phaneron/Kelsidavis-WoWee
1
0
Fork 0
mirror of https://github.com/Kelsidavis/WoWee.git synced 2026-03-22 15:20:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
Kelsidavis-WoWee/docs/WARDEN_QUICK_REFERENCE.md
Kelsi e29b67dad9 Update docs to reflect current project state 
- Update README: date, Warden complete with Unicorn Engine, add trainers/nonbinary to features, add Unicorn Engine to deps
- Update status.md: date, mark quests/trainers/Warden as working, keep transports as in-progress
- Rewrite Warden docs (QUICK_REFERENCE and IMPLEMENTATION) to match actual implementation
- Remove dev-note docs (WARDEN_COMPLETE, WARDEN_MODULE_ARCHITECTURE) and stray .txt files
- Update ATTRIBUTION: add Unicorn Engine, miniaudio, AzerothCore
2026-02-17 15:05:18 -08:00

2.3 KiB
Raw Permalink Blame History

Warden Quick Reference

Warden is WoW's client integrity checking system. Wowee implements full Warden module execution via Unicorn Engine CPU emulation — no Wine required.

How It Works

Warden modules are native x86 Windows DLLs that the server encrypts and delivers at login.

  1. Server sends SMSG_WARDEN_DATA (0x2E6) with the encrypted module
  2. Client decrypts: RC4 → RSA-2048 signature verify → zlib decompress
  3. Parses the PE: relocations applied, imports resolved (Windows API hooks)
  4. Executes entry point via Unicorn Engine x86 emulator
  5. Client responds with check results via CMSG_WARDEN_DATA (0x2E7)

Server Compatibility

Server type Expected result
Warden disabled Works (no Warden packets)
AzerothCore (local) Works
ChromieCraft Should work
Warmane Should work

Module Cache

Modules are cached after first download:

~/.local/share/wowee/warden_cache/<MD5>.wdn

First connection: ~120ms (download + decompress + emulate). Subsequent: ~1-5ms (load from cache).

Dependency

Unicorn Engine is required for module execution:

sudo apt install libunicorn-dev   # Ubuntu/Debian
sudo dnf install unicorn-devel    # Fedora
sudo pacman -S unicorn            # Arch

The client builds without Unicorn (falls back to crypto-only responses), but will not pass strict Warden enforcement in that mode.

Key Files

src/game/warden_module.hpp/cpp     - Module loader (8-step pipeline)
src/game/warden_emulator.hpp/cpp   - Unicorn Engine executor
src/game/warden_crypto.hpp/cpp     - RC4/MD5/SHA1/RSA crypto
src/game/game_handler.cpp          - Packet handler (handleWardenData)

Logs

grep -i warden logs/wowee.log

Key messages:

  • Warden: module loaded from cache — cached path, fast startup
  • Warden: executing module entry point — emulation running
  • Warden: check response sent — working correctly
  • packetsAfterGate=0 — server not responding after Warden exchange

Check Types

Opcode Name Response
0x00 Module info [0x00]
0x01 Hash check [0x01][results]
0x02 Lua check [0x02][0x00]
0x04 Timing [0x04][timestamp]
0x05 Memory scan [0x05][num][results]

Last Updated: 2026-02-17