Warden - The definitive anti-cheat system

[lillecarl]

I think the warden client is the same for 2.4.3 and 3.3.5 just different modules if i get it correct

[zhenya``]

different check

[AlexSot]

there are diffs in packet format to wow client... cause my players got disconnected when try only to log into the world with warden turned on

sorry for my english

[AlexSot]

Just tested it again...

clean client after entering world

Kicking account 1317916 for failed check, MEM Offset 0x70F357 length 7 has content 'CE0F839E000000' instead of 'F08B82D0000000'

Is it possible to change this values somewhere ?

[AlexSot]

and some new fails

Kicking account 1317916 for failed page check Offset 0x0000959C, length 21

Kicking account 1317916 for failed page check Offset 0x0000A078, length 24

Kicking account 1317916 for failed driver check 'ndis_x86'

[AlexSot]

I just realized.... checks fails cause there are wrong data in database.... need check result's for 2.4.3 client....

[AlexSot]

some new info... packets to client are also wrong.... fatal error occurs

[Midna]

Of course the checks are different, the invalid packets might be a problem though unless someone knows how they are supposed to be for 2.4.3?

If you want the right checks, your gonna have to find them yourself, find out what address a cheat modifies, and add a check for that.

[AlexSot]

checks are not problem.... the problem is 132 error.....

[TOM_RUS]

checks are not problem.... the problem is 132 error.....

Have you modified 0x03 warden packet for 2.4.3? It's required step...

[AlexSot]

checks are not problem.... the problem is 132 error.....

Have you modified 0x03 warden packet for 2.4.3? It's required step...

No, I do not know how to do it ... that is why I ask for help

[Tassader2]

Hi TOM_RUS, firstly BIG thanks for amazing work.

I am testing on local, and i have questions, my gm account continue been banned by warden without any third program...

Here examples of this bans

2011-06-29 06:09:31 RESULT PAGE_CHECK fail, CheckId 800 account Id 5

2011-06-29 06:36:40 RESULT PAGE_CHECK fail, CheckId 261 account Id 7

2011-06-29 06:36:40 RESULT PAGE_CHECK fail, CheckId 88 account Id 7

2011-06-29 06:36:42 RESULT PAGE_CHECK fail, CheckId 261 account Id 5

2011-06-29 15:45:56 RESULT PAGE_CHECK fail, CheckId 799 account Id 5

2011-06-29 15:56:00 RESULT PAGE_CHECK fail, CheckId 799 account Id 5

2011-06-29 16:17:59 RESULT PAGE_CHECK fail, CheckId 261 account Id 5

2011-06-29 18:53:57 RESULT PAGE_CHECK fail, CheckId 88 account Id 5

2011-06-30 00:48:43 RESULT PAGE_CHECK fail, CheckId 261 account Id 5

2011-06-30 03:19:02 RESULT PAGE_CHECK fail, CheckId 799 account Id 5

2011-06-30 03:53:15 RESULT PAGE_CHECK fail, CheckId 134 account Id 5

2011-06-30 04:36:18 RESULT PAGE_CHECK fail, CheckId 261 account Id 11

2011-06-30 17:12:57 RESULT PAGE_CHECK fail, CheckId 782 account Id 11

2011-06-30 17:58:36 RESULT PAGE_CHECK fail, CheckId 88 account Id 11

Thanks for any reply man

There are false positives indeed. A friend of mine told me warden is banning for having Ati Tray Tools opened, which only changes Anti Aliasing and other graphic stuff.

This quite screws up everything if not fixed. Checks that found Ati Tray Tools as cheat are page ckecks with id 88, 261 and 783 (with `address` = 174688 AND `length` = 37)

This one looks to be false positive as well (TOM_RUS version, MEM_CHECK)

(438, 243, '', '', 11287980, 8, '04000000903C9F00', NULL);

[Sephiroth1983]

Yes that one is also wrong.

[lillecarl]

There shall only be one version in my opinion, would make the development easier;)

[Sephiroth1983]

There shall only be one version in my opinion, would make the development easier;)

In fact there is only one version now, and I pointed you the repository.

The old version is deprecated.

[lillecarl]

There shall only be one version in my opinion, would make the development easier;)

In fact there is only one version now, and I pointed you the repository.

The old version is deprecated.

So its only tom_rus version that is active?

[Sephiroth1983]

Yes.

[Neo2003]

So its only tom_rus version that is active?

Yes, my version is no more active. This hijack of the thread was the one making the bottle full. I leaved wow development stuff definitely with rm -rf everything, then forget about the full warden cryptography usage, better hardcode static keys everywhere in code.

Good luck for the future

[lillecarl]

So its only tom_rus version that is active?

Yes, my version is no more active. This hijack of the thread was the one making the bottle full. I leaved wow development stuff definitely with rm -rf everything, then forget about the full warden cryptography usage, better hardcode static keys everywhere in code.

Good luck for the future

Im sorry i didnt mean you did anything bad, but as i saw it your version were Windows dependent, and that sucks bigtime, tho i have not tested yet... To bad to hear about it really.... I wish you good luck with everything aswell:)

EDIT: what do you mean with hardcoded keys "everywhere"?

EDIT2: this is win tbh: "- Wardend is not limited to 1 mangosd connection, it can host many mangosd if needed"

- LilleCarl

[Sephiroth1983]

I don't think Tom_Rus intented to be rude by posting his 2010 version. The versions were fairly different, with dinstict approaches. Unluckily one approach is far better than the previous only because of structure, since it's more viable. Your version, Neo, was very good in ideas, coding and progress, so you don't need to feel bad for how the situation in this thread evolved. You are a very clever person that contributed a lot to research of wow development and to database progress, please rethink of your decision and just make it as a summer pause required to let people understand that some actions, even if not meant to be offensive, can lead to misunderstandings.

Coding in our days is all about sharing and analyzing the code together to make it better, don't let the dramas win - leave that to MMoRPG's players.

[herrtrigger]

So its only tom_rus version that is active?

Yes, my version is no more active. This hijack of the thread was the one making the bottle full. I leaved wow development stuff definitely with rm -rf everything, then forget about the full warden cryptography usage, better hardcode static keys everywhere in code.

Good luck for the future

You are a very clever person that contributed a lot to research of wow development and to database progress, please rethink of your decision and just make it as a summer pause required to let people understand that some actions, even if not meant to be offensive, can lead to misunderstandings.

Seeing you leave would be a really sad thing Neo2003 8.(

Please reconsider, 'cos like Sepiroth1983 said, this is probably just one big misunderstanding.

You created great things, wich brought joy to many users imho.

[Iderise]

Is it possible to port TOM_RUS's wardend to a 2.4.3 system?

(tc fork, oregoncore)

[lillecarl]

Is it possible to port TOM_RUS's wardend to a 2.4.3 system?

(tc fork, oregoncore)

That would be stupid, mainly because oregoncore is a half dead project.... And there is no idea to implent a system into another core until it is "done", there are also a few changes someone "with higher skills" needs to do, but i think the basic warden is the same in 2.4.3 and 3.3.5, 1.12.1 has the same warden as Warcraft 3 if i understood it correctly, but yeah it is possible i think

- LilleCarl

[Iderise]

It may be a half-dead project, but they do very good work, however could you recomend a better core to use with 2.4.3?

Also, I only want to use it on my 2.4.3 server, I diddnt meant to implement it in their repo.

define "higher skills"

[lillecarl]

Not sure tbh, TOM_RUS or Neo2003 would probably b e able to do it, but you need to know how the network protocol warden uses works and shit.... Really hard if you dont know it from before

I would recommend mangos/one for 2.4.3, oregoncore is really messed, since their main developer Stfx left before he finished the updates on example the pet system, all pets are retarded and useless..... But maby they got a bit more content, but i would see mangos as a win overall, i mean this damn project has been running since WoWD times if im correct (5 or 6 years?) Wich means shit will just be better here, they might not be "fastest" but thats not their goal, their goal is to learn and make things work properly, See the difference between hackfixes and proper fixes, so i would go with mangos all they way, even if they dont support all the latest features they are stable and have the best opensource development team ive seen in any project ive been looking at, the community is pretty active (tho it could have been better) and everyone is kind.... the MaNGOS Foundation is WIN!

- LilleCarl