Edit: I performed a few magic tricks with the magical f12 button in my browser. It's code. I don't know if you'll be able to log in using all three parameters with the first request and if you'll need to make a request using only the username and password and then make one using all three once the first one fails. And I'll/you'll likely have to exclude the code param if no 2fa code is provided
I've modded the DuckDice.cs so that if twofa is not null, it will send it along as the "code" value in the StringContent. Otherwise, it just leaves it out and sends just the user/pass info as before. (ps. left the all important campaignhash untouched )
I've tested it with and without 2FA enabled... and tried to login with correct 2FA value, incorrect 2FA value and 2FA value blank and it seems to behave as expected (ie. successful logins with 2FA enabled and correct value, rejected logins in other cases... and with 2FA disabled on account, it rejects logins on all but blank 2FA value)
Finally, I think I've managed to successfully create a pull request on github... hope I did it right, I've never actually done it before