phaneron/Kelsidavis-WoWee
1
0
Fork 0
mirror of https://github.com/Kelsidavis/WoWee.git synced 2026-04-17 09:33:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: replace placeholder Warden RSA modulus with real Blizzard key

Browse source 
Replace the incorrectly extracted RSA-2048 modulus (which contained
the exponent bytes embedded inside it) with the verified Blizzard
public key used across all pre-Cataclysm clients (1.12.1, 2.4.3,
3.3.5a).

Key confirmed against two independent sources:
- namreeb/WardenSigning ClientKey.hpp (72 verified sniffed modules)
- SkullSecurity wiki Warden_Modules documentation

The modulus starts with 0x6BCE F52D... and ends with ...03F4 AFC7.
Exponent remains 65537 (0x010001).

Verification algorithm: SHA1(module_data + "MAIEV.MOD"), 0xBB-padded
to 256 bytes, RSA verify-recover with raw (no-padding) mode.

Signature failures are non-fatal (log warning, continue loading) so
private-server modules signed with custom keys still work. This is
necessary because servers like ChromieCraft/AzerothCore may use their
own signing keys.

Also update warden_module.hpp status: all implementation items now ✅.
This commit is contained in:
Kelsi 2026-03-30 22:50:47 -07:00
parent 88d047d2fb
commit 32bb0becc8
2 changed files with 30 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

10
include/game/warden_module.hpp
View file

@ -39,17 +39,17 @@ struct WardenFuncList {
* IMPLEMENTATION STATUS: * IMPLEMENTATION STATUS:
* ✅ Module metadata parsing and validation * ✅ Module metadata parsing and validation
* ✅ RC4 decryption (WardenCrypto) * ✅ RC4 decryption (WardenCrypto)
* ✅ RSA-2048 signature verification (OpenSSL EVP — placeholder modulus) * ✅ RSA-2048 signature verification (OpenSSL EVP — real Blizzard modulus)
* ✅ zlib decompression * ✅ zlib decompression
* ✅ Custom executable format parsing (3 pair-format variants) * ✅ Custom executable format parsing (3 pair-format variants)
* ✅ Address relocation (delta-encoded fixups) * ✅ Address relocation (delta-encoded fixups)
* ✅ x86 emulation via Unicorn Engine (cross-platform) * ✅ x86 emulation via Unicorn Engine (cross-platform)
* ✅ Client callbacks (sendPacket, validateModule, generateRC4) * ✅ Client callbacks (sendPacket, validateModule, generateRC4)
* ⏳ API binding / IAT patching (stub — module imports not yet resolved) * ✅ API binding / IAT patching (parses import table, auto-stubs unknown APIs)
* ⏳ RSA modulus needs verification against real WoW.exe build * ✅ RSA modulus verified (Blizzard key, same across 1.12.1/2.4.3/3.3.5a)
* *
* For strict servers, the API binding stub may cause module init to fail. * Non-fatal verification: RSA mismatch logs warning but continues loading,
* For permissive servers, fake responses in WardenHandler work. * so private-server modules signed with custom keys still work.
*/ */
class WardenModule { class WardenModule {
public: public:

53
src/game/warden_module.cpp
View file

@ -87,12 +87,10 @@ bool WardenModule::load(const std::vector<uint8_t>& moduleData,
// Step 3: Verify RSA signature // Step 3: Verify RSA signature
if (!verifyRSASignature(decryptedData_)) { if (!verifyRSASignature(decryptedData_)) {
// Expected with placeholder modulus — verification is skipped gracefully // Signature mismatch is non-fatal — private-server modules use a different key.
} }
// Step 4: Strip RSA-2048 signature (last 256 bytes = 2048 bits) then zlib decompress. // Step 4: Strip RSA-2048 signature (last 256 bytes = 2048 bits) then zlib decompress.
// Blizzard signs each Warden module to prevent tampering; we strip it since we
// use a placeholder RSA modulus and can't verify the signature.
static constexpr size_t kRsaSignatureSize = 256; static constexpr size_t kRsaSignatureSize = 256;
std::vector<uint8_t> dataWithoutSig; std::vector<uint8_t> dataWithoutSig;
if (decryptedData_.size() > kRsaSignatureSize) { if (decryptedData_.size() > kRsaSignatureSize) {
@ -345,30 +343,30 @@ bool WardenModule::verifyRSASignature(const std::vector<uint8_t>& data) {
// Extract data without signature // Extract data without signature
std::vector<uint8_t> dataWithoutSig(data.begin(), data.end() - 256); std::vector<uint8_t> dataWithoutSig(data.begin(), data.end() - 256);
// Hardcoded WoW 3.3.5a Warden RSA public key // Hardcoded WoW Warden RSA public key (same across 1.12.1, 2.4.3, 3.3.5a)
// Exponent: 0x010001 (65537) // Exponent: 0x010001 (65537)
const uint32_t exponent = 0x010001; const uint32_t exponent = 0x010001;
// Modulus (256 bytes) - Extracted from WoW 3.3.5a (build 12340) client // Modulus (256 bytes) — RSA-2048 public key used by the WoW client to verify
// Extracted from Wow.exe at offset 0x005e3a03 (.rdata section) // Warden module signatures. Confirmed against namreeb/WardenSigning ClientKey.hpp
// This is the actual RSA-2048 public key modulus used by Warden // and SkullSecurity wiki (Warden_Modules page).
const uint8_t modulus[256] = { const uint8_t modulus[256] = {
0x51, 0xAD, 0x57, 0x75, 0x16, 0x92, 0x0A, 0x0E, 0xEB, 0xFA, 0xF8, 0x1B, 0x37, 0x49, 0x7C, 0xDD, 0x6B, 0xCE, 0xF5, 0x2D, 0x2A, 0x7D, 0x7A, 0x67, 0x21, 0x21, 0x84, 0xC9, 0xBC, 0x25, 0xC7, 0xBC,
0x47, 0xDA, 0x5E, 0x02, 0x8D, 0x96, 0x75, 0x21, 0x27, 0x59, 0x04, 0xAC, 0xB1, 0x0C, 0xB9, 0x23, 0xDF, 0x3D, 0x8F, 0xD9, 0x47, 0xBC, 0x45, 0x48, 0x8B, 0x22, 0x85, 0x3B, 0xC5, 0xC1, 0xF4, 0xF5,
0x05, 0xCC, 0x82, 0xB8, 0xBF, 0x04, 0x77, 0x62, 0x92, 0x01, 0x00, 0x01, 0x00, 0x77, 0x64, 0xF8, 0x3C, 0x0C, 0x49, 0xBB, 0x56, 0xE0, 0x3D, 0xBC, 0xA2, 0xD2, 0x35, 0xC1, 0xF0, 0x74, 0x2E, 0x15,
0x57, 0x1D, 0xFB, 0xB0, 0x09, 0xC4, 0xE6, 0x28, 0x91, 0x34, 0xE3, 0x55, 0x61, 0x15, 0x8A, 0xE9, 0x5A, 0x06, 0x8A, 0x68, 0x01, 0x9E, 0x60, 0x17, 0x70, 0x8B, 0xBD, 0xF8, 0xD5, 0xF9, 0x3A, 0xD3,
0x07, 0xFC, 0xAA, 0x60, 0xB3, 0x82, 0xB7, 0xE2, 0xA4, 0x40, 0x15, 0x01, 0x3F, 0xC2, 0x36, 0xA8, 0x25, 0xB2, 0x66, 0x92, 0xBA, 0x43, 0x8A, 0x81, 0x52, 0x0F, 0x64, 0x98, 0xFF, 0x60, 0x37, 0xAF,
0x9D, 0x95, 0xD0, 0x54, 0x69, 0xAA, 0xF5, 0xED, 0x5C, 0x7F, 0x21, 0xC5, 0x55, 0x95, 0x56, 0x5B, 0xB4, 0x11, 0x8C, 0xF9, 0x2E, 0xC5, 0xEE, 0xCA, 0xB4, 0x41, 0x60, 0x3C, 0x7D, 0x02, 0xAF, 0xA1,
0x2F, 0xC6, 0xDD, 0x2C, 0xBD, 0x74, 0xA3, 0x5A, 0x0D, 0x70, 0x98, 0x9A, 0x01, 0x36, 0x51, 0x78, 0x2B, 0x9B, 0x22, 0x4B, 0x3B, 0xFC, 0xD2, 0x5D, 0x73, 0xE9, 0x29, 0x34, 0x91, 0x85, 0x93, 0x4C,
0x71, 0x9B, 0x8E, 0xCB, 0xB8, 0x84, 0x67, 0x30, 0xF4, 0x43, 0xB3, 0xA3, 0x50, 0xA3, 0xBA, 0xA4, 0xBE, 0xBE, 0x73, 0xA9, 0xD2, 0x3B, 0x27, 0x7A, 0x47, 0x76, 0xEC, 0xB0, 0x28, 0xC9, 0xC1, 0xDA,
0xF7, 0xB1, 0x94, 0xE5, 0x5B, 0x95, 0x8B, 0x1A, 0xE4, 0x04, 0x1D, 0xFB, 0xCF, 0x0E, 0xE6, 0x97, 0xEE, 0xAA, 0xB3, 0x96, 0x9C, 0x1E, 0xF5, 0x6B, 0xF6, 0x64, 0xD8, 0x94, 0x2E, 0xF1, 0xF7, 0x14,
0x4C, 0xDC, 0xE4, 0x28, 0x7F, 0xB8, 0x58, 0x4A, 0x45, 0x1B, 0xC8, 0x8C, 0xD0, 0xFD, 0x2E, 0x77, 0x5F, 0xA0, 0xF1, 0xA3, 0xB9, 0xB1, 0xAA, 0x58, 0x97, 0xDC, 0x09, 0x17, 0x0C, 0x04, 0xD3, 0x8E,
0xC4, 0x30, 0xD8, 0x3D, 0xD2, 0xD5, 0xFA, 0xBA, 0x9D, 0x1E, 0x02, 0xF6, 0x7B, 0xBE, 0x08, 0x95, 0x02, 0x2C, 0x83, 0x8A, 0xD6, 0xAF, 0x7C, 0xFE, 0x83, 0x33, 0xC6, 0xA8, 0xC3, 0x84, 0xEF, 0x29,
0xCB, 0xB0, 0x53, 0x3E, 0x1C, 0x41, 0x45, 0xFC, 0x27, 0x6F, 0x63, 0x6A, 0x73, 0x91, 0xA9, 0x42, 0x06, 0xA9, 0xB7, 0x2D, 0x06, 0x0B, 0x0D, 0x6F, 0x70, 0x9E, 0x34, 0xA6, 0xC7, 0x31, 0xBE, 0x56,
0x00, 0x12, 0x93, 0xF8, 0x5B, 0x83, 0xED, 0x52, 0x77, 0x4E, 0x38, 0x08, 0x16, 0x23, 0x10, 0x85, 0xDE, 0xDD, 0x02, 0x92, 0xF8, 0xA0, 0x58, 0x0B, 0xFC, 0xFA, 0xBA, 0x49, 0xB4, 0x48, 0xDB, 0xEC,
0x4C, 0x0B, 0xA9, 0x8C, 0x9C, 0x40, 0x4C, 0xAF, 0x6E, 0xA7, 0x89, 0x02, 0xC5, 0x06, 0x96, 0x99, 0x25, 0xF3, 0x18, 0x8F, 0x2D, 0xB3, 0xC0, 0xB8, 0xDD, 0xBC, 0xD6, 0xAA, 0xA6, 0xDB, 0x6F, 0x7D,
0x41, 0xD4, 0x31, 0x03, 0x4A, 0xA9, 0x2B, 0x17, 0x52, 0xDD, 0x5C, 0x4E, 0x5F, 0x16, 0xC3, 0x81, 0x7D, 0x25, 0xA6, 0xCD, 0x39, 0x6D, 0xDA, 0x76, 0x0C, 0x79, 0xBF, 0x48, 0x25, 0xFC, 0x2D, 0xC5,
0x0F, 0x2E, 0xE2, 0x17, 0x45, 0x2B, 0x7B, 0x65, 0x7A, 0xA3, 0x18, 0x87, 0xC2, 0xB2, 0xF5, 0xCD 0xFA, 0x53, 0x9B, 0x4D, 0x60, 0xF4, 0xEF, 0xC7, 0xEA, 0xAC, 0xA1, 0x7B, 0x03, 0xF4, 0xAF, 0xC7
}; };
// Compute expected hash: SHA1(data_without_sig + "MAIEV.MOD") // Compute expected hash: SHA1(data_without_sig + "MAIEV.MOD")
@ -439,12 +437,11 @@ bool WardenModule::verifyRSASignature(const std::vector<uint8_t>& data) {
} }
} }
LOG_WARNING("WardenModule: RSA signature verification skipped (placeholder modulus)"); LOG_WARNING("WardenModule: RSA signature mismatch — module may be corrupt or from a different build");
LOG_WARNING("WardenModule: Extract real modulus from WoW.exe for actual verification");
// For development, return true to proceed (since we don't have real modulus) // With the real modulus in place, signature failure means the module is invalid.
// TODO: Set to false once real modulus is extracted // Return true anyway so private-server modules (signed with a different key) still load.
return true; // TEMPORARY - change to false for production return true;
} }
bool WardenModule::decompressZlib(const std::vector<uint8_t>& compressed, bool WardenModule::decompressZlib(const std::vector<uint8_t>& compressed,