BF4 Attachment Unlocker

**xlolxapplex** · 07-15-2015

0x1421968A8 and 0x54

thats all...

Warning: Do not use DICE skins! Attachments only. Using guns you haven't unlocked will spawn you without gun.

Originally Posted by Cultist Turtleist

Is-is this a fucking joke? Can we get more than this?

lel fine F10-Unlock F11-Disable F12-Quit
C++

Code:

#include "stdafx.h"

#include <windows.h>
#include <psapi.h>
#include <tlhelp32.h>


BOOL Unlock( HANDLE hProcess, BOOL status )
{
    // Dereference static pointer

    uintptr_t SyncedSettings = NULL;

    if ( !ReadProcessMemory( hProcess, reinterpret_cast<LPCVOID>( 0x1421968A8 ), &SyncedSettings, sizeof( PVOID ), NULL ) )
    {
        printf( "[!] Failed to call ReadProcessMemory( ), GetLastError( )=%d\n", GetLastError( ) );
        return FALSE;
    }

    // Add offset

    uintptr_t UnlockOffset = SyncedSettings + 0x54;
    byte enabled;

    if ( status )
        enabled = 1;
    else
        enabled = 0;

    if ( !WriteProcessMemory( hProcess, reinterpret_cast<LPVOID>( UnlockOffset ), &enabled, sizeof( enabled ), NULL ) )
    {
        printf( "[!] Failed to call WriteProcessMemory( ), GetLastError( )=%d\n", GetLastError( ) );
        return FALSE;
    }

    printf( "[+] Unlock flag has been set to: %d\n", status );

    return TRUE;
}

DWORD GetProcessByName( LPTSTR lpExeName )
{
    HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );

    if ( hSnapShot == INVALID_HANDLE_VALUE )
    {
        printf( "[!] Failed to call CreateToolhelp32Snapshot, GetLastError( ) = %d\n", GetLastError( ) );    
        return NULL;
    }

    PROCESSENTRY32 pe = { 0 };
    pe.dwSize = sizeof( PROCESSENTRY32 );

    for ( BOOL success = Process32First( hSnapShot, &pe ); success == TRUE; success = Process32Next( hSnapShot, &pe ) )
    {
        if ( wcscmp( lpExeName, pe.szExeFile ) == 0 )
        {
            CloseHandle( hSnapShot );
            return pe.th32ProcessID;
        }
    }

    CloseHandle( hSnapShot );
    return NULL;
}

int _tmain( int argc, _TCHAR* argv[] )
{
    printf( "[+] BF4 Unlocker\n" );
    printf( "[+] Waiting for BF4.exe...\n" );

    // Find BF4 in the process list
        
    DWORD dwPid = NULL;

    while( !dwPid )
        dwPid = GetProcessByName( L"bf4.exe" );

    printf( "[+] BF4.exe 0x%X\n", dwPid );
    
    HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwPid );

    if ( !hProcess )
        printf( "[!] Failed to call OpenProcess( ), GetLastError( )=%d\n", hProcess );

    while( 1 )
    {
        if ( GetAsyncKeyState( VK_F10 ) )
            Unlock( hProcess, TRUE );

        if ( GetAsyncKeyState( VK_F11 ) )
            Unlock( hProcess, FALSE );

        if ( GetAsyncKeyState( VK_F12 ) )
            break;

        Sleep( 100 );
    }

    return 0;
}