CS.RIN.RU - Steam Underground Community :: View topic

CS.RIN.RU - Steam Underground Community http://cs.rin.ru/forum/

[Release] XLive (aka GFWL) emulator http://cs.rin.ru/forum/viewtopic.php?f=38&t=60668	Page 47 of 62

Author:	JOHN30011887 [ Thursday, 24 Apr 2014, 17:03 ]
Post subject:	Re: XLive (aka GFWL) emulator
thanks aclair, for dlc unlocker

Author:	aclair [ Friday, 25 Apr 2014, 04:03 ]
Post subject:	Re: XLive (aka GFWL) emulator
Thanks everyone. Beatrix and I worked out a few more DLCs. Although the procedure is flaky - it involves somehow "fooling" the xbox servers to release "hidden" links that normally don't work. Suggested tool: Free Download Manager ex. Battlestations Pacific http://download.xbox.com/content/534307 ... cf0005.cab = Carrier Battles Map Pack - This link always works directly http://download.xbox.com/content/534307 ... cf0003.cab = Volcano Map Pack - This link usually doesn't seem to work directly without GFWL client. When you start punching in random links though, 0003.cab actually begins to work! Although it's really experimental which ones will do the trick. - http://download.xbox.com/content/534307 ... cf000f.cab - http://download.xbox.com/content/534307 ... cf000e.cab (..) So use Free Download Manager: 1. Downloads --> Create Batch Download 2. URL = http://download.xbox.com/content/534307 ... 0ecf000(a).cab 3. Downloads --> Create Batch Download 4. URL = http://download.xbox.com/content/534307 ... fa0ecf00()(a).cab 5. Downloads --> Create Batch Download 6. URL = http://download.xbox.com/content/534307 ... a0ecf00(a)().cab 7. Downloads --> Create Batch Download 8. URL = http://download.xbox.com/content/534307 ... a0ecf000().cab 9. Downloads --> Create Batch Download 10. Set of numbers: 10-99 11. http://download.xbox.com/content/534307 ... fa0ecf00(*).cab Random chance you'll get both 0003 + 0005. If not, select all links. Hit Shift + Q to query file sizes again. Keep doing until 0003.cab tells you size is 223 MB Download and score! Although Mustang is missing (unknown link). Other DLCs that require this trick: 1. Fallout 3 http://download.xbox.com/content/425307 ... cf0016.cab Point Lookout http://download.xbox.com/content/425307 ... cf0017.cab Point Lookout (v2?) http://download.xbox.com/content/425307 ... cf0019.cab Point Lookout (v3?) 2. Microsoft Flight http://download.xbox.com/content/4d5308 ... 070000.cab C-46 I've heard that Red River DLC is manifest GFWL protected. So it may take big luck to backport those 360 files.

Author:

davispuh [ Sunday, 27 Apr 2014, 06:54 ]

Post subject:

Re: XLive (aka GFWL) emulator

Oh my god, ZOMG!!! And it was all these years, GFWL and Xbox Game downloads (including DLCs) are not protected in any way from Microsoft servers. If you know link you can download those, but what is even better is that those links are predictable and exposed in various places. What a shame I only discovered it now when GFWL marketplace have been shutdown

I could have downloaded all GFWL games and DLCs ::D

So anyway, I found this XBLM Browser it allows to download any Xbox game from M$ servers directly. It was made in 2012 but still works lol.

Turns out there are lots of undocumented Xbox Live APIs. And this program uses this URL to get a list of games

Quote:

http://catalog-cdn.xboxlive.com/Catalog/Catalog.asmx/Query?methodName=FindGames&Names=Locale&Values=en-US&Names=LegalLocale&Values=en-US&Names=Store&Values=1&Names=PageSize&Values=50&Names=PageNum&Values=1&Names=DetailView&Values=5&Names=OfferFilterLevel&Values=1&Names=CategoryIds&Values=3027&Names=UserTypes&Values=1&Names=MediaTypes&Values=23

I found someone have writen about this Query call Querying Public Content In The Xbox Marketplace
Result of this call is returned as XML Atom and from it you can get games GUID. With this GUID you can get more information about game. Another way to get games GUID is look in marketplace and view some game for example Battlefield 4 Naval Strike you can see in URL there's it's GUID "a3576d81-4a5f-40d1-b1f7-e4a3a62f2a05"
Now using this other API URL (use games GUID)

Quote:

http://marketplace.xboxlive.com/marketplacecatalog/v1/product/en-us/a3576d81-4a5f-40d1-b1f7-e4a3a62f2a05?tiers=2.3&offerfilter=1

Result is again XML Atom so just view pages source and use XML Formatter to make it readable.
Then there find "//offerInstance[1]/hexOfferId[1]" and it will be "<contentId>bUfxnFqI4xnLdKhV36Pl+z0ywMo=</contentId>"
Use some base64 decode to hex tool and you'll get "6D47F19C5A88E319CB74A855DFA3E5FB3D32C0CA" from it.
Then convert to lowercase and so "6d47f19c5a88e319cb74a855dfa3e5fb3d32c0ca"
Now get "//hexTitleId[1]" from previous XML Atom, it will be "<hexTitleId>0x454109ba</hexTitleId>"
Finally you can download Battlefield 4 Naval Strike directly from M$ servers "http://download.xbox.com/content/454109ba/6d47f19c5a88e319cb74a855dfa3e5fb3d32c0ca.xcp"

And here is the mindblow part: Xbox LIVE and GFWL uses same database and so it works exactly in same way for PC games, DLCs, only thing is that GFWL marketplace is down

and so there aren't any purchase offers and "offerInstance" doesn't exist in PC game data. But this have been working so for several years. I can't believe it's 2014 year and people still have open unprotected file downloads and open API access :ROFL:

But no worries, even thu GFWL market is down, files are still there and all accessible, need to just know links and good is that they are predictable.

There are several kinds of links (they are case-sensitive):

"http://download.xbox.com/content/#{LOWER(HEX(TitleID))}/#{LOWER(HEX(OfferingID))}.cab"
"http://download.xbox.com/content/#{LOWER(HEX(TitleID))}/#{LOWER(HEX(ContentID))}.cab"
"http://download.xbox.com/content/gfwl-public/packages/#{LOWER(HEX(TitleID))}/#{LOWER(HEX(OfferingID))}.cab"
"http://download.xbox.com/content/{LOWER(HEX(TitleID))}/#{LOWER(HEX(OfferingID))}_manifest.cab"
"http://download.xbox.com/content/gfwl/#{UPPER(HEX(TitleID))}/#{UPPER(HEX(OfferingID))}_#{Part}.cab"
"http://download.xbox.com/content/gfwl/#{UPPER(HEX(TitleID))}/#{UPPER(HEX(OfferingID))}_#{UPPER(Uknown_GUID)}_#{Part}.cab"
"http://download.xbox.com/content/#{LOWER(HEX(TitleID))}/#{LOWER(HEX(TitleID))}#{LOWER(HEX(BaseVersion))}_#{LOWER(HEX(UpdateVersion))}.cab"
"http://download.xbox.com/content/#{LOWER(HEX(TitleID))}/tu#{LOWER(HEX(BaseVersion))}_#{LOWER(HEX(UpdateVersion))}.cab"

If you know those params, simply replace #{} with them and you can download even full games

But not all links will work.

To find some games TitleID, if you've previously downloaded it you can look for folder names in "%AppData%\..\Local\Microsoft\XLive\DLC\", "%AppData%\..\Local\Microsoft\XLive\DLC\" and "%AppData%\..\Local\Microsoft\XLive\Updates\"
Another way is using GFWL Marketplace with WayBackMachine and then from game GUID. Last 8 chars are TitleID. For example Microsoft Flight GUID is "66acd000-77fe-1000-9115-d8044d5308d2" and so 4d5308d2 is TitleID in hex, also btw "04" in GUID before TitleID means it's PC platform (02 means Xbox 360)
If you've TitleID and want to know which game it is you can use "http://api.expe.app.v3n3.org/display/game/4d5308d2"

Next you can try to guess OfferingID, first 8 characters of it are TitleID and then typically it's e0000001 for base game. So for Microsoft Flight this link does work "http://download.xbox.com/content/gfwl-public/packages/4d5308d2/4d5308d2e0000001.cab"

OfferingID for DLCs typically ends with 0ecf0001 (0ecf0002, 0ecf0003, 0ecf0004, etc), but it varies per game, for Microsoft Flight it's 00070000, 000a0000, 000b0000 so this link does work "http://download.xbox.com/content/4d5308d2/4d5308d2000b0000.cab". DLCs are the most easiest ones to guess, because of this OfferingID predictability.

Currently I don't know any way to guess ContentID and whether it's even possible, but need just someone who have it downloaded to post it and then everyone can download. You can find it as file name for Updates and DLCs, it's also shown in content.xbx files. It seems to be SHA1 of some data so if can figure that out maybe it would be possible to predict it, also it's same as productInstanceId (not to mix with productId). So anyway for Age of Empires Online ContentID is 12755128321de372588590529b0fa9f1a44cd0c8 and so these links does work "http://download.xbox.com/content/4d530fa3/12755128321de372588590529b0fa9f1a44cd0c8_manifest.cab" "http://download.xbox.com/content/gfwl/4D530FA3/12755128321DE372588590529B0FA9F1A44CD0C8_B926B799-A0A2-41BC-B556-CBFAFA80F030_1.cab"

I don't know what is Uknown_GUID and also not sure if it's guessable, but you can see it in manifest file.

Part is obviously guessable, 1, 2, 3, 4 etc.

BaseVersion is typically 10000081, 10000082, 10000083, etc. and UpdateVersion 10000181, 10000182, 10000183, etc. but it differs per games, still pretty guessable. Also you can find those in content.xbx, so for Microsoft Flight these links does work "http://download.xbox.com/content/4d5308d2/tu10000081_10000281.cab", "http://download.xbox.com/content/4d5308d2/tu10000081_10000581.cab" btw "tu" means Title Update

I guess this is all to successfully guess download links, it would be quite trivial to write script which tries all combinations. Anyway I started to gather some list of these download links and created Google Doc, you can view it anyone can comment, but can't edit, so just comment if you've new links or can post them here. I've also attached this file.

One more thing, there in "Secured?" column, "NO" means that you can download those anytime, but "SEEMS SO" means they should exist but are not downloadable so probably deleted and "PARTLY" means that sometimes they don't work so just try again later.

If you open some "PARTLY" link and it gives `File not found."` or shows "HTTP/1.1 403 Forbidden" or server header is "Server: Apache" or "Server: AkamaiGHost" it means you didn't even got till correct backend and so just try again later, server must be "Server: Level-3 Origin Storage 1.6.2" I think this isn't protection but just very unreliable servers.

TL;DR: Can download any GFWL games and DLCs dirrectly from Microsoft servers with just knowing link which mostly are predictable. Compiled list of download links at Google Docs

Attachments:

GFWL Downloads.zip [66.64 KiB]
Downloaded 61 times

Author:	aclair [ Sunday, 27 Apr 2014, 17:45 ]
Post subject:	Re: XLive (aka GFWL) emulator
Oh! I love you for this. Nicely done. I was pulling my threads out trying to figure out Game Room DLC ids. You should merge your list with catspaw database: cs.rin.ru/forum/viewtopic.php?p=882016#p882016 And add these: Fallout 3 - Point Lookout http://download.xbox.com/content/425307 ... cf0017.cab http://download.xbox.com/content/425307 ... cf0019.cab (PARTLY) I had to hammer 0001-0099 before the servers released them to me. If we can find Dark Void GFWL PC... that's a hard one. Or Tron DLC2 for 360. -- Edit -- Example game link: http://download.xbox.com/content/545408 ... nifest.cab Episodes from Liberty City Maybe time of day makes a difference for PARTLY links. Found some stuff I wanted: Prince of Persia - epilogue (360) http://download.xbox.com/content/555308 ... af7f9f.xcp Tron Multiplayer Map Pack (360) http://download.xbox.com/content/425607 ... 55e766.xcp and they're encrypted.

Author:	davispuh [ Monday, 28 Apr 2014, 08:26 ]
Post subject:	Re: XLive (aka GFWL) emulator
I added all links from catspaw file, I wonder why there TitleIDs are called GPD? also I added few more so docs are the most complete list of course it's really incomplete overall but it's very easy to get more games so just post when you find one aclair wrote: And add these: Fallout 3 - Point Lookout http://download.xbox.com/content/425307 ... cf0017.cab http://download.xbox.com/content/425307 ... cf0019.cab (PARTLY) try them yourself, those are not valid ones, Fallout 3 - Point Lookout is 0ecf0016 not 0ecf0017, 0ecf0019 if you get empty page and if you look at header, you'll see "Server: Level-3 Origin Storage 1.6.2" so that's correct server and so this actually doesn't exist. Thanks for Liberty City, I added it, full download I guess I forgot to tell few things. DLC GUIDs are also very useful, for example GUID for Game Pack 013 is "00000000-0000-4001-8000-d0004d530901" And like I said same for games itself last 8 chars are TitleID, then for DLCs follows last 8 chars of OfferingID. So to get it, remove beginning "00000000-0000-40" and then remove "-80" and "-", so you'll get "00100d000". And now just add OfferingID=TitleID+these 8 chars and then http://download.xbox.com/content/4d530901/4d5309010100d000.cab It's so for all DLCs so very simple. Only some files can have extra text/extension you'll have to know/guess. Also Xbox 360 game DLC OfferingIDs usually are in same range as for GFWL so use them as hints. eg. "00200d000" is Game Pack 013 for Xbox 360 Another thing is that if you've manifest file then that name is actual ContentID which is enough to download full version, also you can extract .cab files and look there inside for "content.xbx" file in which there's also ContentID. I also found that first 4 chars (2 bytes) from TitleID is Publisher ID, "4d53" - Microsoft (if you convert to ASCII it will be "MS"), I added in docs few more spreadsheets for such info, descriptions. About Xbox downloads I don't really know, but xcp means Xbox Content Package and it's encrypted with some key which is somewhere inside Xbox as it can decrypt it, there's also tool which can extract How to make Halo Reach .xcp into extracted iso only that tool is meant for Halo Reach xcp, but I read that it works for other files too, so just rename to c:\halo\reach.xcp I tested but for me this didn't worked and program stuck in infinite loop. I searched all over web and didn't found any other tool so looks like no one have reversed this file yet. I don't have xbox so not my problem Also if anyone finds GFWL SDK please post, it could help a lot, I can't believe it haven't been leaked yet there could be files like GFWLClientPartnerNet.msi, xLivePartnerNetRedist.msi, this is only post what I've found Games for Windows Live SDK

Author:

aclair [ Monday, 28 Apr 2014, 22:12 ]

Post subject:

Re: XLive (aka GFWL) emulator

Quote:

try them yourself, those are not valid ones, Fallout 3 - Point Lookout is 0ecf0016 not 0ecf0017, 0ecf0019
if you get empty page and if you look at header, you'll see "Server: Level-3 Origin Storage 1.6.2" so that's correct server and so this actually doesn't exist.

I'm 95% sure they did show up. But only that one stupid time (~8-9 PST). Different file sizes. 0016 < 0017 < 0019. But it never happens anymore. I downloaded partial files to examine the contents and they said Point Lookout. But erased them.

Anyways if I get them to show up again, I'm recording the file sizes and taking a screenshot.

I do know Pacific Mustang Pack still exists but don't know the correct name. There's folks still downloading them from Steam but they won't give out the link.

Thanks for the database!

edit:
2 more links.

DiRT 3 - Colin McRae Vision Charity Pack (69 MB)
http://download.xbox.com/content/434d0f ... cf0018.cab
(tried via many proxies - okay)

Dawn of War II - Exclusive Content
http://download.xbox.com/content/545108 ... c00000.cab
(I got it in January)

So here's my DOW2 DLC copies.

Attachments:

Dawn of War 2 DLC.7z [2.68 MiB]
Downloaded 15 times

Author:	davispuh [ Monday, 28 Apr 2014, 23:43 ]
Post subject:	Re: XLive (aka GFWL) emulator
I already had there "0ecf0018.cab" "DiRT 3 - Colin McRae Vision Charity Pack" added but didn't had name for it so I added name now I've there "0ec00009" for "Chaos Rising - Exclusive Content", but "0ec00000" doesn't work, added it anyway. I think it could be so that they delete old versions and that this new 0ec00009 includes stuff from 0ec00000 so that's not needed. Also BTW version have this structure: Quote: major.minor build "base disc version" 0x10 0000 81 total 4 bytes, first 1 byte for major.minor (4 bits for each part), then 2 bytes for build and 1 byte for disc version which mostly is used like region and disk version must be same for base version and update version. There's another link format I didn't wrote earier "http://download.xbox.com/content/#{LOWER(HEX(TitleID))}/#{LOWER(HEX(TitleID))}#{LOWER(HEX(BaseVersion))}#{LOWER(HEX(UpdateVersion))}.cab"

Author:	idragonuv [ Tuesday, 29 Apr 2014, 06:28 ]
Post subject:	Re: XLive (aka GFWL) emulator
Does anyone have the base client for Game Room? Also, is there anyway to unlock DLC achievements in GFWL for games like Bioshock 2 and Fable III? Like I can get GFWL running to unlock basic achievements, but I can't unlock DLC achievements. As soon as I use catspaw's xlive.dll though, the DLC works, but I can no longer obtain achievements in the GFWL interface. I'm trying to 100% achievement these games before GFWL gets shut down for good. Any help would be appreciated.

Author:	davispuh [ Tuesday, 29 Apr 2014, 20:06 ]
Post subject:	Re: XLive (aka GFWL) emulator
idragonuv wrote: Does anyone have the base client for Game Room? You should have looked more carefully in google doc file, it's there Anyway Setup and Update About unlocking idk, you need crack, DLC unlocker something like that and if you're using Xliveless then obviously it won't touch LIVE services.

Author:	idragonuv [ Wednesday, 30 Apr 2014, 01:58 ]
Post subject:	Re: XLive (aka GFWL) emulator
You are amazing! Thanks for the Game Room client! Now all I need is a Where's Waldo, Mahjong Wisdom, AFL Live, and Rugby League Live!

Author:	aclair [ Wednesday, 30 Apr 2014, 05:14 ]
Post subject:	Re: XLive (aka GFWL) emulator
Dawn of War II DLC is up again. http://download.xbox.com/content/545108 ... c00000.cab Quote: http://www.webconfs.com/http-header-check.php HTTP/1.1 200 OK => Cache-Control => max-age=604800 Content-Length => 20171 Content-Type => text/plain; charset=UTF-8 ETag => "4ecb-461bb8a6cb000" Expires => Wed, 07 May 2014 01:00:25 GMT Last-Modified => Fri, 30 Jan 2009 23:26:56 GMT Accept-Ranges => bytes Server => Level-3 Origin Storage 1.6.2 Date => Wed, 30 Apr 2014 01:00:25 GMT MSRegion => emea Connection => close If you're collecting PC trailer links, you can add these since GFWL is going dead. I remember seeing some for BioShock 2 also. Almost useless other than for nostalgia sake. Fallout 3 http://download.xbox.com/content/425307 ... BF0001.cab http://download.xbox.com/content/425307 ... BF0002.cab http://download.xbox.com/content/425307 ... BF0003.cab http://download.xbox.com/content/425307 ... BF0004.cab http://download.xbox.com/content/425307 ... BF0005.cab http://download.xbox.com/content/425307 ... BF0006.cab http://download.xbox.com/content/425307 ... BF0007.cab http://download.xbox.com/content/425307 ... BF0009.cab registration video (1 mb) http://download.xbox.com/content/425307 ... BF0010.cab http://download.xbox.com/content/425307 ... BF0011.cab http://download.xbox.com/content/425307 ... BF0012.cab http://download.xbox.com/content/425307 ... BF0013.cab the pitt trailer (71 mb) I guess figuring out game manifest IDs are a lot harder without asking other people who still have their content.xbx or manifest files. BSP Mustang DLC ContentID = 8945016215632815093287215674215674218750 (haven't found anything useful with this yet) -- Edit -- Fallout 3 - The Pitt http://download.xbox.com/content/425307 ... c00010.cab HTTP/1.1 200 OK => Cache-Control => max-age=604800 Content-Length => 352131337 Content-Type => text/plain; charset=UTF-8 ETag => "14fd1909-4669bfdb05b40" Expires => Wed, 07 May 2014 01:26:11 GMT Last-Modified => Fri, 03 Apr 2009 00:54:29 GMT Accept-Ranges => bytes Server => Level-3 Origin Storage 1.6.2 Date => Wed, 30 Apr 2014 01:26:11 GMT MSRegion => emea Connection => close Fallout 3 - Broken Steel http://download.xbox.com/content/425307 ... c00011.cab HTTP/1.1 200 OK => Cache-Control => max-age=604800 Content-Length => 510028115 Content-Type => text/plain; charset=UTF-8 ETag => "1e666953-468a5020ad700" Expires => Wed, 07 May 2014 01:26:29 GMT Last-Modified => Tue, 28 Apr 2009 22:30:20 GMT Accept-Ranges => bytes Server => Level-3 Origin Storage 1.6.2 Date => Wed, 30 Apr 2014 01:26:29 GMT MSRegion => emea Connection => close Fallout 3 - Broken Steel (French) http://download.xbox.com/content/425307 ... c00012.cab HTTP/1.1 200 OK => Cache-Control => max-age=604800 Content-Length => 504125566 Content-Type => text/plain; charset=UTF-8 ETag => "1e0c587e-46910ed736ac0" Expires => Wed, 07 May 2014 01:26:49 GMT Last-Modified => Mon, 04 May 2009 07:15:31 GMT Accept-Ranges => bytes Server => Level-3 Origin Storage 1.6.2 Date => Wed, 30 Apr 2014 01:26:49 GMT MSRegion => emea Connection => close Fallout 3 - Mothership Zeta (French) http://download.xbox.com/content/425307 ... cf0021.cab Fallout 3 - Mothership Zeta (Italian) http://download.xbox.com/content/425307 ... cf0022.cab Fallout 3 - Mothership Zeta (German) http://download.xbox.com/content/425307 ... cf0023.cab Fallout 3 - Mothership Zeta (Spanish) http://download.xbox.com/content/425307 ... cf0024.cab

Author:	idragonuv [ Wednesday, 30 Apr 2014, 06:23 ]
Post subject:	Re: XLive (aka GFWL) emulator
I can't seem to find a Gotham City Impostors setup in the Google Docs. Is it impossible to find, or has it just not been found yet? I'm really looking for that.

Author:	davispuh [ Wednesday, 30 Apr 2014, 07:45 ]
Post subject:	Re: XLive (aka GFWL) emulator
aclair wrote: Dawn of War II DLC is up again. http://download.xbox.com/content/545108 ... c00000.cab that's really weird, and yeah I was able to download it. I think there might be multiple server and some have those and other's doesn't, that's only explanation I think would be reasonable. But so now it seems there's no way to prove that link doesn't exist as it might be still there. I added all those, the more the better, doesn't matter if any use, still why not Guessing ContentID looks like isn't possible, there's 1.4615016373309029182036848327163e+48 possibilities... Have to figure how it's calculated, if it's SHA-1 of some data like package type and other things etc that would make it guessable, but if it''s truly random then no chance. BTW I also found that GUIDs for all GFWL titles are "66acd000-77fe-1000-9115-d804#{TitleID}" so LOL... idragonuv wrote: I can't seem to find a Gotham City Impostors setup in the Google Docs. Is it impossible to find, or has it just not been found yet? I'm really looking for that. It's not there, because ContentID isn't known yet, ask friends and everyone so we could find it EDIT: Actually wow, GUID is also same for Xbox titles, only difference is for platform "66acd000-77fe-1000-9115-d8#{Platform}#{TitleID}" (but TitleID for different platforms can be different for "same" game).

Author:	idragonuv [ Thursday, 01 May 2014, 08:47 ]
Post subject:	Re: XLive (aka GFWL) emulator
I'm basically just wondering if JorjVirus69 is going to finish this project before the GFWL servers entirely shutdown and render achievements useless. Because without a real connection with a game like Tinker, we'll never sync the achievements to our profile.

Author:	aclair [ Thursday, 01 May 2014, 18:04 ]
Post subject:	Re: XLive (aka GFWL) emulator
Someone has uploaded BSP: Mustang Pack DLC http://battlestations.eu/index.php/foru ... 18&lang=en ===> https://www.dropbox.com/s/b3msr229lf3kmmx/DLC.7z Funny is that it's said that the files are shipped via Retail game and can be hack activated.

Page 47 of 62	All times are UTC + 3 hours
Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/