📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Warden Questions and Scene Help

Topic created on: January 18, 2008 20:18 CST by wightolore .

I've recently attempted to dissect the underground world of game modification. I've bought/read the books Rootkits and Exploiting Software, while attempted to browse other related books like Reversing Secrets, Windows Internals, etc.

I feel the hardest part about getting into the true fundamentals of any scene (this one being computer game exploits/exploration/etc) is to understand what exactly the fundamentals truly are. I've found myself in a life where my RL friends couldn't care less about computers, games, security, rootkits, etc., therefore, I have found it exceedingly difficult in analyzing exactly WHAT needs to be understood concerning the taking apart of software games.

I was hoping someone could point me in a direction that could aide me in my journey. I belong to few forums, and honestly couldn't decipher which is a waste of time and effort. This forum I know has merit, and I respect any and all individuals here - especially if a few could help a very determined 'newb.'

---- meat of my question ----
I've seen and toyed with Cheat Engine, IDA, Olly,.. and read a few threats saying it is detected by WoW 2.3.2 but it drives me NUTS that I can't specifically SEE what the Warden is doing. The governor seems crippled lately. It used to flow constantly with reports,
BUT how much of the Warden does it actually see?
How were these function calls actually discovered and hooked?
Is Scan.dll (packed by UPX - easily unpacked w/ as well) an aide for the Warden?
I've heard it is now implemented server side, and it truly can't be traced anywhere?
What is the TRUTH?? lol
I'm pulling my hair out here...

Maybe a better suggestion from a fellow rootkit.com poster would be suggestions on 32-bit games that are relatively modern and can be a better stepping stone to achieve a better understanding of games in general before I try subverting an advanced piece of gay-ware like Warden.. hah

Welp, i'm off to work. thanks for any input in advance!

  sovietskicpu     January 19, 2008 04:00.37 CST
Warden is a real hardcore thing to handle :p

"I've heard it is now implemented server side, and it truly can't be traced anywhere?"

That's true, it is able to download live code from the server and execute it dynamically on the fly ==> code is always changing; + maintain a sort of timed and crypted ping <--> pong with the server : sort of time intervall to detect  time latencies inducted by debugging sessions...

  wightolore   January 19, 2008 09:32.14 CST
oh man that sux
maybe Warden shouldn't be my first adversary lol

that really bugs me.. i can't believe a program can just do that and get away with it
dynamic code injection via an encrypted stream
that's rediculous, and the way some people are reacting to it reminds me a bit of the book George Orwell's 1984 or Huxley's Brave New World..
people are fine with the fact of a big brother entity spying on us for our own good
they won't do anything bad as long as it keeps us safe!
bs!.. wait until the gov't and/or Microsoft decides that Blizzard has set the perfect example and decides to follow suit

God help us all..

anyways... enough of my conspiracy theories?
could u guys suggest any other MMORPG or recent 32-bit game that might be more first-time debugger friendly? :)

  sovietskicpu     January 19, 2008 15:51.23 CST
I really don't know what to suggest you.

  wightolore   January 19, 2008 19:44.16 CST
np .. i posted over at reverse-engineering.net too and I now have a few places to look around at..

i 'spose a modern game would be masochistic and/or impossible for a beginner to attempt to understand

i was told to try a few crackmes and read alot more concerning the actual process of disassembling/debugging

i'll be around tho

thx for the replies, man
really appreciate seeing any kind of help i can get..
i crave understanding, but its hard to find sources even with long sessions w/ google

  Darawk     January 21, 2008 23:50.13 CST
WoW is pretty easy to reverse engineer as games go.  The warden runs as a dynamic code downloading and execution system, which makes it particularly difficult to defeat (if they use it properly, which they don't always do).

For some further reading on game detection mechanisms in general (though written with Warden specifically in mind), go here:

http://www.rootkit.com/newsread.php?newsid=360

If you want the source code examples from the article, PM me or email me and i'll send them to you, as the links at the end are dead right now.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit