Warden Private Server

[Makkah]

Hey everyone,

I wanted to share a useful enum I've been working with for interacting with the Warden anti-cheat system in World of Warcraft: Wrath of the Lich King (WotLK). This enum, named WardenWOTLK, contains various memory offsets and function codes that are essential for understanding and interacting with the Warden's operations.

Here's the enum:

enum WardenWOTLK
{
	WardenStructurePTR = 0x00D31A4C,
	PageStoreInfo = 0x7B8, // read 3x time from the WardenStructure
	LuaStringCHeck = 0x7E8, // read WardenStructurePTR > read WardenStructurePTR Value + this opcode. 
	Vtable = 0x228,
	MemoryCheck = 0x0C,
	ModuleCheck = 0x10,
	CallProcCheckHashAndCompare = 0x1C,
	DriverCheck = 0x20,
	TimingCheck = 0x24,
	GetTickCounterFromMemory = 0x28,
	HeapFreeEx = 0x50,
	ReturnZero = 0xDC,
	ProcAddress = 0x18,
	GetMethod = 0xE8,
	CheckStructValue = 0x1FC,
	FreeHeap = 0x2C,
	closeHandle = 0xF0,
	CheckFunctions = 0x00,
	ReturnControl = 0x200,
	duplicateHandle = 0x100,
};

This enum is crucial for anyone diving into reverse engineering or low-level manipulation of the Warden system in WoW WotLK. Understanding these offsets can help in analyzing how the Warden operates and in developing methods to interact with or bypass its checks.

Feel free to ask if you have any questions or need further clarification on any of the entries!


Note[1] : some servers use GetText instead of Lua_execute, it is recommendto just hook LoadBuffer to bypass both checks.

[Makkah]

Cata 4.3.4 Warden Enum for Warden Functions

Below is the WardenCata enum, which defines various functions and checks used by the Warden system in World of Warcraft Cataclysm (Patch 4.3.4). Warden is Blizzard's anti-cheat mechanism that performs various security checks to detect and prevent the use of unauthorized third-party software.

enum WardenCata {
    WardenPTR = 0x0DC0C70,
    Warden_ModuleCheck = 0xD4,
    Warden_DriverCheck = 0xE4,
    Warden_CloseHandle = 0x144,
    Warden_GetProcAddress = 0xDC,
    Warden_TimingCheck = 0xE8,
    Warden_FreeHeap = 0x90,
    Warden_GetModuleHandle = 0xC8,
    Warden_MemoryCheck = 0xD0,
    Warden_Return0 = 0x70,
    Warden_AddTwoNumbers = 0xCC,
    Warden_CallProcCheckHashAndCompare = 0xE0,
    Warden_StorePageScanInfo = 0xF4,
    Warden_HeapFreeEx = 0x00
};

[uzzy13u]

ty, do you have for MOP 5.4.8 to ?

[Makkah]

i do have it for Mop,

[untouch]

wow this is amazing, must of taken you awhile to figure out all of this thank you. everyone should give you some +rep