Untitled
unknown
c_cpp
a month ago
74 kB
2
Indexable
namespace BO6 {
uint64_t gamepass_decrypt_client_info(uint64_t baseAddr, uint64_t peb)
{
const uint64_t mb = baseAddr;
uint64_t rax = mb, rbx = mb, rcx = mb, rdx = mb, rdi = mb, rsi = mb, r8 = mb, r9 = mb, r10 = mb, r11 = mb, r12 = mb, r13 = mb, r14 = mb, r15 = mb;
rbx = driver::read<uint64_t>(baseAddr + 0x13317558);
if (!rbx)
return rbx;
rcx = peb; //mov rcx, gs:[rax]
//failed to trace. base: 00007FF6325A0000 It's possibly wrong rdx = 0000000000000074
rbx += 0xFFFFFFFFFFFF9357; //add rbx, 0xFFFFFFFFFFFF9357
rcx -= rdx; //sub rcx, rdx
rcx += rbx; //add rcx, rbx
rax = rcx; //mov rax, rcx
rax >>= 0x1D; //shr rax, 0x1D
rcx ^= rax; //xor rcx, rax
rbx = rcx; //mov rbx, rcx
rax = 0; //and rax, 0xFFFFFFFFC0000000
rbx >>= 0x3A; //shr rbx, 0x3A
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rbx ^= rcx; //xor rbx, rcx
rax ^= driver::read<uint64_t>(baseAddr + 0xC9878BC); //xor rax, [0x0000000005CDD023]
rax = _byteswap_uint64(rax); //bswap rax
rbx *= driver::read<uint64_t>(rax + 0x15); //imul rbx, [rax+0x15]
rax = 0xD67810518E7F25DD; //mov rax, 0xD67810518E7F25DD
rbx *= rax; //imul rbx, rax
rax = rbx; //mov rax, rbx
rax >>= 0x5; //shr rax, 0x05
rbx ^= rax; //xor rbx, rax
rax = rbx; //mov rax, rbx
rax >>= 0xA; //shr rax, 0x0A
rbx ^= rax; //xor rbx, rax
rax = rbx; //mov rax, rbx
rax >>= 0x14; //shr rax, 0x14
rbx ^= rax; //xor rbx, rax
rax = rbx; //mov rax, rbx
rax >>= 0x28; //shr rax, 0x28
rbx ^= rax; //xor rbx, rax
return rbx;
}
uint64_t gamepass_decrypt_client_base(uint64_t client_info, uint64_t baseAddr, uint64_t peb)
{
const uint64_t mb = baseAddr;
uint64_t rax = mb, rbx = mb, rcx = mb, rdx = mb, rdi = mb, rsi = mb, r8 = mb, r9 = mb, r10 = mb, r11 = mb, r12 = mb, r13 = mb, r14 = mb, r15 = mb;
rax = driver::read<uint64_t>(client_info + 0x1d3620);
if (!rax)
return rax;
r11 = ~peb; //mov r11, gs:[rcx]
rcx = r11; //mov rcx, r11
//failed to translate: mov [rsp+0x3E0], r13
rcx = _rotl64(rcx, 0x34); //rol rcx, 0x34
rcx &= 0xF;
switch (rcx) {
case 0:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D5AA5]
r13 = baseAddr + 0x16CBED5E; //lea r13, [0x0000000013C0CEBB]
rdx = baseAddr + 0x33D36DEA; //lea rdx, [0x0000000030C84EE9]
rax ^= r11; //xor rax, r11
rax ^= rdx; //xor rax, rdx
rcx = r11; //mov rcx, r11
rcx *= r13; //imul rcx, r13
rax -= rcx; //sub rax, rcx
rcx = 0x2F44AFC8DA410289; //mov rcx, 0x2F44AFC8DA410289
rax *= rcx; //imul rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = 0x31EA6C7327F2F48F; //mov rcx, 0x31EA6C7327F2F48F
rax *= rcx; //imul rax, rcx
rcx = r11; //mov rcx, r11
rcx = ~rcx; //not rcx
uintptr_t RSP_0xFFFFFFFFFFFFFF90;
RSP_0xFFFFFFFFFFFFFF90 = baseAddr + 0xDD05; //lea rcx, [0xFFFFFFFFFCF5BE7E] : RBP+0xFFFFFFFFFFFFFF90
rcx ^= RSP_0xFFFFFFFFFFFFFF90; //xor rcx, [rbp-0x70]
rax -= rcx; //sub rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xF; //shr rcx, 0x0F
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1E; //shr rcx, 0x1E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x3C; //shr rcx, 0x3C
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4DF21]
rax -= rcx; //sub rax, rcx
return rax;
}
case 1:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r9, [0x00000000098D55C3]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4D85B]
rcx += 0x4C577047; //add rcx, 0x4C577047
rcx += r11; //add rcx, r11
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x16; //shr rcx, 0x16
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2C; //shr rcx, 0x2C
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4D961]
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4DA2C]
rcx += 0x673BCC74; //add rcx, 0x673BCC74
rcx += r11; //add rcx, r11
rax ^= rcx; //xor rax, rcx
rcx = 0x14CEC15D15237845; //mov rcx, 0x14CEC15D15237845
rax *= rcx; //imul rax, rcx
rcx = 0xC6C8F26557A42C57; //mov rcx, 0xC6C8F26557A42C57
rax *= rcx; //imul rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
return rax;
}
case 2:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r9, [0x00000000098D514D]
rcx = rax; //mov rcx, rax
rcx >>= 0xC; //shr rcx, 0x0C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x18; //shr rcx, 0x18
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x30; //shr rcx, 0x30
rax ^= rcx; //xor rax, rcx
rax -= r11; //sub rax, r11
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = baseAddr + 0x40BA9587; //lea rcx, [0x000000003DAF6C49]
rax += r11; //add rax, r11
rax += rcx; //add rax, rcx
rcx = 0xB820512AEEAE20F1; //mov rcx, 0xB820512AEEAE20F1
rax *= rcx; //imul rax, rcx
rcx = 0x5B4702F448FEE148; //mov rcx, 0x5B4702F448FEE148
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4D69A]
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x12; //shr rcx, 0x12
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x24; //shr rcx, 0x24
rax ^= rcx; //xor rax, rcx
return rax;
}
case 3:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D4C01]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4CFEE]
rax -= rcx; //sub rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4CE6F]
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x13; //shr rcx, 0x13
rax ^= rcx; //xor rax, rcx
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rcx = rax; //mov rcx, rax
rdx ^= r10; //xor rdx, r10
rcx >>= 0x26; //shr rcx, 0x26
rdx = ~rdx; //not rdx
rax ^= rcx; //xor rax, rcx
rax *= driver::read<uint64_t>(rdx + 0x7); //imul rax, [rdx+0x07]
rcx = r11; //mov rcx, r11
rcx = ~rcx; //not rcx
uintptr_t RSP_0xFFFFFFFFFFFFFF88;
RSP_0xFFFFFFFFFFFFFF88 = baseAddr + 0x639AA956; //lea rcx, [0x00000000608F7BE6] : RBP+0xFFFFFFFFFFFFFF88
rcx += RSP_0xFFFFFFFFFFFFFF88; //add rcx, [rbp-0x78]
rax ^= rcx; //xor rax, rcx
rcx = 0xEF7AA6541B0960DD; //mov rcx, 0xEF7AA6541B0960DD
rax ^= rcx; //xor rax, rcx
rcx = 0xAC44478E4E7E319F; //mov rcx, 0xAC44478E4E7E319F
rax *= rcx; //imul rax, rcx
rcx = 0x69DF0E377EDBC9BB; //mov rcx, 0x69DF0E377EDBC9BB
rax ^= rcx; //xor rax, rcx
return rax;
}
case 4:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r9, [0x00000000098D4785]
rcx = 0x6B6B6FEB24A18CBC; //mov rcx, 0x6B6B6FEB24A18CBC
rax ^= rcx; //xor rax, rcx
rcx = 0xE26425F12DE4CEB; //mov rcx, 0xE26425F12DE4CEB
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x15; //shr rcx, 0x15
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2A; //shr rcx, 0x2A
rax ^= rcx; //xor rax, rcx
rax += r11; //add rax, r11
rcx = 0xC6BD746DB1DF1B31; //mov rcx, 0xC6BD746DB1DF1B31
rax *= rcx; //imul rax, rcx
rax -= baseAddr; //sub rax, [rbp-0x70] -- didn't find trace -> use base
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = rax; //mov rcx, rax
rcx >>= 0x1; //shr rcx, 0x01
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2; //shr rcx, 0x02
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x4; //shr rcx, 0x04
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
return rax;
}
case 5:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D407F]
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rcx = r11 * 0xFFFFFFFFFFFFFFFE; //imul rcx, r11, 0xFFFFFFFFFFFFFFFE
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rax += rcx; //add rax, rcx
rdx ^= r10; //xor rdx, r10
rcx = baseAddr + 0x5F737FAA; //lea rcx, [0x000000005C684478]
rdx = ~rdx; //not rdx
rax += rcx; //add rax, rcx
rax *= driver::read<uint64_t>(rdx + 0x7); //imul rax, [rdx+0x07]
rcx = rax; //mov rcx, rax
rcx >>= 0x19; //shr rcx, 0x19
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x32; //shr rcx, 0x32
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4C350]
rcx += 0x6987CC3C; //add rcx, 0x6987CC3C
rcx += r11; //add rcx, r11
rax += rcx; //add rax, rcx
rcx = 0xBEC2B746A9461603; //mov rcx, 0xBEC2B746A9461603
rax *= rcx; //imul rax, rcx
rcx = 0x7D25D991052F24B5; //mov rcx, 0x7D25D991052F24B5
rax += rcx; //add rax, rcx
rcx = 0x6B9AD86F193C7172; //mov rcx, 0x6B9AD86F193C7172
rax += rcx; //add rax, rcx
return rax;
}
case 6:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D3C13]
rdx = baseAddr + 0x50AF1F4F; //lea rdx, [0x000000004DA3E1B5]
rax += r11; //add rax, r11
rcx = r11; //mov rcx, r11
rcx ^= rdx; //xor rcx, rdx
rax -= rcx; //sub rax, rcx
rcx = 0xFA37AFACEF63040B; //mov rcx, 0xFA37AFACEF63040B
rax ^= rcx; //xor rax, rcx
rcx = 0xE15A50F0F0B4D5D9; //mov rcx, 0xE15A50F0F0B4D5D9
rax *= rcx; //imul rax, rcx
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rcx = baseAddr + 0xEE8B; //lea rcx, [0xFFFFFFFFFCF5AD5B]
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rcx -= r11; //sub rcx, r11
rax ^= rcx; //xor rax, rcx
rdx ^= r10; //xor rdx, r10
rdx = ~rdx; //not rdx
rax *= driver::read<uint64_t>(rdx + 0x7); //imul rax, [rdx+0x07]
rcx = 0x61E687AD8B6807D4; //mov rcx, 0x61E687AD8B6807D4
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x15; //shr rcx, 0x15
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2A; //shr rcx, 0x2A
rax ^= rcx; //xor rax, rcx
return rax;
}
case 7:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D36FD]
r13 = baseAddr + 0xBEE4; //lea r13, [0xFFFFFFFFFCF57CA4]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4BA5A]
rax ^= rcx; //xor rax, rcx
rcx = 0x8DB3E6B3BD449D8; //mov rcx, 0x8DB3E6B3BD449D8
rax += rcx; //add rax, rcx
rcx = 0x7CFD8CC5318E532F; //mov rcx, 0x7CFD8CC5318E532F
rax *= rcx; //imul rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x7; //shr rcx, 0x07
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xE; //shr rcx, 0x0E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1C; //shr rcx, 0x1C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x38; //shr rcx, 0x38
rax ^= rcx; //xor rax, rcx
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rcx = 0x6DE6E637B4DB68F1; //mov rcx, 0x6DE6E637B4DB68F1
rdx ^= r10; //xor rdx, r10
rdx = ~rdx; //not rdx
rax *= driver::read<uint64_t>(rdx + 0x7); //imul rax, [rdx+0x07]
rax *= rcx; //imul rax, rcx
rcx = r11; //mov rcx, r11
rcx -= r13; //sub rcx, r13
rax ^= rcx; //xor rax, rcx
rax -= r11; //sub rax, r11
return rax;
}
case 8:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r9, [0x00000000098D32AE]
rcx = rax; //mov rcx, rax
rcx >>= 0x1E; //shr rcx, 0x1E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x3C; //shr rcx, 0x3C
rax ^= rcx; //xor rax, rcx
rcx = 0xD16E8EE163C9A6B; //mov rcx, 0xD16E8EE163C9A6B
rax *= rcx; //imul rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xE; //shr rcx, 0x0E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1C; //shr rcx, 0x1C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x38; //shr rcx, 0x38
rax ^= rcx; //xor rax, rcx
rcx = 0xA9C58221B90E7C46; //mov rcx, 0xA9C58221B90E7C46
rax ^= rcx; //xor rax, rcx
rcx = 0x55F6ED3AB42B87A0; //mov rcx, 0x55F6ED3AB42B87A0
rax -= rcx; //sub rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4B4A3]
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x14; //shr rcx, 0x14
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x28; //shr rcx, 0x28
rax ^= rcx; //xor rax, rcx
return rax;
}
case 9:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D2BEB]
rdx = r11; //mov rdx, r11
rcx = baseAddr + 0xFCE2; //lea rcx, [0xFFFFFFFFFCF5ADEE]
rdx *= rcx; //imul rdx, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4B101]
rdx -= rcx; //sub rdx, rcx
rcx = r11; //mov rcx, r11
rax += rdx; //add rax, rdx
rcx = ~rcx; //not rcx
rax ^= rcx; //xor rax, rcx
rdx = baseAddr + 0x6EC75C18; //lea rdx, [0x000000006BBC0D03]
rax ^= rdx; //xor rax, rdx
rcx = rax; //mov rcx, rax
rcx >>= 0x7; //shr rcx, 0x07
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0xE; //shr rcx, 0x0E
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x1C; //shr rcx, 0x1C
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x38; //shr rcx, 0x38
rax ^= rcx; //xor rax, rcx
r13 = 0xB691FFD9C9D61B2E; //mov r13, 0xB691FFD9C9D61B2E
rax += r13; //add rax, r13
r13 = 0x89C1B16D1EAC4B85; //mov r13, 0x89C1B16D1EAC4B85
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rax ^= r13; //xor rax, r13
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = 0x272542A0099256AB; //mov rcx, 0x272542A0099256AB
rax *= rcx; //imul rax, rcx
return rax;
}
case 10:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D26B9]
rcx = baseAddr + 0x240D8AB0; //lea rcx, [0x00000000210236DB]
rcx += r11; //add rcx, r11
rax ^= rcx; //xor rax, rcx
rdx = baseAddr + 0x3B21; //lea rdx, [0xFFFFFFFFFCF4E4FE]
rcx = r11; //mov rcx, r11
rdx *= r11; //imul rdx, r11
rcx = ~rcx; //not rcx
rdx += rax; //add rdx, rax
rax = baseAddr + 0x24E689C1; //lea rax, [0x0000000021DB337A]
rcx += rax; //add rcx, rax
rax = rdx; //mov rax, rdx
rax ^= rcx; //xor rax, rcx
rcx = 0x489A1BC87CDCD670; //mov rcx, 0x489A1BC87CDCD670
rax ^= rcx; //xor rax, rcx
rcx = 0xA00242052F60AE53; //mov rcx, 0xA00242052F60AE53
rax ^= rcx; //xor rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = 0xBDB64B81FECB6E7D; //mov rcx, 0xBDB64B81FECB6E7D
rax *= rcx; //imul rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x28; //shr rcx, 0x28
rax ^= rcx; //xor rax, rcx
return rax;
}
case 11:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D21D2]
rcx = rax; //mov rcx, rax
rcx >>= 0x15; //shr rcx, 0x15
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2A; //shr rcx, 0x2A
rax ^= rcx; //xor rax, rcx
rcx = 0xD3A53D9499733245; //mov rcx, 0xD3A53D9499733245
rax *= rcx; //imul rax, rcx
rcx = 0x72C2AC821062ABD1; //mov rcx, 0x72C2AC821062ABD1
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4A396]
rax -= rcx; //sub rax, rcx
rax += 0xFFFFFFFFFFFF4954; //add rax, 0xFFFFFFFFFFFF4954
rax += r11; //add rax, r11
rcx = rax; //mov rcx, rax
rcx >>= 0x1; //shr rcx, 0x01
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2; //shr rcx, 0x02
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x4; //shr rcx, 0x04
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4A734]
rax ^= rcx; //xor rax, rcx
rcx = baseAddr + 0x5B0222F4; //lea rcx, [0x0000000057F6C635]
rcx *= r11; //imul rcx, r11
rax += rcx; //add rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
return rax;
}
case 12:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D1C53]
r13 = baseAddr + 0x852; //lea r13, [0xFFFFFFFFFCF4AB6D]
rcx = 0xF7D4FABCE6FC022; //mov rcx, 0xF7D4FABCE6FC022
rax += rcx; //add rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF4A0C6]
rax ^= rcx; //xor rax, rcx
rax -= rcx; //sub rax, rcx
rcx = 0x5C9D9DBA026E85B7; //mov rcx, 0x5C9D9DBA026E85B7
rax *= rcx; //imul rax, rcx
rcx = rax; //mov rcx, rax
rdx = r11; //mov rdx, r11
rcx >>= 0x21; //shr rcx, 0x21
rdx = ~rdx; //not rdx
rdx *= r13; //imul rdx, r13
rdx ^= rcx; //xor rdx, rcx
rax ^= rdx; //xor rax, rdx
rax += r11; //add rax, r11
return rax;
}
case 13:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D1883]
r13 = baseAddr + 0x12585A59; //lea r13, [0x000000000F4CF9A4]
rcx = r11; //mov rcx, r11
rcx = ~rcx; //not rcx
rcx ^= r13; //xor rcx, r13
rax += rcx; //add rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x8; //shr rcx, 0x08
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x10; //shr rcx, 0x10
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x20; //shr rcx, 0x20
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x11; //shr rcx, 0x11
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x22; //shr rcx, 0x22
rax ^= rcx; //xor rax, rcx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = 0xA4979265BBC7E3D5; //mov rcx, 0xA4979265BBC7E3D5
rax *= rcx; //imul rax, rcx
rcx = r11; //mov rcx, r11
rcx = ~rcx; //not rcx
rcx -= baseAddr; //sub rcx, [rbp-0x70] -- didn't find trace -> use base
rcx -= 0x756FAD6E; //sub rcx, 0x756FAD6E
rcx ^= rax; //xor rcx, rax
rax = baseAddr + 0x78217335; //lea rax, [0x00000000751610A2]
rcx += r11; //add rcx, r11
rax += rcx; //add rax, rcx
rcx = 0xC20F4E2AD24BC517; //mov rcx, 0xC20F4E2AD24BC517
rax ^= rcx; //xor rax, rcx
return rax;
}
case 14:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D1305]
r13 = baseAddr + 0x3CF1; //lea r13, [0xFFFFFFFFFCF4D6BE]
rcx = rax; //mov rcx, rax
rcx >>= 0x16; //shr rcx, 0x16
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2C; //shr rcx, 0x2C
rax ^= rcx; //xor rax, rcx
rcx = 0xAF96B7C88EDF2B75; //mov rcx, 0xAF96B7C88EDF2B75
rax *= rcx; //imul rax, rcx
rax ^= r11; //xor rax, r11
rdx = 0; //and rdx, 0xFFFFFFFFC0000000
rdx = _rotl64(rdx, 0x10); //rol rdx, 0x10
rdx ^= r10; //xor rdx, r10
rcx = r11 + r13 * 1; //lea rcx, [r11+r13*1]
rax += rcx; //add rax, rcx
rdx = ~rdx; //not rdx
rcx = 0x7B695E53D3CD7B7F; //mov rcx, 0x7B695E53D3CD7B7F
rax *= driver::read<uint64_t>(rdx + 0x7); //imul rax, [rdx+0x07]
rax *= rcx; //imul rax, rcx
rcx = 0x56A40B352BF2FDB7; //mov rcx, 0x56A40B352BF2FDB7
rax -= rcx; //sub rax, rcx
rcx = baseAddr + 0x32FFEB8B; //lea rcx, [0x000000002FF48471]
rcx = ~rcx; //not rcx
rcx *= r11; //imul rcx, r11
rax += rcx; //add rax, rcx
return rax;
}
case 15:
{
r10 = driver::read<uint64_t>(baseAddr + 0xC987925); //mov r10, [0x00000000098D0DAC]
rdx = baseAddr + 0x23AC2B6F; //lea rdx, [0x0000000020A0BF3C]
rcx = baseAddr; //lea rcx, [0xFFFFFFFFFCF49246]
rax -= rcx; //sub rax, rcx
rax += r11; //add rax, r11
rdx = ~rdx; //not rdx
rdx ^= r11; //xor rdx, r11
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r10; //xor rcx, r10
rcx = ~rcx; //not rcx
rax *= driver::read<uint64_t>(rcx + 0x7); //imul rax, [rcx+0x07]
rcx = rax; //mov rcx, rax
rcx >>= 0x17; //shr rcx, 0x17
rax ^= rcx; //xor rax, rcx
rcx = rax; //mov rcx, rax
rcx >>= 0x2E; //shr rcx, 0x2E
rax ^= rcx; //xor rax, rcx
rax -= rdx; //sub rax, rdx
rcx = 0xAE9091426078C4DF; //mov rcx, 0xAE9091426078C4DF
rax *= rcx; //imul rax, rcx
rcx = 0x2E839B5F3DB76D2B; //mov rcx, 0x2E839B5F3DB76D2B
rax += rcx; //add rax, rcx
rcx = 0x632E9341FBDD9A7C; //mov rcx, 0x632E9341FBDD9A7C
rax -= rcx; //sub rax, rcx
return rax;
}
}
};
auto gamepass_decrypt_bone_base(uint64_t baseAddr, uint64_t peb)
{
const uint64_t mb = baseAddr;
uint64_t rax = mb, rbx = mb, rcx = mb, rdx = mb, rdi = mb, rsi = mb, r8 = mb, r9 = mb, r10 = mb, r11 = mb, r12 = mb, r13 = mb, r14 = mb, r15 = mb;
rdx = driver::read<uint64_t>(baseAddr + 0x110152A8);
if (!rdx)
return rdx;
r10 = peb; //mov r10, gs:[rax]
rax = r10; //mov rax, r10
rax <<= 0x22; //shl rax, 0x22
rax = _byteswap_uint64(rax); //bswap rax
rax &= 0xF;
switch (rax)
{
case 0:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A4AC3B]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C322F]
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = 0xC98EF2FFB1E013D2; //mov rax, 0xC98EF2FFB1E013D2
rdx -= r11; //sub rdx, r11
rdx += 0xFFFFFFFFFFFFC795; //add rdx, 0xFFFFFFFFFFFFC795
rdx += r10; //add rdx, r10
rdx ^= rax; //xor rdx, rax
rdx ^= r10; //xor rdx, r10
rax = 0x1AE0F1058D3590F1; //mov rax, 0x1AE0F1058D3590F1
rdx *= rax; //imul rdx, rax
rax = 0x1EAC0325CBA779BC; //mov rax, 0x1EAC0325CBA779BC
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1F; //shr rax, 0x1F
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x3E; //shr rax, 0x3E
rdx ^= rax; //xor rdx, rax
rdx ^= r10; //xor rdx, r10
return rdx;
}
case 1:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A4A774]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C2D68]
rax = 0x311E3C7DD1297B69; //mov rax, 0x311E3C7DD1297B69
rdx *= rax; //imul rdx, rax
rcx = r10; //mov rcx, r10
rcx = ~rcx; //not rcx
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = baseAddr + 0x437D3D7F; //lea rax, [0x000000003C896950]
rax = ~rax; //not rax
rcx += rax; //add rcx, rax
rdx ^= rcx; //xor rdx, rcx
rax = rdx; //mov rax, rdx
rax >>= 0x28; //shr rax, 0x28
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x13; //shr rax, 0x13
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x26; //shr rax, 0x26
rdx ^= rax; //xor rdx, rax
rax = r11 + 0x3b261317; //lea rax, [r11+0x3B261317]
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
rax = 0x85B82AEE944DCF96; //mov rax, 0x85B82AEE944DCF96
rdx ^= rax; //xor rdx, rax
rdx += r11; //add rdx, r11
return rdx;
}
case 2:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A4A2E5]
rax = rdx; //mov rax, rdx
rax >>= 0x25; //shr rax, 0x25
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0xC; //shr rax, 0x0C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x18; //shr rax, 0x18
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x30; //shr rax, 0x30
rdx ^= rax; //xor rdx, rax
rdx += r10; //add rdx, r10
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rdx ^= r10; //xor rdx, r10
rax = 0x6B65DF2C3A88AE69; //mov rax, 0x6B65DF2C3A88AE69
rdx -= rax; //sub rdx, rax
rax = 0xA4B331303E4E7A67; //mov rax, 0xA4B331303E4E7A67
rdx *= rax; //imul rdx, rax
rax = 0x6A137DDDFCE4C0D7; //mov rax, 0x6A137DDDFCE4C0D7
rdx -= rax; //sub rdx, rax
return rdx;
}
case 3:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A49EA9]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C2498]
r9 = baseAddr + 0x1314A155; //lea r9, [0x000000000C20C5E1]
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rdx -= r11; //sub rdx, r11
rax = rdx; //mov rax, rdx
rax >>= 0x1F; //shr rax, 0x1F
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x3E; //shr rax, 0x3E
rdx ^= rax; //xor rdx, rax
rdx ^= r10; //xor rdx, r10
rax = r9; //mov rax, r9
rax -= r10; //sub rax, r10
rdx ^= rax; //xor rdx, rax
rax = 0xD5A4D08183955257; //mov rax, 0xD5A4D08183955257
rdx *= rax; //imul rdx, rax
rax = 0x8DC8AE43913090FA; //mov rax, 0x8DC8AE43913090FA
rdx ^= rax; //xor rdx, rax
return rdx;
}
case 4:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A49BB4]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C21A8]
rax = 0xF7A45523CB2EF07F; //mov rax, 0xF7A45523CB2EF07F
rdx ^= rax; //xor rdx, rax
rdx -= r10; //sub rdx, r10
rdx -= r10; //sub rdx, r10
rdx -= r10; //sub rdx, r10
rax = rdx; //mov rax, rdx
rax >>= 0x14; //shr rax, 0x14
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x28; //shr rax, 0x28
rdx ^= rax; //xor rdx, rax
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = r11 + 0x8f29; //lea rax, [r11+0x8F29]
rax += r10; //add rax, r10
rdx ^= rax; //xor rdx, rax
rax = 0xD43375ADC5407E51; //mov rax, 0xD43375ADC5407E51
rdx *= rax; //imul rdx, rax
return rdx;
}
case 5:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A49737]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C1D1F]
r12 = baseAddr + 0x12426297; //lea r12, [0x000000000B4E7FAA]
rax = 0x7C5DF0A12057BE6; //mov rax, 0x7C5DF0A12057BE6
rdx -= rax; //sub rdx, rax
rax = 0x83F8FC0408B5D1AB; //mov rax, 0x83F8FC0408B5D1AB
rdx ^= rax; //xor rdx, rax
rax = baseAddr + 0x158DE932; //lea rax, [0x000000000E9A04C0]
rax = ~rax; //not rax
rax *= r10; //imul rax, r10
rdx += rax; //add rdx, rax
rax = r10; //mov rax, r10
rax *= r12; //imul rax, r12
rdx ^= rax; //xor rdx, rax
rax = r11 + 0x5541; //lea rax, [r11+0x5541]
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x5; //shr rax, 0x05
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0xA; //shr rax, 0x0A
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x14; //shr rax, 0x14
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x28; //shr rax, 0x28
rdx ^= rax; //xor rdx, rax
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = 0x3F31D045C89ED8C5; //mov rax, 0x3F31D045C89ED8C5
rdx *= rax; //imul rdx, rax
return rdx;
}
case 6:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A491C8]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C17B7]
r12 = baseAddr + 0x6DA9DAD4; //lea r12, [0x0000000066B5F27F]
rax = rdx; //mov rax, rdx
rax >>= 0x6; //shr rax, 0x06
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0xC; //shr rax, 0x0C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x18; //shr rax, 0x18
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x30; //shr rax, 0x30
rdx ^= rax; //xor rdx, rax
rax = 0x7564570D161CA18D; //mov rax, 0x7564570D161CA18D
rdx *= rax; //imul rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x26; //shr rax, 0x26
rdx ^= rax; //xor rdx, rax
rax = r11 + 0x144205b7; //lea rax, [r11+0x144205B7]
rax += r10; //add rax, r10
rdx ^= rax; //xor rdx, rax
rax = 0x80C6B6FC948F6729; //mov rax, 0x80C6B6FC948F6729
rdx *= rax; //imul rdx, rax
rax = 0x31DF20582505A415; //mov rax, 0x31DF20582505A415
rdx += rax; //add rdx, rax
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rdx += r12; //add rdx, r12
rcx = r10; //mov rcx, r10
rcx = ~rcx; //not rcx
rdx += rcx; //add rdx, rcx
return rdx;
}
case 7:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A48DE9]
r12 = baseAddr + 0x4354; //lea r12, [0xFFFFFFFFF90C5731]
rdx ^= r10; //xor rdx, r10
rax = rdx; //mov rax, rdx
rax >>= 0xD; //shr rax, 0x0D
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1A; //shr rax, 0x1A
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x34; //shr rax, 0x34
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x7; //shr rax, 0x07
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0xE; //shr rax, 0x0E
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1C; //shr rax, 0x1C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x38; //shr rax, 0x38
rdx ^= rax; //xor rdx, rax
rax = 0xCCB3012D7BB7524F; //mov rax, 0xCCB3012D7BB7524F
rdx *= rax; //imul rdx, rax
rax = 0x11516F5E5F563F90; //mov rax, 0x11516F5E5F563F90
rdx -= rax; //sub rdx, rax
rax = r10; //mov rax, r10
rax = ~rax; //not rax
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rax *= r12; //imul rax, r12
rcx ^= r9; //xor rcx, r9
rcx = _byteswap_uint64(rcx); //bswap rcx
rdx += rax; //add rdx, rax
rdx *= driver::read<uint64_t>(rcx + 0x11); //imul rdx, [rcx+0x11]
return rdx;
}
case 8:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A48965]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C0F59]
r12 = baseAddr + 0x7D814959; //lea r12, [0x00000000768D58A6]
rdx -= r10; //sub rdx, r10
rax = 0xEDC13D6B57B6E285; //mov rax, 0xEDC13D6B57B6E285
rdx *= rax; //imul rdx, rax
rax = r10; //mov rax, r10
rax ^= r12; //xor rax, r12
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rcx = _byteswap_uint64(rcx); //bswap rcx
rdx *= driver::read<uint64_t>(rcx + 0x11); //imul rdx, [rcx+0x11]
rax = rdx; //mov rax, rdx
rax >>= 0x21; //shr rax, 0x21
rdx ^= rax; //xor rdx, rax
rdx += r10; //add rdx, r10
rdx ^= r11; //xor rdx, r11
return rdx;
}
case 9:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A4863A]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C0C2E]
rax = rdx; //mov rax, rdx
rax >>= 0xB; //shr rax, 0x0B
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x16; //shr rax, 0x16
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x2C; //shr rax, 0x2C
rdx ^= rax; //xor rdx, rax
rdx ^= r11; //xor rdx, r11
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = rdx; //mov rax, rdx
rax >>= 0xB; //shr rax, 0x0B
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x16; //shr rax, 0x16
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x2C; //shr rax, 0x2C
rdx ^= rax; //xor rdx, rax
rax = 0x53198E81F809E193; //mov rax, 0x53198E81F809E193
rax -= r10; //sub rax, r10
rax -= r11; //sub rax, r11
rdx += rax; //add rdx, rax
rax = 0x5E76F88978AFE528; //mov rax, 0x5E76F88978AFE528
rdx += rax; //add rdx, rax
rax = 0x33557C5CEFBE234B; //mov rax, 0x33557C5CEFBE234B
rdx *= rax; //imul rdx, rax
return rdx;
}
case 10:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A48149]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C073D]
rdx -= r11; //sub rdx, r11
rcx = rdx; //mov rcx, rdx
rcx >>= 0x27; //shr rcx, 0x27
rcx ^= rdx; //xor rcx, rdx
rdx = baseAddr + 0x9688; //lea rdx, [0xFFFFFFFFF90C9B6C]
rdx *= r10; //imul rdx, r10
rdx += rcx; //add rdx, rcx
rax = rdx; //mov rax, rdx
rax >>= 0x13; //shr rax, 0x13
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x26; //shr rax, 0x26
rdx ^= rax; //xor rdx, rax
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rax = 0x3331EF2FFF7DD801; //mov rax, 0x3331EF2FFF7DD801
rdx *= rax; //imul rdx, rax
rax = 0x2130706D6228E017; //mov rax, 0x2130706D6228E017
rdx ^= rax; //xor rdx, rax
return rdx;
}
case 11:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A47C96]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90C028A]
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rax = baseAddr + 0x1E13DCA3; //lea rax, [0x00000000171FDB86]
rax = ~rax; //not rax
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rax += r10; //add rax, r10
rcx ^= r9; //xor rcx, r9
rdx += rax; //add rdx, rax
rcx = _byteswap_uint64(rcx); //bswap rcx
rdx *= driver::read<uint64_t>(rcx + 0x11); //imul rdx, [rcx+0x11]
rax = r11 + 0x9d9e; //lea rax, [r11+0x9D9E]
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
rax = r10; //mov rax, r10
rax -= r11; //sub rax, r11
rdx += rax; //add rdx, rax
rax = 0x10CE41F37EB30D3D; //mov rax, 0x10CE41F37EB30D3D
rdx *= rax; //imul rdx, rax
rax = 0x3078E9571E8D51B0; //mov rax, 0x3078E9571E8D51B0
rdx -= rax; //sub rdx, rax
rax = 0x13796DAAB7614CCB; //mov rax, 0x13796DAAB7614CCB
rdx += rax; //add rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x11; //shr rax, 0x11
rdx ^= rax; //xor rdx, rax
rcx = baseAddr + 0x7C2A0085; //lea rcx, [0x000000007535FFFC]
rcx = ~rcx; //not rcx
rcx *= r10; //imul rcx, r10
rax = rdx; //mov rax, rdx
rax >>= 0x22; //shr rax, 0x22
rcx ^= rax; //xor rcx, rax
rdx ^= rcx; //xor rdx, rcx
return rdx;
}
case 12:
{
r8 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r8, [0x0000000005A47854]
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r8; //xor rax, r8
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rdx -= r10; //sub rdx, r10
rax = 0x509EB372CDB3AEF3; //mov rax, 0x509EB372CDB3AEF3
rdx *= rax; //imul rdx, rax
rax = 0x3978478545AD0B0E; //mov rax, 0x3978478545AD0B0E
rdx += rax; //add rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x11; //shr rax, 0x11
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x22; //shr rax, 0x22
rdx ^= rax; //xor rdx, rax
rax = 0xF1F3C3AA4D6D1089; //mov rax, 0xF1F3C3AA4D6D1089
rdx *= rax; //imul rdx, rax
return rdx;
}
case 13:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A473CF]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90BF9C3]
rax = rdx; //mov rax, rdx
rax >>= 0xE; //shr rax, 0x0E
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x1C; //shr rax, 0x1C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rax >>= 0x38; //shr rax, 0x38
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rdx ^= rax; //xor rdx, rax
rcx ^= r9; //xor rcx, r9
rdx += r10; //add rdx, r10
rcx = _byteswap_uint64(rcx); //bswap rcx
rdx *= driver::read<uint64_t>(rcx + 0x11); //imul rdx, [rcx+0x11]
rcx = baseAddr + 0x7FFA; //lea rcx, [0xFFFFFFFFF90C7935]
rax = 0xEA5C4AF83EEC98D; //mov rax, 0xEA5C4AF83EEC98D
rdx += rax; //add rdx, rax
rax = rcx; //mov rax, rcx
rax = ~rax; //not rax
rax ^= r10; //xor rax, r10
rdx ^= rax; //xor rdx, rax
rax = 0x58CCD785809FBA65; //mov rax, 0x58CCD785809FBA65
rdx *= rax; //imul rdx, rax
rax = 0xCB1252FFDD097729; //mov rax, 0xCB1252FFDD097729
rdx *= rax; //imul rdx, rax
rax = r11 + 0x1cfb; //lea rax, [r11+0x1CFB]
rax += r10; //add rax, r10
rdx += rax; //add rdx, rax
return rdx;
}
case 14:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A46E52]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90BF446]
rax = rdx; //mov rax, rdx
rax >>= 0x1C; //shr rax, 0x1C
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x38; //shr rax, 0x38
rdx ^= rax; //xor rdx, rax
rdx -= r11; //sub rdx, r11
rdx += 0xFFFFFFFFD3BC8867; //add rdx, 0xFFFFFFFFD3BC8867
rdx += r10; //add rdx, r10
rax = 0; //and rax, 0xFFFFFFFFC0000000
rax = _rotl64(rax, 0x10); //rol rax, 0x10
rax ^= r9; //xor rax, r9
rax = _byteswap_uint64(rax); //bswap rax
rdx *= driver::read<uint64_t>(rax + 0x11); //imul rdx, [rax+0x11]
rdx -= r11; //sub rdx, r11
rax = 0x311461FA31B150C8; //mov rax, 0x311461FA31B150C8
rdx ^= rax; //xor rdx, rax
rax = 0x3D057F65AC2E944D; //mov rax, 0x3D057F65AC2E944D
rdx += rax; //add rdx, rax
rax = 0x3EA61F392134306F; //mov rax, 0x3EA61F392134306F
rdx *= rax; //imul rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x16; //shr rax, 0x16
rdx ^= rax; //xor rdx, rax
rax = rdx; //mov rax, rdx
rax >>= 0x2C; //shr rax, 0x2C
rdx ^= rax; //xor rdx, rax
return rdx;
}
case 15:
{
r9 = driver::read<uint64_t>(baseAddr + 0xC9879F9); //mov r9, [0x0000000005A469F8]
r11 = baseAddr; //lea r11, [0xFFFFFFFFF90BEFEC]
rax = rdx; //mov rax, rdx
rax >>= 0x25; //shr rax, 0x25
rdx ^= rax; //xor rdx, rax
rdx -= r10; //sub rdx, r10
rcx = 0; //and rcx, 0xFFFFFFFFC0000000
rcx = _rotl64(rcx, 0x10); //rol rcx, 0x10
rcx ^= r9; //xor rcx, r9
rax = r11 + 0x953; //lea rax, [r11+0x953]
rax += r10; //add rax, r10
rcx = _byteswap_uint64(rcx); //bswap rcx
rdx ^= rax; //xor rdx, rax
rdx *= driver::read<uint64_t>(rcx + 0x11); //imul rdx, [rcx+0x11]
rax = 0xEDC186E4F45D82CF; //mov rax, 0xEDC186E4F45D82CF
rdx *= rax; //imul rdx, rax
rdx -= r10; //sub rdx, r10
rdx -= r11; //sub rdx, r11
rax = 0x579691DADE4159FD; //mov rax, 0x579691DADE4159FD
rdx *= rax; //imul rdx, rax
rax = 0x20B206512FA8AEE; //mov rax, 0x20B206512FA8AEE
rdx -= rax; //sub rdx, rax
rax = 0x804CFF40F9D9BEBF; //mov rax, 0x804CFF40F9D9BEBF
rdx *= rax; //imul rdx, rax
return rdx;
}
}
}
uintptr_t gamepass_get_bone_index(uint32_t bone_index, uint64_t baseAddr)
{
const uint64_t mb = baseAddr;
uint64_t rax = mb, rbx = mb, rcx = mb, rdx = mb, rdi = mb, rsi = mb, r8 = mb, r9 = mb, r10 = mb, r11 = mb, r12 = mb, r13 = mb, r14 = mb, r15 = mb;
rsi = bone_index;
rcx = rsi * 0x13C8;
rax = 0xD8CE01BF28E39A45; //mov rax, 0xD8CE01BF28E39A45
rax = _umul128(rax, rcx, (uintptr_t*)&rdx); //mul rcx
rdi = baseAddr; //lea rdi, [0xFFFFFFFFFD55EB5A]
r10 = 0xB225E47EA96E19B5; //mov r10, 0xB225E47EA96E19B5
rdx >>= 0xD; //shr rdx, 0x0D
rax = rdx * 0x25C9; //imul rax, rdx, 0x25C9
rcx -= rax; //sub rcx, rax
rax = 0xCEA41D97BF6494DF; //mov rax, 0xCEA41D97BF6494DF
r8 = rcx * 0x25C9; //imul r8, rcx, 0x25C9
rax = _umul128(rax, r8, (uintptr_t*)&rdx); //mul r8
rax = r8; //mov rax, r8
rax -= rdx; //sub rax, rdx
rax >>= 0x1; //shr rax, 0x01
rax += rdx; //add rax, rdx
rax >>= 0xE; //shr rax, 0x0E
rax = rax * 0x46D4; //imul rax, rax, 0x46D4
r8 -= rax; //sub r8, rax
rax = 0x526226F064679F75; //mov rax, 0x526226F064679F75
rax = _umul128(rax, r8, (uintptr_t*)&rdx); //mul r8
rax = 0xD79435E50D79435F; //mov rax, 0xD79435E50D79435F
rdx >>= 0x9; //shr rdx, 0x09
rcx = rdx * 0x637; //imul rcx, rdx, 0x637
rax = _umul128(rax, r8, (uintptr_t*)&rdx); //mul r8
rdx >>= 0x4; //shr rdx, 0x04
rcx += rdx; //add rcx, rdx
rax = rcx * 0x26; //imul rax, rcx, 0x26
rcx = r8 + r8 * 4; //lea rcx, [r8+r8*4]
rcx <<= 0x3; //shl rcx, 0x03
rcx -= rax; //sub rcx, rax
rax = driver::read<uint16_t>(rcx + rdi * 1 + 0xB932F40); //movzx eax, word ptr [rcx+rdi*1+0xB932F40]
r8 = rax * 0x13C8; //imul r8, rax, 0x13C8
rax = r10; //mov rax, r10
rax = _umul128(rax, r8, (uintptr_t*)&rdx); //mul r8
rcx = r8; //mov rcx, r8
rax = r10; //mov rax, r10
rcx -= rdx; //sub rcx, rdx
rcx >>= 0x1; //shr rcx, 0x01
rcx += rdx; //add rcx, rdx
rcx >>= 0xD; //shr rcx, 0x0D
rcx = rcx * 0x25BD; //imul rcx, rcx, 0x25BD
r8 -= rcx; //sub r8, rcx
r9 = r8 * 0x319C; //imul r9, r8, 0x319C
rax = _umul128(rax, r9, (uintptr_t*)&rdx); //mul r9
rax = r9; //mov rax, r9
rax -= rdx; //sub rax, rdx
rax >>= 0x1; //shr rax, 0x01
rax += rdx; //add rax, rdx
rax >>= 0xD; //shr rax, 0x0D
rax = rax * 0x25BD; //imul rax, rax, 0x25BD
r9 -= rax; //sub r9, rax
rax = 0x842108421084211; //mov rax, 0x842108421084211
rax = _umul128(rax, r9, (uintptr_t*)&rdx); //mul r9
rax = r9; //mov rax, r9
rax -= rdx; //sub rax, rdx
rax >>= 0x1; //shr rax, 0x01
rax += rdx; //add rax, rdx
rax >>= 0xA; //shr rax, 0x0A
rcx = rax * 0x7C0; //imul rcx, rax, 0x7C0
rax = 0xE38E38E38E38E38F; //mov rax, 0xE38E38E38E38E38F
rax = _umul128(rax, r9, (uintptr_t*)&rdx); //mul r9
rdx >>= 0x3; //shr rdx, 0x03
rcx += rdx; //add rcx, rdx
rax = rcx + rcx * 8; //lea rax, [rcx+rcx*8]
rax += rax; //add rax, rax
rcx = r9 + r9 * 4; //lea rcx, [r9+r9*4]
rcx <<= 0x2; //shl rcx, 0x02
rcx -= rax; //sub rcx, rax
r12 = driver::read<uint16_t>(rcx + rdi * 1 + 0xB941B70); //movsx r12d, word ptr [rcx+rdi*1+0xB941B70]
return r12;
}
}
}
namespace gamepassOffsets {
namespace BO6 {
static uint32_t timestamp = 0x671C4C3E; // not sure - dont think we need it
static uint32_t refdef = 0x133EC1A8; // updated 11/9
static uint32_t name_array = 0x135ABC78; // updated 11/9
static uint32_t name_array_pos = 0x1838; // updated 11/9
static uint32_t name_size = 0xC8; // updated 11/9
static uint32_t loot_ptr = 0xDF30440; // updated 11/9
static uint32_t loot_pos = 0x170;
static uint32_t loot_valid = 0x124;
static uint32_t loot_valid_supply = 0x126;
static uint32_t loot_size = 0x1F0;
static uint32_t camera_base = 0x13567050; // updated 11/9
static uint32_t camera_pos = 0x1F4; // updated 11/9
static uint32_t local_index = 0x17C280; // updated 11/9
static uint32_t local_index_pos = 0x344; // updated 11/9
static uint32_t recoil = 0xB5E20; // not updated
static uint32_t game_mode = 0xCBEF258; // updated 11/9
static uint32_t weapon_definitions = 0x13445220; // updated 11/9
static uint32_t distribute = 0x1000BF18; // updated 11/9
static uint32_t visible_offset = 0x1A1384; // updated 11/9
static uint32_t visible = 0x1A1384; // not sure
static uint32_t scoreboard = 0x16EC30; // untested
static uint32_t scoreboard_size = 0x90; // updated 11/9
namespace bone {
static uintptr_t base_pos = 0xED3B0; // updated 11/9
static uintptr_t index_struct_size = 0x1A8; // updated 11/9
};
namespace player {
static uint32_t size = 0x1DE8; // updated 11/9
static uint32_t valid = 0x230; // updated 11/9
static uint32_t pos = 0x19D8; // updated 11/9
static uint32_t team = 0x500; // updated 11/9
static uint32_t stance = 0xE68; // updated 11/9
static uint32_t weapon_index = 0x18AA; // updated 11/9
static uint32_t dead_1 = 0x9D4; // updated 11/9
static uint32_t dead_2 = 0x1198; // updated 11/9
static uint32_t entity_size = 0x4F0; // updated 10/23
static uint32_t entity_type = 0x388; // updated 10/23
static uint32_t entity_index = 0x380; // updated 10/23
static uint32_t entity_pos = entity_type + 0x1C;
}
}
};Editor is loading...
Leave a Comment