[Question] Warden Scanner and hooking

[Empted]

Can't help but be reminded of:
Three Star Programmer

I bet you can. Though, some humor helps too.

[Master674]

Can't help but be reminded of:
Three Star Programmer

rofld hard.

[daCoder]

I wanted to check out the warden scans today and recognized, that the warden client is loaded but there are no active scans.
Anybody else with the same experience?

[Frosttall]

I wanted to check out the warden scans today and recognized, that the warden client is loaded but there are no active scans.
Anybody else with the same experience?

Same here, it's possible that Warden is inactive for days or weeks and suddenly turns on.

[Master674]

Seems like warden will get an update, we should keep a close eye.

Maybe they will add self hashing to warden or something like this...

[eracer]

I noticed that too, its loaded in memory but not scanning. Maybe we will get lucky and they will just leave it that way

[-Ryuk-]

I noticed that too, its loaded in memory but not scanning. Maybe we will get lucky and they will just leave it that way

This has happened many time before. Usually they update the scans afterwards.

Maybe the will also update warden but it seems unlikely.

[Frosttall]

Warden is back online and scanning. (EU)

Scanned offsets within 30 minutes. No new scans after 10 minutes.

Total scans: 47

Address: 0006FA74
Length: 07
Bytes : E8 87 48 1F 00 8B 0D

Address: 0007038A
Length: 07
Bytes : 83 C4 08 85 C0 74 EF

Address: 0007536D
Length: 05
Bytes : 8B 4D 10 89 0D

Address: 003F7F10
Length: 09
Bytes : 55 8B EC 83 EC 18 56 8B F1

Address: 003F9AE0
Length: 09
Bytes : 55 8B EC 83 EC 10 53 56 8B

Address: 00421F20
Length: 09
Bytes : 55 8B EC 8B 45 0C 83 EC 08

Address: 004466C0
Length: 0A
Bytes : 55 8B EC 81 EC B8 00 00 00 8B

Address: 00447A22
Length: 07
Bytes : E8 09 1D D2 FF 8B F0

Address: 00486230
Length: 0A
Bytes : 8B 81 08 08 00 00 25 00 00 80

Address: 004A714B
Length: 04
Bytes : 85 DB 74 1F

Address: 004A714D
Length: 04
Bytes : 74 1F 8B 06

Address: 004EA311
Length: 07
Bytes : 0F 2F 44 08 08 72 06

Address: 004ED2E5
Length: 07
Bytes : A9 00 00 00 04 74 24

Address: 004ED2EA
Length: 07
Bytes : 74 24 A9 00 00 10 00

Address: 004EDA89
Length: 09
Bytes : F7 41 38 00 02 00 20 75 34

Address: 004F13D3
Length: 0B
Bytes : 01 7E 74 8B CE E8 33 A6 FF FF 8B

Address: 0052AE53
Length: 04
Bytes : 7E 0B 8B CE

Address: 0056B574
Length: 04
Bytes : 78 47 05 C0

Address: 00572B71
Length: 06
Bytes : 8B EC 83 3D E8 FF

Address: 00572B82
Length: 07
Bytes : 74 65 83 F9 1C 77 60

Address: 0057F445
Length: 05
Bytes : 77 34 FF 24 85

Address: 00597810
Length: 0C
Bytes : 55 8B EC B8 A0 42 00 00 E8 23 13 20

Address: 00597CB4
Length: 05
Bytes : 74 13 83 F8 10

Address: 00597CC7
Length: 09
Bytes : 75 0A 8B 4D 10 C7 41 04 00

Address: 0059AEF0
Length: 0C
Bytes : 55 8B EC 81 EC 20 0E 00 00 6A 0A E8

Address: 006EB0E8
Length: 05
Bytes : 74 2A F6 40 34

Address: 007148B1
Length: 04
Bytes : 75 0B 5F 5E

Address: 007148D9
Length: 0D
Bytes : 0F 85 4E 02 00 00 8D 55 DC 52 8D 45 CC

Address: 00762BEE
Length: 08
Bytes : F7 C3 00 00 F0 00 74 28

Address: 00762BF4
Length: 05
Bytes : 74 28 8B 4D 18

Address: 00762C1E
Length: 08
Bytes : F7 C3 F0 00 03 00 74 1D

Address: 00762C24
Length: 05
Bytes : 74 1D 8B 4D 18

Address: 00762C4E
Length: 08
Bytes : F7 C3 00 01 00 00 74 13

Address: 00762C54
Length: 05
Bytes : 74 13 8B 4D 18

Address: 00762C69
Length: 05
Bytes : F6 C3 0F 74 21

Address: 00762C6C
Length: 05
Bytes : 74 21 8B 4D 18

Address: 00796750
Length: 09
Bytes : 55 8B EC 8B 45 0C 8B 4D 08

Address: 008B576F
Length: 09
Bytes : F7 41 38 00 00 10 01 74 65

Address: 008B5776
Length: 05
Bytes : 74 65 D9 41 50

Address: 008B91D0
Length: 07
Bytes : A9 00 00 00 10 74 07

Address: 008B9210
Length: 05
Bytes : 75 3E F6 46 3C

Address: 008B9963
Length: 0C
Bytes : 81 66 38 FF FF 9F FF 8B 4E 3C 8B 46

Address: 008C0E40
Length: 09
Bytes : 55 8B EC 51 53 56 8B 75 08

Address: 00933E90
Length: 08
Bytes : 2F 54 9A 41 43 4D 69 73

Address: 00937BDC
Length: 04
Bytes : BB 8D 24 3F

Address: 00A0B458
Length: 08
Bytes : D8 93 FE C0 48 8C 11 C1

Address: 00A725BC
Length: 06
Bytes : 04 00 00 00 84 FC

[eracer]

Back online and scanning here in the US also.

Looks like the same 47 addresses

Offset: 0x0006FA74 Length: 7 Bytes: E8 87 48 1F 00 8B 0D
Offset: 0x0007038A Length: 7 Bytes: 83 C4 08 85 C0 74 EF
Offset: 0x0007536D Length: 5 Bytes: 8B 4D 10 89 0D
Offset: 0x003F7F10 Length: 9 Bytes: 55 8B EC 83 EC 18 56 8B F1
Offset: 0x003F9AE0 Length: 9 Bytes: 55 8B EC 83 EC 10 53 56 8B
Offset: 0x00421F20 Length: 9 Bytes: 55 8B EC 8B 45 0C 83 EC 08
Offset: 0x004466C0 Length: 10 Bytes: 55 8B EC 81 EC B8 00 00 00 8B
Offset: 0x00447A22 Length: 7 Bytes: E8 09 1D D2 FF 8B F0
Offset: 0x00486230 Length: 10 Bytes: 8B 81 08 08 00 00 25 00 00 80
Offset: 0x004A714B Length: 4 Bytes: 85 DB 74 1F
Offset: 0x004A714D Length: 4 Bytes: 74 1F 8B 06
Offset: 0x004EA311 Length: 7 Bytes: 0F 2F 44 08 08 72 06
Offset: 0x004ED2E5 Length: 7 Bytes: A9 00 00 00 04 74 24
Offset: 0x004ED2EA Length: 7 Bytes: 74 24 A9 00 00 10 00
Offset: 0x004EDA89 Length: 9 Bytes: F7 41 38 00 02 00 20 75 34
Offset: 0x004F13D3 Length: 11 Bytes: 01 7E 74 8B CE E8 33 A6 FF FF 8B
Offset: 0x0052AE53 Length: 4 Bytes: 7E 0B 8B CE
Offset: 0x0056B574 Length: 4 Bytes: 78 47 05 C0
Offset: 0x00572B71 Length: 6 Bytes: 8B EC 83 3D E8 FF
Offset: 0x00572B82 Length: 7 Bytes: 74 65 83 F9 1C 77 60
Offset: 0x0057F445 Length: 5 Bytes: 77 34 FF 24 85
Offset: 0x00597810 Length: 12 Bytes: 55 8B EC B8 A0 42 00 00 E8 23 13 20
Offset: 0x00597CB4 Length: 5 Bytes: 74 13 83 F8 10
Offset: 0x00597CC7 Length: 9 Bytes: 75 0A 8B 4D 10 C7 41 04 00
Offset: 0x0059AEF0 Length: 12 Bytes: 55 8B EC 81 EC 20 0E 00 00 6A 0A E8
Offset: 0x006EB0E8 Length: 5 Bytes: 74 2A F6 40 34
Offset: 0x007148B1 Length: 4 Bytes: 75 0B 5F 5E
Offset: 0x007148D9 Length: 13 Bytes: 0F 85 4E 02 00 00 8D 55 DC 52 8D 45 CC
Offset: 0x00762BEE Length: 8 Bytes: F7 C3 00 00 F0 00 74 28
Offset: 0x00762BF4 Length: 5 Bytes: 74 28 8B 4D 18
Offset: 0x00762C1E Length: 8 Bytes: F7 C3 F0 00 03 00 74 1D
Offset: 0x00762C24 Length: 5 Bytes: 74 1D 8B 4D 18
Offset: 0x00762C4E Length: 8 Bytes: F7 C3 00 01 00 00 74 13
Offset: 0x00762C54 Length: 5 Bytes: 74 13 8B 4D 18
Offset: 0x00762C69 Length: 5 Bytes: F6 C3 0F 74 21
Offset: 0x00762C6C Length: 5 Bytes: 74 21 8B 4D 18
Offset: 0x00796750 Length: 9 Bytes: 55 8B EC 8B 45 0C 8B 4D 08
Offset: 0x008B576F Length: 9 Bytes: F7 41 38 00 00 10 01 74 65
Offset: 0x008B5776 Length: 5 Bytes: 74 65 D9 41 50
Offset: 0x008B91D0 Length: 7 Bytes: A9 00 00 00 10 74 07
Offset: 0x008B9210 Length: 5 Bytes: 75 3E F6 46 3C
Offset: 0x008B9963 Length: 12 Bytes: 81 66 38 FF FF 9F FF 8B 4E 3C 8B 46
Offset: 0x008C0E40 Length: 9 Bytes: 55 8B EC 51 53 56 8B 75 08
Offset: 0x00933E90 Length: 8 Bytes: 2F 54 9A 41 43 4D 69 73
Offset: 0x00937BDC Length: 4 Bytes: BB 8D 24 3F
Offset: 0x00A0B458 Length: 8 Bytes: D8 93 FE C0 48 8C 11 C1
Offset: 0x00A725BC Length: 6 Bytes: 04 00 00 00 84 FC

Here is the last 4 that i posted from 16048 dump thread which i noticed are a little different, all the others were exactly the same

Offset: 0x00933E20 Length: 8 Bytes: 2F 54 9A 41 43 4D 69 73
Offset: 0x00937B74 Length: 4 Bytes: BB 8D 24 3F
Offset: 0x00A0B3C8 Length: 8 Bytes: D8 93 FE C0 48 8C 11 C1
Offset: 0x00A725BC Length: 6 Bytes: 04 00 00 00 1C FC

[-Ryuk-]

Back online and scanning here in the US also.

-snip-
Here is the last 4 that i posted from 16048 dump thread which i noticed are a little different, all the others were exactly the same

Offset: 0x00933E20 Length: 8 Bytes: 2F 54 9A 41 43 4D 69 73
Offset: 0x00937B74 Length: 4 Bytes: BB 8D 24 3F
Offset: 0x00A0B3C8 Length: 8 Bytes: D8 93 FE C0 48 8C 11 C1
Offset: 0x00A725BC Length: 6 Bytes: 04 00 00 00 1C FC

I assume this is because of the mini patch. I haven't checked if warden module was updated, but I assume the "downtime" was due to laziness after the mini patch.

[DarkLinux]

All this talk about Warden made me want to code something for new members

http://www.ownedcore.com/forums/worl...n-scanner.html (EverScan - An Open Source Warden Scanner)

[ha1yguadal]

I've searched for this but have not found