Hi there,

Kinda new round here so first hi and really great work on the bot.

With the rumors (they are just rumors but they sound plausible) that Blizzard have just recently started monitoring Hearthstone and Diablo I wondered if HearthRanger modified/wrote anything in the Hearthstone address space? Just wondering as that is one of the things Warden looks for :). I would think not but hoped there would be no harm in asking.

They are not rumors, multiple 3rd party tool creators have confirmed that when Blizzard updated Warden (their anti-cheat detection for all their games) in January, they added the ability for it to be told by their servers to look at certain memory locations within EVERY process that is attached to D3 or HS (has an open handle afaik) and report back a fingerprint (a hash) of whatever it found. No memory writing is required, just the act of reading memory is detectable now. They can store those hashes for a while and keep checking new programs that they find against the old hashes, so even if you don't get caught right away you could still get caught down the road.

I've run multiple bots and other tools in both games and so far have not had any bans but D3 players have been getting hit hard with bans for the past two Tuesdays and nearly my entire friends list in D3 is gone. Bossland ("buddy" bots) were the ones that discovered it, warned everybody, and updated their bots to avoid detection (I think they intercept the location warden wants to read and then modify the memory to be random) and then everybody else started relying on a low tech solution of running D3 with a different user account in windows with no permission to read the folders of the 3rd party tools. Not all programs are able to see the game process when it is run as a different user though, I tried it with HR but it wouldn't work.

I don't know what exactly HR does or if it's detectable.