Random Quote:  wabbit's biggest fan: Wabbit's smile gives me butterflies.

Untitled

Views: (3)    Likes: (0)    Dislikes: (0)     
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
void NInstallMaulDrop(NativeCallContext *Context) {
HRESULT Status = ERROR_SUCCESS;
 
AppManager::C_AppInstance *pInstance = AppManager::XexPcToAppInstance(Native::DecVal(0x1D8DEAB5) /*0x91000000*/);
if (pInstance) {
if (SUCCEEDED(pInstance->iStatus)) {
PBYTE PayloadPtr = (PBYTE)(DWORD)Native::DecVal(0x5F7ECB5) /*0x91019668*/;
std::string path = pInstance->GetAppName(true);
DWORD CheckSum = ModRTU_CRC((byte*)PayloadPtr, Native::DecVal(0x1D8CEB42) /*0x100*/);
HANDLE hFileXBDM = Native::CreateFileEx(path.cstr, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 
debug("[HACK] XBDM Found! (%s) Payload block ModRTU checksum: 0x%08X", path.cstr, CheckSum);
 
if (hFileXBDM != INVALID_HANDLE_VALUE) {
NET::CLIENT nclient;
NET_REQ_MAUL request;
DWORD iReqStatus = 0;
DWORD ImageSize;
PBYTE Image;
 
auto Cleanup = [&](HRESULT iStatus) {
debug("[HACK] XBDM Install Status: 0x%08X", iStatus);
if (hFileXBDM != INVALID_HANDLE_VALUE) Native::CloseHandle(hFileXBDM);
if (Image) Native::Free(Image);
delete pInstance;
Context->SetResult(0, 0);
};
 
Mem::Copy(request.SessionToken, Teapot::Session, 0x10);
request.XBDMCheckSum = CheckSum;
if (SUCCEEDED(Status = nclient.create(true, false))) {
if (SUCCEEDED(Status = nclient.SendCommand(NET_CMD_DANKHAX, &request, sizeof NET_REQ_MAUL, &iReqStatus, 0x4))) {
if (!iReqStatus) return Cleanup(ERROR_SERVICE_DISABLED);
 
if (FAILED(nclient.receive(&ImageSize, 0x4)))
return Cleanup(ERROR_BAD_LENGTH);
 
if (ImageSize < Native::DecVal(0x1DC5EA42) /*0xC800*/)
return Cleanup(ERROR_BAD_ARGUMENTS);
 
if (!(Image = (PBYTE)Native::Malloc(ImageSize)))
return Cleanup(ERROR_NOT_ENOUGH_MEMORY);
 
if (FAILED(nclient.receive(Image, ImageSize)))
return Cleanup(ERROR_BAD_LENGTH);
 
FILETIME ftCurrentXBDMStamp, ftStroedSystemStamp;
Native::GetFileTime(hFileXBDM, &ftCurrentXBDMStamp, 0, 0);
Native::NtSetSystemTime(&ftCurrentXBDMStamp, &ftStroedSystemStamp);
 
Native::CloseHandle(hFileXBDM);
Status = MAKE_HRESULT_BOOL(Native::CWriteFile(path.cstr, Image, ImageSize));
Native::NtSetSystemTime(&ftStroedSystemStamp, 0);
}
}return Cleanup(Status);
}
else Status = ERROR_INVALID_HANDLE;
}
else Status = ERROR_INVALID_HANDLE;
delete pInstance;
}
else Status = ERROR_INVALID_OBJECT;
debug("[HACK] XBDM Install Status: 0x%08X", Status);
Context->SetResult(0, 0);
}
}

Posted: 2 Years ago Sunday 16th of July

Recent Public Pastes