Team XPG Watch Dogs +25 V1.1 Reversed by Trainereverser_

]Xbox 360 Trainer reversed by Trainereverser_
<< Knowledge should be open_ >>
<< The Xbox 360 Trainer vigilante strikes again_ >>

Today's Victim: << Trainer Watch Dogs +25 TeamXPG V1.1 by XPGSensei420_ >>
Download: << http://www.xpgamesaves.com/files/file/5100-trainer-watch-dogs-25-teamxpg-v11/_ >>

Fellow citizens, and xbox 360 hackers and modders_

If you aren't familiar with the way this works, whenever some bigoted trainer is released without source code, I spend my time reversing their piece of shit system and release offsets and code in order to do this yourselves and perhaps make another tool_

The required knowledge for this is how to patch bytes in memory and at times write a Xbox 360 .dll with Visual Studio_

The following format is: Description :: Offset in Memory :: Bytes for Hack (patched) :: Regular Bytes (unpatched)_

<< XPGSensei420's Watch Dogs ALL TU +25 Trainer by XPGSensei420 Exposed_ >>
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-------------------------------------------------------------------------------
DESCRIPTION_ 		OFFSET_			PATCHED_		UNPATCHED_
-------------------------------------------------------------------------------
Skill/Money Mod 	82E5B550		396B7530 		7D7D5850
Infinite Ammo		82ADFDD8		394B0000		394BFFFF
Infinite Batteries	827E8F2C 		7D6B5B78		7C8B2378
Infinite Health		[ this is a cave-code, source below ]
Fast XP 		82E53CF4		39081D4C		7D085214
Infinite Items		82ABFBB0		60000000		7D7F5850
Infinite Focus		82A6405C		60000000		D01F0168
ctOS Timer Mod 		827B2E10		60000000		EC000828
Easy Kills		[ removed from trainer ]


Cash Run Inf Time 	8300CB54		60000000		EC1F002A
NVZN Inf Lives		8308BFCC		396B0000		396BFFFF
NVZN Score Mod 		830D458C		396A7530		7D6A5A14
NVZN Inf Ammo		82ADFDD8		394B0000		394BFFFF	[same as Infinite Ammo. +25? Bullshit.]
Psych-Score Mod     	82DA9AC8		396A7530		7D6A5A14
Psych-Combo Mod     	82D82A7C 		394A0063		394A0001
Alone Inf Ammo		82ADFDD8		394B0000		394BFFFF	[same as Infinite Ammo..]
Alone Inf Items		82ABFBB0		60000000		7D7F5850	[same as Infinite Items..]
Alone Max Skill     	82E5B550		396B0063		7D7D5850
Alone Score Mod     	82D71AE4		396B7530		7D6B2214
SpidTank Ammo		82ADFDD8		394B0000		394BFFFF	[same as Infinite Ammo..]
SpidTank FastXP		82E6CFA4		396B7530		7D6B2214
SpidTank Score 					396B1388		7D6B2214	[The offset is broken in their trainer.] SpidTank MaxSkill	82E5B550		396B0063		7D7D5850



Madness Inf Time 	82DAA1B8		60000000		917D02A4
Madness ScoreMod	82D8397C		394A4E20		7D495214
Madness FastXP		82D8397C		394A4E20		7D495214	[someone fucked up via copy and paste]
Madness ComboMod	82D83948		904B0000		914B0000
Madness MaxSkills	82E5B550		396B0063		7D7D5850	[same as Max Skills]

Madness SoulMod		82D638F4		D1AB025C		FC0D582E
			82D638D8		D003006C		D1A3006C




CODE CAVES_
-------------------------------------------------------------
// Infinite Health reversed by Trainereverser_

#define INFINITE_HEALTH_HOOK 0x82D638D8

// PatchInJump by FSD
VOID PatchInJump(DWORD* Address, DWORD Destination, BOOL Linked)
{
    if(Destination & 0x8000)
            Address[0] = 0x3D600000 + (((Destination >> 16) & 0xFFFF) + 1);
    else
            Address[0] = 0x3D600000 + ((Destination >> 16) & 0xFFFF);

    Address[1] = 0x396B0000 + (Destination & 0xFFFF);
    Address[2] = 0x7D6903A6;

    if(Linked)
            Address[3] = 0x4E800421;
    else
            Address[3] = 0x4E800420;
}

VOID InfiniteHealthASM
{
	__asm
	{
		std r6,18h(r3)			// Store the player's health
		cmplwi cr6, r10, 0
		fsel f2, f12, f13, f0
		stfs f2, -0x10(r1)
		lwz r11, 0xC(r3)
		stw r11, -0xC(r1)

		lis r11, 0x9193			// Load the 'isInfHealth' boolean
		lbz r11, -0x5E3C(r11)

		cmpwi cr6, r11, 1       	// Compare InfiniteHealth to 1
		bne cr6, 9190C330		// If it's not, we go to InstaKill

		lwz r11, -0xC(r1)
		lis r10, 0x117
		ori r10, r10, 0xCED9
		cmplw cr6, r11, r10		// Compare the Disrupt's Event ID with 0x117CED9 (Send Damage to Player)
		bne cr6, 9190C330		// If it's not we go to Instakill

		lis r11, 0x9190			// If we are:
		lfs f0, 0x5A0(r11)		// Load the float of 100.0f into f0
		stfs f0, -0x10(r1)		// Set the float to 100.0f

		blr				// Break off back into the previous function in the stack [unconditionally]
	}
}

// Easy Kills is the same as above except if 0x117CED9 doesn't match (Send Damage to NOT player), set the health to 0.0f so it's an instant kill.


VOID InfiniteHealth()
{
    PatchInJump((DWORD *)INFINITE_HEALTH_HOOK, (DWORD)InfiniteHealthASM, false);
}




Pwned by

....#.#######.########....###...###.##....#.#######.########.#######.##.....#.#######.########..######.#######.########.##...
...##....##...##.....#...##.##...##.###...#.##......##.....#.##......##.....#.##......##.....#.##....#.##......##.....#..##..
..##.....##...##.....#..##...##..##.####..#.##......##.....#.##......##.....#.##......##.....#.##......##......##.....#...##.
.##......##...########.##.....#..##.##.##.#.######..########.######..##.....#.######..########..######.######..########....##
..##.....##...##...##..########..##.##..###.##......##...##..##.......##...##.##......##...##........#.##......##...##....##.
...##....##...##....##.##.....#..##.##...##.##......##....##.##........##.##..##......##....##.##....#.##......##....##..##..
....#....##...##.....#.##.....#.###.##....#.#######.##.....#.#######....###...#######.##.....#..######.#######.##.....#.##...