llBeastModell

BO3 Ban Bypass

Nov 5th, 2015
4,043
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 5.05 KB | None | 0 0
  1. //BO3 Bypass By: OvaKill
  2. #ifndef _BO3_BYPASS_DEFINES_H
  3. #define _BO3_BYPASS_DEFINES_H
  4.  
  5. #include "stdafx.h"
  6. #include "Vec.h"
  7. #include <time.h>
  8.  
  9. BYTE IPAddress[4], ConsoleSerial[12], ConsoleIndex[12];
  10. BYTE MachineId[] = { 0xFA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
  11. BYTE Enet[] = { 0x00, 0x1D, 0xD8, 0x00, 0x00, 0x00 };
  12.  
  13. byte Response[] =
  14. {
  15.     0x46, 0x7C, 0x70, 0xB0,                                                         // IP Address [4 Bytes]
  16.     0xFC, 0x00, 0x00, 0x00, 0xE6, 0xA5, 0xDD, 0xD1,                                 // Machine ID [8 Bytes]
  17.     0xF5, 0xD7, 0xDA, 0xF1, 0x46, 0x21, 0x01, 0x10,                                 // MAC Address [8 Bytes]
  18.     0x00, 0x00, 0x00, 0x00,                                                         // ChallengePadding 0 (Read Memory @ func_849AF534(float))
  19.     0x00, 0x00, 0x00, 0x00,                                                         // ChallengePadding 1 (Read Memory @ func_849AF534 + 0x04(float))
  20.     0x08, 0x60,                                                                     // ChallengePadding 2 (Read Memory @ func_84629B5C)
  21.     0x03,                                                                           // RetailFlag 0x01 = Active | 0x02 = Clean Retail (What Makes it Not?) | 01 + 02 = 0x03 = Active + Clean
  22.     0x30, 0x31, 0x34, 0x32, 0x36, 0x31, 0x37, 0x39, 0x35, 0x32, 0x30, 0x37, 0x00,   // Console Serial [12 Bytes]
  23.     0x30, 0x33, 0x32, 0x37, 0x35, 0x38, 0x31, 0x31, 0x33, 0x30, 0x35, 0x35,         // Console ID
  24.     0x42, 0xFE                                                                      // Unknown Padding
  25. };
  26. typedef struct _BO3_ChallengeResponse
  27. {
  28.     unsigned char abOnlineIP[4];//0x00-0x04
  29.     unsigned long long qwMachineId;//0x04-0xC
  30.     unsigned long long qwEnet;//0xC-0x14
  31.     float fRegionLatitude;//0x14-0x18
  32.     float fRegionLongtitude;//0x18-0x1C
  33.     short shFreeAmount;//0x1C-0x1E
  34.     unsigned char bSecurityFlag;//0x1E-0x1F
  35.     char szConsoleSerial[0xD];//0x1F-0x2C
  36.     char szConsoleId[0xC];//0x2C-0x38
  37.     char szConsoleRetail[0x3];//0x01+0x02 = 0x03
  38.     short shKernalVersion;//0x38-0x3A
  39.     WORD Padding1;
  40.     QWORD UnknownVector2;
  41.     WORD UnknownShort;
  42.     BYTE Padding2;
  43. } BO3_ChallengeResponse, *pBO3_ChallengeResponse;
  44.  
  45. typedef enum BO3_ChallengeFlag : BYTE
  46. {
  47.     ACTIVE = 1,
  48.     VALID = 2,
  49.     INVALIDPRIVILEGE = 8,
  50.     XBDM = 16,
  51. } BO3_ChallengeFlag;
  52. typedef enum _BO3_RenderFlag : BYTE
  53. {
  54.     HIGHLIGHT_RED = 18,
  55.     HIGHLIGHT_HOT = 20,
  56.     HIGHLIGHT_GREEN = 22,
  57.     HIGHLIGHT_CYAN = 24,
  58.     HIGHLIGHT_ORANGE = 26,
  59.     HIGHLIGHT_YELLOW = 28,
  60.     HIGHLIGHT_BLUE = 30,
  61. } BO3_RenderFlag;
  62.  
  63. int XNetXnAddrToMachineIdHookDASH(XNCALLER_TYPE xnc, XNADDR  pxnaddr, unsigned long long MachineId)
  64. {
  65.     srand((unsigned int)time(0));
  66.     MachineId = 0xFA00000000000000 | (0x2000000 | rand() % 0x7FFFFF);
  67.     *(__int64*)0x8232BE18 = 0x386000014E800020; //BO3 bypass hash
  68.     return 0;
  69. }
  70.  
  71.  
  72. inline __declspec() int answerChallenges(int r3, int r4, int r5)
  73. {
  74.     __asm
  75.     {
  76.         nop
  77.             nop
  78.             nop
  79.             nop
  80.             nop
  81.             nop
  82.             nop
  83.             blr
  84.     }
  85. }
  86.  
  87. void randomize()
  88. {
  89.     BYTE IPAddress[4], MachineId[8], Enet[8], ConsoleKey[13], ConsoleIndex[12], padding0[2], padding1[8];
  90.     for (int i = 0; i < 2; i++)IPAddress[i] = rand() % 90;
  91.     for (int i = 0; i < 2; i++)MachineId[i] = rand() % 90;
  92.     for (int i = 0; i < 1; i++)Enet[i] = rand() % 90;
  93.     for (int i = 0; i < 3; i++)ConsoleIndex[i] = rand() % 90;
  94.     for (int i = 0; i < 3; i++)ConsoleKey[i] = rand() % 90;
  95.     for (int i = 0; i < 2; i++)padding0[i] = rand() % 90;
  96.     for (int i = 0; i < 8; i++)padding1[i] = rand() % 90;
  97.     memcpy(Response + 0x2, &IPAddress, 2);
  98.     memcpy(Response + 0x6, &MachineId, 2);
  99.     memcpy(Response + 0x10, &Enet, 1);
  100.     memcpy(Response + 0x29, &ConsoleKey, 3);
  101.     memcpy(Response + 0x33, &ConsoleIndex, 3);
  102.     memcpy(Response + 0x1C, &padding0, 2);
  103.     memcpy(Response + 0x14, &padding1, 8);
  104. }
  105.  
  106. void RandomizeData()
  107. {
  108.     srand((unsigned int)time(0));
  109.     for (int i = 0; i < 4; i++) IPAddress[i] = rand() % 90;
  110.     for (int i = 0; i < 8; i++) MachineId[i] = rand() % 90;
  111.     for (int i = 0; i < 6; i++) Enet[i] = rand() % 90;
  112.     for (int i = 0; i < 12; i++){
  113.         ConsoleSerial[i] = rand() % 90;
  114.         ConsoleIndex[i] = rand() % 90;
  115.     }
  116. }
  117. inline DWORD GoldSpoofHook(DWORD dwUserIndex, XPRIVILEGE_TYPE PrivilegeType, PBOOL pfResult)
  118. {
  119.     if (PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_COMMUNICATIONS_FRIENDS_ONLY
  120.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PROFILE_VIEWING_FRIENDS_ONLY
  121.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_USER_CREATED_CONTENT_FRIENDS_ONLY
  122.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_PRESENCE_FRIENDS_ONLY
  123.         || PrivilegeType == XPRIVILEGE_TYPE::XPRIVILEGE_VIDEO_COMMUNICATIONS_FRIENDS_ONLY)
  124.         *pfResult = FALSE;
  125.     else
  126.         *pfResult = TRUE;
  127.  
  128.     return 0;
  129. }
  130.  
  131. unsigned long XeXGetModuleHandleHook(char* ModuleName)
  132. {
  133.     if (strcmp(ModuleName, "xbdm.xex") == 0)
  134.         return 0;
  135. }
  136.  
  137. int XNetXnAddrToMachineIdHook(XNCALLER_TYPE xnc, XNADDR  pxnaddr, unsigned long long MachineId)
  138. {
  139.     srand((unsigned int)time(0));
  140.     MachineId = 0xFA00000000000000 | (0x2000000 | rand() % 0x7FFFFF);
  141.     return 0;
  142. }
  143. unsigned long XeKeysGetKeyHook(unsigned short key, unsigned char* buffer, PDWORD len) //
  144. {
  145.     if (key == 0x14)
  146.     {
  147.         srand((unsigned int)time(0));
  148.         for (int i = 0x00; i < 0xC; i++) buffer[i] = rand() % 0x7F;
  149.         return 0L;
  150.     }
  151.     return XeKeysGetKey(key, buffer, len);
  152. }
  153.  
  154. long XeKeysGetConsoleIDHook(unsigned char* buffer, int Unknown)
  155. {
  156.     srand((unsigned int)time(0));
  157.     for (int i = 0x00; i < 0xC; i++) buffer[i] = rand() % 0x7F;
  158.     return 0;
  159. }
  160. #endif
Advertisement
Add Comment
Please, Sign In to add comment