Realm of the Mad God
-migrated-
Re: Realm of the Mad God Posted on: 11/25/2010 11:53am
Quote Post
I mean I really don't care, it's just that my friend requested that I don't post them so he has the advantage.. he doesn't seem to be playing very often:

Code: [Select]
Godmode(UNDETECTABLE)
d066c301d066e5044f911f026208d066c504620fd06695
d1d066c301d066e5044fbe21032748023828c1987ab40d

Sniper (UNDETECTABLE)
6206620566b206
2400620566b206

76124900006207
76124900002400

Always Max (UNDETECTABLE)
620b66830366a929
620b66830366c728

And great job to anyone who managed to crack my hash function. I will be posting more cheats using the same function in the future.
Re: Realm of the Mad God Posted on: 11/25/2010 1:18pm
Quote Post
System Bot
If anyone cares: here is the RawData/SourceCode of the AoBs and where to find them.

Godmode
d0 66 c3 01 d0 66 e5 04 4f 91 1f 02 62 08 d0 66 c5 04 62 0f d0 66 95
d1 d0 66 c3 01 d0 66 e5 04 4f be 21 03 27 48 02 38 28 c1 98 7a b4 0d

Action > com > company > assembleegameclient > objects > Projectile

_-LB.gs_.gsc_.playerHit(this.bulletId_, this.ownerId_);

Code: [Select]
//d0
_as3_getlocal <0>
//66 c3 01
_as3_getproperty bulletId_
//d0
_as3_getlocal <0>
//66 e5 04
_as3_getproperty ownerId_
//4f 91 1f 02
_as3_callpropvoid playerHit(param count:2)
//62 08
_as3_getlocal <8>
//d0
_as3_getlocal <0>
//66 c5 04
_as3_getproperty containerType_
//62 0f
_as3_getlocal <15>
//d0
_as3_getlocal <0>
//66 95 05
_as3_getproperty conditionEffect_

Sniper
62 06 62 05 66 b2 06
24 00 62 05 66 b2 06

Action > com > company > assembleegameclient > objects > Projectile

if (_loc_6 <= _loc_5.radius_)

Code: [Select]
//62 06
_as3_getlocal <6>
//62 05
_as3_getlocal <5>
//66 b2 06
_as3_getproperty radius_
[hr:1tke63er][/hr:1tke63er]
76 12 49 00 00 62 07
76 12 49 00 00 24 00

Action > com > company > assembleegameclient > objects > Projectile

No useful SourceCode.

Code: [Select]
//76
_as3_convert_b
//12 49 00 00
_as3_iffalse offset: 73
//62 07
_as3_getlocal <7>

Always Max
62 0b 66 83 03 66 a9 29
62 0b 66 83 03 66 c7 28

Action > com > company > assembleegameclient > objects > Player

_loc_13 = int(_loc_11._-Dy.MinDamage);

Code: [Select]
//62 0b
_as3_getlocal <11>
//66 83 03
_as3_getproperty _-Dy
//66 a9 29
_as3_getproperty MinDamage


This post was imported from an account that no longer exists!
Previous Name: phreneticus
Re: Realm of the Mad God Posted on: 11/25/2010 5:44pm
Quote Post
My biggest gratitude Imk0tter, Phreneticus, and everyone else who has helped.
Re: Realm of the Mad God Posted on: 11/25/2010 6:33pm
Quote Post
Can someone tech me how to hack mad god?
im very noob in this, so please can someone explain me
thanks
Re: Realm of the Mad God Posted on: 11/27/2010 4:25am
Quote Post
Well, just got 2x characters deleted using these hacks. Enjoy everyone.
Re: Realm of the Mad God Posted on: 11/27/2010 10:57am
Quote Post
Detected (broken image removed). Also we need not projectile-type god hack but a hitbox one. Hitbox hacks are undetectable.
Re: Realm of the Mad God Posted on: 11/27/2010 4:28pm
Quote Post
I don't get it. It says the Godmode AoB got replaced in HXD, the program I use, but it doesn't work anymore. The game didn't update either. Is this happening for others as well?
Re: Realm of the Mad God Posted on: 11/29/2010 7:01am
Quote Post
Quote from: "TokyoDriftz"
I don't get it. It says the Godmode AoB got replaced in HXD, the program I use, but it doesn't work anymore. The game didn't update either. Is this happening for others as well?
Server looks like change the code!
the AoB doesn't work now !
Although it still show no damage but your Hp will decrease like normal player
Re: Realm of the Mad God Posted on: 12/01/2010 6:23am
Quote Post
How the hell do you crack hashes?
Re: Realm of the Mad God Posted on: 12/05/2010 12:52am
Quote Post
Well Its all cryptography... which I do not know so much of since I do not have the tools for this...

also can someone tell me what is an AoB?
Re: Realm of the Mad God Posted on: 12/05/2010 4:00am
Quote Post
(Godmode)

Code: [Select]
Hash:
217558b80eae181080091b9ce1d99ca2aeef691f90bb44b7abb4d1c12824fa04f3b31af4da649b29c0edb2d928209d97e65f7c392645bb2a6a

Key:
60345712:8G9[bed]Mo


Latest server build

NOTE: it only works if there's at least one other person on your map
Re: Realm of the Mad God Posted on: 12/06/2010 3:33am
Quote Post
Code: [Select]
Godmode/Instant Damage(UNDETECTABLE)
14030000620548
13390000020202

6206620566b206
2400620566b206

76124900006207
76124900002400


Must use with instant damage hack (bottom two sets of AoB's)

Must use with at least one other player on the map

Try not to get swarmed by sprite gods.. the more enemy continuous shots on the screen, the more likely you are to get deleted
Re: Realm of the Mad God Posted on: 12/06/2010 7:29am
Quote Post
Replaced the AoB's for godmode and insta damage still didn't work... Am I doing something wrong here?
Re: Realm of the Mad God Posted on: 12/07/2010 11:26pm
Quote Post
Here's a quick explanation on how the cheat was created (posted this on another forum before here after some people asked how I 'found' the AoB's)

Well basically if you're familiar with java bytecode, this should come fairly simple to you.. All the hex values that you are searching for/replacing represent AVM2 bytecode. The only difference between editing java bytecode and flash bytecode is the fact that you inject the bytecode into class files with java, and in flash, you inject the code into memory.

Here's an example of the godmode hack:

Code: [Select]
//62 05
_as3_getlocal <5>
//60 1a
_as3_getlex _-LB
//66 4c
_as3_getproperty player_
//14 03 00 00
_as3_ifne offset: 3
//62 05
_as3_getlocal <5>
//48
_as3_returnvalue

What this code translates to is:
Code: [Select]
               if (_loc_5 == _-LB.player_)
                {
                    return _loc_5;
                }

in other words, if loc_5 is equal to your player, then it returns your player (this is in the function -0A in the projectile class which handles the collision detection, and returns any object the that the current projectile is in range of (in order to damage it))

what I did was I changed the code to look like this:

Code: [Select]
if (_loc_5 == _-LB.player_) {
 continue;
}

and what we end up with is this

Code: [Select]
//14 03 00 00
_as3_ifne offset: 3
//62 05
_as3_getlocal <5>
//48

changed to

//13 39 00 00
_as3_ifeq offset: 57
//02
_as3_nop
//02
_as3_nop
//02
_as3_nop

Basically what this modification does is it skips your players object when searching for objects to collide with, and registers the hit on the next object that the projectile is in range to collide with. Unfortunately, due to recent updates, this alone isn't enough to create a no-damage hack.. Through some form of magic, the server is capable of knowing if the projectile has collided with your player even if your player doesn't send a playerHit packet. I'm fairly sure it has to do with the SHOOTACK packet, but i'm not entirely sure.. Anyway, the simple hack around for this is to make sure every enemy shot fired collides with an object around you (which generates an otherHit packet), which is exactally what happens when you take the range checks out.. if you take the range detection out, the projectile collides with the nearest object, regardless of range (except for your own player, if you use the cheat above (broken image removed))

Code: [Select]
//62 06
_as3_getlocal <6>
//62 05
_as3_getlocal <5>
//66 b2 06
_as3_getproperty radius_
//62 0c
_as3_getlocal <12>
//11 30 00 00
_as3_iftrue offset: 48
//af
_as3_greaterthan
//2a
_as3_dup
//62 0c
_as3_getlocal <12>
//11 51 00 00
_as3_iftrue offset: 81
//11 33 00 00
_as3_iftrue offset: 51
//29
_as3_pop
//62 0b
_as3_getlocal <11>
//2a
_as3_dup
//11 03 00 00
_as3_iftrue offset: 3
//29
_as3_pop
//d0
_as3_getlocal <0>
//76
_as3_convert_b
//12 49 00 00
_as3_iffalse offset: 73
//62 07
_as3_getlocal <7>
//62 05
_as3_getlocal <5>
//66 b2 06
_as3_getproperty radius_


Basically what this does is it compares the distance between the projectile and the current object in the iteration (both x and y seperately), and if they're not in range, then the function continues. What we could do to make this simple is modify the values that the distances get compared to, put them to 0, so that way it looks like:

Code: [Select]
if (_loc_5.radius_ < _loc_6) {
continue;
}
if (_loc_5.radius_ < _loc_7) {
continue;
}

into

if (_loc_5.radius_ < 0) {
continue;
}
if (_loc_5.radius_ < 0) {
continue;
}

and you end up with this bytecode

Code: [Select]
//24 00
_as3_pushbyte 0
//62 05
_as3_getlocal <5>
//66 b2 06
_as3_getproperty radius_
//62 0c
_as3_getlocal <12>
//11 30 00 00
_as3_iftrue offset: 48
//af
_as3_greaterthan
//2a
_as3_dup
//62 0c
_as3_getlocal <12>
//11 51 00 00
_as3_iftrue offset: 81
//11 33 00 00
_as3_iftrue offset: 51
//29
_as3_pop
//62 0b
_as3_getlocal <11>
//2a
_as3_dup
//11 03 00 00
_as3_iftrue offset: 3
//29
_as3_pop
//d0
_as3_getlocal <0>
//76
_as3_convert_b
//12 49 00 00
_as3_iffalse offset: 73
//24 00
_as3_pusbyte 0
//62 05
_as3_getlocal <5>
//66 b2 06
_as3_getproperty radius_

Hopefully this helps you understand how to find/create AoB's for flash games (AS3 in specific since AS1-2 operate on the AVM1 bytecode engine which uses a completely different format)


If you have any questions, just post them here, and sorry for the overuse of the term 'basically'

NOTE: In case you were wondering, this method completely differs from any other methods i've used in the past (all of which have been patched thanks to these forums (broken image removed))

This one in particular isn't easy to patch due to the fact that some compromises have to be made (server-side projectile deletion based on when a player tells the server that THEY've been hit, or the simpler more direct route, server-side range-checked collision detection) which is why I've chosen to post it.
Re: Realm of the Mad God Posted on: 12/31/2010 6:16am
Quote Post
These still work with the 110 build?