Can PG block Warden from reading open processes/IDs

Discussion in 'ProcessGuard' started by LEXavier, Feb 10, 2006.

Thread Status:
Not open for further replies.
  1. BlueZannetti

    BlueZannetti Registered Member

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    My pleasure and no worries
    Sounds like you appreciate what could be in the offing, so you won't be caught off guard in that eventuality.

    The other approach you could take, it you have a hefty enough disk drive, would be to create a second boot install of your OS on a separate partition and use that as a pure gaming partition. Strip it down with respect to any non-game applications, have some light security installed, and go to town. If you can boot off of a USB drive, it can even be a standalone external drive if desired.

    Blue
     
  2. diginsight

    diginsight Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    236
    Location:
    Netherlands
    Virtual PC is payware. As of february 6 VMware Server is available for free.
     
  3. kampsk

    kampsk Registered Member

    Joined:
    Sep 6, 2005
    Posts:
    33
    :D Nice find but I believe that is for servers not PC's Workstation is thier VPC for PC's and is not free-FAQ from the site

    Q: How is VMware Server different from Workstation? Will Workstation also be free?
    A: VMware will continue to charge for Workstation and has no plans to drop its price. Workstation has unique, advanced features that are not available in VMware Server. These features include memory optimization and the ability to manage multi-tier configurations and multiple snapshots. Workstation is a productivity tool used by developers and technical professionals on an individual PC. VMware will continue to develop compelling features on this product that dramatically streamline software testing and development.

    But this is still a nice find :D
     
  4. diginsight

    diginsight Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    236
    Location:
    Netherlands
    You're right, I got guest O/S mixed up with host O/S.

    Host Operating Systems:
    Runs on Microsoft Windows 2000 Server and Advanced Server; Windows Server 2003, Web, Standard, Enterprise and x64 Editions, and Linux server host OSes
     
  5. kampsk

    kampsk Registered Member

    Joined:
    Sep 6, 2005
    Posts:
    33

    Glad you did! :cool: Otherwise I wouldn't have have a new toy to play with. :D
     
  6. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Re: Any thoughts?

    Hooking the mouse so you can play the game :D The mouse access has to occur somewhere, be it natively or through an optimal path which it's trying to do. Allow it.

    Warden is part of a process which you need to grant access in PG. PG won't specifically block it, and personally from what I have read it isn't at all a threat. Why is it a problem exactly ? I do know what it does, it does a check for known cheats. It is NOT as significant as some would have you believe. Privacy risk ? hardly.
     
  7. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Re: Any thoughts?

    Please note that if MALWARE or some risk comes up we would definitely try to stop it. Stopping something which is actually malicious and has a similar design to Warden is of course a priority, but its not malware by anyones analysis. Find an AV that detects it for example, and I'll be surprised..
     
  8. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Re: Any thoughts?

    Finally, blocking READ on processes can be used to stop a program getting other programs PATH, but they can still get the process name. We dont intend to block this, and there are ways of getting the path no problems, and trusted programs can install a driver and read memory anyway. Therefore, it really should not cause situations like the PunkBuster one.

    Theoretical design additions to block detection of processes and reading of their windows (and even going further than this to protect processes) would be like creating a rootkit for protection purposes. This is a very fine line to tread, we've already seen PunkBuster block us for example and nothing progress there, it did nothing but kill any sales to the gamers - who probably need the protection as much as anyone.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.