Warden - The New Detection

[Dark_Mage-]

Well, this is the new anti-hacking detection system Blizzard has implemented into Diablo II and WoW.
I've known about it for a while now, but haven't really said anything about it.
All discussion of it (for Diablo II) will go in this thread please.

It is constantly updated server-side and will put a hurting on hackers of Diablo II.
It searches for DLLs loaded in memory used by common hacks.

So, they can pretty much update when new hacks come out and detect/ban hackers uber fast now (over night)...
This is what happened to Netter's Maphack..

Anyone interested in researching it, open up D2Client.dll ...

Code:

Text strings referenced in D2Client:.text, item 627
Address=6FB0261E
Disassembly=PUSH D2Client.6FB86160
Text string=ASCII "..\Source\D2Client\WARDEN\WardenClient.cpp"

It's not like ub3rhard to find or anything... :\

Some info:

I think the server sends 0xAE with a list of DLLs to look for in memory and then the client returns 0x66 which declares wether they were found or not and flags you for bannage.

I think it also sends 0xB0 and drops you from the game if you don't return 0x66 (I think this is why people with 2 d2s were getting dropped)...

I'm not confirming this though.

Actually, I think I'm just going to stop researching this as I probably will never play D2 again.
So, if anyone out there wants to research this, please do.

I currently have Netter looking into it.

[llamalord]

YOU'RE NEVER GOING TO PLAY D2 AGAIN? OMG CAN I HAVE YOUR CD KEY? =) srrry. yes i am a noob.

[Silver Power101]

Damn that's really gonna suck for all the hackers out there...

[pt14]

yeah warden is gonna be a ***** for a while but there wil eventualy be away around it..as usual

[ReLate]

hope mousepad and njuguar dont have a tough time getting around this.

[Dark_Mage-]

hope mousepad and njuguar dont have a tough time getting around this.

This actually IS what is giving them problems right now.

I forgot to mention that you should also watch for the server sending 0x8F and the client returning 0x6D (the new ping packets) because there is also something with those that checks memory.

[[The Reaper]]

So if you get around the 2 windows thing can you be banned?

[slics]

yeah warden is gonna be a ***** for a while but there wil eventualy be away around it..as usual

idk man.. u cant win forever :eek:

[bashfo]

Yea I was wonder if u load up 2 d2s at once on a computer can u be banned from that? And i hope mousepad luck with the maphack development

[pt14]

idk man.. u cant win forever :eek:

actualy in d2 u can win because its not like WoW or guildwars were they send updates every 20 minutes once hackers figure it out there wont be another challenge till another 6months or a year, you know what i mean? oh and maybe there will be a way to use pixels like MM

[DsX-SNiPeR00]

wat if u delete d2client?

[Cauhtemoc]

I forgot to mention that you should also watch for the server sending 0x8F and the client returning 0x6D (the new ping packets) because there is also something with those that checks memory.

You speak as if anyone (besides me, and a very limited number of other people) will understand what you're saying.

[bashfo]

I could guess what hes trying to say but its not helping as much as id like it to.

[DsX-SNiPeR00]

wat do u guess he is saying

[Mr Blaine Ng]

Well, i guess were just going to have to wait a while because I'm pretty sure mousepad will need a bit more time to get around the new detection method.

[bluemouse]

could you not trick it into thinking that the dlls etc are normal, when infact they are not? I am not a good hacker, but it seems to me that it would be very possible to do such a thing.

[fusion50]

Or wouldn't it be possible To load up maphack toggle it using a hotkey to reveal the map then toggle it off some how saving the map picture and displaying it without having to worry about packets.

[bluemouse]

Or wouldn't it be possible To load up maphack toggle it using a hotkey to reveal the map then toggle it off some how saving the map picture and displaying it without having to worry about packets.

that may be possible for just the map itself, but there is still probably a chance to detect it, Im sure blizzard has thought of that.

[[The Reaper]]

When they made the next patch they should of had like a securtiy thing whenever you create a game you copy a letter and a number into a box like the signup things to prevent bots. But I guess you'd have the edit the game.exe itself for that.

[Mr Blaine Ng]

That'd be kinda inconvient for people because everytime you make a game you have to copy that code...