SystemHooks.cpp

No on#include "stdafx.h"
#include "SystemHooks.h"
#include "Utilities.h"
#include "TitleSpecificHooks.h"
#include "SECRETNiNJACONFIGFILES.h"
#include "XamChallengeResponse.h"
#include "Xosc.h"
#include "Xam.h"
#include "ServComm.h"
#include <string>
#include <stdio.h>
#include <bitset>
#include "KeyVault.h"

/**
 * SystemHook.cpp
 * @author ZZ9 x iCaLZz
 * @description System Hooks - KV Same as NiNJA
 * @date 06/02/2016 23:17 LONDON TIME
 */

int msgDisplayed = 0;
extern BYTE cpuKeyDigest[];
extern BYTE hvRandomData[];
BYTE HvECCDigest[20];
extern BYTE seshKey[];
extern BYTE cpuKeySpoofedHash[XECRYPT_SHA_DIGEST_SIZE];
extern HANDLE hXeLinx;
extern BOOL IsDevkit;
extern DWORD dwUpdateSequence;
extern BOOL crl;
extern BOOL fcrt;
BYTE DriveLevel;
BYTE DriveData[0x24];
BYTE ConsoleID[5];
WORD xam_region, xam_odd;
BYTE XOSC_CPUKEY[0x10];
BYTE bCpuKeyHash[0x10];
BYTE XOSC_KVHASH[0x14];
BYTE Buffer[0x14];
BYTE ConsoleKey[0x10];
BYTE r6[0x2E0];
BYTE MediaShit[] = { 0x04 };
BYTE * bCPUKey;
DWORD bCPUKeySize;
BYTE bKV[0x4000];
BYTE XoscHash[0x10];
BYTE VoidBuff[0x10];    // r1 + 0x60;
BYTE VoidBuff2[0x10];   // r1 + 0x70;
BYTE VoidBuff3[0x10];   // r1 + 0x80;
UINT32 ModuleResult = 0;  // r1 + 0x54;
QWORD Temp11 = 0;
BYTE input[0x10] = { 0 };
BYTE output[0x10] = { 0 };
QWORD Temp8 = 0;
QWORD Temp7 = 0;
QWORD Temp3 = 0;
QWORD Temp4 = 0;
QWORD Temp9 = 0;
QWORD Temp28 = 0;
QWORD Temp29 = 0;
QWORD Temp30 = 0;
QWORD Temp10 = 0;
BOOL XOSC_CRL = FALSE;
BOOL XOSC_FCRT = FALSE;
BOOL XOSC_KV1 = FALSE;
extern BOOL fcrt;
extern BOOL type1KV;
extern BOOL ZZ9StealthInit;
extern wchar_t challengeNotify[XSTL_BUFFER_CHALLENGENOTIFYLEN];
extern HANDLE dllHandle;
extern HANDLE hXam;
bool didnotify = false;
MESSAGEBOX_RESULT result;
XOVERLAPPED overlapped;
XEX_EXECUTION_ID xeExecutionIdSpoof;
XEX_EXECUTION_ID XamLoaderID;
BYTE XeKeysCPU[0x10];
BYTE SecCleanHash[] = { 0x21 };


EXTERN_C DWORD ExecuteSpoofedSupervisorChallenge(DWORD dwTaskParam1, BYTE* pbDaeTableName, DWORD cbDaeTableName, XOSC* pBuffer, DWORD cbBuffer) {
    return 0;
}

typedef DWORD(*XEKEYSEXECUTE)(BYTE* chalData, DWORD size, BYTE* HVSalt, UINT64 krnlBuild, UINT64 r7, UINT64 r8);
QWORD SpoofXamChallenge(BYTE* pBuffer, DWORD dwFileSize, BYTE* Salt, QWORD Input2, QWORD Input3, QWORD Input4) {
    return NiNJA_SPOOFXAMCHALLENGEJNHGWOJQEWIFEqweqwjqnfijkweqnfwe();
}

VOID HalSendSMCMessageHook(LPVOID pCommandBuffer, LPVOID pRecvBuffer) {
    NiNJA_HALSHETINGHISTEANBQHIKFW();
}

QWORD XeKeysExecuteHook(VOID* pBuffer, DWORD dwFileSize, QWORD Input1, QWORD Input2, QWORD Input3, QWORD Input4) {
    return XBLSNiNJABULLSHITSpoofXamChallenge((BYTE*)pBuffer, dwFileSize, (BYTE*)Input1, Input2, Input3, Input4);
}

VOID* RtlImageXexHeaderFieldHook(VOID* headerBase, DWORD imageKey) {
    return JUSTANOTHERTNiNJAFUCKINGVALUETHING(headerBase, imageKey);
}

typedef DWORD(*ExecuteSupervisorChallenge_t)(DWORD dwTaskParam1, PBYTE pbDaeTableName, DWORD szDaeTableName, PBYTE pbBuffer, DWORD cbBuffer);
DWORD XamLoaderExecuteAsyncChallengeHook(DWORD ExecuteSupervisorChallengeAddress, DWORD dwTaskParam1, PBYTE pbDaeTableName, DWORD cbDaeTableName, PBYTE pbBuffer, DWORD cbBuffer) {
    return NiNJASFUCKINGAWESOMEXAMHOOKSTHATYOUWILLNEVERKNOWABOUT();
}

NTSTATUS XexLoadImageHook(LPCSTR szXexName, DWORD dwModuleTypeFlags, DWORD dwMinimumVersion, PHANDLE pHandle) {
    return NiNJASXexLoadImageHook(szXexName, dwModuleTypeFlags, dwMinimumVersion, pHandle);
}

NTSTATUS XexLoadExecutableHook(PCHAR szXexName, PHANDLE pHandle, DWORD dwModuleTypeFlags, DWORD dwMinimumVersion) {
    return NiNJASXexLoadExecutableHook(szXexName, pHandle, dwModuleTypeFlags, dwMinimumVersion);
}

BOOL XexCheckExecutablePrivilegeHook(DWORD priv) {
    return NiNJASXexCheckExecutablePrivilegeHook(priv);
}

void patchXamQosHang() {
    NiNJASpatchXamQosHang();
}

VOID __declspec(naked) NetDll_XnpSaveMachineAccountSaveVar(VOID) {
    NiNJASNetDll_XnpSaveMachineAccountSaveVar();
}

typedef HRESULT(*pNetDll_XnpSaveMachineAccount)(DWORD xamDebugLvl, PBYTE machineAcct);
pNetDll_XnpSaveMachineAccount NetDll_XnpSaveMachineAccount = (pNetDll_XnpSaveMachineAccount)NetDll_XnpSaveMachineAccountSaveVar;
static DWORD NetDll_XnpSaveMachineAccountOld[4];

HRESULT NetDll_XnpSaveMachineAccountHook(DWORD xamDebugLvl, PBYTE machineAcct) {
    return NiNJASNetDll_XnpSaveMachineAccountHook(xamDebugLvl, machineAcct);
}

typedef VOID(*myWprintf)(PWCHAR _Dest, INT64 _Count, const PWCHAR _Format, ...);
typedef VOID(*XAMBUILDRESOURCELOCATOR)(HANDLE hModule, PWCHAR wModuleName, PWCHAR const cdModule, HMODULE hdRes, ULONG ddSize);
VOID XamBuildXamResourceLocatorhook(PWCHAR const cModule, HMODULE hRes, ULONG dSize) {
    NiNJASXamBuildXamResourceLocatorhook(cModule, hRes, dSize);
}

HRESULT InitializeXamBuildResourceHook() {
    return NiNJASInitializeXamBuildResourceHook();
}


BOOL InitializeSystemXexHooks() {
    return STARTNiNJASECRETXEXHOOKS();
}

BOOL InitializeSystemHooks() {
    return STARTNiNJASECRETHOOKS();
}