Is it safe to use Lua DoString function now?

[codedemen]

I am scared by last banwave - as I understood there is some sort of warden update to monitor lua functionality/ Is here somebody who knows if it is safe now to use DoString(CastSpellByName("spellname")) function or is it better to do it a tricky way with emulating keypresses? Thank you for your time!

[Jadd]

Depends on your implementation. Post your code for "DoString."

[codedemen]

Depends on your implementation. Post your code for "DoString."

Here it is:

"call " + (Memory.ClientProcess.WowModule + 15118u),
"test eax, eax",
"je @out",
"mov eax, " + aloc,
"push 0",
"push eax",
"push eax",
"mov eax, " + (Memory.ClientProcess.WowModule + 151869u),
"call eax",
"add esp, 0xC",
"@out:",
"retn"

Im using customized version of blackmagik. The hook is located inside the endscene function(exactly how it is done by fraps).

Ah. And of course the GetLocalizedText call:

"call " + (Memory.ClientProcess.WowModule + 15118u),
"test eax, eax",
"je @out",
"call " + (Memory.ClientProcess.WowModule + 15118u),
"mov ecx, eax",
"push -1",
"mov edx, " + aloc,
"push edx",
"call " + (Memory.ClientProcess.WowModule + 3055698u),
"@out:",
"retn"

[Jadd]

Im using customized version of blackmagik. The hook is located inside the endscene function(exactly how it is done by fraps).

You should not run Lua from within EndScene. This sounds exactly like what Blizzard has looked for in the last few days.

Whether this detection method is still activated now, I couldn't say. But I'd reconsider your custom BlackMagic library.

[Master674]

The hook is located inside the endscene function(exactly how it is done by fraps).

You're most likely detected because you're calling Lua code from EndScene.

Darn, too slow

[provirus]

Hello.
What about calls from kernel32.dll (via CreateRemoteThread)? If it is not safe, what should I use? I really appreciate any help you can provide.

[mtz]

since when is this check active? have they already banned people using this method or are we awaiting a banwave? and how does this check work?

[Jadd]

since when is this check active? have they already banned people using this method or are we awaiting a banwave? and how does this check work?

It activated a couple weeks ago. I don't monitor it myself, but l0l1dk noticed and so did the Honorbuddy team.

http://www.ownedcore.com/forums/worl...hod-added.html (New 32-bit Detection Method Added)

[csoldjb]

Is there another way to run LUA without crashing the client randomly? (without using EndScene)

CreateRemoteThread could do this.

[JamesHook]

CreateRemoteThread will crash LuaDoString after some time and also the calling code is not executed inside Wow.exe module. I guess that the next detection will also affect LuaDoString. (Its just a guess)

[VesperCore]

You can hook pretty much anything, but if you are not hooking EndScene, it's going to appear in the Warden in a week or two.

At the very beginning of our project, we used windows "GetThreadPriority()" to hook WoW, few days later, it was part of the Warden.

Well, 3 years later, there is still a warden check for it xD