Beat Warden! Info on Warden, and how to beat Waren.

[Zeltraz500]

Hello this is Zeltraz500!
You probably dont me from nowhere
Okay so this post is all about Warden, and how to beat it!
Listen MMowned community, were in a battle with Warden, and we can win! But how can we win if we dont know our enemy? Waha!

Okay so lets first talk about the Scan.dll file!
In your WoW Directory you should see a dll file called Scan, this is an interesting file. We dont know if its Warden, or if its Wardens baby. Well this is what I know:
Here is an example:
Warden can detect cheat engine, so if cheat engine is running when you run WoW you get a nasty air message that says you are running Cheat Engine, making you have to restart your computer to play WoW, and of course exit out of cheat engine, but if you happen to delete your scan.dll file, the error message does not come up! This works with pretty much anything WoW can scan and stop you from doing right away. Now dont fret because the scan.dll immediatly re creates itself if its deleted when you run WoW.

Warden:
Warden is an anit-cheat thing provided by Blizzard

Taken from Wikipedia:
Warden uses API function calls to collect data on open programs on the user's computer and sends it back to Blizzard servers as hash values to be compared to those of known cheating programs.[1] Privacy advocates consider the program to be spyware.[2]

Warden is their.


Thank you!

[Zenthours]

This may be true, however that does not mean that Warden is gone completely, that as far as i know is not a possibility. WoW may not stop you from running cheat engine if you delete scan.dll, however it does not mean that you are undetectable.

[Vladinator]

Thanks for telling us what we knew.

[nerner2]

post a way to get past the remaking it again, luckily i know how: open scan.dll in notepad, then delete everything in it, then save it, then open it again and (its still empty) saveas as scan.new.dll and put it in the same place as scan.dll it should stop it from ever detecting anything (except you have to do this every patch)

[Apoc]

Sigh. STOP POSTING STUFF YOU KNOW NOTHING ABOUT!

1) Scan.dll just checks startup items. (Warden isn't actually first loaded until you login)

2) Warden is currently not (and hasn't been for over a year) checking processes outside of it's own app domain.

3) A Warden packet is sent every 15 seconds or so from the server to the client, and cannot be stopped by deleting Scan.dll (durrr). All packets sent by Warden are encrypted with a key (currently SHA-1 if memory serves me correctly).

4) You're an idiot for trying to get rep on subjects you know nothing about, and knew ahead of time you'd be proved wrong about. (kynox, and Cypher will be in this thread soon enough to explain more, and I'm sure Hamut may join as well)

</endrant>

Idiot.

[Martognigno]

And you have to know, that no activity(bans) means nothing.
Since before the last ban wave, we haven't seen a wave for more than 6 months.
And suddenly here you go, 250k acc banned. Including my main.

[nikomo]

Sigh. STOP POSTING STUFF YOU KNOW NOTHING ABOUT!

1) Scan.dll just checks startup items. (Warden isn't actually first loaded until you login)

2) Warden is currently not (and hasn't been for over a year) checking processes outside of it's own app domain.

3) A Warden packet is sent every 15 seconds or so from the server to the client, and cannot be stopped by deleting Scan.dll (durrr). All packets sent by Warden are encrypted with a key (currently SHA-1 if memory serves me correctly).

4) You're an idiot for trying to get rep on subjects you know nothing about, and knew ahead of time you'd be proved wrong about. (kynox, and Cypher will be in this thread soon enough to explain more, and I'm sure Hamut may join as well)

</endrant>

Idiot.

Finally someone with a ****ing clue.

[Sychotix]

Finally someone with a ****ing clue.

its apoc... what do you expect? =P

and Apoc, I wonder if its possible to emulate the packet as has been done with gameguard. If you guys are able to decrypt the packets, try writing a script that checks for the connection that warden/the server makes when they are communicating. When it receives the packet from the server, the script creates a packet (u prob cant send the same packet over and over again due to time stamps) and then encrypts it and sends it back to the server.

With that successfully done, you can simply kill warden and any checks that may be in WoW if its running (there should be none since you can run on private servers without warden).

[kynox]

its apoc... what do you expect? =P

and Apoc, I wonder if its possible to emulate the packet as has been done with gameguard. If you guys are able to decrypt the packets, try writing a script that checks for the connection that warden/the server makes when they are communicating. When it receives the packet from the server, the script creates a packet (u prob cant send the same packet over and over again due to time stamps) and then encrypts it and sends it back to the server.

With that successfully done, you can simply kill warden and any checks that may be in WoW if its running (there should be none since you can run on private servers without warden).

It's entirely possible, i emulate warden without warden running, via the packet stream. Though, that is something i will never release. The packet encryption is simple, but the keys get shifted using a complex algorithm.

currently SHA-1 if memory serves me correctly

RC4

You're an idiot for trying to get rep on subjects you know nothing about, and knew ahead of time you'd be proved wrong about. (kynox, and Cypher will be in this thread soon enough to explain more, and I'm sure Hamut may join as well)

Reporting in!

[Cypher]

Kynox and Apoc seem to have all the bases covered so all I'm going to say to the OP is:

You're an idiot, do some research before polluting the forums with your stupidity.

[Saint-Pasdoy]

lol so much true things here

[[Shon3m]]

well here's an idea make an auto it that well auto delete it so when it creates it self again and auto it delete it


idk maybe just an idea lol

[Clain]

Kynox has already taken place in this but I suggest you all go to Emupedia and read that.

[coni]

Hey look! Officer Obvious made another clear post! Thx!

[Couwae]

Yeh, a lot of true things in this poll. (: