Bubble Tanks TD 1.5

Bubbles is double*1

link- http://www.kongregate.com/games/HeroInt ... nks-td-1-5

Oh, yes.. forgot to post the link. Thanks for posting it, Spellcater.

no problem  (broken image removed)

Bubbles, score, and i assume life is all double(truncated)*1.

The tower data is a array filled with objects, if you can modify "before" the game starts (or just decompress locally and change the swf), you can make the base turret a nuclear warhead of epicness :3
Also, the game don't have any encription or obsfuscation, and can be decompiled easily...

Yep, it's double*1, but if you don't want to bother multiple scans:
66 a0 07 27->66 a0 07 26 .
Change the 4th one, and you should get 9999999999999 bubbles at the beginning of each round. :mrgreen:
EDIT: Ok, I forgot about highscores, I guess we should just log out when we use it. :roll:

Yep, it's double*1, but if you don't want to bother multiple scans:
66 a0 07 27->66 a0 07 26 .
Change the 4th one, and you should get 9999999999999 bubbles at the beginning of each round. :mrgreen:

that might be a problem if highscores pick it up.

ok, just a AoB to make the game relaxing:

Search:
d0 d0 66 81 0d 66 85 06 66 80 01 d0 66 c0 0a 66 cc 13 66 cf 13 68 b5 0a

This give 2 address, change then to:
d0 24 7F 24 7F A2 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 68 b5 0a


so, the code:
this.damage = this.mRef.gData.arrTowerData[this.ID].damage;
becames:
this.damage = 127 * 127;

I need to study more about pushint/pushshort/pushint, but for now, pushsmallint and mull opcodes works...
Just changing damage is enough to kill everything, but I can boost areadamage/splash/poison/ others if anyone wants :3

ok, just a AoB to make the game relaxing:

Search:
d0 d0 66 81 0d 66 85 06 66 80 01 d0 66 c0 0a 66 cc 13 66 cf 13 68 b5 0a

This give 2 address, change then to:
d0 24 7F 24 7F A2 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 68 b5 0a


so, the code:
this.damage = this.mRef.gData.arrTowerData[this.ID].damage;
becames:
this.damage = 127 * 127;

I need to study more about pushint/pushshort/pushint, but for now, pushsmallint and mull opcodes works...
Just changing damage is enough to kill everything, but I can boost areadamage/splash/poison/ others if anyone wants :3

Good job! (broken image removed) Great to see another hacker here.

I looked into the swf, but didn't understand too much xD

does this need to be hacked or something?
if it is i'll do it if u want :mrgreen:

does this need to be hacked or something?
if it is i'll do it if u want :mrgreen:

It has already been hacked, but if you can find something new, go ahead and try. (broken image removed)

This post was imported from an account that no longer exists!
Previous Name: phreneticus

D: ok ill keep looking

I was looking the gamedata folder and found this:

_as3_pushstring "id"
//24 00
_as3_pushbyte 0
//2c e8 0d
_as3_pushstring "blnBlackListed"
//27
_as3_pushfalse
//2c 13
_as3_pushstring "type"
//25 ae 02
_as3_pushshort 302
//2c a2 0c
_as3_pushstring "dim"
//24 28
_as3_pushbyte 40
//2c e9 0d
_as3_pushstring "tClass"
//24 00
_as3_pushbyte 0
//2c b5 0c
_as3_pushstring "cost"
//24 0a
_as3_pushbyte 10
//2c 95 0c
_as3_pushstring "sell"
//24 0a
_as3_pushbyte 10
//2c 91 0c
_as3_pushstring "range"
//24 3c
_as3_pushbyte 60
//2c af 0c
_as3_pushstring "areaRange"
//24 00
_as3_pushbyte 0
//2c a0 0a
_as3_pushstring "damage"
//24 0a
_as3_pushbyte 10
//2c 97 0c
_as3_pushstring "areaDamage"
//24 00
_as3_pushbyte 0
//2c b8 0c
_as3_pushstring "slowDamage"
//24 00
_as3_pushbyte 0
//2c bf 0c
_as3_pushstring "weakenDamage"
//24 00
_as3_pushbyte 0
//2c 9f 0a
_as3_pushstring "splashDamage"
//24 00
_as3_pushbyte 0
//2c 8c 0a
_as3_pushstring "ghostDamage"
//24 05
_as3_pushbyte 5
//2c 93 0a
_as3_pushstring "poisonDamage"
//24 00
_as3_pushbyte 0
//2c ea 0d
_as3_pushstring "dBoost"
//24 01
_as3_pushbyte 1
//2c eb 0d
_as3_pushstring "fBoost"
//24 01
_as3_pushbyte 1
//2c ec 0d
_as3_pushstring "rBoost"
//24 01
_as3_pushbyte 1
//2c ed 0d
_as3_pushstring "bulletType"
//24 01
_as3_pushbyte 1
//2c ee 0d
_as3_pushstring "fireSpeed"
//24 0f
_as3_pushbyte 15
//2c ef 0d
_as3_pushstring "areaFireSpeed"
//24 00
_as3_pushbyte 0
//2c 9a 0c
_as3_pushstring "bulletSpeed"
//24 07
_as3_pushbyte 7
//2c f0 0d
_as3_pushstring "confuseTime"
//24 00
_as3_pushbyte 0
//2c f1 0d
_as3_pushstring "name"
//2c f2 0d
_as3_pushstring "Initial Tower"
//2c c0 0c
_as3_pushstring "upgrades"
//24 04
_as3_pushbyte 4
//2c f3 0d
_as3_pushstring "path1"
//24 01
_as3_pushbyte 1
//2c f4 0d
_as3_pushstring "path2"
//24 02
_as3_pushbyte 2
//2c f5 0d
_as3_pushstring "path3"
//24 03
_as3_pushbyte 3
//2c f6 0d
_as3_pushstring "path4"
//24 04
_as3_pushbyte 4
//2c f7 0d
_as3_pushstring "desc"
//2c f8 0d
_as3_pushstring "This is your basic tower.  All tower paths start right here!"
//55 1f So I changed pushbyte 10 to pushbyte 250 on pushstring sell, which what I'm pretty sure should make you get 250 bubbles when you sell the Initial Tower. No effect. Then, to make sure it wasn't something different when using Initial Tower, I upgraded it to Basic Normal 1 and changed sell to FA again. No effect. I tried changing damage. No effect. What am I doing wrong?
The mega-mega tower is super epic!