Can't login in to Warmane servers.

[devimauz]

As soon you try to login you get the error message.
Would be fun to find out what is it try to run. Maybe process explorer can see it :))

[stoneharry]

Warmane was the first known public user of the RCE. It is up to you whether you trust it.

[armchairrockstar1]

Warmane was the first known public user of the RCE. It is up to you whether you trust it.

And what did they do with the exploit? Do you have any sources for this?

[stoneharry]

Warmane was the first known public user of the RCE. It is up to you whether you trust it.

And what did they do with the exploit? Do you have any sources for this?

Client edits without needing to distribute a patch. I won't be providing how it works, since I don't think a fully disclosed RCE would be good for the WoW emu scene. But myself and many other developers can vouch for its authenticity.

[TheNotary]

This is a clever fix, but instead of safe-listing servers to use the exploit, what about doing a checksum or signing on the incoming "non-malicious" use of the exploit? That way when the payload changes, the client crashes until that payload can be verified.

It sounds like a security concern for any servers to be executing arbitrary code on the client's machine. Even if it's a Microsoft-run server, there's still an opportunity for them to become compromised in an attack which would then expose potentially thousands of their clients to the RCE.

[brian8544]

This is a clever fix, but instead of safe-listing servers to use the exploit, what about doing a checksum or signing on the incoming "non-malicious" use of the exploit? That way when the payload changes, the client crashes until that payload can be verified.

It sounds like a security concern for any servers to be executing arbitrary code on the client's machine. Even if it's a Microsoft-run server, there's still an opportunity for them to become compromised in an attack which would then expose potentially thousands of their clients to the RCE.

I don't think you can create an allow list. The 'door' is either open or closed (patched out). By keeping the RCE active, you'll give the server/malicious-actor full control over your World of Warcraft executable's memory, so it can just overwrite any previous custom code.

[armchairrockstar1]

robinsch has patched 2 different RCEs here: https://github.com/robinsch/WoWFix335/blob/master/Patcher/Patcher.cpp

I think the first one is the same as yours, is it? @stoneharry

(line 59)
    // remote code execution exploit
    write_pos<uint8_t>(0x2A7, 0xC0);

Second one disables the warden on client-side

(line 62)
    // remote code execution exploit (2)
    write_pos(0x3D9D7C, { 0x90, 0x90 });

I don't play on Warmane so I'm able to use both these fixes without immediate crashes but I asked him if these could somehow alert the server admins and he simply said "yes" without explanation. I wonder how. Is it common for server admins to make regular warden scans for all players? I guess our client won't respond to such scans. Is the warden going to flag the account because of it? Or is there any other way they can get alerted due to patching RCE's?

[devimauz]

Sorry. Pressed wrong button.
@armchairrockstar1 Warmane using RCE for detect bot/helpers. In older bots there was anti-warden to make it undetectable on Warmane servers so propably they using it as anti-cheat.

[stoneharry]

robinsch has patched 2 different RCEs here: https://github.com/robinsch/WoWFix335/blob/master/Patcher/Patcher.cpp

I think the first one is the same as yours, is it? @stoneharry

(line 59)
    // remote code execution exploit
    write_pos<uint8_t>(0x2A7, 0xC0);

Second one disables the warden on client-side

(line 62)
    // remote code execution exploit (2)
    write_pos(0x3D9D7C, { 0x90, 0x90 });

I don't play on Warmane so I'm able to use both these fixes without immediate crashes but I asked him if these could somehow alert the server admins and he simply said "yes" without explanation. I wonder how. Is it common for server admins to make regular warden scans for all players? I guess our client won't respond to such scans. Is the warden going to flag the account because of it? Or is there any other way they can get alerted due to patching RCE's?

Servers allowing arbitrary code execution can of course detect if such code is not executed, because they can have the code reply to the server saying it completed successfully. No reply, RCE was not successful.

Sorry. Pressed wrong button. @armchairrockstar1 Warmane using RCE for detect bot/helpers. In older bots there was anti-warden to make it undetectable on Warmane servers so propably they using it as anti-cheat.

It is not only used for anti-cheat.

This repository is a bit redundant. The patch does not completely mitigate the issue, and while write_pos(0x3D9D7C, { 0x90, 0x90 }); does, it also completely disables Warden which is not a viable solution in my opinion.

However, this repository does add another layer of complexity that most people won't know how to bypass.

[armchairrockstar1]

This repository is a bit redundant. The patch does not completely mitigate the issue, and while write_pos(0x3D9D7C, { 0x90, 0x90 }); does, it also completely disables Warden which is not a viable solution in my opinion.

Sorry for the late reply, but this got me thinking. How did you know write_pos(0x3D9D7C, { 0x90, 0x90 }); completely disables Warden? I think you meant client will stop responding to Warden queries. If that's the case, by default the server should kick the player after 10 secs.

Did you test whether the client responds to server with this patch?