One bullet to hit them all

52 4c 12 9d 02 00 18 00
52 4c 12 9d 02 00 00 00

Rapid fire

1c 96 05 00 07 01 00 00 00 0b 1d 96 02 00 08 ?? 1c 4c
1c 96 05 00 07 00 00 00 00 0c 1d 96 02 00 08 ?? 1c 4c

EDIT: One bullet to hit them all

can you talk about that part of the code you changed?

[spoiler=Long winded explanation:3acae214]function hitTesting()
{
    for (b = bullets.length - 1; b >= 0; b--)
    {
        bullet = bullets[b];
        for (g = ghosts.length - 1; g >= 0; g--)
        {
            ghost = ghosts[g];
            if (ghost.hitTest(bullet._x, bullet._y, true) && bullet.Type != 6)
            {
                ghost.health = ghost.health - 1;
Looking at this section of code in the Main Timeline action script.

{
    for (b = bullets.length - 1; b >= 0; b--)
    {
        bullet = bullets[b];While the number of bullets onscreen is greater than 0 it takes a note of the locations of them

       for (g = ghosts.length - 1; g >= 0; g--)
        {
            ghost = ghosts[g];Similarly while the number of ghosts onscreen is greater than 0 it takes note of them.

if (ghost.hitTest(bullet._x, bullet._y, true) && bullet.Type != 6)
It then checks each bullet location against each ghost location and sees if theres a hit. It also makes sure the bullet is not type 6 (whatever one that happens to be).

ghost.health = ghost.health - 1;
If there is a hit AND the bullet is not type 6 then this section of code is performed. If there isn't a hit or the bullet is type 6 then it will jump over this section of code and the ghost won't take damage.

We obviously want it to say that for any bullet onscreen it will be hitting a ghost so we want to force the following section of code to never jump:

if (ghost.hitTest(bullet._x, bullet._y, true) && bullet.Type != 6)
In raw data mode that part of the code corresponds to:

//96 05 00 05 01 09 07 01
_push true "bullet"
//1c
_getVariable
//96 02 00 08 12
_push "_y"
//4e
_getMember
//96 03 00 09 07 01
_push "bullet"
//1c
_getVariable
//96 02 00 08 0e
_push "_x"
//4e
_getMember
//96 07 00 07 03 00 00 00 08 fa
_push 3 "ghost"
//1c
_getVariable
//96 02 00 08 9c
_push "hitTest"
//52
_callMethod
//4c
_dup
//12
_not
//9d 02 00 18 00
_if true goto #6081
//17
_pop
//96 03 00 09 07 01
_push "bullet"
//1c
_getVariable
//96 02 00 08 78
_push "Type"
//4e
_getMember
//96 05 00 07 06 00 00 00
_push 6
//49
_equals2
//12
_not
#6081 //12
_not
//9d 02 00 2a 02
_if true goto #6232
The code up to  _if true goto #6081 corresponds to the check to see if a marked bullet has hit a ghost. The section after corresponds to the check to see whether it is a type 6 bullet. We want it to always say that an onscreen bullet has hit a ghost therefore we want to stop it jumping on the first jump command.

//12
_not
//9d 02 00 18 00
_if true goto #6081
12 is the not op code. 9d is the if true go to op code. 02 00 is how long the byte array is. 18 00 is how many bytes it will jump (18 is in hex so it will jump 24 bytes in dec). Therefore it reads if the above statement is NOT true (i.e a bullet hasn't hit) then jump 24 bytes.
Several ways to change this.
Firstly you can NOP out the not command (12 => 02) so it will read that if the above statement is true it will jump. That means if a bullet hasn't hit an enemy it will hurt/kill it but if it has hit an enemy it won't hurt/kill it.
Second method is to switch the if true opcode to an if false opcode. This will have the same effect as above.
The method I used is changed the 18 00 to 00 00. This tells it to jump 0 bytes instead of the 24 bytes. That means that regardless of whether a bullet has hit or not it won't jump any bytes and will always hurt the enemy as long as it isn't a type 6 bullet.

So our AoB is:

52 4c 12 9d 02 00 18 00
52 4c 12 9d 02 00 00 00
The 52 4c are just a few extra bytes added on to make sure it only finds this section of the code

You can also change the second jump command so it jumps 0 bytes but I didn't particullaly want to muck around seeing what a type 6 bullet was and if there would be any huge side effects.

Not proof read so expect numerous mistakes

*.sol file

All objectives complete.