Kelsi
|
82d0b211fb
|
Implement Warden Phase 4: Executable Loader (partial)
Added module memory allocation and skip/copy parsing:
Executable Format Parser:
- Read 4-byte little-endian final code size
- Parse alternating skip/copy sections (2-byte length + data)
- Skip sections: advance offset without copying
- Copy sections: memcpy x86 code to allocated memory
- Boundary validation and sanity checks (max 5MB code)
Memory Allocation:
- Linux: mmap() with PROT_READ|WRITE|EXEC permissions
- Windows: VirtualAlloc() with PAGE_EXECUTE_READWRITE
- Proper cleanup in unload() (munmap/VirtualFree)
- Zero-initialize allocated memory
Address Relocations (STUB):
- Framework in place for delta-encoded offset parsing
- Needs real Warden module data to implement correctly
- Currently returns true to continue loading pipeline
Load Pipeline Status:
✅ Step 1-5: MD5, RC4, RSA, zlib, exe parsing
⚠️ Step 6: Relocations (stub - needs real module)
⏳ Step 7-8: API binding, initialization
Progress: 4/7 phases underway (~1.5 months remaining)
Next: Phase 5 (API Binding) - kernel32.dll/user32.dll imports
|
2026-02-12 02:49:58 -08:00 |
|
Kelsi
|
68a66a02a4
|
Implement Warden Phase 3: Validation Layer (RSA + zlib)
Completed validation pipeline for Warden module loading:
RSA Signature Verification:
- Implemented RSA-2048 public key decryption (OpenSSL)
- Extracts last 256 bytes as signature
- Verifies SHA1(module_data + "MAIEV.MOD") hash
- Public key: exponent 0x010001 (65537), 256-byte modulus
- ⚠ Currently using placeholder modulus (returns true for dev)
- TODO: Extract real modulus from WoW.exe for production
zlib Decompression:
- Read 4-byte little-endian uncompressed size
- Inflate compressed module data
- Sanity check: reject modules > 10MB
- Full error handling and logging
Standalone RC4:
- Implemented RC4 cipher in WardenModule (KSA + PRGA)
- Used for module decryption (16-byte key)
- Separate from WardenCrypto (which handles packet streams)
Load Pipeline Status:
✅ Step 1-4: MD5, RC4, RSA, zlib (validation complete)
⏳ Step 5-8: Exe parsing, relocations, API binding, execution
Progress: 3/7 phases complete (~2 months remaining)
Next: Phase 4 (Executable Loader)
|
2026-02-12 02:47:29 -08:00 |
|
Kelsi
|
4b425f1225
|
Implement Warden module execution foundation (Phase 1 & 2)
Added architecture for loading and executing native x86 Warden modules:
New classes:
- WardenModule: Individual module loader with 8-step pipeline
✅ MD5 verification (working)
✅ RC4 decryption (working)
⏳ RSA/zlib/exe-parsing/relocation/API-binding/execution (TODOs)
- WardenModuleManager: Module lifecycle and disk caching
~/.local/share/wowee/warden_cache/<MD5>.wdn
- WardenFuncList: Callback structure for module execution
Integration:
- Added wardenModuleManager_ to GameHandler
- Module manager initialized on startup
- Foundation ready for phases 3-7 (validation → execution)
Documentation:
- WARDEN_MODULE_ARCHITECTURE.md (comprehensive 7-phase roadmap)
- Estimated 2-3 months for full native code execution
- Alternative: packet capture approach (1-2 weeks)
Status: Crypto layer complete, execution layer TODO
|
2026-02-12 02:43:20 -08:00 |
|