Kelsidavis-WoWee/docs/WARDEN_QUICK_REFERENCE.md
Kelsi dab534e631 docs: fix stale references across 10 documentation files
- CONTRIBUTING.md: C++17 → C++20 (matches CMakeLists.txt)
- TROUBLESHOOTING.md: fix log path (~/.wowee/logs/ → logs/wowee.log)
- docs/authentication.md: remove stale "next milestone" (char enum
  and world entry have been working for months)
- docs/srp-implementation.md: update session key status (RC4 encryption
  is implemented), fix file reference to actual src/auth/srp.cpp
- docs/packet-framing.md: remove stale "next steps" (realm list is
  fully implemented), update status with tested servers
- docs/WARDEN_IMPLEMENTATION.md: fix file list — handler is in
  warden_handler.cpp not game_handler.cpp, add warden_memory.hpp/cpp
- docs/WARDEN_QUICK_REFERENCE.md: fix header/source paths (include/
  not src/), add warden_handler and warden_memory
- docs/quickstart.md: fix clone command (--recurse-submodules, WoWee
  not wowee), remove obsolete manual ImGui clone step, fix log path
- docs/server-setup.md: update version to v1.8.9-preview, date to
  2026-03-30, add all supported expansions
- assets/textures/README.md: remove broken doc references
  (TURTLEHD_IMPORT.md, TEXTURE_MANIFEST.txt), update integration
  status to reflect working PNG override pipeline
2026-03-30 18:33:21 -07:00

2.5 KiB

Warden Quick Reference

Warden is WoW's client integrity checking system. Wowee implements full Warden module execution via Unicorn Engine CPU emulation — no Wine required.


How It Works

Warden modules are native x86 Windows DLLs that the server encrypts and delivers at login.

  1. Server sends SMSG_WARDEN_DATA (0x2E6) with the encrypted module
  2. Client decrypts: RC4 → RSA-2048 signature verify → zlib decompress
  3. Parses the PE: relocations applied, imports resolved (Windows API hooks)
  4. Executes entry point via Unicorn Engine x86 emulator
  5. Client responds with check results via CMSG_WARDEN_DATA (0x2E7)

Server Compatibility

Server type Expected result
Warden disabled Works (no Warden packets)
AzerothCore (local) Works
ChromieCraft Should work
Warmane Should work

Module Cache

Modules are cached after first download:

~/.local/share/wowee/warden_cache/<MD5>.wdn

First connection: ~120ms (download + decompress + emulate). Subsequent: ~1-5ms (load from cache).


Dependency

Unicorn Engine is required for module execution:

sudo apt install libunicorn-dev   # Ubuntu/Debian
sudo dnf install unicorn-devel    # Fedora
sudo pacman -S unicorn            # Arch

The client builds without Unicorn (falls back to crypto-only responses), but will not pass strict Warden enforcement in that mode.


Key Files

include/game/warden_handler.hpp + src/game/warden_handler.cpp   - Packet handler
include/game/warden_module.hpp  + src/game/warden_module.cpp    - Module loader (8-step pipeline)
include/game/warden_emulator.hpp + src/game/warden_emulator.cpp - Unicorn Engine executor
include/game/warden_crypto.hpp  + src/game/warden_crypto.cpp    - RC4/MD5/SHA1/RSA crypto
include/game/warden_memory.hpp  + src/game/warden_memory.cpp    - PE image + memory patching

Logs

grep -i warden logs/wowee.log

Key messages:

  • Warden: module loaded from cache — cached path, fast startup
  • Warden: executing module entry point — emulation running
  • Warden: check response sent — working correctly
  • packetsAfterGate=0 — server not responding after Warden exchange

Check Types

Opcode Name Response
0x00 Module info [0x00]
0x01 Hash check [0x01][results]
0x02 Lua check [0x02][0x00]
0x04 Timing [0x04][timestamp]
0x05 Memory scan [0x05][num][results]

Last Updated: 2026-02-17