeah its about time.

I dont understand why its idle tho xD Unless thy are waiting for "prime time playing(sunday afrernoon)" and are going to instant ban people.

None of the addresses that juju posted hit speedhacking/teleport... which is just weird, considering they pulled back there hotfix some time ago.

Sent from my GT-S5570 using Tapatalk

[-Ryuk-]

Hey again,

Warden came back online on my realm about 20 minutes ago!

Here is a list of new addresses

--------------------------------
Offset: 0x4FA3E5
Length: A
Bytes: 82 87 139 125 248 232 129 227 254 255 


--------------------------------
Offset: 0x1D970F
Length: 4
Bytes: 133 219 116 28 


--------------------------------
Offset: 0x3DD8B
Length: A
Bytes: 118 165 243 15 17 142 212 1 0 0 


--------------------------------
Offset: 0x4D22C1
Length: 9
Bytes: 139 236 131 61 52 131 201 0 0 


--------------------------------
Offset: 0x38ABE7
Length: 8
Bytes: 247 195 240 0 3 0 116 29 


--------------------------------
Offset: 0x38AC32
Length: 5
Bytes: 246 195 15 116 33 


--------------------------------
Offset: 0x204855
Length: 7
Bytes: 169 0 0 0 4 116 38 


--------------------------------
Offset: 0x38AC17
Length: 8
Bytes: 247 195 0 1 0 0 116 19 


--------------------------------
Offset: 0x38ABB7
Length: 8
Bytes: 247 195 0 0 240 0 116 40 


--------------------------------
Offset: 0x621E10
Length: 7
Bytes: 169 0 0 0 16 116 7 


--------------------------------
Offset: 0x205509
Length: 9
Bytes: 247 65 56 0 2 0 32 117 52 


--------------------------------
Offset: 0x62035F
Length: 9
Bytes: 247 65 56 0 0 16 1 116 101 


--------------------------------
Offset: 0x200F11
Length: 7
Bytes: 15 47 68 8 8 114 6 


--------------------------------
Offset: 0x54313
Length: 4
Bytes: 126 11 139 206 


--------------------------------
Offset: 0x4F6AC0
Length: 5
Bytes: 116 14 131 251 16 


--------------------------------
Offset: 0x32FF7A
Length: 4
Bytes: 117 11 95 94

And here is a complete list

Offset         Length       Bytes
0x704430         9       85 139 236 81 83 86 139 117 8 
0x4FA3E5         A       82 87 139 125 248 232 129 227 254 255 
0x621E50         5       117 62 246 70 60 
0x1D9711         4       116 28 139 6 
0x38ABBD         5       116 40 139 77 24 
0x44A6             5       232 133 239 63 0 
0x1D970F         4       133 219 116 28 
0x89AA0           9       85 139 236 83 139 93 16 139 67 
0x4F9E37         7       117 22 104 56 2 0 0 
0x620366         5       116 101 217 65 80 
0x38ABED         5       116 29 139 77 24 
0x818C44         8       216 147 254 192 72 140 17 193 
0x119A             6       204 204 204 204 204 204 
0x883E0           9       85 139 236 131 236 24 86 139 241 
0x3DD8B           A       118 165 243 15 17 142 212 1 0 0 
0x7B76B8         8       187 141 36 63 212 208 49 62 
0x31F4E8         5       116 42 246 64 52 
0x898D0           9       85 139 236 131 236 8 83 86 139 
0x4F9CF0         C       85 139 236 129 236 24 14 0 0 106 10 232 
0x4D22C1         9       139 236 131 61 52 131 201 0 0 
0x4C5A74         4       124 71 5 192 
0x7B15C8         8       47 84 154 65 215 163 112 62 
0x44B0             6       232 75 203 255 255 232 
0x38ABE7         8       247 195 240 0 3 0 116 29 
0x14DF71         1       255 
0x17A8B2         7       232 73 243 47 0 139 240 
0x14D470         B       139 193 51 201 137 8 137 72 4 137 72 
0x4F6610         C       85 139 236 184 148 66 0 0 232 99 127 177 
0x20485A         7       116 38 169 0 0 16 0 
0x4493             5       106 0 232 150 138 
0x4ED3EE         5       114 59 139 77 24 
0x16D0D0         9       85 139 236 139 69 12 131 236 8 
0x38AC32         5       246 195 15 116 33 
0x38AC35         5       116 33 139 77 24 
0x4D22D2         7       116 101 131 249 25 119 96 
0x17A1F0         A       85 139 236 131 236 8 139 69 8 83 
0x204855         7       169 0 0 0 4 116 38 
0x4DDFC5         5       119 52 255 36 133 
0x32FFA2         D       15 133 216 1 0 0 141 85 220 82 141 69 204 
0x43C02E         5       139 77 16 137 13 
0xE440             6       232 139 159 255 255 137 
0x70A430         9       85 139 236 139 69 12 139 77 8 
0x90788C         8       4 0 0 0 1 0 0 0 
0x38AC17         8       247 195 0 1 0 0 116 19 
0x2088AD         B       1 126 116 139 206 232 201 165 255 255 139 
0x38ABB7         8       247 195 0 0 240 0 116 40 
0x1B3B60         A       139 129 184 7 0 0 37 0 0 128 
0x621E10         7       169 0 0 0 16 116 7 
0x205509         9       247 65 56 0 2 0 32 117 52 
0x62035F         9       247 65 56 0 0 16 1 116 101 
0x626DAF         C       129 102 56 63 255 143 255 243 15 17 94 80 
0x1C81FD         7       117 24 104 72 1 0 0 
0x17A88A         4       80 81 139 203 
0x200F11         7       15 47 68 8 8 114 6 
0x4F6ACE         9       117 10 139 69 16 199 64 4 0 
0x38AC1D         5       116 19 139 77 24 
0x54313           4       126 11 139 206 
0x4F6AC0         5       116 14 131 251 16 
0x32FF7A         4       117 11 95 94