Snake

Gah, I'm getting rusty at my aob'ing, so I picked something that should be simple to play with.
http://flash.mindjolt.com/static/flash/SS/99ZNWV9W1J.swf?v=5
Haven't looked at it too closely, but score looks easy enough. What I'm wondering is if the extent of change possible, like speed or length control (bad choice of words).

Seems like score is obfuscated...

Can't die
9d 02 00 85 00 96 02 00 08 2b -> 99 02 00 85 00 96 02 00 08 2b

Change it back to die (change 99 to 9d).

thanks derek.

Derek, would you mind giving a quick walkthrough of how you found that AOB?  Just a couple screenshots and a few lines of explanation.  TIA.

Derek, would you mind giving a quick walkthrough of how you found that AOB?  Just a couple screenshots and a few lines of explanation. TIA.

Why should he do that? It won't help you at all buddy. It won't make it easier for you to hack any game.

Anyway, it's pretty obvious what he did, if you just search for his AoB:

delete onEnterFrame;

//9d 02 00 85 00
_if true goto #301
//96 02 00 08 2b
_push "onEnterFrame"What I would have done would be:

9d 02 00 85 00 96 02 00 08 2b 3b
9d 02 00 85 00 96 02 00 08 2b 02

It's kinda messy compared to Derek's AoB but at least it works. (broken image removed) I don't know why he changed 9d to 99, I usually don't hack so many AS2 games.

This post was imported from an account that no longer exists!
Previous Name: phreneticus

OK, I think I figured this thing out.  I didn't want to actually play the game, no matter how many cheats there are.  I just want a high score.

So torrented Sothink, downloades swf, decomplied, etc, as explained in the sticked topics.  The key lines in the actionscript are:

           score = (w - (e = e - 5) - 2) * 2 - 8;
            MindJoltAPI.service.submitScore(score);
which I think correspond to P-code

//96 04 00 08 2f 08 27
_push "score" "w"
//1c
_getVariable
//96 04 00 08 29 08 29
_push "e" "e"
//1c
_getVariable
//96 05 00 07 05 00 00 00
_push 5
//0b
_subtract
//87 01 00 00
_storeRegister 0
//1d
_setVariable
//96 02 00 04 00
_push register0
//0b
_subtract
//96 05 00 07 02 00 00 00
_push 2
//0b
_subtract
//96 05 00 07 02 00 00 00
_push 2
//0c
_multiply
//96 05 00 07 08 00 00 00
_push 8
//0b
_subtract
//1d
_setVariable
//96 02 00 08 2f
_push "score"
//1c
_getVariable
//96 07 00 07 01 00 00 00 08 01
_push 1 "MindJoltAPI"
//1c
_getVariable
//96 02 00 08 12
_push "service"
//4e
_getMember
//96 02 00 08 30
_push "submitScore"
It took me a while to wrap my head around this (and I'm not even sure I fully understand it), because I'm used to c++ and Java.  Finally I realized the key part was at the end of score calculation, where it pushes an 8, then subtracts it.  If instead I pushed a 2 and ADDED it, my score would be ten points higher than what I'd earned. If I pushed and added a 0x3E0 (992), it would be a thousand points higher.  

I know computers often work with 4-byte ints, with the bytes listed in reverse order.  So the "08 00 00 00" needed to change to "E0 03 00 00".

I found a list of bytecodes in a sticky thread.  There were several involving "add", but its pretty clearly "ActionAdd = x0A".  So I changed the 0B to 0A.  It's not a coincidence that related operations have similar bytecodes.

So then I downloaded cheatengine, ran it, opened it to firefox, as described in the stickies.  The AOB I searched for was "96 05 00 07 08 00 00 00 0b", which luckily appears exactly once. The AOB I replaced it with was "96 05 00 07 E0 03 00 00 0A".

And everything worked great.  Started the game, died immediately, got 1000 points, beat all my friend's high scores.  

Thanks for the stickies, konghack forums!

Grats on making your first AoB  (broken image removed)

I got it... Anyways.

One of the guys who has the highest score ever explained to me how he did it. Said the value I need to find is "96 05 00 07 08 00 00 00 0b 1d 96 02 00 08 2f 1c," which is the same one to make your score 1000 points and then die. But how to get 892359235982835 points? If no one knows, I'll let you guys know as soon as I know.

is all you have to do open CE select the plugin-container in the process list under firefox, go to memory view, and search "96 05 00 07 08 00 00 00 0b"? how come when i search this i get the 96 05 00 07 part but then different stuff afterwards? also, after the 0b there's a lot of other variables like FF, other random #'s, etc.(broken image removed)
I do change just that segment to "96 05 00 07 E0 03 00 00 0A", start the game, die immediately, but to no effect?

So I got to 20025 using 31 4e 00 00 in place of E0 03 00 00, I think I did it backwards I was trying to get to 5100, which I had set to 5092 which is 13e4, I guess I converted wrong... But it turned out better...

Does anyone know how people are getting ridiculous scores like 9223372036854775807? Most I could manage was like 190xxx.

I followed the instructions and it worked perfectly. Could you explain no_ninjas how you got the aobs for each corresponding push. I don't just want a fish. I want to learn how to catch a fish  :lol:

Would anyone care to explain?

atsay714,

1st. i dont like you, *glares*, you seem impatient and seem to expect everyone else to do stuff for you and only wish to learn so you can go "ha! i know how to hack"

2nd. try looking, i would never, ever, post in a forum and embarrass myself without first exausting all my energy looking first

3rd. well despite it being obvious, did you try the tutorial section or more specifically the intro into bytecode hacking: http://forum.kongregatehack.com/viewtopic.php?f=30&t=2104 and the bytecode tutorial , or am i going to have to add another reason to my "i dont like you list"

4th. i also highly suggest you read the rules and use your common sense allthough it doesn't say it, don't double post especially when its barely been a day, some people dont come on everyday, only me and phreneticus stay on here non-stop, everyone else has a life   (broken image removed)

congratulations you learnt something *claps*