Kelsidavis-WoWee/docs/WARDEN_QUICK_REFERENCE.md
Kelsi dab534e631 docs: fix stale references across 10 documentation files
- CONTRIBUTING.md: C++17 → C++20 (matches CMakeLists.txt)
- TROUBLESHOOTING.md: fix log path (~/.wowee/logs/ → logs/wowee.log)
- docs/authentication.md: remove stale "next milestone" (char enum
  and world entry have been working for months)
- docs/srp-implementation.md: update session key status (RC4 encryption
  is implemented), fix file reference to actual src/auth/srp.cpp
- docs/packet-framing.md: remove stale "next steps" (realm list is
  fully implemented), update status with tested servers
- docs/WARDEN_IMPLEMENTATION.md: fix file list — handler is in
  warden_handler.cpp not game_handler.cpp, add warden_memory.hpp/cpp
- docs/WARDEN_QUICK_REFERENCE.md: fix header/source paths (include/
  not src/), add warden_handler and warden_memory
- docs/quickstart.md: fix clone command (--recurse-submodules, WoWee
  not wowee), remove obsolete manual ImGui clone step, fix log path
- docs/server-setup.md: update version to v1.8.9-preview, date to
  2026-03-30, add all supported expansions
- assets/textures/README.md: remove broken doc references
  (TURTLEHD_IMPORT.md, TEXTURE_MANIFEST.txt), update integration
  status to reflect working PNG override pipeline
2026-03-30 18:33:21 -07:00

96 lines
2.5 KiB
Markdown

# Warden Quick Reference
Warden is WoW's client integrity checking system. Wowee implements full Warden module execution
via Unicorn Engine CPU emulation — no Wine required.
---
## How It Works
Warden modules are native x86 Windows DLLs that the server encrypts and delivers at login.
1. Server sends `SMSG_WARDEN_DATA` (0x2E6) with the encrypted module
2. Client decrypts: RC4 → RSA-2048 signature verify → zlib decompress
3. Parses the PE: relocations applied, imports resolved (Windows API hooks)
4. Executes entry point via Unicorn Engine x86 emulator
5. Client responds with check results via `CMSG_WARDEN_DATA` (0x2E7)
---
## Server Compatibility
| Server type | Expected result |
|-------------|-----------------|
| Warden disabled | Works (no Warden packets) |
| AzerothCore (local) | Works |
| ChromieCraft | Should work |
| Warmane | Should work |
---
## Module Cache
Modules are cached after first download:
```
~/.local/share/wowee/warden_cache/<MD5>.wdn
```
First connection: ~120ms (download + decompress + emulate). Subsequent: ~1-5ms (load from cache).
---
## Dependency
Unicorn Engine is required for module execution:
```bash
sudo apt install libunicorn-dev # Ubuntu/Debian
sudo dnf install unicorn-devel # Fedora
sudo pacman -S unicorn # Arch
```
The client builds without Unicorn (falls back to crypto-only responses), but will not pass
strict Warden enforcement in that mode.
---
## Key Files
```
include/game/warden_handler.hpp + src/game/warden_handler.cpp - Packet handler
include/game/warden_module.hpp + src/game/warden_module.cpp - Module loader (8-step pipeline)
include/game/warden_emulator.hpp + src/game/warden_emulator.cpp - Unicorn Engine executor
include/game/warden_crypto.hpp + src/game/warden_crypto.cpp - RC4/MD5/SHA1/RSA crypto
include/game/warden_memory.hpp + src/game/warden_memory.cpp - PE image + memory patching
```
---
## Logs
```bash
grep -i warden logs/wowee.log
```
Key messages:
- `Warden: module loaded from cache` — cached path, fast startup
- `Warden: executing module entry point` — emulation running
- `Warden: check response sent` — working correctly
- `packetsAfterGate=0` — server not responding after Warden exchange
---
## Check Types
| Opcode | Name | Response |
|--------|------|----------|
| 0x00 | Module info | `[0x00]` |
| 0x01 | Hash check | `[0x01][results]` |
| 0x02 | Lua check | `[0x02][0x00]` |
| 0x04 | Timing | `[0x04][timestamp]` |
| 0x05 | Memory scan | `[0x05][num][results]` |
---
**Last Updated**: 2026-02-17