COD4/WAW RPC [C#]

      #region CallFunction

            static uint function_address;

            public static int Init()
            {
                function_address = Get_func_address();
                if (function_address == 0) return -1;
                Enable_RPC();
                return 0;
            }

            public static uint Get_func_address()
            {
                for (uint i = 0x32F1FC; i < 0x1000000; i += 4)
                {
                    byte[] bytes = Ghosts.GetMemory(i, 8);
                    if (((bytes[0] == 0xF8) && (bytes[1] == 0x01) && (bytes[2] == 0x1F) && (bytes[3] == 0x38) && (bytes[4] == 0x4B) && (bytes[5] == 0xFF) && (bytes[6] == 0xF1) && (bytes[7] == 0xB8)))
                    {
                        return i + 0xC;
                    }
                }
                return 0;
            }

            public static void Enable_RPC()
            {
                /*

                 Here is the PPC function that gets written into memory, at the address of the fog function

                    stdu      r1, -0x70(r1)
                    mflr      r0
                    std       r0, 0x80(r1)
                    lis       r3, 0x1005
                    lwz       r12, 0x4C(r3)
                    cmpwi     r12, 0
                    beq       0x64   #local return
                    lwz       r4, 4(r3)
                    lwz       r5, 8(r3)
                    lwz       r6, 0xC(r3)
                    lwz       r7, 0x10(r3)
                    lwz       r8, 0x14(r3)
                    lwz       r9, 0x18(r3)
                    lwz       r10, 0x1C(r3)
                    lwz       r11, 0x20(r3)
                    lfs       f1, 0x24(r3)
                    lfs       f2, 0x28(r3)
                    lfs       f3, 0x2C(r3)
                    lfs       f4, 0x30(r3)
                    lfs       f5, 0x34(r3)
                    lfs       f6, 0x38(r3)
                    lfs       f7, 0x3C(r3)
                    lfs       f8, 0x40(r3)
                    lfs       f9, 0x48(r3)
                    lwz       r3, 0(r3)
                    mtctr     r12
                    bctrl
                    lis       r4, 0x1005
                    li        r5, 0
                    stw       r5, 0x4C(r4)
                    lwz       r3, 0x50(r4)
                    ld        r0, arg_80(r1)    #here's what the local return branch goes to
                    mtlr      r0
                    addi      r1, r1, 0x70
                    blr

                */

                Lib.SetMemory(function_address, new byte[] { 0x4E, 0x80, 0x00, 0x20 });
                System.Threading.Thread.Sleep(20);
                byte[] func = new byte[] { 0x7C, 0x08, 0x02, 0xA6, 0xF8, 0x01, 0x00, 0x80, 0x3C, 0x60, 0x50, 0x05, 0x81, 0x83, 0x00, 0x4C, 0x2C, 0x0C, 0x00, 0x00, 0x41, 0x82, 0x00, 0x64, 0x80, 0x83, 0x00, 0x04, 0x80, 0xA3, 0x00, 0x08, 0x80, 0xC3, 0x00, 0x0C, 0x80, 0xE3, 0x00, 0x10, 0x81, 0x03, 0x00, 0x14, 0x81, 0x23, 0x00, 0x18, 0x81, 0x43, 0x00, 0x1C, 0x81, 0x63, 0x00, 0x20, 0xC0, 0x23, 0x00, 0x24, 0xC0, 0x43, 0x00, 0x28, 0xC0, 0x63, 0x00, 0x2C, 0xC0, 0x83, 0x00, 0x30, 0xC0, 0xA3, 0x00, 0x34, 0xC0, 0xC3, 0x00, 0x38, 0xC0, 0xE3, 0x00, 0x3C, 0xC1, 0x03, 0x00, 0x40, 0xC1, 0x23, 0x00, 0x48, 0x80, 0x63, 0x00, 0x00, 0x7D, 0x89, 0x03, 0xA6, 0x4E, 0x80, 0x04, 0x21, 0x3C, 0x80, 0x50, 0x05, 0x38, 0xA0, 0x00, 0x00, 0x90, 0xA4, 0x00, 0x4C, 0x80, 0x64, 0x00, 0x50, 0xE8, 0x01, 0x00, 0x80, 0x7C, 0x08, 0x03, 0xA6, 0x38, 0x21, 0x00, 0x70, 0x4E, 0x80, 0x00, 0x20 };
                Lib.SetMemory(function_address + 0x4, func);
                Lib.SetMemory(0x50050000, new byte[0x2854]);
                Lib.SetMemory(function_address, new byte[] { 0xF8, 0x21, 0xFF, 0x91 });
            }

            public static int Call(uint func_address, params object[] parameters)
            {
                int num_params = parameters.Length;
                uint num_floats = 0;
                for (uint i = 0; i < num_params; i++)
                {
                    if (parameters[i] is int)
                    {
                        byte[] val = BitConverter.GetBytes((int)parameters[i]);
                        Array.Reverse(val);
                        Lib.SetMemory(0x50050000 + (i + num_floats) * 4, val);
                    }
                    else if (parameters[i] is uint)
                    {
                        byte[] val = BitConverter.GetBytes((uint)parameters[i]);
                        Array.Reverse(val);
                        Lib.SetMemory(0x50050000 + (i + num_floats) * 4, val);
                    }
                    else if (parameters[i] is string)
                    {
                        byte[] str = Encoding.UTF8.GetBytes(Convert.ToString(parameters[i]) + "\0");
                        Lib.SetMemory(0x50050054 + i * 0x400, str);
                        uint addr = 0x50050054 + i * 0x400;
                        byte[] address = BitConverter.GetBytes(addr);
                        Array.Reverse(address);
                        Lib.SetMemory(0x50050000 + (i + num_floats) * 4, address);
                    }
                    else if (parameters[i] is float)
                    {
                        num_floats++;
                        byte[] val = BitConverter.GetBytes((float)parameters[i]);
                        Array.Reverse(val);
                        Lib.SetMemory(0x50050024 + ((num_floats - 1) * 0x4), val);
                    }
                }
                byte[] fadd = BitConverter.GetBytes(func_address);
                Array.Reverse(fadd);
                Lib.SetMemory(0x5005004C, fadd);
                System.Threading.Thread.Sleep(20);
                byte[] ret = Ghosts.GetMemory(0x50050050, 4);
                Array.Reverse(ret);
                return BitConverter.ToInt32(ret, 0);
            }
            #endregion
            public static class Protection
            {
                public static uint write_protection = 0x1D61F8;
                public static uint cheat_protection = 0x1D61F0;
                public static class Write
                {
                    public static void On()
                    {
                        byte[] Write = new byte[] { 0x60, 0x00, 0x00, 0x00 };
                        Lib.SetMemory(write_protection , Write);
                    }
                    public static void Off()
                    {
                        byte[] Default = new byte[] { 0x40, 0x9E, 0x02, 0xA8 };
                        Lib.SetMemory(write_protection , Default);
                    }
                }
                public static class Cheat
                {
                    public static void On()
                    {
                        byte[] Write = new byte[] { 0x60, 0x00, 0x00, 0x00 };
                        Lib.SetMemory(cheat_protection , Write);
                    }
                    public static void Off()
                    {
                        byte[] Default = new byte[] { 0x55, 0x40, 0x06, 0xF6 };
                        Lib.SetMemory(cheat_protection , Default);
                    }
                }
            }
            //RPC.Init();
            //Protection.Write.On();
            //Protection.Cheat.On();
            //http://www.mediafire.com/download/3r5cb9bspvdfp5d/Modern+Warfare+And+Waw+STATE+CLIENTS.rar - Full with WaW RPC