http://www.kongregate.com/games/kurechii/the-kings-league-odyssey

money is 4 bytes.

What do you know, there are AoB's for this game too! :P

protip,you can 4b*1 the stats for your 5 peeps. you can also 4b*1 the crystals soyou can level them all up and upgrade them all.

First time I've killed the Dragon I didn't even use the Cleric. My Rogue was so O.P that she couldn't be hit by the Dragon. Seriously, the game is really easy. Though, if you're still having difficulty, you can always hack the stat points. They're simple Value(4 Bytes).

Instantly win a match:

d2 24 00 0d 14 00 00 62 09 d2 24 00 0d 00 00 00 62 09

Because the source is pretty obfuscated (run it through SWFDecrypt first), we began by searching for one thing which almost never changes: Strings. When you win a match, it gives you a message ("Goddess of Victory is definitely smiling upon you" and all sorts of stuff).

That leads us to _-Kj file in the _-K7 folder. Now we search for where the class is used (search for :_-K7 as that's how variable types are declared in ActionScript), a single use case in the neighbouring _-0w file: A variable named _-LT (keep those in mind for when you're looking for baby names).

Now we look for where _-LT is used inside the file. The only times it's used is inside a _-Q0 function, which accepts a boolean - suspicious, very suspicious...especially since the function contains totalBattleWon + 1. A bit more nosing around reveals that passing false causes  us to lose, and passing true causes a win. Interesting.

Searching for _-Q0(true) leads us a bit further into the file, inside _-Ed

if (_loc_2 <= 0) { if (_loc_9 || _loc_3) { this._-Q0(true); } }

Looks very promising indeed! Thanks Ed! We can ignore the if statement inside, as _loc_9 is always true (look at the beginning of the function), so _loc_9 || _loc_3 will always be true (it's part of the dumb obfuscation).

So we move to the original (obfuscated) file (switch to Raw Data mode if you're using SoThink, source code causes it to sometimes crash on the obfuscated source). Go to _-K7 ->_-0w, and search for _-Q0(true) - the 3rd results is what interests us. We have to look a bit higher in the file to find the _loc_2 <= 0 condition. Here're the opcodes, up to the function call

//d2  _as3_getlocal <2>  //24 00  _as3_pushbyte 0 //0d 14 00 00  _as3_ifnle offset: 20 //62 09  _as3_getlocal <9> //2a  _as3_dup  //11 03 00 00  _as3_iftrue offset: 3 //29  _as3_pop  //d3  _as3_getlocal <3>  //76  _as3_convert_b  //12 06 00 00  _as3_iffalse offset: 6 //d0  _as3_getlocal <0>  //26  _as3_pushtrue  //4f 9f 1b 01  _as3_callpropvoid *::_-Q0(param count:1)

And the AoB is simply making this if branch always execute (changing the jump offset to 0).

edited by Thenewcomer ~ now its not so broken looking lol