NINJA XOSC

//NINJA XOSC

typedef struct _XOSC {
    DWORD                   dwResult;                     // 0x00-0x04
    BYTE                    Unknown1[0x4];                // 0x04-0x08
    QWORD                   qwOperations;                 // 0x08-0x10
    BYTE                    Unknown2[0x8];                // 0x10-0x18
    DWORD                   dwExecutionResult;            // 0x18-0x1C
    BYTE                    Unknown3[0x1C];               // 0x1C-0x38
    XEX_EXECUTION_ID        xexExecutionId;               // 0x38-0x50
    BYTE                    bCpuKeyHash[0x10];            // 0x50-0x60
    BYTE                    bKvHash[0x10];                // 0x60-0x70
    BYTE                    Unknown4[0x13];               // 0x70-0x83
    BYTE                    bKvDrivePhaseLevel;           // 0x83-0x84
    QWORD                   qwXampOddMediaStuff;          // 0x84-0x8C
    BYTE                    Unknown5[0x64];               // 0x8C-0xF0
    BYTE                    bKvDriveData1[0x24];          // 0xF0-0x114
    BYTE                    bKvDriveData2[0x24];          // 0x114-0x138
    BYTE                    bSerialNumber[0xC];           // 0x138-0x144
    WORD                    wUnknown1;                    // 0x144-0x146
    WORD                    wXamBldrBase;                 // 0x146-0x148
    WORD                    wXamRegion;                   // 0x148-0x14A
    WORD                    wXamOdd;                      // 0x14A-0x14C
    BYTE                    stuff6[0xC];                  // 0x14C-0x158
    DWORD                   dwXamBaseFlag;                // 0x158-0x15C
    BYTE                    Unknown7[0x3C];               // 0x15C-0x198
    QWORD                   qwHvProtectedFlags;           // 0x198-0x1A0
    BYTE                    bConsoleID[0x5];              // 0x1A0-0x1A5
    BYTE                    Unknown8[0xB3];               // 0x1A5-0x258
    DWORD                   dwFooterMagic;                // 0x2D8-0x2DC
    DWORD                   dwUnknown9;                   // 0x2DC-0x2E0
    BYTE                    Unknown9[0x120];              // 0x2E0-0x400
} XOSC, *pXOSC;

EXTERN_C DWORD ExecuteXOSC(DWORD r3, BYTE * r4, DWORD r5, XOSC * data, DWORD size)
{
        //Null buffer
        ZeroMemory(data, size);

        //Alloc the buffer
        data = (XOSC*)XPhysicalAlloc(size, MAXULONG_PTR, NULL, PAGE_READWRITE);

        //XOSC
        QWORD HvProtectedFlags = *((QWORD *)0x8E038678);
        QWORD FinalHvProtectedFlags = 4 | (((QWORD)HvProtectedFlags & 1) == 1 ? 1 : 0);
        DWORD ExecutionResult; XEX_EXECUTION_ID ExecutionId; XEX_EXECUTION_ID * pExecutionId;

        if ((ExecutionResult = (DWORD)XamGetExecutionId(&pExecutionId)) == S_OK) {
                memcpy(&ExecutionId, pExecutionId, sizeof(XEX_EXECUTION_ID));
                //Spoof title id here
        }

        //Write data
        data->dwExecutionResult = 0;
        data->xexExecutionId = ExecutionId;
        data->qwXampOddMediaStuff = 0;
        data->wXamBldrBase = 0xD83E;
        data->dwXamBaseFlag = 0x2389D3;
        data->qwHvProtectedFlags = FinalHvProtectedFlags;
        data->dwFooterMagic = 0x5F534750;
        memcpy(&data->bKvDrivePhaseLevel, (kvData + 0xCB9), 1);
        memcpy(&data->wXamRegion, (kvData + 0xC8), 2);
        memcpy(&data->wXamOdd, (kvData + 0x1C), 2);
        memcpy(data->bSerialNumber, (kvData + 0xB0), 0xC);
        memcpy(data->bConsoleID, (BYTE *)(kvData + 0x9CA), 5);
        memcpy(data->bKvDriveData1, (BYTE*)(kvData + 0xC8A), 0x24);
        memcpy(data->bKvDriveData2, (BYTE*)(kvData + 0xC8A), 0x24);
        XeCryptSha(CPUKey, 0x20, 0, 0, 0, 0, data->bCpuKeyHash, 0x14);
        if (XamLoaderIsTitleTerminatePending()) data->qwOperations |= 0x4000000000000000;
        if (XamTaskShouldExit()) data->qwOperations |= 0x2000000000000000;

        //Free XOSC buffer
        XPhysicalFree(data);

        //Notify the client
        Notify(L"XOSC Spoofed!");


        return ERROR_SUCCESS;