found a new check item in WARDEN

[yangcock]

Found a new check item in WARDEN,today!

2012- 3-14 18:53:51| ===== S->C : Unknown warden server opcode[137]

2012- 3-14 18:53:51| 0204406578650C6B65726E656C33322E646C6C114765745468726561645072696F72697479086465 6F776C73797900D9E344BD941CF9C9BA83F0553127D3E08517E1DA17FDFB3FEB424300000BD50106 104B620C8A24B3D92F70E92F7C743383F9D011C3F6B713232F1AEAC4CF0203FFFFFFFF06D50102F3 4105D50106009B0809D5010630830809D50102064205D50106C46E81087798069E0C180FE762FD63 9E28B891CDBA0342AFCAA613DB6104E8
2012- 3-14 18:53:51| @exe
2012- 3-14 18:53:51| kernel32.dll
2012- 3-14 18:53:51| GetThreadPriority
2012- 3-14 18:53:51| deowlsyy
2012- 3-14 18:53:51| [00] D9 0x00004342 11 (CT_PAGEAB)
2012- 3-14 18:53:51| [01] D5 0x00624B10 12 (CT_MEM)
2012- 3-14 18:53:51| [02] 8A kernel32.dll (CT_DVR)
2012- 3-14 18:53:51| addxp ok (4)
2012- 3-14 18:53:51| [03] 8A 0xFFFF0302 255 (CT_PAGEAB)
2012- 3-14 18:53:51| -----wd in pak parse [fail]------
2012- 3-14 18:53:52| 02390067C6AD63E900816638FFFF9FFF8B4638F6C1E9006A00E8367500558BEC538B5D108B430055 8BEC83EC18568BF100E895FD3F0000D893FEC0488C11C1E9|chk r

2012- 3-14 18:53:52| danger4 stop



02
04 40657865
0C 6B65726E656C33322E646C6C
11 4765745468726561645072696F72697479
08 64656F776C737979
00
D9 E344BD94 1CF9C9BA83F0553127D3E08517E1DA17FDFB3FEB 42430000 0B CT_PAGEAB

D5 01 06 104B62 0C CT_MEM
8A 24B3D92F70E92F7C743383F9D011C3F6B713232F1AEAC4CF0203FFFFFFFF 06 NEW
D5 01 02 F341 05 CT_MEM
D5 01 06 009B08 09 CT_MEM
D5 01 06 308308 09 CT_MEM
D5 01 02 0642 05 CT_MEM
D5 01 06 C46E81 08 CT_MEM
77 98069E0C 180FE762FD639E28B891CDBA0342AFCAA613DB61 04 CT_DVR
E8

[TOM_RUS]

That's API hook check or something... Blizzard using it very rare. They were checking user32.dll+GetCursorPos in the past (2.x, 3.x).

[guizmows]

does someone check that? Which part of user32.dll is scanned by warden?

I'm far from home for few days, I can't check it now.

EDIT : oups I may have read first post to fast. it's not scanning user32 but kernel32.