Hey!
First of all, awesome job! This warden support is really great stuff!
I'm looking at the source code here and there's a few questions that arise in my head, there's a fair chance that I misunderstand the way that warden works and/or missing some obvious code that in fact does what I'm talking about, but I'll give it a shot anyway So here goes:
1. When the client sends a warden cheat response, is that cheat anyhow validated with the module or is the list of "answers" somewhat predefined? I mean, I would imagine this works like this:
- Server chooses the module, for instance, memory check and chooses which page / part / address / whatever else of memory to ask for
- Server sends the cheat check request to the client
- Client processes the request and sends the result back
- Server processes the response and cross checks the result with output that the warden module gives server-side
In case the responses are predefined, the warden check communication can be spoofed more easily by the client, cause the possible man-in-the middle attack would only require the cheater to know the predefined values, right?
2. This question implies that the responses are predefined. If so, why do we need to load the modules into the memory and basically operate in Win32 code? My understanding then is that we just need to read the module and send it to the client (more or less) at the beginning of the session, and then just send the requests, get replies and compare them with predefined values. So maybe this can be coded without using native Win32 calls?
Thanks in advance for your reply