LuaDoString detected by Warden?

[yellow82]

Hi poeple!

Is this detected by Warden?

public static void DoString(string command)
        {
            // Allocate memory
            uint DoStringArg_Codecave = Memory.AllocateMemory(Encoding.UTF8.GetBytes(command).Length + 1);

            // Write value:
            Memory.WriteBytes(DoStringArg_Codecave, Encoding.UTF8.GetBytes(command));

            // Write the asm stuff for Lua_DoString
            String[] asm = new String[] 
            {
                "mov eax, " + DoStringArg_Codecave,
                "push 0",
                "push eax",
                "push eax",
                "mov eax, " + ((uint)Memory.BaseAddress + (uint) Pointers.Lua_DoString), // Lua_DoString
                "call eax",
                "add esp, 0xC",
                "retn",    
            };

            // Inject
            InjectAndExecute(asm);
            // Free memory allocated 
            Memory.FreeMemory(DoStringArg_Codecave);
        }

thanks in advance

[Nonowmana]

WardenMon is your safe bet, check it by yourself

[danwins]

Are you asking because you have reason to be suspicious?

Because unless something has changed, That method of calling DoString isn't detected by warden, It's simply a codecave used to call the function.

[Jadd]

I don't know if the Honorbuddy detection packet still exists, but it used to perform a stack trace on lua_load to check if the caller (two levels up) is in .text.

[yellow82]

WardenMon is your safe bet, check it by yourself

sorry, but I have absolutely no idea what I can do wardenmon me!

[Jadd]

sorry, but I have absolutely no idea what I can do wardenmon me!

WardenMon