API tools faq
paste
Advertisement
Guest User

Lulllllssss

a guest
Jul 14th, 2017
1,023
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.23 KB | None | 0 0
raw download clone embed print report
  1. #include "stdafx.h"
  2. #include "KushGamingConfig.h"
  3. #include "Utilities.h"
  4. #include "titleHooks.h"
  5. #include "SystemHooks.h"
  6. #include "ServComm.h"
  7. #include "PatchData.h"
  8. #include <xbdm.h>
  9. #include <time.h>
  10. #include "AW.h"
  11. #include "BO2_game.h"
  12. #include "HUD.h"
  13. #include "HudHook.h"
  14. #include "Aimbot.h"
  15. #include "BO3.h"
  16.  
  17.  
  18. extern _SERVER_GET_CUSTOM_RESPONCE cData;
  19. BYTE Challenge[] = { // Challenge using random data // Using Full Challenge resp clean
  20. 0x46, 0x7C, 0x70, 0xB0, // IP Address [4 Bytes]
  21. 0xFC, 0x00, 0x00, 0x00, 0xE6, 0xA5, 0xDD, 0xD1, // Machine ID [8 Bytes]
  22. 0xF5, 0xD7, 0xDA, 0xF1, 0x46, 0x21, 0x01, 0x10, // MAC Address [8 Bytes]
  23. 0x00, 0x00, 0x00, 0x00, // ChallengePadding 0 (Read Memory @ func_849AF534(float))
  24. 0x00, 0x00, 0x00, 0x00, // ChallengePadding 1 (Read Memory @ func_849AF534 + 0x04(float))
  25. 0x08, 0x60, // ChallengePadding 2 (Read Memory @ func_84629B5C)
  26. 0x03, // RetailFlag 0x01 = Active | 0x02 = Clean Retail (What Makes it Not?) | 01 + 02 = 0x03 = Active + Clean
  27. 0x30, 0x31, 0x34, 0x32, 0x36, 0x31, 0x37, 0x39, 0x35, 0x32, 0x30, 0x37, 0x00, // Console Serial [12 Bytes]
  28. 0x30, 0x33, 0x32, 0x37, 0x35, 0x38, 0x31, 0x31, 0x33, 0x30, 0x35, 0x35, // Console ID
  29. 0x42, 0xFE
  30. };
  31. extern HANDLE hXam;
  32. extern BOOL IsDevkit;
  33. extern BOOL dashLoaded;
  34.  
  35. MESSAGEBOX_RESULT g_mb_result;
  36. XOVERLAPPED g_xol;
  37.  
  38. DWORD nop = 0x60000000;
  39. DWORD other = 0x38600001;
  40. DWORD Data = 0x38600000;
  41.  
  42. extern DWORD ApplyPatches(CHAR* FilePath, const VOID* DefaultPatches = NULL);
  43. extern void printBytes(PBYTE bytes, DWORD len);
  44.  
  45.  
  46. extern "C" VOID KeSweepIcacheRange(PVOID Address, DWORD cbBytes);
  47. VOID ApplyPatchData(PBYTE pBuffer, DWORD dwLength) {
  48. PDWORD pdwData = (PDWORD)pBuffer;
  49.  
  50. // Sanity check
  51. if (pdwData[(dwLength / 4) - 1] != -1) {
  52. return;
  53. }
  54.  
  55. while (TRUE) {
  56. DWORD dwAddress = *pdwData++;
  57.  
  58. if (dwAddress == -1)
  59. break;
  60.  
  61. DWORD dwPatchCount = *pdwData++;
  62. for (DWORD i = 0; i < dwPatchCount; i++) {
  63. DWORD dwAddrToPatch = dwAddress + (i * 4);
  64. *(DWORD*)(dwAddrToPatch) = *pdwData++;
  65. }
  66.  
  67. KeSweepIcacheRange((PVOID)dwAddress, dwPatchCount * 4);
  68. }
  69. }
  70.  
  71. static BYTE PATCH_DATA_KXAM_MSPOINTS_RETAIL[64] = {
  72. 0x81, 0x68, 0xD7, 0x60, //0x81, 0x68, 0xA5, 0x50,
  73. 0x00, 0x00, 0x00, 0x07,
  74. 0x38, 0x80, 0x00, 0x05,
  75. 0x80, 0x63, 0x00, 0x1C,
  76. 0x90, 0x83, 0x00, 0x04,
  77. 0x38, 0x80, 0x05, 0x39,
  78. 0x90, 0x83, 0x00, 0x08,
  79. 0x38, 0x60, 0x00, 0x00,
  80. 0x4E, 0x80, 0x00, 0x20,
  81.  
  82. 0x81, 0x8E, 0x8C, 0xF0,//0x81, 0x8E, 0x4F, 0x30,
  83. 0x00, 0x00, 0x00, 0x01,
  84. 0x60, 0x00, 0x00, 0x00,
  85.  
  86. 0x81, 0x8E, 0xD5, 0x44,//0x81, 0x8E, 0x96, 0x1C,
  87. 0x00, 0x00, 0x00, 0x01,
  88. 0x48, 0x00, 0x00, 0xC8,
  89.  
  90. 0xFF, 0xFF, 0xFF, 0xFF
  91. };
  92. static BYTE PATCH_DATA_MPPURCHASE_MSPOINTS_RETAIL[0x1C] = {
  93. 0x90, 0x15, 0xB1, 0xDC,
  94. 0x00, 0x00, 0x00, 0x01,
  95. 0x39, 0x60, 0x00, 0x00,
  96.  
  97. 0x90, 0x15, 0xB1, 0x88,
  98. 0x00, 0x00, 0x00, 0x01,
  99. 0x60, 0x00, 0x00, 0x00,
  100.  
  101. 0xFF, 0xFF, 0xFF, 0xFF
  102. };
  103.  
  104. byte bytes0[28] = {
  105. 0x38, 0x80, 0x00, 0x05,
  106. 0x80, 0x63, 0x00, 0x1C,
  107. 0x90, 0x83, 0x00, 0x04,
  108. 0x38, 0x80, 0x05, 0x39,
  109. 0x90, 0x83, 0x00, 0x08,
  110. 0x38, 0x60, 0x00, 0x00,
  111. 0x4E, 0x80, 0x00, 0x20
  112. };
  113.  
  114.  
  115. byte bytes1[4] = { 0x48, 0x00, 0x00, 0xC8 }; // 480000C8
  116. byte bytes2[4] = { 0x39, 0x60, 0x00, 0x00 }; // 39600000
  117. byte bytes3[4] = { 0x60, 0x00, 0x00, 0x00 }; // 60000000
  118. #ifdef _INI_
  119. INIReader readerr;
  120. #endif
  121.  
  122. void MSPSpoof() {
  123. #ifdef _INI_
  124.  
  125. if (readerr.GetBoolean("extras", "AutoSpoofMSP", "true")) {
  126.  
  127.  
  128. // if (readerr.GetInteger("extras", "CustomMSPAmount", 420) != 420 && readerr.ParseError() < 0) {
  129. // int mspamount = readerr.GetInteger("extras", "CustomMSPAmount", 420);
  130. //SetMemory((PVOID)0x8168A7F0, (PVOID)((DWORD)mspamount), sizeof(WORD)); //updated 17511
  131. SetMemory((PVOID)0x8168A7F0, bytes0, 28); //updated 17511
  132. SetMemory((PVOID)0x818E9034, bytes1, 4); ////updated 17511
  133. SetMemory((PVOID)0x818ED72C, bytes2, 4); ////updated 17511
  134. SetMemory((PVOID)0x9015C108, bytes3, 4); //<didnt change
  135. ApplyPatchData(PATCH_DATA_KXAM_MSPOINTS_RETAIL, 64);
  136. ApplyPatchData(PATCH_DATA_MPPURCHASE_MSPOINTS_RETAIL, 0x1C);
  137.  
  138. XNotifyUI(L"KushGaming - MSP Spoofed!\nTime for a shopping spree...");
  139. #endif
  140. }
  141. }
  142.  
  143.  
  144. VOID __cdecl APCWorker(void* Arg1, void* Arg2, void* Arg3) {
  145.  
  146. // Call our completion routine if we have one
  147. if(Arg2)
  148. ((LPOVERLAPPED_COMPLETION_ROUTINE)Arg2)((DWORD)Arg3, 0, (LPOVERLAPPED)Arg1);
  149. }
  150.  
  151. DWORD XSecurityCreateProcessHook(DWORD dwHardwareThread)
  152. {
  153. return ERROR_SUCCESS;
  154. }
  155.  
  156. VOID XSecurityCloseProcessHook(){}
  157.  
  158. DWORD XSecurityVerifyHook(DWORD dwMilliseconds, LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) {
  159.  
  160. // Queue our completion routine
  161. if(lpCompletionRoutine)
  162. NtQueueApcThread((HANDLE)-2, (PIO_APC_ROUTINE)APCWorker, lpOverlapped, (PIO_STATUS_BLOCK)lpCompletionRoutine, 0);
  163.  
  164. // All done
  165. return ERROR_SUCCESS;
  166. }
  167.  
  168. DWORD XSecurityGetFailureInfoHook(PXSECURITY_FAILURE_INFORMATION pFailureInformation)
  169. {
  170. if (pFailureInformation->dwSize != 0x18) return ERROR_NOT_ENOUGH_MEMORY;
  171. pFailureInformation->dwBlocksChecked = 0;
  172. pFailureInformation->dwFailedReads = 0;
  173. pFailureInformation->dwFailedHashes = 0;
  174. pFailureInformation->dwTotalBlocks = 0;
  175. pFailureInformation->fComplete = TRUE;
  176. return ERROR_SUCCESS;
  177. }
  178.  
  179. DWORD XexGetProcedureAddressHook(HANDLE hand, DWORD dwOrdinal, PVOID* pvAddress)
  180. {
  181. if(hand == hXam) {
  182. switch(dwOrdinal) {
  183. case 0x9BB:
  184. *pvAddress = XSecurityCreateProcessHook;
  185. return 0;
  186. case 0x9BC:
  187. *pvAddress = XSecurityCloseProcessHook;
  188. return 0;
  189. case 0x9BD:
  190. *pvAddress = XSecurityVerifyHook;
  191. return 0;
  192. case 0x9BE:
  193. *pvAddress = XSecurityGetFailureInfoHook;
  194. return 0;
  195. }
  196. }
  197. //DbgPrint("XexGetProcedureAddressHook [pvAddress]: 0x%p", pvAddress);
  198. return XexGetProcedureAddress(hand, dwOrdinal, pvAddress);
  199. }
  200.  
  201. unsigned long XeKeysGetKeyHook(unsigned short key, unsigned char* buffer, PDWORD len)
  202. {
  203. if (key == 0x14)
  204. {
  205. srand((unsigned int)time(0));
  206. for (int i = 0x00; i < 0xC; i++) buffer[i] = rand() % 0x7F;
  207. return 0L;
  208. }
  209. return XeKeysGetKey(key, buffer, len);
  210. }
  211.  
  212. int XNetXnAddrToMachineIdHookBO2(XNCALLER_TYPE xnc, XNADDR pxnaddr, unsigned long long MachineId)
  213. {
  214. srand((unsigned int)time(0));
  215. MachineId = 0xFA00000000000000 | (0x2000000 | rand() % 0x7FFFFF);
  216. return 0;
  217. }
  218.  
  219. inline __declspec() bool Live_GetConsoleDetailsSavestubGhosts(bool alwaysTrue, unsigned char internalIP[4], unsigned char onlineIP[4], unsigned long long *machineIDH, unsigned long long *null, unsigned long long *enet)
  220. {
  221. __asm
  222. {
  223. nop
  224. nop
  225. nop
  226. nop
  227. nop
  228. nop
  229. nop
  230. blr
  231. }
  232. }
  233.  
  234. bool Live_GetConsoleDetailsHookGhosts(bool alwaysTrue, unsigned char internalIP[4], unsigned char externalIP[4], unsigned long long * machineIDH, unsigned long long * machineIDL, unsigned long long *enet)
  235. {
  236. srand(time(0));
  237. int iTargetAddress = 0;
  238. __asm mflr iTargetAddress
  239. if (iTargetAddress == 0x82627564 || iTargetAddress == 0x82628888)
  240. {
  241. for (int i = 0; i < 4; i++) { internalIP[i] = rand() % 0xFF; externalIP[i] = rand() % 0xFF; }
  242. *enet = 0x001DD8000000 | rand() % 0x7FFFFF;
  243. return true;
  244. }
  245. return Live_GetConsoleDetailsSavestubGhosts(alwaysTrue, internalIP, externalIP, machineIDH, machineIDL, enet);
  246. }
  247.  
  248. HRESULT XeKeysGetConsoleIDHook( PBYTE databuffer OPTIONAL, char* szBuffer OPTIONAL ) {
  249.  
  250. XE_CONSOLE_ID consoleID;
  251. XeKeysGetConsoleID((PBYTE)&consoleID, NULL);
  252.  
  253. XUSER_SIGNIN_INFO userInfo;
  254. XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  255.  
  256. BYTE gamertagSha[0x10];
  257. XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  258. consoleID.asBits.MacIndex3=gamertagSha[0];
  259. consoleID.asBits.MacIndex4=gamertagSha[1];
  260. consoleID.asBits.MacIndex5=gamertagSha[2];
  261.  
  262. SetMemory(databuffer, &consoleID, 0x5);
  263. return ERROR_SUCCESS;
  264. }
  265.  
  266.  
  267. int NetDll_XNetXnAddrToMachineIdHook( XNCALLER_TYPE xnc, XNADDR * pxnaddr, ULONGLONG * pqwMachineId){
  268.  
  269. int rett = NetDll_XNetXnAddrToMachineId( xnc, pxnaddr, pqwMachineId);
  270.  
  271. XUSER_SIGNIN_INFO userInfo;
  272. XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  273.  
  274. BYTE gamertagSha[0x10];
  275. XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  276. SetMemory(pqwMachineId+5, gamertagSha, 0x3);
  277.  
  278. return rett;
  279. }
  280.  
  281. int XNetXnAddrToMachineIdHook(XNCALLER_TYPE xnc, XNADDR* pxnaddr, unsigned long long* qwMachineId)
  282. {
  283. srand((unsigned int)time(0));
  284. *qwMachineId = 0xFA00000002000000 | (0x2000000 | rand() % 0x7FFFFF);
  285. return 0;
  286. }
  287.  
  288.  
  289. inline __declspec() bool Live_GetConsoleDetailsSavestub(unsigned char internalIP[4], unsigned char onlineIP[4], unsigned long long *machineIDH, unsigned long long *null, unsigned long long *enet)
  290. {
  291. __asm
  292. {
  293. nop
  294. nop
  295. nop
  296. nop
  297. nop
  298. nop
  299. nop
  300. blr
  301. }
  302. }
  303.  
  304. bool Live_GetConsoleDetailsHook(unsigned char internalIP[4], unsigned char onlineIP[4], unsigned long long *machineIDH, unsigned long long *null, unsigned long long *enet) {
  305. srand(time(0));
  306. int iTargetAddress = 0;
  307. __asm mflr iTargetAddress
  308. if (iTargetAddress == 0X822EC08C || iTargetAddress == 0X822EB7C4) {
  309. for (int i = 0; i < 4; i++) {
  310. internalIP[i] = rand() % 0xFF; onlineIP[i] = rand() % 0xFF;
  311. }
  312. *enet = 0x001DD8000000 | rand() % 0x7FFFFF;
  313. return true;
  314. }
  315. return Live_GetConsoleDetailsSavestub(internalIP, onlineIP, machineIDH, null, enet);
  316. }
  317. HRESULT XNetLogonGetMachineIDHook(QWORD* machineID){
  318.  
  319. QWORD machID=0;
  320. HRESULT rett = XNetLogonGetMachineID(&machID);
  321.  
  322. XUSER_SIGNIN_INFO userInfo;
  323. XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  324.  
  325. BYTE gamertagSha[0x10];
  326. XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  327. SetMemory(machineID+5, gamertagSha, 0x3);
  328.  
  329. return rett;
  330. }
  331.  
  332. typedef HRESULT (*pXamInputGetState)(QWORD r3,QWORD r4,QWORD r5);
  333. pXamInputGetState XamInputGetState = (pXamInputGetState)ResolveFunction(NAME_XAM, 401);
  334.  
  335. static BOOL isFrozen = FALSE;
  336. HRESULT XamInputGetStateHook(QWORD r3,QWORD r4,QWORD r5){
  337. if(isFrozen){
  338. return 0;
  339. }
  340. HRESULT ret = XamInputGetState(r3, r4, r5);
  341. return ret;
  342. }
  343.  
  344. static DWORD lastTitleID=0;
  345. BYTE NOP[] = { 0x60, 0x00, 0x00, 0x00 };
  346. BYTE Branch[] = { 0x48, 0x00 };
  347. BYTE DOLONG[] = { 0x89, 0x21, 0x00, 0x50, 0x60, 0x00, 0x00, 0x00 };
  348. BYTE TEST[] = { 0x61, 0x49, 0x00, 0x00 };
  349. BYTE GHOSTS_LASER[] = { 0x38, 0x60, 0x00, 0x01 };
  350. BYTE GHOSTS_UAV[] = { 0x3B, 0x60, 0x00, 0x01 };
  351. BYTE BO2_WALL[] = { 0x34, 0xC0, 0xFF, 0xFF };
  352. BYTE AW_ENABLER[] = { 0x39, 0x60, 0x00, 0x00 };
  353. BYTE AW_ENABLER2[] = { 0x38, 0xC0, 0x00, 0x03 };
  354.  
  355. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  356.  
  357. LPCWSTR Buttons5[2] = { L"Modifications", L"Original Game"};
  358.  
  359. DWORD WINAPI MW2_Go(LPVOID lpParam)
  360. {
  361.  
  362. #ifdef _INI_
  363. if (readerr.GetBoolean("menus", "MW2Menu", "true")) {
  364.  
  365.  
  366. XNotifyUI(L"KushGaming Beta - MW2 Menu Enabled!");
  367. MW2_Start();
  368. }
  369.  
  370. #endif
  371.  
  372. return 0;
  373. }
  374.  
  375.  
  376. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  377.  
  378.  
  379.  
  380. DWORD WINAPI BO3_Go(LPVOID lpParam)
  381. {
  382. #ifdef _INI_
  383. if (readerr.GetBoolean("menus", "BO3Menu", "true")) {
  384. *(int*)0x82201008 = 0x60000000;//NoSway TU8
  385. BO3_Start();
  386. }
  387. if (readerr.GetBoolean("bypasses", "BO3", "true")) {
  388. BO3_Bypass();
  389. }
  390. #endif
  391. return 0;
  392. }
  393.  
  394.  
  395. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  396.  
  397. LPCWSTR Buttons0[2] = { L"Modifications", L"Original Game"};
  398.  
  399. DWORD WINAPI BO2_go(LPVOID lpParam)
  400. {
  401. #ifdef _INI_
  402. if (readerr.GetBoolean("menus", "BO2Menu", "true")) {
  403. *(int*)0x82201008 = 0x60000000;//NoSway TU8
  404. BO2_Start();
  405. }
  406. #endif
  407. return 0;
  408. }
  409.  
  410. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  411.  
  412.  
  413. byte Responsee[] = {
  414. 0x46, 0x7C, 0x70, 0xB0, // IP Address [4 Bytes]
  415. 0xFC, 0x00, 0x00, 0x00, 0xE6, 0xA5, 0xDD, 0xD1, // Machine ID [8 Bytes]
  416. 0xF5, 0xD7, 0xDA, 0xF1, 0x46, 0x21, 0x01, 0x10, // MAC Address [8 Bytes]
  417. 0x00, 0x00, 0x00, 0x00, // ChallengePadding 0 (Read Memory @ func_849AF534(float))
  418. 0x00, 0x00, 0x00, 0x00, // ChallengePadding 1 (Read Memory @ func_849AF534 + 0x04(float))
  419. 0x08, 0x60, // ChallengePadding 2 (Read Memory @ func_84629B5C)
  420. 0x03, // RetailFlag 0x01 = Active | 0x02 = Clean Retail (What Makes it Not?) | 01 + 02 = 0x03 = Active + Clean
  421. 0x30, 0x31, 0x34, 0x32, 0x36, 0x31, 0x37, 0x39, 0x35, 0x32, 0x30, 0x37, 0x00, // Console Serial [12 Bytes]
  422. 0x30, 0x33, 0x32, 0x37, 0x35, 0x38, 0x31, 0x31, 0x33, 0x30, 0x35, 0x35, // Console ID
  423. 0x42, 0xFE // Unknown Padding
  424. };
  425.  
  426. LPCWSTR Buttons3[2] = { L"Modifications", L"Original Game"};
  427.  
  428. DWORD FindPattern(DWORD Address, DWORD Length, PCHAR pbMask)
  429. {
  430. DWORD szMaskl = std::strlen(pbMask);
  431. PCHAR szMask = "";
  432. for (DWORD i = 0; i < szMaskl/4;i++){
  433. szMask += 'X';
  434. }
  435. for(DWORD i = 0; i < Length; i++)
  436. {
  437. if(DataCompare((PBYTE)(Address + i), (PBYTE)pbMask, szMask) == TRUE)
  438. { return Address + i; }
  439. }
  440. return NULL;
  441. }
  442.  
  443. unsigned long ReturnXBDMHook(char* ModuleName) {
  444. if (strcmp(ModuleName, "xbdm.xex") == 0) {
  445. DbgPrint("Returned XBDM as 0");
  446. return 0;
  447. }
  448. else return (unsigned long)GetModuleHandle(ModuleName);
  449. }
  450.  
  451. inline DWORD GoldSpoofHook(DWORD dwUserIndex, XPRIVILEGE_TYPE PrivilegeType, PBOOL pfResult)
  452. {
  453. if (PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_COMMUNICATIONS_FRIENDS_ONLY
  454. || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PROFILE_VIEWING_FRIENDS_ONLY
  455. || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_USER_CREATED_CONTENT_FRIENDS_ONLY
  456. || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PRESENCE_FRIENDS_ONLY
  457. || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_VIDEO_COMMUNICATIONS_FRIENDS_ONLY)
  458. *pfResult = FALSE;
  459. else
  460. *pfResult = TRUE;
  461.  
  462. return 0;
  463. }
  464. DWORD WINAPI AW_go(LPVOID lpParam)
  465. {
  466.  
  467.  
  468. #ifdef _INI_
  469. if (readerr.GetBoolean("bypasses", "AW", "true")) {
  470.  
  471.  
  472. *(int*)0x82665268 = 0x60000000;
  473. *(int*)0x825889DC = 0x60000000;
  474. *(int*)0x825889E4 = 0x400;
  475. PatchModuleImport("default.xex", "xboxkrnl.exe", 405, (DWORD)ReturnXBDMHook);
  476. PatchModuleImport("default.xex", "xam.xex", 64, (DWORD)NetDll_XNetXnAddrToMachineIdHook);
  477. Sleep(2000);
  478. PatchInJump((PDWORD)(ResolveFunction("xam.xex", 0x195)), (DWORD)ReturnXBDMHook, false);
  479. }
  480.  
  481. if (readerr.GetBoolean("menus", "AWMenu", "true")) {
  482.  
  483. DoAWMenu();
  484. XNotifyUI(L"Beta Engine - AW Enabled!");
  485. }
  486.  
  487. #endif
  488.  
  489.  
  490.  
  491. return 0;
  492. }
  493.  
  494.  
  495.  
  496. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  497.  
  498.  
  499. LPCWSTR Buttons4[2] = { L"Modifications", L"Original Game"};
  500.  
  501. BYTE MW3_WH[] = { 0x42, 0x20, 0x00, 0x00 };
  502. BYTE MW3_BOXES[] = { 0x41, 0x9A, 0x00, 0x12 };
  503. BYTE MW3_UAV[] = { 0x3B, 0x80, 0x00, 0x01 };
  504. BYTE MW3_RECOIL[] = { 0x60, 0x00, 0x00, 0x00 };
  505. BYTE MW3_LASER[] = { 0x2F, 0x10, 0x00, 0x01 };
  506. BYTE MW3_CH[] = { 0x3B, 0x80, 0x00, 0x01 };
  507.  
  508. DWORD WINAPI MW3_Go(LPVOID lpParam)
  509. {
  510. #ifdef _INI_
  511. if (readerr.GetBoolean("menus", "MW3Menu", "true")) {
  512.  
  513.  
  514. // *(int*)0x82287ee0 = 0x60000000; //Force Host :P (since no gold spoof...)
  515. XNotifyUI(L"KushGaming Beta - MW3 Menu Enabled!");
  516. MW3_Start();
  517.  
  518. }
  519.  
  520. #endif
  521.  
  522. return 0;
  523. }
  524.  
  525.  
  526. //////////////////////////////////////////////////////////////////////////////////////////////
  527.  
  528.  
  529.  
  530. //////////////////////////////////////////////////////////////////////////////////////////////
  531.  
  532. DWORD WINAPI GTA5_go(LPVOID lpParam)
  533. {
  534. //#ifdef _INI_
  535. // if (readerr.GetBoolean("menus", "GTAVMenu", "true") == true) {
  536. // NativeDLL();
  537.  
  538. // XNotifyUI( L"KushGaming - GTAV Shit Enabled!");
  539. // }
  540.  
  541. //#endif
  542.  
  543. return 0;
  544.  
  545. }
  546. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  547.  
  548.  
  549. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  550.  
  551.  
  552.  
  553. LPCWSTR Buttons6[2] = { L"Modifications", L"Original Game"};
  554.  
  555. DWORD WINAPI COD5_Go(LPVOID lpParam)
  556. {
  557.  
  558. //*(int*)0x011c0bb7 = other; //GodMode
  559. *(int*)0x821A0BFC = 0x60000000;
  560. *(int*)0x8215C7E4 = 0x60000000;
  561. *(int*)0x821A00C0 = 0x60000000;
  562. *(int*)0x8214789C = 0x60000000;
  563. *(int*)0x8214804C = 0x60000000;
  564. *(int*)0x821548A4 = 0x3B800001;
  565. XNotifyUI(L"KushGaming Beta - WAW Shit Enabled!");
  566. return 0;
  567. }
  568.  
  569.  
  570. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  571.  
  572.  
  573. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  574.  
  575.  
  576. LPCWSTR Buttons7[2] = { L"Modifications", L"Original Game"};
  577.  
  578. DWORD WINAPI COD4_Go(LPVOID lpParam)
  579. {
  580.  
  581. *(int*)0x822EDAA0 = 0x60000000;
  582. *(int*)0x822ECE14 = 0x60000000;
  583. *(int*)0x82319514 = 0x60000000;
  584. *(int*)0x8233048C = 0x60000000;
  585. *(int*)0x8233169C = 0x60000000;
  586. *(int*)0x823225C8 = 0x3B400001;
  587. XNotifyUI(L"KushGaming Beta - COD4 Shit Enabled!");
  588. return 0;
  589. }
  590.  
  591.  
  592. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  593.  
  594.  
  595. LPCWSTR Buttons8[2] = { L"Modifications", L"Original Game"};
  596.  
  597. DWORD WINAPI BO1_Go(LPVOID lpParam)
  598. {
  599. #ifdef _INI_
  600. if (readerr.GetBoolean("menus", "BO1Menu", "true")) {
  601.  
  602. BO1_Start();
  603. XNotifyUI( L"KushGaming Beta - BO1 Menu Enabled!");
  604.  
  605. }
  606.  
  607. #endif
  608.  
  609. return 0;
  610. }
  611.  
  612.  
  613. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  614.  
  615.  
  616. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  617.  
  618. void Ghost(){
  619. *(PDWORD)0x8267680 = 0x4800;
  620. *(PDWORD)0x826276CC = 0x36800000;
  621. *(int*)0x826276E0 = 0x60000000;
  622. *(int*)0x826276D4 = 0x60000000;
  623. XNotifyUI(L"KushGaming Beta - Ghosts Shit Enabled!");
  624.  
  625. }
  626.  
  627.  
  628.  
  629.  
  630. VOID GHOSTS_RandomizeData(){
  631. srand(time(NULL));
  632. BYTE IPAddress[4], MachineID[8], abEnet[3], ConsoleSerialNumber[12], ConsoleID[12];
  633. for(int i = 0; i < 4; i++) { IPAddress[i] = rand() % 90; }
  634. for(int i = 0; i < 3; i++){ abEnet[i] = rand() % 90; }
  635. for(int i = 0; i < 8; i++) { MachineID[i] = rand() % 90; }
  636. for(int i = 0; i < 12; i++) { ConsoleSerialNumber[i] = rand() % 90; ConsoleID[i] = rand() % 90; }
  637. }
  638.  
  639. inline __declspec() INT answerChallenges(__int64 r3, __int64 r4, DWORD ChallengeResponse) {
  640. __asm {
  641. nop
  642. nop
  643. nop
  644. nop
  645. nop
  646. nop
  647. nop
  648. blr
  649. }
  650. }
  651.  
  652. void answerChallengesHook(__int64 r3, __int64 r4, DWORD ChallengeResponse){ // r3, r4, r5 --> ChallengeResponse is the third argument (r5).
  653. // Set our Random Data
  654. memcpy((PVOID)(ChallengeResponse + 0x1E), &Challenge, sizeof(Challenge));
  655. // return r3, r4 and r5
  656. answerChallenges(r3, r4, ChallengeResponse);
  657. }
  658.  
  659. inline __declspec() bool Live_GetConsoleDetailsSavestubGhost(bool alwaysTrue, unsigned char internalIP[4], unsigned char onlineIP[4], unsigned long long *machineIDH, unsigned long long *null, unsigned long long *enet)
  660. {
  661. __asm {
  662. nop
  663. nop
  664. nop
  665. nop
  666. nop
  667. nop
  668. nop
  669. blr
  670. }
  671. }
  672.  
  673. bool Live_GetConsoleDetailsHookGhost(bool alwaysTrue, unsigned char internalIP[4], unsigned char onlineIP[4], unsigned long long *machineIDH, unsigned long long *null, unsigned long long *enet) {
  674. srand(time(0));
  675. int iTargetAddress = 0;
  676. __asm mflr iTargetAddress
  677. if(iTargetAddress == 0X822EC08C || iTargetAddress == 0X822EB7C4) {
  678. for(int i = 0; i < 4; i++) {
  679. internalIP[i] = rand() % 0xFF; onlineIP[i] = rand() % 0xFF;
  680. }
  681. *enet = 0x001DD8000000 | rand() % 0x7FFFFF;
  682. return true;
  683. }
  684. return Live_GetConsoleDetailsSavestubGhost(alwaysTrue, internalIP,onlineIP,machineIDH,null,enet);
  685. }
  686.  
  687. LPCWSTR Buttons1[2] = { L"Modifications", L"Original Game"};
  688.  
  689. DWORD WINAPI Ghosts_Go(LPVOID lpParam){
  690. /*
  691. #ifdef _INI_
  692. if (readerr.GetBoolean("menus", "GHOSTMenu", "true")) {
  693.  
  694.  
  695.  
  696.  
  697. }
  698.  
  699. #endif*/
  700.  
  701. #ifdef _INI_
  702. if (readerr.GetBoolean("bypasses", "GHOSTS", "true")) {
  703.  
  704. GO_Start();
  705. Ghosts_Bypass();
  706. XNotifyUI(L"BETA Engine - Ghosts Enabled!");
  707. }
  708.  
  709. #endif
  710.  
  711.  
  712. return 0;
  713. }
  714.  
  715.  
  716. DWORD WINAPI BF4_go(LPVOID lpParam) {
  717.  
  718. *(int*)0x88C06B54 = 0x48000040;
  719. *(int*)0x88BE3500 = 0xED8701F2;
  720. *(int*)0x88BE3524 = 0x60000000;
  721. *(int*)0x8852C634 = 0x60000000;
  722. *(int*)0x8852C11C = 0x60000000;
  723. *(int*)0x886E7174 = 0x60000000;
  724. Sleep(1000);
  725. XNotifyUI(L"BETA - BF4 Cheats Enabled!");
  726.  
  727. return 0;
  728. }
  729.  
  730. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  731.  
  732. DWORD WINAPI DestinyLaunch_Go(LPVOID lpParam){
  733. //=========================================================
  734. Sleep(50);
  735. //=========================================================
  736. Sleep(50);
  737. //=========================================================
  738. *(DWORD*)0xD95A05AC = 0x00000001;
  739. *(DWORD*)0xD95A05AF = 0x00000001;
  740. *(DWORD*)0xD95A1488 = 0x00000001;
  741. *(DWORD*)0xD95B1988 = 0x00000001;
  742. *(DWORD*)0xD95A1487 = 0x00000001;
  743. //=========================================================
  744. Sleep(50);
  745. //=========================================================
  746. *(int*)0xD95A05AC = 1;
  747. *(int*)0xD95A05AF = 1;
  748. *(int*)0xD95A1488 = 1;
  749. *(int*)0xD95B1988 = 1;
  750. *(int*)0xD95A05AC = 1;
  751. *(int*)0xD95A1487 = 1;
  752. //=========================================================
  753. Sleep(50);
  754. //=========================================================
  755. for(;;){
  756. //=========================================================
  757. Sleep(20);
  758. //=========================================================
  759. *(DWORD*)0xD95A05AC = 0x00000001;
  760. *(DWORD*)0xD95A05AF = 0x00000001;
  761. *(DWORD*)0xD95A1488 = 0x00000001;
  762. *(DWORD*)0xD95B1988 = 0x00000001;
  763. *(DWORD*)0xD95A1487 = 0x00000001;
  764. //=========================================================
  765. Sleep(20);
  766. //=========================================================
  767. *(int*)0xD95A05AC = 1;
  768. *(int*)0xD95A05AF = 1;
  769. *(int*)0xD95A1488 = 1;
  770. *(int*)0xD95B1988 = 1;
  771. *(int*)0xD95A05AC = 1;
  772. *(int*)0xD95A1487 = 1;
  773. //=========================================================
  774. Sleep(20);
  775. //=========================================================
  776. for(DWORD i = 0xD95A0000; i < 0xD95AFFFF; i++){
  777. if(*(int*)i)
  778. if(*(int*)i == 0)
  779. *(int*)i = 1;
  780. Sleep(10);
  781. if(*(DWORD*)i)
  782. if(*(DWORD*)i == 0x00000000)
  783. *(DWORD*)i = 0x00000001;
  784. }
  785. //=========================================================
  786. Sleep(2);
  787. //=========================================================
  788. for(DWORD i = 0xD9500000; i < 0xD95FFFFF; i++){
  789. if(*(int*)i)
  790. if(*(int*)i == 0)
  791. *(int*)i = 1;
  792. Sleep(10);
  793. if(*(DWORD*)i)
  794. if(*(DWORD*)i == 0x00000000)
  795. *(DWORD*)i = 0x00000001;
  796. }
  797. //=========================================================
  798. Sleep(20);
  799. //=========================================================
  800. }
  801. return 0;
  802. }
  803.  
  804. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  805.  
  806. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  807.  
  808.  
  809. void patchGold()
  810. {
  811. DWORD XUCP = (DWORD)ResolveFunction("xam.xex", 0x212);
  812. DWORD XUCPP = (DWORD)ResolveFunction("xam.xex", 0x1C8);
  813. *(int*)(XUCPP + 0x16C) = 0x60000000;
  814. *(int*)(XUCP + 0x140) = 0x39600001;
  815. *(int*)(XUCP + 0x1A0) = 0x39600001;
  816. *(int*)(XUCP + 0x1AC) = 0x39600001;
  817. *(int*)(XUCP + 0x1B4) = 0x39600001;
  818. PatchInJump((PDWORD)(0x8169C5D8), (DWORD)XamLoaderExecuteAsyncChallengeHook);
  819. }
  820.  
  821.  
  822. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  823. DWORD WINAPI BF3_go(LPVOID lpParam) {
  824. *(int*)0x836FDAC8 = 0x60000000; // No Recoil
  825. *(int*)0x832291E0 = 0x60000000; // No Sway
  826. *(int*)0x83505268 = 0x60000000; // Name Tags
  827. *(int*)0x833E02A8 = 0x39600000; // Name Tags
  828. *(int*)0x835054C0 = 0x60000000; // Name Tags
  829. *(int*)0x835054FC = 0x4800003C; // Name Tags
  830. *(int*)0x831F7430 = 0x60000000; // Wall Hax
  831. *(int*)0x83505268 = 0x60000000; // Esp Hax
  832. *(int*)0x835054C0 = 0x60000000; // Esp Hax
  833. *(int*)0x835054FC = 0x4800003C; // Esp Hax
  834. *(int*)0x835056B0 = 0x4BD1FE59; // Esp Hax
  835. *(int*)0x83225508 = 0x7D8802A6; // Esp Hax
  836. *(int*)0x8322550C = 0x2F1C0002; // Esp Hax
  837. *(int*)0x83225510 = 0x41980010; // Esp Hax
  838. *(int*)0x83225514 = 0x3BE0005F; // Esp Hax
  839. *(int*)0x83225518 = 0x7D8803A6; // Esp Hax
  840. *(int*)0x8322551C = 0x4E000020; // Esp Hax
  841. *(int*)0x83225520 = 0x3BE00012; // Esp Hax
  842. *(int*)0x83225524 = 0x7D8803A6; // Esp Hax
  843. *(int*)0x83225528 = 0x4E000020; // Esp Hax
  844. *(int*)0x83504BB4 = 0x419A0010; // Esp Hax
  845. *(int*)0x836D7C60 = 0x60000000; // Max Damage
  846. *(int*)0x834FB424 = 0x39600001; // Enable UAV
  847. *(int*)0x834FB3D0 = 0x39600001; // Enable UAV
  848. *(int*)0x836D7C60 = 0x60000000; // 1 Hit Kill
  849. *(int*)0x836D7C34 = 0xED400032; // 1 Hit Kill
  850. *(int*)0x836D7C38 = 0xED200032; // 1 Hit Kill
  851. *(int*)0x83225534 = 0x7D8802A6; // Speed / Gravity Hax
  852. *(int*)0x83225538 = 0x2B0A0000; // Speed / Gravity Hax
  853. *(int*)0x8322553C = 0x419A0010; // Speed / Gravity Hax
  854. *(int*)0x83225540 = 0x8976011C; // Speed / Gravity Hax
  855. *(int*)0x83225544 = 0x7D8803A6; // Speed / Gravity Hax
  856. *(int*)0x83225548 = 0x4E000020; // Speed / Gravity Hax
  857. *(int*)0x8322554C = 0xC0090018; // Speed / Gravity Hax
  858. *(int*)0x83225550 = 0xC0290018; // Speed / Gravity Hax
  859. *(int*)0x83225554 = 0xEC210032; // Speed / Gravity Hax
  860. *(int*)0x83225558 = 0xEC210032; // Speed / Gravity Hax
  861. *(int*)0x8322555C = 0xEC210032; // Speed / Gravity Hax
  862. *(int*)0x83225560 = 0xEC210032; // Speed / Gravity Hax
  863. *(int*)0x83225564 = 0xD0290088; // Speed / Gravity Hax
  864. *(int*)0x83225568 = 0x100019C3; // Speed / Gravity Hax
  865. *(int*)0x83225570 = 0x100019C3; // Speed / Gravity Hax
  866. *(int*)0x83225574 = 0x8976011C; // Speed / Gravity Hax
  867. *(int*)0x83225578 = 0x7D8803A6; // Speed / Gravity Hax
  868. *(int*)0x8322557C = 0x4E000020; // Speed / Gravity Hax
  869. *(int*)0x832241B0 = 0xFC007890; // Speed / Gravity Hax
  870. *(int*)0x8328B1E8 = 0x4BF9A34D; // Speed / Gravity Hax
  871. *(int*)0x83504994 = 0x60000000; // Name Above Player
  872. *(int*)0x835049A8 = 0x60000000; // Name Above Player
  873. *(int*)0x835049B8 = 0x60000000; // Name Above Player
  874. *(int*)0x83504938 = 0x60000000; // Name Above Player
  875. *(int*)0x83504944 = 0x60000000; // Name Above Player
  876. Sleep(1000); // No Freeze
  877. XNotifyUI(L"KushGaming BETA - BF3 Cheats Enabled!");
  878.  
  879. return 0;
  880. }
  881.  
  882. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  883.  
  884. VOID InitializeTitleSpecificHooks(PLDR_DATA_TABLE_ENTRY ModuleHandle)
  885. {
  886.  
  887. PatchModuleImport(ModuleHandle, NAME_KERNEL, 407, (DWORD)XexGetProcedureAddressHook);
  888.  
  889. PatchInJump((PDWORD)(ResolveFunction(MODULE_XAM, 0x212)), (DWORD)GoldSpoofHook, false);
  890.  
  891. PatchModuleImport(ModuleHandle, NAME_KERNEL, 408, (DWORD)XexLoadExecutableHook);
  892.  
  893. PatchModuleImport(ModuleHandle, NAME_KERNEL, 409, (DWORD)XexLoadImageHook);
  894.  
  895. PatchModuleImport(ModuleHandle, NAME_XAM, 401, (DWORD)XamInputGetStateHook);
  896.  
  897. XEX_EXECUTION_ID* pExecutionId = (XEX_EXECUTION_ID*)RtlImageXexHeaderField(ModuleHandle->XexHeaderBase, 0x00040006);
  898.  
  899. if (pExecutionId == 0) return;
  900.  
  901. bool test = 0;
  902.  
  903. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  904.  
  905. if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"dash.xex") == 0 || wcscmp(ModuleHandle->BaseDllName.Buffer, L"xshell.xex") == 0 || pExecutionId->TitleID == FREESTYLEDASH)
  906. {
  907. dashLoaded = TRUE;
  908. lastTitleID = pExecutionId->TitleID;
  909. test = 0;
  910.  
  911.  
  912.  
  913. patchGold();
  914.  
  915. }
  916.  
  917. else {
  918.  
  919. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  920.  
  921.  
  922. if (pExecutionId->TitleID == BO2)
  923. {
  924. // HookFunctionStart((PDWORD)LiveStats_Probation_GiveProbation, (PDWORD)LiveStats_Probation_GiveProbationSaveStub, (DWORD)LiveStats_Probation_GiveProbationHook);
  925. if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default_mp.xex") == 0)
  926. {
  927. #ifdef _INI_
  928.  
  929. if (readerr.GetBoolean("bypasses", "BO2", "true")) {
  930. BYTE Data[] = { 0x60, 0x00, 0x00, 0x00 };
  931. memcpy((BYTE*)0x8259A65C, Data, 4); // Disable challenge log check
  932. memcpy((BYTE*)0x82497EB0, Data, 4); // Disable call to protections
  933. memcpy((BYTE*)0x82497F30, Data, 4); // Cheat
  934. memcpy((BYTE*)0x82497EE0, Data, 4); // Write
  935. }
  936.  
  937. #endif
  938. HANDLE hThread;
  939. DWORD threadId;
  940. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BO2_go, NULL, 0x2 | CREATE_SUSPENDED);
  941. XSetThreadProcessor(hThread, 4);
  942. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  943. ResumeThread(hThread);
  944. CloseHandle(hThread);
  945.  
  946. //XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty BO2", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nRedboxes= ON!\nNo Recoil= ON!\nUAV= ON!\nLaser= OFF!\nWallhack= OFF!", 2, Buttons0, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  947. //if(g_mb_result.dwButtonPressed == 0) {
  948. // *(int*)0x821f5b7c = 0x38600001; //Redboxes
  949. // *(int*)0x82259BC8 = 0x38600001; //No Recoil
  950. // *(int*)0x821B8FD0 = 0x2b110001; //UAV
  951. // *(int*)0x82255E1C = 0x2b110001; //Laser
  952. // //*(int*)0x829052FC = other; //Wallhack
  953. // XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, XNOTIFYUI_PRIORITY_HIGH, L"Black Ops 2 - Modifications Enabled!", NULL);
  954. //}
  955. }
  956. else if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default.xex") == 0)
  957. {
  958. PatchInJump((PDWORD)0x82844820, (DWORD)XNetXnAddrToMachineIdHookBO2, false);//TU18 Machine ID From XeX
  959. BYTE Data[] = { 0x60, 0x00, 0x00, 0x00 };
  960. SetMemory((PVOID*)0x824A7620, Data, 4); //Bypass xD
  961. SetMemory((PVOID*)0x8248FA60, Data, 4); // Disable challenge log check
  962. SetMemory((PVOID*)0x823B9B00, Data, 4); // Disable call to protections
  963. SetMemory((PVOID*)0x823B99D4, Data, 4); // Cheat
  964. SetMemory((PVOID*)0x823B99A0, Data, 4); // Write
  965. SetMemory((PVOID*)0x823B9988, Data, 4); // Read
  966. XNotifyUI(L"Black Ops 2 Zombies - Bypass Enabled!");
  967. }
  968. }
  969.  
  970. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  971. #ifdef _INI_
  972.  
  973. if (readerr.GetBoolean("settings", "AutoSpoofMSP", "true")) {
  974.  
  975.  
  976. #pragma region Guide Menu
  977. if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"Guide.MP.Purchase.xex") == 0) {
  978. MSPSpoof();
  979. }
  980. }
  981. #endif
  982. #ifdef _INI_
  983. if (readerr.GetBoolean("settings", "DisableCustomHUD", "false")) {
  984.  
  985. if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"hud.xex") == 0 && !IsDevkit)
  986. {
  987. //Spoofing();
  988.  
  989. //HUD_PatchLabels();
  990. InitializeHudHooks(ModuleHandle);
  991.  
  992. }
  993.  
  994. }
  995.  
  996. #endif
  997.  
  998.  
  999. #pragma endregion
  1000.  
  1001. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1002.  
  1003.  
  1004. if (pExecutionId->TitleID == MW2)
  1005. {
  1006. HANDLE hThread;
  1007. DWORD threadId;
  1008. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, MW2_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1009. XSetThreadProcessor(hThread, 4);
  1010. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1011. ResumeThread(hThread);
  1012. CloseHandle(hThread);
  1013. /*MESSAGEBOX_RESULT g_mb_result;
  1014. XOVERLAPPED g_xol;
  1015. LPCWSTR Buttons5[2] = { L"Modifications", L"Original Game"};*/
  1016. //XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty MW2", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nNo Recoil= ON!\nLazer= ON!\nUAV= ON!\nRedbox= ON!", 2, Buttons5, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  1017. //while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1018. //if(g_mb_result.dwButtonPressed == 0) {
  1019. // *(int*)0x8212F6A0 = other; //lazer
  1020. // *(int*)0x82135BE3 = other; //No Recoil
  1021. // *(int*)2182017324u = other; //UAV
  1022. // *(int*)2182038068u = other; //Redbox
  1023. // XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"KushGaming - MW2 Mods Enabled!", NULL);
  1024. //}
  1025. }
  1026.  
  1027. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1028. if (pExecutionId->TitleID == BF4) {
  1029. HANDLE hThread;
  1030. DWORD threadId;
  1031. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BF4_go, NULL, 0x2 | CREATE_SUSPENDED);
  1032. XSetThreadProcessor(hThread, 4);
  1033. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1034. ResumeThread(hThread);
  1035. CloseHandle(hThread);
  1036. }
  1037.  
  1038. if (pExecutionId->TitleID == BF3) {
  1039. HANDLE hThread;
  1040. DWORD threadId;
  1041. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BF3_go, NULL, 0x2 | CREATE_SUSPENDED);
  1042. XSetThreadProcessor(hThread, 4);
  1043. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1044. ResumeThread(hThread);
  1045. CloseHandle(hThread);
  1046. }
  1047.  
  1048. if (pExecutionId->TitleID == AW)
  1049. {
  1050. if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default.xex") == 0)
  1051. {
  1052.  
  1053. HANDLE hThread;
  1054. DWORD threadId;
  1055. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, AW_go, NULL, 0x2 | CREATE_SUSPENDED);
  1056. XSetThreadProcessor(hThread, 4);
  1057. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1058. ResumeThread(hThread);
  1059. CloseHandle(hThread);
  1060.  
  1061. }
  1062. /* else if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default.xex") == 0)
  1063. {
  1064. HANDLE hThread;
  1065. DWORD threadId;
  1066. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, AW_go, NULL, 0x2 | CREATE_SUSPENDED);
  1067. XSetThreadProcessor(hThread, 4);
  1068. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1069. ResumeThread(hThread);
  1070. CloseHandle(hThread);
  1071.  
  1072. }*/
  1073. }
  1074.  
  1075. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1076.  
  1077.  
  1078. DWORD rflag = 0x39200003;
  1079. QWORD dnop = 0x6000000060000000;
  1080. if (pExecutionId->TitleID == GHOSTS)
  1081. {
  1082.  
  1083. HANDLE hThread;
  1084. DWORD threadId;
  1085. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, Ghosts_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1086. XSetThreadProcessor(hThread, 4);
  1087. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1088. ResumeThread(hThread);
  1089. CloseHandle(hThread);
  1090.  
  1091. //XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty Ghost", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nRedbox= ON!\nNo Recoil= ON!\nLazer= ON!\nUAV= ON!", 2, Buttons1, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  1092. //while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1093. //if(g_mb_result.dwButtonPressed == 0) {
  1094. // *(int*)0x8226D2B4 = nop; //RedBox
  1095. // *(int*)0x822C9344 = nop; //No Recoil
  1096. // *(int*)0x8227F198 = other; //Lazer
  1097. // *(int*)0x8226539B = other; //UAV1
  1098. // *(int*)0x82265793 = other; //UAV2
  1099. // *(int*)0x822657FF = other; //UAV3
  1100. // XNotifyQueueUI(XNOTIFYUI_TYPE_GENERIC, 0, 2, L"Ghosts - Modifications Enabled!", 0);
  1101. //}
  1102. }
  1103.  
  1104. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1105.  
  1106.  
  1107. if (pExecutionId->TitleID == DESTINY)
  1108. {
  1109. HANDLE hThread;
  1110. DWORD threadId;
  1111. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, (LPTHREAD_START_ROUTINE)DestinyLaunch_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1112. XSetThreadProcessor(hThread, 4);
  1113. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1114. ResumeThread(hThread);
  1115. }
  1116.  
  1117. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1118.  
  1119. // if (pExecutionId->TitleID == GTAV)
  1120. // {
  1121.  
  1122.  
  1123.  
  1124. // }
  1125.  
  1126.  
  1127.  
  1128. if (pExecutionId->TitleID == MW3)
  1129. {
  1130.  
  1131. HANDLE hThread;
  1132. DWORD threadId;
  1133. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, MW3_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1134. XSetThreadProcessor(hThread, 4);
  1135. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1136. ResumeThread(hThread);
  1137. CloseHandle(hThread);
  1138.  
  1139.  
  1140.  
  1141. }
  1142.  
  1143. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1144.  
  1145.  
  1146. if (pExecutionId->TitleID == WAW)
  1147. {
  1148. /*MESSAGEBOX_RESULT g_mb_result;
  1149. XOVERLAPPED g_xol;
  1150. LPCWSTR Buttons6[2] = { L"Modifications", L"Original Game"};*/
  1151. //COD5 Public Cheater Thread
  1152. HANDLE hThread;
  1153. DWORD threadId;
  1154. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, COD5_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1155. XSetThreadProcessor(hThread, 4);
  1156. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1157. ResumeThread(hThread);
  1158. CloseHandle(hThread);
  1159. //while(XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty WAW", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nGodMode= ON!\n", 2, Buttons6, 0, XMB_ALERTICON, &g_mb_result, &g_xol) == ERROR_ACCESS_DENIED) Sleep(500);
  1160. //while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1161. //if(g_mb_result.dwButtonPressed == 0) {
  1162. //*(int*)0x011c0bb7 = other; //GodMode
  1163. //XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"KushGaming - WAW Mods Enabled!", NULL);
  1164. //}
  1165. }
  1166.  
  1167. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1168.  
  1169.  
  1170. if (pExecutionId->TitleID == MW1)
  1171. {
  1172. /*MESSAGEBOX_RESULT g_mb_result;
  1173. XOVERLAPPED g_xol;
  1174. LPCWSTR Buttons7[2] = { L"Modifications", L"Original Game"};*/
  1175. //COD4 Public Cheater Thread
  1176. HANDLE hThread;
  1177. DWORD threadId;
  1178. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, COD4_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1179. XSetThreadProcessor(hThread, 4);
  1180. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1181. ResumeThread(hThread);
  1182. CloseHandle(hThread);
  1183. /*XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty COD4", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\n", 2, Buttons7, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  1184. while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1185. if(g_mb_result.dwButtonPressed == 0) {
  1186. XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"KushGaming - COD4 Mods Enabled!", NULL);
  1187. }*/
  1188. }
  1189.  
  1190. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1191.  
  1192.  
  1193. if (pExecutionId->TitleID == BO1)
  1194. {
  1195. /*MESSAGEBOX_RESULT g_mb_result;
  1196. XOVERLAPPED g_xol;
  1197. LPCWSTR Buttons8[2] = { L"Modifications", L"Original Game"};*/
  1198. //BO1 Public Cheater Thread
  1199. HANDLE hThread;
  1200. DWORD threadId;
  1201. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BO1_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1202. XSetThreadProcessor(hThread, 4);
  1203. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1204. ResumeThread(hThread);
  1205. CloseHandle(hThread);
  1206. //XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty BO1", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nRedbox= ON!\nBlackbird= ON!\n", 2, Buttons8, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  1207. //while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1208. //if(g_mb_result.dwButtonPressed == 0) {
  1209. // *(int*)2182775199u = other; //Redbox
  1210. // *(int*)2182980139u = other; //Blackbird
  1211. //XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"KushGaming - Black Ops 1 Mods Enabled!", NULL);
  1212. //}
  1213. }
  1214.  
  1215.  
  1216. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1217.  
  1218.  
  1219. if (pExecutionId->TitleID == BO3)
  1220. {
  1221. /*MESSAGEBOX_RESULT g_mb_result;
  1222. XOVERLAPPED g_xol;
  1223. LPCWSTR Buttons8[2] = { L"Modifications", L"Original Game"};*/
  1224. //BO1 Public Cheater Thread
  1225. HANDLE hThread;
  1226. DWORD threadId;
  1227. ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BO3_Go, NULL, 0x2 | CREATE_SUSPENDED);
  1228. XSetThreadProcessor(hThread, 4);
  1229. SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  1230. ResumeThread(hThread);
  1231. CloseHandle(hThread);
  1232. //XShowMessageBoxUI(XUSER_INDEX_ANY, L"KushGaming - Call Of Duty BO1", L"KushGaming Mods -\nPlease Select A Cheat Option\n\nModifications\n----------------\nRedbox= ON!\nBlackbird= ON!\n", 2, Buttons8, 0, XMB_ALERTICON, &g_mb_result, &g_xol);
  1233. //while(!XHasOverlappedIoCompleted(&g_xol)) Sleep(500);
  1234. //if(g_mb_result.dwButtonPressed == 0) {
  1235. // *(int*)2182775199u = other; //Redbox
  1236. // *(int*)2182980139u = other; //Blackbird
  1237. //XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"KushGaming - Black Ops 1 Mods Enabled!", NULL);
  1238. //}
  1239. }
  1240.  
  1241. ////////////////////////////////////////////////////////////////////////////////////////////////////////////
  1242. lastTitleID = pExecutionId->TitleID;
  1243. }
  1244. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!