WoWMimic PvPAdvance v15

More epic fail from the WoWMimic team with the release of PvPAdvance v15.

They have made ZERO improvements to their anti-detection since v14. That means that it can still be detected using  a  warden scan that’s already implemented. No new functionality is required, only a new hash.

The only thing they are currently doing to protect themselves is unlink their module from the linked list, but Warden doesn’t even use that list!*

Sigh. It seems like they’re never going to learn. Hopefully Blizzard will teach them the hard way, but given how lazy the Warden guy is, I can’t exatly say you should count on it.

Update:

*Whilst there is a scan in place that does in fact use that list through the use of Module32First/Module32Next, it is not currently activated. Thank you Kynox for catching and confirming that.

  1. kynox says:

    Technically, your claim of “Warden doesn’t even use that list” is incorrect. Module32First/Next uses the linked lists to enumerate modules. All their unlinking prevents is module name detection :p.

  2. Cypherjb says:

    @kynox
    Must’ve been very unlucky I guess. I know it uses the APIs, but I couldn’t get it to fire.

    Is it still active? Because I hooked it and their other scans were firing but not that one.

  3. kynox says:

    Not as of late it seems, the code is still there though.

  4. Cypherjb says:

    @kynox
    Thats what I thought (and meant). I’ll clarify it in the post.

    Thanks for confirmation.

  1. There are no trackbacks for this post yet.

Leave a Reply