Cloudstone

Ok, figured it out. It's working again.

On another note - a question that I may or may not have asked before on this forum: on a lot of subfiles, you've got a list of constants up at the very top. When going from looking at the regular code in sothink to the actual bytecode, that list stays the same; it doesn't get its own bytecode. With that said, are those constants able to be hacked? Or does it mean that those values are set in stone, or are server-sided, making them unchangeable?

they are members of the constant_pool. The constant values of the AVM2 are one of the following types: int, uint, double, string, namespace, undefined, or null.  The values of these types appear directly in the ABC file or in the instruction encodings.

the constant pool looks like this.

u30 int_count 
s32 integer[int_count] 
u30 uint_count 
u32 uinteger[uint_count] 
u30 double_count 
d64 double[double_count] 
u30 string_count 
string_info string[string_count] 
u30 namespace_count 
namespace_info namespace[namespace_count] 
u30 ns_set_count
ns_set_info ns_set[ns_set_count] 
u30 multiname_count 
multiname_info multiname[multiname_count]so if you want to change a double, you do it like this:

• find the index of the double(this will be in the bytecode somewhere. the index is the part after the 2f (pushdouble)), call it index
• get a pointer to the double constant pool, double_base
• in cheat engine add a new pointer and point it to base_pointer+sizeof(double)*index
• change the value to whatever you want

its dangerous to go alone! take this: http://www.adobe.com/content/dam/Adobe/en/devnet/actionscript/articles/avm2overview.pdf

So for a game like this, where you can buff your exp/shard/gold by x times, (x being a constant) - theoretically if I found the index and whatnot, I could change that constant to get a 20x-whatever boost rather than the original values? Or set the constant for my energy regen to something higher than 1? Or set my total energy constant to something higher than 30?

ostensibly. The server may bark if values go outside of acceptable range.

Well yeah, people shouldn't set it to a bajillion and level from 1 to 45 in a day. I guess what I'm saying is that, in moderation, those values could be changed to tweak this or that.

Big question: is doing this more trouble than it's worth?

Big question: is doing this more trouble than it's worth?

by hand, without a doubt.
if you write a program, then perhaps not.  even then im still not sure its worth it.

easiest way is to just find some bit of script you can trash and use as your own personal space. then modify the values from in there.

Big question: is doing this more trouble than it's worth?

that depends on how much you want the end result now doesnt it (broken image removed)

on a side note, since im a noob id like to ask more about the base pointer mentioned above me. i know what pointers are, and multilevel pointers and all that good stuff but not the base pointer. but im guessing the base pointer would be part of the swf. now i was wondering two things. 1: how would you find it. and 2: since flash games load in flash player, addresses change every loading. that would include the base_pointer's address too correct? that would mean you would have to find it every time you load unless you make a pointer in flash to point to another in the swf and that would just be too much work.

presuming you arent doing this programmatically, youre probably gonna wanna search for the in memory data structure. lets assume you wanna find an int.
without bothering to look into it, id assume it goes like this

• so open up sothink and find pretty much any int value
• suppose you find in the as file "c7 01" as your first int
• go ahead and convert its value to hex (with ce just type the number into search as 4b then switch to aob) and hold on to this number
• now search for "2d c8 01" and go ahead and repeat step 3
• put em together as 1 aob, with a701 first obviously, then search that aob, and note its address
• c701 is 199d, that math is hard so call it 200.
• multiply by 4, get 800d or 0x320
• subtract 0x320 from the address you noted in step 5
• click add address manually in CE and put the result you noted in step 8 as the address
• that should have you somewhere near the beginning of the array
• so now just poke around in there. you can find a u30 converter on my website somewhere i think. if not its definitely in in the menu o my aob tool under tools|ce 4byte calc

hopefully that can give you some idea

Hello, I'm quite new to this AoB thing and have tried to follow the instructions left for others to get the console open.
It's quite possible I'm misunderstanding this but what I've been doing has been opening CE, opening cloudstone, enabling speedhack set at 0.1, refreshing the webpage, setting speedhack to 0.0 once a the loading screen appears again. Then applying "part 1", quickly disabling then re-enabling speedhack, then applying part 2.
I've also tried applying parts 1 and 2 at the same time on the loading screen, parts 1 and 2 at the same time after the loading screen but at the update notes screen, part1 at the loading screen and part2 at the update notes screen.
After each attempt I try entering the practice fields, shop, an area, hitting S and tilde. There's no chime and no "invisible target" above the shop icon.
I apologize if my issue is something obvious to someone who understands what they are doing. I also apologize if my issue is that I'm using the wrong codes.
Any help is appreciated, thanks.

Part1
d1 66 ?? ?? 24 53 14 19 00 00 d1 66 ?? ?? 76 2a 12 05 00 00 29 60 ?? ?? 76 12 06 00 00 d0 4f ?? ?? ?? 47
to
d1 66 ?? ?? 24 72 14 19 00 00 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 d0 4f ?? ?? ?? 47

Part2
d0 30 d0 66 a8 46 46 c9 05 00 85 d5 60 b1 55 d1 4f aa 6b 01 5d 90 29 4a 90 29 00 80 90 29 d6 d2 60 0d 66 a7 62 d0 66 cc 46 27 24 00 26 4f b8 14 05 d2 d0 66 a8 46 46 c9 05 00 d0 66 b2 46 4f d0 6b 02 47
to
d0 30 d0 26 61 83 3f 60 88 05 d0 2c e0 07 4f 9e 49 02 d0 5d 5a 4a 5a 00 68 ae 46 d0 66 ae 46 60 9f 54 60 a0 54 60 a7 23 60 a3 04 66 d2 48 4f 83 05 04 d0 4f cd 46 00 60 25 66 b0 48 24 42 4f d9 04 01 47

When you're changing part 1, make sure you're changing any ?? to what they are in the original aob.

Thank you, that's something (rather obvious now that I think about it) that I did miss. I'm still not able to bring up the console. Which exactly of the different ways I've tried above is the correct method? The best I can figure from previous posts it's:
open CE, open game, set to 0.1, refresh browser, immediately set to 0.0 at loading screen, search-change-apply part 1, search-change-apply part 2, set to 1.0, enter training area, exit training area, hit the grave/tilde key, hear a chime.

After the aobs are changed, hit f3 to hear the foghorn telling you it worked. That sets you up to use the console.

btw the whole reason for the 2part aob is so it can be used at your leisure. no speedhacking, no waiting until just the right time, just punch it in whenever youre ready.

then hit F3

Thank you SaucyJack, that did the trick and I somehow missed that part in the posts, I apologize.

...also. /facepalm

Thanks kolonelkadat, for clearing that part up and making my life so much easier.

I couldn't bring up the console either until earlier. It's not that I hadn't entered the code in correctly, it was more that I was using the wrong key. I assumed as per the 1st post in this thread that it was ` to open the console. I was pressing a few keys on my keyboard and on mine it's actually the ' key.