bool bStoredOpened = 1;
HRESULT MSPSPoof() {
switch (bStoredOpened)
{
case 0: {
//Patch 1
BYTE PATCH_XAM[0x30] = {
0x00, 0x00, 0x00, 0x07,
0x7D, 0x88, 0x02, 0xA6,
0x48, 0x0C, 0xE0, 0xB5,
0x94, 0x21, 0xFE, 0xE0,
0x3F, 0xC0, 0x81, 0x5F,
0x7C, 0x7C, 0x1B, 0x78,
0x3F, 0xA0, 0x80, 0x00,
0x3F, 0xE0, 0x81, 0x5F,
0x81, 0xAF, 0x91, 0xD4,
0x00, 0x00, 0x00, 0x01,
0x3B, 0x2B, 0x5B, 0x80,
0xFF, 0xFF, 0xFF, 0xFF
};
//Patch 2
BYTE xampatch2[0x1C] = {
0x38, 0x80, 0x00, 0x05,
0x80, 0x63, 0x00, 0x1C,
0x90, 0x83, 0x00, 0x04,
0x38, 0x80, 0x01, 0x90,/*0x0190 = $400*/
0x90, 0x83, 0x00, 0x08,
0x38, 0x60, 0x00, 0x00,
0x4E, 0x80, 0x00, 0x20
};
memcpy((PVOID)0x8173F678, PATCH_XAM, 0x30); // xam.xex 17559
memcpy((PVOID)0x8168A6F8, xampatch2, 0x1C); // xam.xex 17559
*(DWORD*)(0x818E9BD8) = 0x60000000; // xam.xex 17559
*(DWORD*)(0x818EE414) = 0x480000C8; // xam.xex 17559
*(DWORD*)(0x818EA928) = 0x480000F4; // xam.xex 17559
*(DWORD*)(0x818E78B0) = 0x39600010; // xam.xex 17559
//Patch 3
*(DWORD*)(0x9015D8F4) = 0x48000034; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D908) = 0x48000020; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D840) = 0x38600000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x90155928) = 0x38600000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x901569CC) = 0x38600000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D834) = 0x38600000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015E064) = 0x38600000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D868) = 0x60000000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D860) = 0x60000000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D924) = 0x60000000; // Guide.MP.Purchase.xex 17559
*(DWORD*)(0x9015D900) = 0x60000000; // Guide.MP.Purchase.xex 17559
bStoredOpened = 1;
break;
}
case 1: {
BYTE UnPatchXam[0x20] = {
0x00, 0x00, 0x00, 0x07,
0x7D, 0x88, 0x02, 0xA6,
0x48, 0x0A, 0x2C, 0xBD,
0x94, 0x21, 0xFF, 0x50,
0x3F, 0xC0, 0x80, 0x00,
0x7C, 0x7F, 0x1B, 0x78,
0x3B, 0x40, 0x00, 0x02,
0x63, 0xDE, 0x40, 0x05,
};
BYTE UnPatchXam2[0x1C] = {
0x38, 0x80, 0x00, 0x05,
0x80, 0x63, 0x00, 0x1C,
0x90, 0x83, 0x00, 0x04,
0x38, 0x80, 0x1B, 0x39, /*MSP Money last 4 digits*/
0x90, 0x83, 0x00, 0x08,
0x38, 0x60, 0x00, 0x00,
0x4E, 0x80, 0x00, 0x20,
};
memcpy((PVOID)0x8168A6F8, UnPatchXam, 0x20); // xam.xex 17559
memcpy((PVOID)0x8173F678, UnPatchXam2, 0x1C); // xam.xex 17559
*(DWORD*)(0x818E9BD8) = 0x41800010; // xam.xex 17559
*(DWORD*)(0x818EE414) = 0x409A0058; // xam.xex 17559
*(DWORD*)(0x81AEC18C) = 0x48000064; // xam.xex 17559
*(DWORD*)(0x81AF91D4) = 0x480002E4; // xam.xex 17559
*(DWORD*)(0x81AF2308) = 0x480002A0; // xam.xex 17559
*(DWORD*)(0x81AE9370) = 0x39600010; // xam.xex 17559
bStoredOpened = 0;
break;
}
default:
break;
}
return 0;
}
VOID Utils::MakeThread(LPTHREAD_START_ROUTINE Address)
{
HANDLE Handle = 0;
ExCreateThread(&Handle, 0, 0, XapiThreadStartup, Address, 0, (EX_CREATE_FLAG_SUSPENDED | EX_CREATE_FLAG_SYSTEM | 0x18000424));
XSetThreadProcessor(Handle, 4);
SetThreadPriority(Handle, THREAD_PRIORITY_ABOVE_NORMAL);
ResumeThread(Handle);
CloseHandle(Handle);
}
if (wcscmp(moduleHandle->BaseDllName.Buffer, L"Guide.MP.Purchase.xex") == 0) {
if (Config::MSP) {
bStoredOpened = 0;
Utils::MakeThread((LPTHREAD_START_ROUTINE)MSPSPoof);
}
}
if (wcscmp(moduleHandle->BaseDllName.Buffer, L"hud.xex") == 0) {
if (Config::MSP) {
bStoredOpened = 1;
Utils::MakeThread((LPTHREAD_START_ROUTINE)MSPSPoof);
}
}