New warden activity

[FattyXP]

I wasn't quite sure where I should post this, figured you guys would know more about it... It seems blizzard has updated warden.

I'm not sure if I was the only one still using OHack... but there was an updated version for 5.0.5 that was uploaded before l0ldk shut it down. I've been using it since it was released, and just recently (in the last two days) my wow client has been crashing to desktop with no messages, indicating that OHack is unloading wow to prevent a warden scan (at least I assume thats what it does). I'm sure its memory locations that were previously unscanned but because of the new developments with WoWPlus I believe a lot of the offsets that OHack uses are probably the same, and are now compromised.

Just figured I'd share my thoughts.

Edit:
Almost forgot, wow closes roughly 30-45 seconds after I load up OHack after logging in.

[l0l1dk]

I don't understand where people are getting the idea that Warden was updated (I've been asked several times today). I checked last night and it hadn't been updated (no changes to the module, that is). And OHack should no longer close after a few seconds. I didn't think anyone was still using it so I deleted the files from my Dropbox. That caused it to close because it couldn't check the killswitch. I put the killswitch file back, so it should run again.

[DarkLinux]

Sounds like its scanning a new address... not a big deal... or its just a crap hack and crashes lols XD If warden truly changed then I dont think l0ldk would detect it.

[eracer]

I just checked and warden is still scanning the same 47 offsets so it sounds like it's probably the killswitch file like l0l1dk said.

5.0.5.16135

Offset: 0x0006FA74 Length: 7 Bytes: E8 87 48 1F 00 8B 0D
Offset: 0x0007038A Length: 7 Bytes: 83 C4 08 85 C0 74 EF
Offset: 0x0007536D Length: 5 Bytes: 8B 4D 10 89 0D
Offset: 0x003F7F10 Length: 9 Bytes: 55 8B EC 83 EC 18 56 8B F1
Offset: 0x003F9AE0 Length: 9 Bytes: 55 8B EC 83 EC 10 53 56 8B
Offset: 0x00421F20 Length: 9 Bytes: 55 8B EC 8B 45 0C 83 EC 08
Offset: 0x004466C0 Length: 10 Bytes: 55 8B EC 81 EC B8 00 00 00 8B
Offset: 0x00447A22 Length: 7 Bytes: E8 09 1D D2 FF 8B F0
Offset: 0x00486230 Length: 10 Bytes: 8B 81 08 08 00 00 25 00 00 80
Offset: 0x004A714B Length: 4 Bytes: 85 DB 74 1F
Offset: 0x004A714D Length: 4 Bytes: 74 1F 8B 06
Offset: 0x004EA311 Length: 7 Bytes: 0F 2F 44 08 08 72 06
Offset: 0x004ED2E5 Length: 7 Bytes: A9 00 00 00 04 74 24
Offset: 0x004ED2EA Length: 7 Bytes: 74 24 A9 00 00 10 00
Offset: 0x004EDA89 Length: 9 Bytes: F7 41 38 00 02 00 20 75 34
Offset: 0x004F13D3 Length: 11 Bytes: 01 7E 74 8B CE E8 33 A6 FF FF 8B
Offset: 0x0052AE53 Length: 4 Bytes: 7E 0B 8B CE
Offset: 0x0056B574 Length: 4 Bytes: 78 47 05 C0
Offset: 0x00572B71 Length: 6 Bytes: 8B EC 83 3D E8 FF
Offset: 0x00572B82 Length: 7 Bytes: 74 65 83 F9 1C 77 60
Offset: 0x0057F445 Length: 5 Bytes: 77 34 FF 24 85
Offset: 0x00597810 Length: 12 Bytes: 55 8B EC B8 A0 42 00 00 E8 23 13 20
Offset: 0x00597CB4 Length: 5 Bytes: 74 13 83 F8 10
Offset: 0x00597CC7 Length: 9 Bytes: 75 0A 8B 4D 10 C7 41 04 00
Offset: 0x0059AEF0 Length: 12 Bytes: 55 8B EC 81 EC 20 0E 00 00 6A 0A E8
Offset: 0x006EB0E8 Length: 5 Bytes: 74 2A F6 40 34
Offset: 0x007148B1 Length: 4 Bytes: 75 0B 5F 5E
Offset: 0x007148D9 Length: 13 Bytes: 0F 85 4E 02 00 00 8D 55 DC 52 8D 45 CC
Offset: 0x00762BEE Length: 8 Bytes: F7 C3 00 00 F0 00 74 28
Offset: 0x00762BF4 Length: 5 Bytes: 74 28 8B 4D 18
Offset: 0x00762C1E Length: 8 Bytes: F7 C3 F0 00 03 00 74 1D
Offset: 0x00762C24 Length: 5 Bytes: 74 1D 8B 4D 18
Offset: 0x00762C4E Length: 8 Bytes: F7 C3 00 01 00 00 74 13
Offset: 0x00762C54 Length: 5 Bytes: 74 13 8B 4D 18
Offset: 0x00762C69 Length: 5 Bytes: F6 C3 0F 74 21
Offset: 0x00762C6C Length: 5 Bytes: 74 21 8B 4D 18
Offset: 0x00796750 Length: 9 Bytes: 55 8B EC 8B 45 0C 8B 4D 08
Offset: 0x008B576F Length: 9 Bytes: F7 41 38 00 00 10 01 74 65
Offset: 0x008B5776 Length: 5 Bytes: 74 65 D9 41 50
Offset: 0x008B91D0 Length: 7 Bytes: A9 00 00 00 10 74 07
Offset: 0x008B9210 Length: 5 Bytes: 75 3E F6 46 3C
Offset: 0x008B9963 Length: 12 Bytes: 81 66 38 FF FF 9F FF 8B 4E 3C 8B 46
Offset: 0x008C0E40 Length: 9 Bytes: 55 8B EC 51 53 56 8B 75 08
Offset: 0x00933E90 Length: 8 Bytes: 2F 54 9A 41 43 4D 69 73
Offset: 0x00937BDC Length: 4 Bytes: BB 8D 24 3F
Offset: 0x00A0B458 Length: 8 Bytes: D8 93 FE C0 48 8C 11 C1
Offset: 0x00A725BC Length: 6 Bytes: 04 00 00 00 84 FC

[sitnspinlock]

this just in: i'm writing the new warden

[DarkLinux]

Yes go rewrite warden and send it to Blizz... -_-

[FattyXP]

I don't understand where people are getting the idea that Warden was updated (I've been asked several times today). I checked last night and it hadn't been updated (no changes to the module, that is). And OHack should no longer close after a few seconds. I didn't think anyone was still using it so I deleted the files from my Dropbox. That caused it to close because it couldn't check the killswitch. I put the killswitch file back, so it should run again.

Thx for the response, and ty for putting the file back up =-)
Guess if I had looked at the source I would have seen that, removed it and recompiled... but yeah lol

[Jaladhjin]

I didn't think anyone was still using it so I deleted the files from my Dropbox.

I didn't think it was still available..moved up to higher access ranks? :-/

[l0l1dk]

I didn't think it was still available..moved up to higher access ranks? :-/

I took it down but I didn't disable it, so if you already had it you could still use it.

[Jaladhjin]

oh..well hot darn is that going to be a fairly consistent understanding for as long as it's functional? :-)

[l0l1dk]

oh..well hot darn is that going to be a fairly consistent understanding for as long as it's functional? :-)

Yes, it'll continue to work until there's a patch and the offsets change.

[-Ryuk-]

Yes, it'll continue to work until there's a patch and the offsets change.

Just a heads up, Warden scans were updated last night...

There are 19 new scans(so far) and 66 scans in total:

--------------------------------
Offset: 0x8B576F
Length: 9
Bytes: 247 65 56 0 0 16 1 116 101 


--------------------------------
Offset: 0x6EB0E8
Length: 5
Bytes: 116 42 246 64 52 


--------------------------------
Offset: 0x421F20
Length: 9
Bytes: 85 139 236 139 69 12 131 236 8 


--------------------------------
Offset: 0x59B3E6
Length: 5
Bytes: 116 82 131 255 7 


--------------------------------
Offset: 0x762C4E
Length: 8
Bytes: 247 195 0 1 0 0 116 19 


--------------------------------
Offset: 0x597CB4
Length: 5
Bytes: 116 19 131 248 16 


--------------------------------
Offset: 0x8B5730
Length: B
Bytes: 85 139 236 131 236 32 243 15 16 65 76 


--------------------------------
Offset: 0x796750
Length: 9
Bytes: 85 139 236 139 69 12 139 77 8 


--------------------------------
Offset: 0x52AE36
Length: 4
Bytes: 127 29 139 134 


--------------------------------
Offset: 0x7038A
Length: 7
Bytes: 131 196 8 133 192 116 239 


--------------------------------
Offset: 0x762C1E
Length: 8
Bytes: 247 195 240 0 3 0 116 29 


--------------------------------
Offset: 0x4ED2E5
Length: 7
Bytes: 169 0 0 0 4 116 36 


--------------------------------
Offset: 0x597CC7
Length: 9
Bytes: 117 10 139 77 16 199 65 4 0 


--------------------------------
Offset: 0x3F9AE0
Length: 9
Bytes: 85 139 236 131 236 16 83 86 139 


--------------------------------
Offset: 0x762BF4
Length: 5
Bytes: 116 40 139 77 24 


--------------------------------
Offset: 0x4A714D
Length: 4
Bytes: 116 31 139 6 


--------------------------------
Offset: 0x4466C0
Length: A
Bytes: 85 139 236 129 236 184 0 0 0 139 


--------------------------------
Offset: 0x762B30
Length: A
Bytes: 85 139 236 131 236 28 83 139 93 28 


--------------------------------
Offset: 0x762BEE
Length: 8
Bytes: 247 195 0 0 240 0 116 40 


--------------------------------
Offset: 0x7148D9
Length: D
Bytes: 15 133 78 2 0 0 141 85 220 82 141 69 204 


--------------------------------
Offset: 0x933E90
Length: 8
Bytes: 47 84 154 65 67 77 105 115 


--------------------------------
Offset: 0x49F9E7
Length: 4
Bytes: 116 24 139 200 


--------------------------------
Offset: 0x445590
Length: A
Bytes: 85 139 236 131 236 52 83 86 139 241 


--------------------------------
Offset: 0x572B71
Length: 6
Bytes: 139 236 131 61 232 255 


--------------------------------
Offset: 0x413FBD
Length: 4
Bytes: 117 39 139 206 


--------------------------------
Offset: 0x8B9963
Length: C
Bytes: 129 102 56 255 255 159 255 139 78 60 139 70 


--------------------------------
Offset: 0x4A053F
Length: 7
Bytes: 117 24 104 83 1 0 0 


--------------------------------
Offset: 0x493760
Length: A
Bytes: 85 139 236 131 236 24 83 86 139 241 


--------------------------------
Offset: 0x125000
Length: 9
Bytes: 85 139 236 131 236 72 139 69 8 


--------------------------------
Offset: 0x486230
Length: A
Bytes: 139 129 8 8 0 0 37 0 0 128 


--------------------------------
Offset: 0x165930
Length: 8
Bytes: 85 139 236 161 148 44 235 1 


--------------------------------
Offset: 0x56B574
Length: 4
Bytes: 120 71 5 192 


--------------------------------
Offset: 0x447A22
Length: 7
Bytes: 232 9 29 210 255 139 240 


--------------------------------
Offset: 0x4A714B
Length: 4
Bytes: 133 219 116 31 


--------------------------------
Offset: 0x8C0E40
Length: 9
Bytes: 85 139 236 81 83 86 139 117 8 


--------------------------------
Offset: 0x5866C0
Length: 9
Bytes: 85 139 236 131 236 64 15 87 192 


--------------------------------
Offset: 0x52AE53
Length: 4
Bytes: 126 11 139 206 


--------------------------------
Offset: 0x8B91D0
Length: 7
Bytes: 169 0 0 0 16 116 7 


--------------------------------
Offset: 0x4937E8
Length: 4
Bytes: 116 121 243 15 


--------------------------------
Offset: 0x7148B1
Length: 4
Bytes: 117 11 95 94 


--------------------------------
Offset: 0x4EA311
Length: 7
Bytes: 15 47 68 8 8 114 6 


--------------------------------
Offset: 0x4EDA89
Length: 9
Bytes: 247 65 56 0 2 0 32 117 52 


--------------------------------
Offset: 0x597810
Length: C
Bytes: 85 139 236 184 160 66 0 0 232 35 19 32 


--------------------------------
Offset: 0x762C6C
Length: 5
Bytes: 116 33 139 77 24 


--------------------------------
Offset: 0x762C24
Length: 5
Bytes: 116 29 139 77 24 


--------------------------------
Offset: 0x762C69
Length: 5
Bytes: 246 195 15 116 33 


--------------------------------
Offset: 0x937BDC
Length: 4
Bytes: 187 141 36 63 


--------------------------------
Offset: 0xA725BC
Length: 6
Bytes: 4 0 0 0 132 252 


--------------------------------
Offset: 0x59AEF0
Length: C
Bytes: 85 139 236 129 236 32 14 0 0 106 10 232 


--------------------------------
Offset: 0x572B82
Length: 7
Bytes: 116 101 131 249 28 119 96 


--------------------------------
Offset: 0x125200
Length: A
Bytes: 85 139 236 131 236 100 86 139 117 8 


--------------------------------
Offset: 0x4A5E54
Length: 4
Bytes: 116 30 243 15 


--------------------------------
Offset: 0x57F445
Length: 5
Bytes: 119 52 255 36 133 


--------------------------------
Offset: 0x8B5776
Length: 5
Bytes: 116 101 217 65 80 


--------------------------------
Offset: 0x125A10
Length: A
Bytes: 85 139 236 139 69 12 131 120 8 6 


--------------------------------
Offset: 0x57F913
Length: 7
Bytes: 86 87 232 70 188 254 255 


--------------------------------
Offset: 0x3F7F10
Length: 9
Bytes: 85 139 236 131 236 24 86 139 241 


--------------------------------
Offset: 0x4A7030
Length: 9
Bytes: 85 139 236 131 236 32 86 139 241 


--------------------------------
Offset: 0xA0B458
Length: 8
Bytes: 216 147 254 192 72 140 17 193 


--------------------------------
Offset: 0x762C54
Length: 5
Bytes: 116 19 139 77 24 


--------------------------------
Offset: 0x6FA74
Length: 7
Bytes: 232 135 72 31 0 139 13 


--------------------------------
Offset: 0x4ED2EA
Length: 7
Bytes: 116 36 169 0 0 16 0 


--------------------------------
Offset: 0x8B9210
Length: 5
Bytes: 117 62 246 70 60 


--------------------------------
Offset: 0x7536D
Length: 5
Bytes: 139 77 16 137 13 


--------------------------------
Offset: 0x56B5F0
Length: A
Bytes: 106 1 104 192 25 147 1 104 224 138 


--------------------------------
Offset: 0x4F13D3
Length: B
Bytes: 1 126 116 139 206 232 51 166 255 255 139

[l0l1dk]

How ironic... They're targetting OHack. I've enabled its killswitch.

Also, it looks like they also detected Jadd's packet logger. There's a scan on NetClient::Send2 now, which it hooked, IIRC.

[demisehi]

Anything posted on Ownedcore will eventually be targeted. Some are pretty harmless and may not be, but most everything else will be under the spotlight at some time. Always happens.

[beanso]

How ironic... They're targetting OHack. I've enabled its killswitch.

Also, it looks like they also detected Jadd's packet logger. There's a scan on NetClient::Send2 now, which it hooked, IIRC.

He hooks at +0xA. They've been scanning those 9 bytes for a while.