API tools faq
paste
llBeastModell

titlehook.cpp

llBeastModell
Nov 23rd, 2015
932
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 13.65 KB | None | 0 0
raw download clone embed print report
  1. #include "stdafx.h"
  2.  
  3. #pragma region Externs & Includes
  4. extern HANDLE hXam;
  5. extern BOOL isPlatinum;
  6. extern BOOL isBypassed;
  7. extern BOOL IsDevkit;
  8. extern BOOL dashLoaded;
  9. extern BOOL mspSpoofEnabled;
  10. extern const int spPatchSz;
  11. extern const int mpPatchSz;
  12. extern const int awmpPatchSz;
  13. extern const int ghostmpPatchSz;
  14. extern const int awspPatchSz;
  15. extern const int bypassDataSize;
  16. extern BYTE spAddress[];
  17. extern BYTE mpAddress[];
  18. extern BYTE awmpAddress[];
  19. extern BYTE ghostsAddress[];
  20. extern BYTE awspAddress[];
  21. HANDLE thread;
  22. DWORD threadID;
  23. static BOOL isFrozen = FALSE;
  24. static DWORD lastTitleID = 0;
  25. typedef unsigned __int64 QWORD;
  26.  
  27. // defines message box sterf
  28.  
  29.  
  30. #define XNOTIFY
  31.  
  32.  
  33.  
  34. extern DWORD ApplyPatches(CHAR* FilePath, const VOID* DefaultPatches = NULL);
  35. extern void printBytes(PBYTE bytes, DWORD len);
  36.  
  37.  
  38.  
  39. VOID __cdecl APCWorker(void* Arg1, void* Arg2, void* Arg3) {
  40.  
  41.     // Call our completion routine if we have one
  42.     if (Arg2)
  43.         ((LPOVERLAPPED_COMPLETION_ROUTINE)Arg2)((DWORD)Arg3, 0, (LPOVERLAPPED)Arg1);
  44. }
  45.  
  46. DWORD XSecurityCreateProcessHook(DWORD dwHardwareThread)
  47. {
  48.     return ERROR_SUCCESS;
  49. }
  50. VOID XSecurityCloseProcessHook(){}
  51.  
  52. DWORD XSecurityVerifyHook(DWORD dwMilliseconds, LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) {
  53.  
  54.     // Queue our completion routine
  55.     if (lpCompletionRoutine)
  56.         NtQueueApcThread((HANDLE)-2, (PIO_APC_ROUTINE)APCWorker, lpOverlapped, (PIO_STATUS_BLOCK)lpCompletionRoutine, 0);
  57.  
  58.     // All done
  59.     return ERROR_SUCCESS;
  60. }
  61. DWORD XSecurityGetFailureInfoHook(PXSECURITY_FAILURE_INFORMATION pFailureInformation)
  62. {
  63.     if (pFailureInformation->dwSize != 0x18) return ERROR_NOT_ENOUGH_MEMORY;
  64.     pFailureInformation->dwBlocksChecked = 0;
  65.     pFailureInformation->dwFailedReads = 0;
  66.     pFailureInformation->dwFailedHashes = 0;
  67.     pFailureInformation->dwTotalBlocks = 0;
  68.     pFailureInformation->fComplete = TRUE;
  69.     return ERROR_SUCCESS;
  70. }
  71.  
  72. DWORD XexGetProcedureAddressHook(HANDLE hand, DWORD dwOrdinal, PVOID* pvAddress)
  73. {
  74.     if (hand == hXam) {
  75.         switch (dwOrdinal) {
  76.         case 0x9BB:
  77.             *pvAddress = XSecurityCreateProcessHook;
  78.             return 0;
  79.         case 0x9BC:
  80.             *pvAddress = XSecurityCloseProcessHook;
  81.             return 0;
  82.         case 0x9BD:
  83.             *pvAddress = XSecurityVerifyHook;
  84.             return 0;
  85.         case 0x9BE:
  86.             *pvAddress = XSecurityGetFailureInfoHook;
  87.             return 0;
  88.         }
  89.     }
  90.     //DbgPrint("XexGetProcedureAddressHook [pvAddress]: 0x%p", pvAddress);
  91.     return XexGetProcedureAddress(hand, dwOrdinal, pvAddress);
  92. }
  93.  
  94. NTSTATUS XeKeysGetKeyHookBO2(WORD KeyId, PVOID KeyBuffer, PDWORD keyLength){
  95.     if (KeyId == 0x14){
  96.         XUSER_SIGNIN_INFO userInfo;
  97.         XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  98.  
  99.         BYTE gamertagSha[0x10];
  100.         XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  101.         BYTE temp = 0;
  102.         for (int i = 0; i<0xC; i++){
  103.             temp = (gamertagSha[i] & 0xE) + '0';
  104.             SetMemory(&((BYTE*)(KeyBuffer))[i], &temp, 1);
  105.         }
  106.     }
  107.     else return XeKeysGetKey(KeyId, KeyBuffer, keyLength);
  108.     return ERROR_SUCCESS;
  109. }
  110.  
  111. HRESULT XeKeysGetConsoleIDHookBO2(PBYTE databuffer OPTIONAL, char* szBuffer OPTIONAL) {
  112.  
  113.     XE_CONSOLE_ID consoleID;
  114.     XeKeysGetConsoleID((PBYTE)&consoleID, NULL);
  115.  
  116.     XUSER_SIGNIN_INFO userInfo;
  117.     XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  118.  
  119.     BYTE gamertagSha[0x10];
  120.     XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  121.     consoleID.asBits.MacIndex3 = gamertagSha[0];
  122.     consoleID.asBits.MacIndex4 = gamertagSha[1];
  123.     consoleID.asBits.MacIndex5 = gamertagSha[2];
  124.  
  125.     SetMemory(databuffer, &consoleID, 0x5);
  126.     return ERROR_SUCCESS;
  127. }
  128.  
  129. int NetDll_XNetXnAddrToMachineIdHookBO2(XNCALLER_TYPE xnc, XNADDR * pxnaddr, ULONGLONG * pqwMachineId){
  130.  
  131.     int rett = NetDll_XNetXnAddrToMachineId(xnc, pxnaddr, pqwMachineId);
  132.  
  133.     XUSER_SIGNIN_INFO userInfo;
  134.     XamUserGetSigninInfo(0, XUSER_GET_SIGNIN_INFO_ONLINE_XUID_ONLY, &userInfo);
  135.  
  136.     BYTE gamertagSha[0x10];
  137.     XeCryptSha((PBYTE)userInfo.szUserName, strlen(userInfo.szUserName), NULL, NULL, NULL, NULL, gamertagSha, 0x10);
  138.     SetMemory(pqwMachineId + 5, gamertagSha, 0x3);
  139.  
  140.     return rett;
  141. }
  142.  
  143. typedef HRESULT(*pXamInputGetState)(QWORD r3, QWORD r4, QWORD r5);
  144. pXamInputGetState XamInputGetState = (pXamInputGetState)ResolveFunction(NAME_XAM, 401);
  145.  
  146. HRESULT XamInputGetStateHook(QWORD r3, QWORD r4, QWORD r5){
  147.     if (isFrozen){
  148.         return 0;
  149.     }
  150.     HRESULT ret = XamInputGetState(r3, r4, r5);
  151.     return ret;
  152. }
  153.  
  154.  
  155. DWORD WINAPI MW2_Go(LPVOID lpParam)
  156. {
  157.     *(byte *)0x82104093 = 1; //TU8 -> Modern Warfare 2
  158.     *(byte *)0x820F4233 = 1; //TU8 -> Modern Warfare 2
  159.     *(byte *)0x82135BE3 = 0; //TU8 -> Modern Warfare 2
  160.     //*(float*)0x82000858 = 999; //TU8 -> Modern Warfare 2
  161.     *(byte*)0x82104093 = 1; //TU8 -> Modern Warfare 2
  162.     (0, "set g_compassshowenemies 1;set activeaction \"g_compassshowenemies 1;scr_game_forceuav 1;set activeaction \\\"g_compassshowenemies 1;scr_game_forceuav 1;set activeaction g_compassshowenemies 1\\\"\"");
  163.     return 0;
  164. }
  165. BYTE MW3_WH[] = { 0x42, 0x20, 0x00, 0x00 };
  166. BYTE MW3_BOXES[] = { 0x41, 0x9A, 0x00, 0x12 };
  167. BYTE MW3_UAV[] = { 0x3B, 0x80, 0x00, 0x01 };
  168. BYTE MW3_RECOIL[] = { 0x60, 0x00, 0x00, 0x00 };
  169. BYTE MW3_LASER[] = { 0x2F, 0x10, 0x00, 0x01 };
  170. BYTE MW3_CH[] = { 0x3B, 0x80, 0x00, 0x01 };
  171. DWORD WINAPI MW3_Go(LPVOID lpParam)
  172. {
  173.     *(int*)0x82001B7C = 0x42200000;
  174.     *(int*)0x821154A4 = 0x60000000;
  175.     *(int*)0x8210E58C = 0x3B800001;
  176.     *(int*)0x821614D4 = 0x60000000;
  177.     *(int*)0x8215A2C0 = 0x2F100001;
  178.     return 0;
  179. }
  180.  
  181. DWORD WINAPI COD5_Go(LPVOID lpParam)
  182. {
  183.     *(int*)0x821A0BFC = 0x60000000;
  184.     *(int*)0x8215C7E4 = 0x60000000;
  185.     *(int*)0x821A00C0 = 0x60000000;
  186.     *(int*)0x8214789C = 0x60000000;
  187.     *(int*)0x8214804C = 0x60000000;
  188.     *(int*)0x821548A4 = 0x3B800001;
  189.     return 0;
  190. }
  191. DWORD WINAPI COD4_Go(LPVOID lpParam)
  192. {
  193.     *(int*)0x822EDAA0 = 0x60000000;
  194.     *(int*)0x822ECE14 = 0x60000000;
  195.     *(int*)0x82319514 = 0x60000000;
  196.     *(int*)0x8233048C = 0x60000000;
  197.     *(int*)0x8233169C = 0x60000000;
  198.     *(int*)0x823225C8 = 0x3B400001;
  199.     return 0;
  200. }
  201. DWORD WINAPI BO1_Go(LPVOID lpParam)
  202. {
  203.     *(int*)0x82227624 = 0x60000000;
  204.     *(int*)0x8232786C = 0x60000000;
  205.     *(int*)0x821B7C04 = 0x60000000;
  206.     *(int*)0x82195200 = 0x60000000;
  207.     *(int*)0x82195D1C = 0x60000000;
  208.     *(int*)0x821A819C = 0x2B0B0001;
  209.     return 0;
  210. }
  211.  
  212. void Ghost(){
  213.     *(PDWORD)0x8267680 = 0x4800;
  214.     *(PDWORD)0x826276CC = 0x36800000;
  215.     *(int*)0x826276E0 = 0x60000000;
  216.     *(int*)0x826276D4 = 0x60000000;
  217.     XNotifyUI(L"Ghosts - Bypass Online [tu17]!");
  218. }
  219.  
  220. VOID GHOSTS_RandomizeData(){
  221.     srand(time(NULL));
  222.  
  223.     BYTE IPAddress[4], MachineID[8], abEnet[3], ConsoleSerialNumber[12], ConsoleID[12];
  224.  
  225.     for (int i = 0; i < 4; i++) { IPAddress[i] = rand() % 90; }
  226.     for (int i = 0; i < 3; i++){ abEnet[i] = rand() % 90; }
  227.     for (int i = 0; i < 8; i++) { MachineID[i] = rand() % 90; }
  228.     for (int i = 0; i < 12; i++) { ConsoleSerialNumber[i] = rand() % 90; ConsoleID[i] = rand() % 90; }
  229. }
  230. inline DWORD GoldSpoofHook(DWORD dwUserIndex, XPRIVILEGE_TYPE PrivilegeType, PBOOL pfResult)
  231. {
  232.     if (PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_COMMUNICATIONS_FRIENDS_ONLY
  233.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PROFILE_VIEWING_FRIENDS_ONLY
  234.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_USER_CREATED_CONTENT_FRIENDS_ONLY
  235.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PRESENCE_FRIENDS_ONLY
  236.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_VIDEO_COMMUNICATIONS_FRIENDS_ONLY)
  237.         *pfResult = FALSE;
  238.     else
  239.         *pfResult = TRUE;
  240.  
  241.     return 0;
  242. }
  243.  
  244. unsigned long XeXGetModuleHandleHook(char* ModuleName)
  245. {
  246.     if (strcmp(ModuleName, "xbdm.xex") == 0)
  247.         return 0;
  248. }
  249.  
  250. int XNetXnAddrToMachineIdHook(XNCALLER_TYPE xnc, XNADDR  pxnaddr, unsigned long long MachineId)
  251. {
  252.     srand((unsigned int)time(0));
  253.     MachineId = 0xFA00000000000000 | (0x2000000 | rand() % 0x7FFFFF);
  254.     return 0;
  255. }
  256. unsigned long XeKeysGetKeyHook(unsigned short key, unsigned char* buffer, PDWORD len) //
  257. {
  258.     if (key == 0x14)
  259.     {
  260.         srand((unsigned int)time(0));
  261.         for (int i = 0x00; i < 0xC; i++) buffer[i] = rand() % 0x7F;
  262.         return 0L;
  263.     }
  264.     return XeKeysGetKey(key, buffer, len);
  265. }
  266.  
  267. long XeKeysGetConsoleIDHook(unsigned char* buffer, int Unknown) //81A74FE4
  268. {
  269.     srand((unsigned int)time(0));
  270.     for (int i = 0x00; i < 0xC; i++) buffer[i] = rand() % 0x7F;
  271.     return 0;
  272. }
  273.  
  274.  
  275. VOID InitializeTitleSpecificHooks(PLDR_DATA_TABLE_ENTRY ModuleHandle)
  276. {
  277.     PatchModuleImport(ModuleHandle, NAME_KERNEL, 407, (DWORD)XexGetProcedureAddressHook);
  278.  
  279.     PatchModuleImport(ModuleHandle, NAME_KERNEL, 408, (DWORD)XexLoadExecutableHook);
  280.  
  281.     PatchModuleImport(ModuleHandle, NAME_KERNEL, 409, (DWORD)XexLoadImageHook);
  282.  
  283.     PatchModuleImport(ModuleHandle, NAME_XAM, 401, (DWORD)XamInputGetStateHook);
  284.  
  285.     XEX_EXECUTION_ID* pExecutionId = (XEX_EXECUTION_ID*)RtlImageXexHeaderField(ModuleHandle->XexHeaderBase, 0x00040006);
  286.  
  287.     if (pExecutionId == 0) return;
  288.  
  289.     bool test = 0;
  290.     if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"dash.xex") == 0 || wcscmp(ModuleHandle->BaseDllName.Buffer, L"xshell.xex") == 0 || wcscmp(ModuleHandle->BaseDllName.Buffer, L"KVSpoofer.xex") == 0 || pExecutionId->TitleID == FREESTYLEDASH){
  291.         dashLoaded = TRUE;
  292.         lastTitleID = pExecutionId->TitleID;
  293.         test = 0;
  294.     }
  295.     else {
  296.  
  297.         if (pExecutionId->TitleID == COD_BLACK_OPS_2 && pExecutionId->Version == 0x00001202)
  298.         {
  299.             if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default_mp.xex") == 0)
  300.             {
  301.                 Sleep(500);
  302.                 (int*)0x8259A65C, 0x60000000; // Disable challenge log check
  303.                 (int*)0x82497EB0, 0x60000000; // Disable call to protections
  304.                 (int*)0x82497F30, 0x60000000; // Cheat
  305.                 (int*)0x82497EE0, 0x60000000; // Write
  306.                 (int*)0x82497EC8, 0x60000000; // Read
  307.                 (int*)0x82599680, 0x60000000; // Ban 1
  308.                 (int*)0x82599670, 0x60000000; // Ban 2
  309.                 (int*)0x82599628, 0x60000000; // Ban 3
  310.                 (int*)0x8259964C, 0x60000000; // Ban 4
  311.                 (int*)0x825996AC, 0x60000000; // Ban Checks
  312.                 (int*)0x825996B4, 0x60000000; // Console Checks
  313.                 (int*)0x82599644, 0x60000000; // XUID Check
  314.                 (int*)0x8259964C, 0x60000000; // Other
  315.                 (int*)0x82599630, 0x60000000; // New
  316.                 *(int*)0x824E0DEC = 0x3940331C; //New
  317.                 *(int*)0x82409118 = 0x3900331C; //This is Single Player
  318.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, XNOTIFYUI_PRIORITY_HIGH, L"Black Ops 2 - Challenges Spoofed!", NULL);
  319.             }
  320.         }
  321.         if (pExecutionId->TitleID == COD_GHOSTS)
  322.         {
  323.             Sleep(1000);
  324.             if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default_mp.xex") == 0){
  325.             //if (wcscmp(ModuleHandle->BaseDllName.Buffer, L"default.xex") == 0){
  326.                 PatchInJump((PDWORD)(ResolveFunction("xam.xex", 0x212)), (DWORD)GoldSpoofHook, false);
  327.                 PatchInJump((PDWORD)(ResolveFunction("xam.xex", 0x195)), (DWORD)XeXGetModuleHandleHook, false);
  328.                 //HookFunctionStart((PDWORD)0x827BE888, (PDWORD)answerChallenges, (DWORD)GhostsBypassHook);
  329.                 //HookFunctionStart((PDWORD)0x82591688, (PDWORD)Live_GetConsoleDetailsSavestubGHOST, (DWORD)Live_GetConsoleDetailsHookGHOST);
  330.                 //PatchInJump((PDWORD)0x8173DFA8, (DWORD)XNetXnAddrToMachineIdHook, false);
  331.                 PatchInJump((PDWORD)0x81A74DB4, (DWORD)XeKeysGetKeyHook, false); //XAM
  332.                 PatchInJump((PDWORD)0x81A74FE4, (DWORD)XeKeysGetConsoleIDHook, false); //XAM
  333.                 Ghost();
  334.                 GHOSTS_RandomizeData();
  335.             }
  336.         }
  337.         lastTitleID = pExecutionId->TitleID;
  338.  
  339.         if (pExecutionId->TitleID == COD_MW3)
  340.         {
  341.                 //MW3 Public Cheater Thread
  342.                 HANDLE hThread;
  343.                 DWORD threadId;
  344.                 ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, MW3_Go, NULL, 0x2 | CREATE_SUSPENDED);
  345.                 XSetThreadProcessor(hThread, 4);
  346.                 SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  347.                 ResumeThread(hThread);
  348.                 CloseHandle(hThread);
  349.                 //Notify Client About Success!
  350.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"[XBLBypass] - MW3 Mods Enabled!", NULL);
  351.         }
  352.         if (pExecutionId->TitleID == COD_5)
  353.         {
  354.                 //COD5 Public Cheater Thread
  355.                 HANDLE hThread;
  356.                 DWORD threadId;
  357.                 ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, COD5_Go, NULL, 0x2 | CREATE_SUSPENDED);
  358.                 XSetThreadProcessor(hThread, 4);
  359.                 SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  360.                 ResumeThread(hThread);
  361.                 CloseHandle(hThread);
  362.                 //Notify Client About Success!
  363.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"[XBLBypass] - COD 5 Mods Enabled!", NULL);
  364.         }
  365.         if (pExecutionId->TitleID == COD_4)
  366.         {
  367.                 //COD4 Public Cheater Thread
  368.                 HANDLE hThread;
  369.                 DWORD threadId;
  370.                 ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, COD4_Go, NULL, 0x2 | CREATE_SUSPENDED);
  371.                 XSetThreadProcessor(hThread, 4);
  372.                 SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  373.                 ResumeThread(hThread);
  374.                 CloseHandle(hThread);
  375.  
  376.                 //Notify Client About Success!
  377.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"[XBLBypass] - COD 4 Mods Enabled!", NULL);
  378.         }
  379.         if (pExecutionId->TitleID == COD_BO1)
  380.         {
  381.  
  382.                 //BO1 Public Cheater Thread
  383.                 HANDLE hThread;
  384.                 DWORD threadId;
  385.                 ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, BO1_Go, NULL, 0x2 | CREATE_SUSPENDED);
  386.                 XSetThreadProcessor(hThread, 4);
  387.                 SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  388.                 ResumeThread(hThread);
  389.                 CloseHandle(hThread);
  390.  
  391.                 //Notify Client About Success!
  392.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"[XBLBypass] - Black Ops 1 Mods Enabled!", NULL);
  393.         }
  394.         if (pExecutionId->TitleID == COD_MW2)
  395.         {
  396.             //BO1 Public Cheater Thread
  397.                 HANDLE hThread;
  398.                 DWORD threadId;
  399.                 ExCreateThread(&hThread, 0, &threadId, (VOID*)XapiThreadStartup, MW2_Go, NULL, 0x2 | CREATE_SUSPENDED);
  400.                 XSetThreadProcessor(hThread, 4);
  401.                 SetThreadPriority(hThread, THREAD_PRIORITY_HIGHEST);
  402.                 ResumeThread(hThread);
  403.                 CloseHandle(hThread);
  404.  
  405.                 //Notify Client About Success!
  406.                 XNotifyQueueUI(XNOTIFYUI_TYPE_COMPLAINT, 0, 2, L"[XBLBypass] - MW2 Mods Enabled!", NULL);
  407.         }
  408.     }
  409. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!