Authenticator Prompt in 2.4.3 and Server Injected Code

[error4o3]

Hi there,
I've been searching on these forums for a couple hours for an answer to my question, but I've had no luck. I'm curious if anyone knows how authenticators were implemented in 2.4.3? I'm not finding "security code" as a string in IDA and looking up some history it seems that authenticator support was added without an official patch (or at least it was earlier on and not noted). This leads me to believe that perhaps the authenticator prompt was code injected by the server (like Warden is), but I'm not familiar enough with code distributed by the servers to say for sure.

For a while I thought that 2.4.3 was too early for authenticator support, but then I found this:



And recall that back then it used to prompt you every time you logged in, suggesting it could have been implemented without a patch.

Some may wonder why I'm bothering with this... my team is looking at options for security in our upcoming private server and while other options exist, I wanted to investigate this solution a bit more. Not exactly WoW Memory Editing in the sense of client-on-client, but hopefully you'll see how I made the connection.

Thanks all

[TOM_RUS]

I'm not finding "security code" as a string in IDA

Check Interface\GlueXML\GlueStrings.lua? Or DBC. If client displays a string, it should be somewhere, not necessary in game binary.

[error4o3]

Check Interface\GlueXML\GlueStrings.lua? Or DBC. If client displays a string, it should be somewhere, not necessary in game binary.

Indeed after much searching I found it in GlueStrings.lua from patch.mpq. Thanks for that tip. (Didn't realize even the first few screens were written in LUA too)

That being said, does anyone know the opcodes and/or other bytes to trigger the client to prompt for this and the rest of the authentication steps? I don't see it documented in a few of the more common servers.

[TOM_RUS]

Have you even looked at emu sources? Pretty sure mangos has some things documented AuthSocket.cpp (securityFlags).