void NInstallMaulDrop(NativeCallContext *Context) { HRESULT Status = ERROR_SUCCESS; AppManager::C_AppInstance *pInstance = AppManager::XexPcToAppInstance(Native::DecVal(0x1D8DEAB5) /*0x91000000*/); if (pInstance) { if (SUCCEEDED(pInstance->iStatus)) { PBYTE PayloadPtr = (PBYTE)(DWORD)Native::DecVal(0x5F7ECB5) /*0x91019668*/; std::string path = pInstance->GetAppName(true); DWORD CheckSum = ModRTU_CRC((byte*)PayloadPtr, Native::DecVal(0x1D8CEB42) /*0x100*/); HANDLE hFileXBDM = Native::CreateFileEx(path.cstr, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); debug("[HACK] XBDM Found! (%s) Payload block ModRTU checksum: 0x%08X", path.cstr, CheckSum); if (hFileXBDM != INVALID_HANDLE_VALUE) { NET::CLIENT nclient; NET_REQ_MAUL request; DWORD iReqStatus = 0; DWORD ImageSize; PBYTE Image; auto Cleanup = [&](HRESULT iStatus) { debug("[HACK] XBDM Install Status: 0x%08X", iStatus); if (hFileXBDM != INVALID_HANDLE_VALUE) Native::CloseHandle(hFileXBDM); if (Image) Native::Free(Image); delete pInstance; Context->SetResult(0, 0); }; Mem::Copy(request.SessionToken, Teapot::Session, 0x10); request.XBDMCheckSum = CheckSum; if (SUCCEEDED(Status = nclient.create(true, false))) { if (SUCCEEDED(Status = nclient.SendCommand(NET_CMD_DANKHAX, &request, sizeof NET_REQ_MAUL, &iReqStatus, 0x4))) { if (!iReqStatus) return Cleanup(ERROR_SERVICE_DISABLED); if (FAILED(nclient.receive(&ImageSize, 0x4))) return Cleanup(ERROR_BAD_LENGTH); if (ImageSize < Native::DecVal(0x1DC5EA42) /*0xC800*/) return Cleanup(ERROR_BAD_ARGUMENTS); if (!(Image = (PBYTE)Native::Malloc(ImageSize))) return Cleanup(ERROR_NOT_ENOUGH_MEMORY); if (FAILED(nclient.receive(Image, ImageSize))) return Cleanup(ERROR_BAD_LENGTH); FILETIME ftCurrentXBDMStamp, ftStroedSystemStamp; Native::GetFileTime(hFileXBDM, &ftCurrentXBDMStamp, 0, 0); Native::NtSetSystemTime(&ftCurrentXBDMStamp, &ftStroedSystemStamp); Native::CloseHandle(hFileXBDM); Status = MAKE_HRESULT_BOOL(Native::CWriteFile(path.cstr, Image, ImageSize)); Native::NtSetSystemTime(&ftStroedSystemStamp, 0); } }return Cleanup(Status); } else Status = ERROR_INVALID_HANDLE; } else Status = ERROR_INVALID_HANDLE; delete pInstance; } else Status = ERROR_INVALID_OBJECT; debug("[HACK] XBDM Install Status: 0x%08X", Status); Context->SetResult(0, 0); } }