From e3bb2d6744a0a9ae33cb07e863d10e7e04dd1f2d Mon Sep 17 00:00:00 2001
From: Kelsi <kelsihates2fa@gmail.com>
Date: Fri, 20 Feb 2026 02:02:25 -0800
Subject: [PATCH] Match CMaNGOS uppercase module hash semantics in Warden
 checks

---
 src/game/game_handler.cpp | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/game/game_handler.cpp b/src/game/game_handler.cpp
index 72c6a4f4..7d1610c4 100644
--- a/src/game/game_handler.cpp
+++ b/src/game/game_handler.cpp
@@ -3835,8 +3835,18 @@ void GameHandler::handleWardenData(network::Packet& packet) {
                             std::memcpy(reqHash, p + 4, 20);
                             pos += moduleSize;
 
-                            // CMaNGOS sanity check expects kernel32.dll to be found.
-                            bool shouldReportFound = hmacSha1Matches(seedBytes, "kernel32.dll", reqHash);
+                            // CMaNGOS uppercases module names before hashing.
+                            // DB module scans:
+                            //   KERNEL32.DLL (wanted=true)
+                            //   WPESPY.DLL / SPEEDHACK-I386.DLL / TAMIA.DLL (wanted=false)
+                            bool shouldReportFound = false;
+                            if (hmacSha1Matches(seedBytes, "KERNEL32.DLL", reqHash)) {
+                                shouldReportFound = true;
+                            } else if (hmacSha1Matches(seedBytes, "WPESPY.DLL", reqHash) ||
+                                       hmacSha1Matches(seedBytes, "SPEEDHACK-I386.DLL", reqHash) ||
+                                       hmacSha1Matches(seedBytes, "TAMIA.DLL", reqHash)) {
+                                shouldReportFound = false;
+                            }
                             resultData.push_back(shouldReportFound ? 0x4A : 0x01);
                             break;
                         }