The King's League: Odyssey

http://www.kongregate.com/games/kurechii/the-kings-league-odyssey

money is 4 bytes.

Talent Points and Crystals are also 4bytes*1

What do you know, there are AoB's for this game too! :P

Even with cheats, its hard to shut down the dragon --

Simple CE stuff because I have no amazing: (
-Money=4bx1
-Crystals=4bx1
-UnitLevels=4bx1 (although when I change the value I can't get the level of the unit to change permanently but if I freeze it then the lvl up cost of the unit is the same as that of the frozen value and you can freeze it at a level lower than ten and level it again to get it to level 11)
-UnitStats=4bx1 (can't permanently change a stat to over 99 but you can freeze it over 99 and it count's in battle),
-DaysUntillMatch=4bx1(can increase to over the starting days untill match time)
-DayOfTheWeek=4bx1 (values over 7 increase the week/month/year count but do not count down more than one day on the DaysUntillMatch count)
-WeekOfTheMonth=4bx1 (similar to DaysOfTheWeek)
-MonthOfTheYear=4bx1 (see previous)
-Year=4bx1 (years start at 1810)
-GuildPoints=4bx1(in incresed to over what you need for next tier it will be added to the next tier)

(yes I know that it says 4bx1 for everything but some things work weird so explanations for all)

Na it aint tat hard took tmie though..

Awesome AOB's BTW..Tried this game before using only 4byte hack and it went tough in the end..

protip,you can 4b*1 the stats for your 5 peeps. you can also 4b*1 the crystals soyou can level them all up and upgrade them all.

The dragon really? He didn't even kill any one of my guys without cheats, my Bishop/Cleric was healing my team the whole time.

First time I've killed the Dragon I didn't even use the Cleric. My Rogue was so O.P that she couldn't be hit by the Dragon. Seriously, the game is really easy. Though, if you're still having difficulty, you can always hack the stat points. They're simple Value(4 Bytes).

well thanks, it should have worked now. just bugging a bit

Instantly win a match:

d2 24 00 0d 14 00 00 62 09 d2 24 00 0d 00 00 00 62 09

Because the source is pretty obfuscated (run it through SWFDecrypt first), we began by searching for one thing which almost never changes: Strings. When you win a match, it gives you a message ("Goddess of Victory is definitely smiling upon you" and all sorts of stuff).

That leads us to _-Kj file in the _-K7 folder. Now we search for where the class is used (search for :_-K7 as that's how variable types are declared in ActionScript), a single use case in the neighbouring _-0w file: A variable named _-LT (keep those in mind for when you're looking for baby names).

Now we look for where _-LT is used inside the file. The only times it's used is inside a _-Q0 function, which accepts a boolean - suspicious, very suspicious...especially since the function contains totalBattleWon + 1. A bit more nosing around reveals that passing false causes  us to lose, and passing true causes a win. Interesting.

Searching for _-Q0(true) leads us a bit further into the file, inside _-Ed

if (_loc_2 <= 0) { if (_loc_9 || _loc_3) { this._-Q0(true); } }

Looks very promising indeed! Thanks Ed! We can ignore the if statement inside, as _loc_9 is always true (look at the beginning of the function), so _loc_9 || _loc_3 will always be true (it's part of the dumb obfuscation).

So we move to the original (obfuscated) file (switch to Raw Data mode if you're using SoThink, source code causes it to sometimes crash on the obfuscated source). Go to _-K7 ->_-0w, and search for _-Q0(true) - the 3rd results is what interests us. We have to look a bit higher in the file to find the _loc_2 <= 0 condition. Here're the opcodes, up to the function call

//d2  _as3_getlocal <2>  //24 00  _as3_pushbyte 0 //0d 14 00 00  _as3_ifnle offset: 20 //62 09  _as3_getlocal <9> //2a  _as3_dup  //11 03 00 00  _as3_iftrue offset: 3 //29  _as3_pop  //d3  _as3_getlocal <3>  //76  _as3_convert_b  //12 06 00 00  _as3_iffalse offset: 6 //d0  _as3_getlocal <0>  //26  _as3_pushtrue  //4f 9f 1b 01  _as3_callpropvoid *::_-Q0(param count:1)

And the AoB is simply making this if branch always execute (changing the jump offset to 0).

edited by Thenewcomer ~ now its not so broken looking lol