I've already done it.
Your basic steps, if you have any idea on how to reverse / code.
You will need to find the encryption/decryption algorithm.
1. Hook send and recv on PnkBuster.
2. In your hook, decrypt the buffer based on the algorithm you found while reversing.
3. Find out the structure of the packet / hash.
4. Find out where it is created.
5. Re-Create the routine in a programming language.
6. Reverse Warrock.exe and find where it compares if PnkBuster is running/being updated etc, and have it compare with itself.
7. Have your runnable run your emulator.
8. Warrock should load with your emulator, and no real punkbuster.