Jump to content

question Warzone unlock all?

SourceEngineMod
 Share

Recommended Posts

borisc Newbie

borisc

Posted
Posted (edited) 
With this release I'll show you how you can soft unlock the battlepass and every single microtranaction item in the game. That means every single weapon in the armory, every vehicle skin, operator skin, watch, decal, spray, taunt, reticle, calling card, all the special activision camos, and all the unreleased bundles and skins. And beacuse there aren't any checks for if you own the items you put on your account, once you reboot your game you keep everything you applied permanently 

You will need a hooking library like minhook or detours. You also need to hook the game after it runs some integrity checks on stayrtup so you don't crash immediately for hooking directly on the .text section. Just make sure you do this with a hook or the game does do a lazy check that will ban you for directly manipulating the loot data (Infinity Ward lazy idea for a "patch"). Hooking right after the intro screen when the game is connecting to online services should work good. Once you run the unlock function, you can just unhook directly after. You need two pretty known functions from the engine to work with the stringtables (StringTable_GetAsset, StringTable_GetColumnValueForRow) but thats all. You could get by without using those functions, but I'm going to use them in this example cause I don't want to post a stupidly long array again.

--------------------------------------------------

void UnlockEverything() {
 
	auto pLootBase = base + 0x9F0C910;// signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44 (LEA rcx, pLootBase)
 
	struct LootItem {
		int m_itemId;
		int m_itemQuantity;
	};
	
	struct StringTable {
		char* name;
		int columnCount;
		int rowCount;
	};
 
	auto pInventory = (LootItem*)((uintptr_t)pLootBase + 64);
 
	auto pNumItems = (uint32_t*)((uintptr_t)pLootBase + 240064);
 
	int curCount = *pNumItems;
 
	auto updateOrAddItem = [&] (int itemId, int quantity) {
 
		bool bFound = false;
 
		for (int i = 0; i < 30000; i++) {
			if (pInventory[i].itemId == itemId && pInventory[i].quantity < 1) {
				pInventory[i].quantity++;
				bFound = true;
				break;
			}
		}
 
		if (!bFound) {
			pInventory[curCount].itemId = itemId;
			pInventory[curCount].quantity = 1;
 
			curCount++;
			(*pNumItems)++;
 
			*(BYTE*)((uintptr_t)pLootBase + 240072) = 0;
		}
	};
 
	StringTable* loot_master = nullptr;
 
	StringTable_GetAsset("loot/loot_master.csv", &loot_master);
 
	for (int i = 1; i < loot_master->rowCount; i++) {
 
		char* loot_type = StringTable_GetColumnValueForRow(loot_master, i, 2);
 
		if (strstr(loot_type, "iw8_") || loot_type[0] == '#')
			continue;
			
		char buf[1024];
		
		sprintf_s(buf, "loot/%s_ids.csv", loot_type);
 
		StringTable * string_table = nullptr;
 
		StringTable_GetAsset(buf, &string_table);
 
		if (!string_table)
			continue;
 
		for (int s = 0; s < string_table->rowCount; s++) {
 
			updateOrAddItem(atoi(StringTable_GetColumnValueForRow(string_table, s, 0)), 1);
		}
	}
}
 
using MoveResponseToInventory_t = bool(__fastcall*)(LPVOID, int);
 
MoveResponseToInventory_t fpMoveResponseOrig;
 
pMoveResponseToInventory = 
 
bool __fastcall MoveResponseToInventory_Hooked(LPVOID a1, int a2) {
 
	fpMoveResponseOrig(a1, a2);
 
	UnlockEverything();
 
	MH_RemoveHook(pMoveResponseToInventory);
 
	return false;
}
 
void SetupYourHook() {
	if (MH_CreateHook(pMoveResponseToInventory, MoveResponseToInventory_Hooked, &fpMoveResponseOrig) != MH_SUCCESS) {
	
		printf("Failed to hook...");
	}
}
 
 
Addresses (latest update):
 
pMoveResponseToInventory: base + 0x576BB60 // signature 40 53 55 56 57 41 55 41 56 48 83 EC 28 4C
 
pLootBase: base + 0xA0DC290 // signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44
 
StringTable_GetAsset: base + 0x2F56A70 // signature E8 ? ? ? ? 48 8D 15 ? ? ? ? 8D 4B 36
 
StringTable_GetColumnValueForRow: base + 0x2F56AB0 // signature E8 ? ? ? ? 33 D2 48 8B C8 44 8D 42 16

 

Edited by borisc
  • Like 2
Link to comment
Share on other sites
btc Veteran

btc

Posted
Posted
On 7/5/2021 at 2:21 PM, borisc said: 

With this release I'll show you how you can soft unlock the battlepass and every single microtranaction item in the game. That means every single weapon in the armory, every vehicle skin, operator skin, watch, decal, spray, taunt, reticle, calling card, all the special activision camos, and all the unreleased bundles and skins. And beacuse there aren't any checks for if you own the items you put on your account, once you reboot your game you keep everything you applied permanently 

You will need a hooking library like minhook or detours. You also need to hook the game after it runs some integrity checks on stayrtup so you don't crash immediately for hooking directly on the .text section. Just make sure you do this with a hook or the game does do a lazy check that will ban you for directly manipulating the loot data (Infinity Ward lazy idea for a "patch"). Hooking right after the intro screen when the game is connecting to online services should work good. Once you run the unlock function, you can just unhook directly after. You need two pretty known functions from the engine to work with the stringtables (StringTable_GetAsset, StringTable_GetColumnValueForRow) but thats all. You could get by without using those functions, but I'm going to use them in this example cause I don't want to post a stupidly long array again.

--------------------------------------------------

void UnlockEverything() {
 
	auto pLootBase = base + 0x9F0C910;// signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44 (LEA rcx, pLootBase)
 
	struct LootItem {
		int m_itemId;
		int m_itemQuantity;
	};
	
	struct StringTable {
		char* name;
		int columnCount;
		int rowCount;
	};
 
	auto pInventory = (LootItem*)((uintptr_t)pLootBase + 64);
 
	auto pNumItems = (uint32_t*)((uintptr_t)pLootBase + 240064);
 
	int curCount = *pNumItems;
 
	auto updateOrAddItem = [&] (int itemId, int quantity) {
 
		bool bFound = false;
 
		for (int i = 0; i < 30000; i++) {
			if (pInventory[i].itemId == itemId && pInventory[i].quantity < 1) {
				pInventory[i].quantity++;
				bFound = true;
				break;
			}
		}
 
		if (!bFound) {
			pInventory[curCount].itemId = itemId;
			pInventory[curCount].quantity = 1;
 
			curCount++;
			(*pNumItems)++;
 
			*(BYTE*)((uintptr_t)pLootBase + 240072) = 0;
		}
	};
 
	StringTable* loot_master = nullptr;
 
	StringTable_GetAsset("loot/loot_master.csv", &loot_master);
 
	for (int i = 1; i < loot_master->rowCount; i++) {
 
		char* loot_type = StringTable_GetColumnValueForRow(loot_master, i, 2);
 
		if (strstr(loot_type, "iw8_") || loot_type[0] == '#')
			continue;
			
		char buf[1024];
		
		sprintf_s(buf, "loot/%s_ids.csv", loot_type);
 
		StringTable * string_table = nullptr;
 
		StringTable_GetAsset(buf, &string_table);
 
		if (!string_table)
			continue;
 
		for (int s = 0; s < string_table->rowCount; s++) {
 
			updateOrAddItem(atoi(StringTable_GetColumnValueForRow(string_table, s, 0)), 1);
		}
	}
}
 
using MoveResponseToInventory_t = bool(__fastcall*)(LPVOID, int);
 
MoveResponseToInventory_t fpMoveResponseOrig;
 
pMoveResponseToInventory = 
 
bool __fastcall MoveResponseToInventory_Hooked(LPVOID a1, int a2) {
 
	fpMoveResponseOrig(a1, a2);
 
	UnlockEverything();
 
	MH_RemoveHook(pMoveResponseToInventory);
 
	return false;
}
 
void SetupYourHook() {
	if (MH_CreateHook(pMoveResponseToInventory, MoveResponseToInventory_Hooked, &fpMoveResponseOrig) != MH_SUCCESS) {
	
		printf("Failed to hook...");
	}
}
 
 
Addresses (latest update):
 
pMoveResponseToInventory: base + 0x576BB60 // signature 40 53 55 56 57 41 55 41 56 48 83 EC 28 4C
 
pLootBase: base + 0xA0DC290 // signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44
 
StringTable_GetAsset: base + 0x2F56A70 // signature E8 ? ? ? ? 48 8D 15 ? ? ? ? 8D 4B 36
 
StringTable_GetColumnValueForRow: base + 0x2F56AB0 // signature E8 ? ? ? ? 33 D2 48 8B C8 44 8D 42 16

 

 

impressive +1

Link to comment
Share on other sites
stacy98 Newbie

stacy98

Posted
Posted
On 7/5/2021 at 4:21 AM, borisc said: 

With this release I'll show you how you can soft unlock the battlepass and every single microtranaction item in the game. That means every single weapon in the armory, every vehicle skin, operator skin, watch, decal, spray, taunt, reticle, calling card, all the special activision camos, and all the unreleased bundles and skins. And beacuse there aren't any checks for if you own the items you put on your account, once you reboot your game you keep everything you applied permanently 

You will need a hooking library like minhook or detours. You also need to hook the game after it runs some integrity checks on stayrtup so you don't crash immediately for hooking directly on the .text section. Just make sure you do this with a hook or the game does do a lazy check that will ban you for directly manipulating the loot data (Infinity Ward lazy idea for a "patch"). Hooking right after the intro screen when the game is connecting to online services should work good. Once you run the unlock function, you can just unhook directly after. You need two pretty known functions from the engine to work with the stringtables (StringTable_GetAsset, StringTable_GetColumnValueForRow) but thats all. You could get by without using those functions, but I'm going to use them in this example cause I don't want to post a stupidly long array again.

--------------------------------------------------

void UnlockEverything() {
 
	auto pLootBase = base + 0x9F0C910;// signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44 (LEA rcx, pLootBase)
 
	struct LootItem {
		int m_itemId;
		int m_itemQuantity;
	};
	
	struct StringTable {
		char* name;
		int columnCount;
		int rowCount;
	};
 
	auto pInventory = (LootItem*)((uintptr_t)pLootBase + 64);
 
	auto pNumItems = (uint32_t*)((uintptr_t)pLootBase + 240064);
 
	int curCount = *pNumItems;
 
	auto updateOrAddItem = [&] (int itemId, int quantity) {
 
		bool bFound = false;
 
		for (int i = 0; i < 30000; i++) {
			if (pInventory[i].itemId == itemId && pInventory[i].quantity < 1) {
				pInventory[i].quantity++;
				bFound = true;
				break;
			}
		}
 
		if (!bFound) {
			pInventory[curCount].itemId = itemId;
			pInventory[curCount].quantity = 1;
 
			curCount++;
			(*pNumItems)++;
 
			*(BYTE*)((uintptr_t)pLootBase + 240072) = 0;
		}
	};
 
	StringTable* loot_master = nullptr;
 
	StringTable_GetAsset("loot/loot_master.csv", &loot_master);
 
	for (int i = 1; i < loot_master->rowCount; i++) {
 
		char* loot_type = StringTable_GetColumnValueForRow(loot_master, i, 2);
 
		if (strstr(loot_type, "iw8_") || loot_type[0] == '#')
			continue;
			
		char buf[1024];
		
		sprintf_s(buf, "loot/%s_ids.csv", loot_type);
 
		StringTable * string_table = nullptr;
 
		StringTable_GetAsset(buf, &string_table);
 
		if (!string_table)
			continue;
 
		for (int s = 0; s < string_table->rowCount; s++) {
 
			updateOrAddItem(atoi(StringTable_GetColumnValueForRow(string_table, s, 0)), 1);
		}
	}
}
 
using MoveResponseToInventory_t = bool(__fastcall*)(LPVOID, int);
 
MoveResponseToInventory_t fpMoveResponseOrig;
 
pMoveResponseToInventory = 
 
bool __fastcall MoveResponseToInventory_Hooked(LPVOID a1, int a2) {
 
	fpMoveResponseOrig(a1, a2);
 
	UnlockEverything();
 
	MH_RemoveHook(pMoveResponseToInventory);
 
	return false;
}
 
void SetupYourHook() {
	if (MH_CreateHook(pMoveResponseToInventory, MoveResponseToInventory_Hooked, &fpMoveResponseOrig) != MH_SUCCESS) {
	
		printf("Failed to hook...");
	}
}
 
 
Addresses (latest update):
 
pMoveResponseToInventory: base + 0x576BB60 // signature 40 53 55 56 57 41 55 41 56 48 83 EC 28 4C
 
pLootBase: base + 0xA0DC290 // signature 48 8D 0D ? ? ? ? 48 8D 44 24 ? C7 44
 
StringTable_GetAsset: base + 0x2F56A70 // signature E8 ? ? ? ? 48 8D 15 ? ? ? ? 8D 4B 36
 
StringTable_GetColumnValueForRow: base + 0x2F56AB0 // signature E8 ? ? ? ? 33 D2 48 8B C8 44 8D 42 16

 

 

how do you use this?

Link to comment
Share on other sites
  • 7 months later...
  • 3 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...