In honour of this game getting BotD, I submitted a pretty sure-fire way of winning the game (global crits on every shot). The hack is a bit cool, so here's how I did it:

At first I searched for places where critical strikes might be mentioned, so I searched for "head" as that's how it appears in game. First result, MainTimeline#912, a variable named critMsg. Searching for that, we find this peachy piece of code, enemy#601-615:

                 if (param6){                     _loc_12 = new critKill();                     _loc_12.x = x;                     _loc_12.y = y - 12;                     if (param6 == 3){                         _loc_12.msg = "ONE HIT KILL!";                     }                     else if (param6 == 2){                         _loc_12.msg = "CRITICAL KILL!";                     }                     else{                         _loc_12.msg = _root.critMsg[_root.critArray[id]];                     }                     stage.addChild(_loc_12);                 }

Sweet. So it looks like param6 (the 6th function argument) is what determines whether it's a crit. We're in a function named damage, so let's search for ".damage(", without the quotes, to see where that function is called. 5 places overall. The last is damage to our castle, 2nd and 3rd are passing constants so they don't interest us, and the 1st result seems to be in a function which isn't really used for some reason. 4th result it is, MainTimeline#6657! And will you look at that, it's in a function named "shoot", how appropriate:
 

 enemyArray[_loc_4].damage(_loc_2, _loc_11, _loc_7, _loc_8, param1, _loc_12);

Cool. The sixth parameter (whether it's a crit or not) is _loc_12, so if we change it, we win. That's pretty easy to do, but what if we do something more interesting? Just above, we have the hit detection:

 if (enemyArray[_loc_4].mc.hitTestPoint(_loc_7, _loc_8, true)){

What if we replaced the hit detection with our way of ensuring critical hits? Two birds with one stone! The hack merely replaces the line above with:
 

 _loc_12 = 1; 

​And in bright bytecode:

 60 f6 29 62 04 66 d5 26 66 f3 2c 62 07 62 08 26 46 83 2a 03 12 c0 01 00  24 01 63 0c 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 

Thanks for the cheats, made things a lot more fun.

Thanks for the hacks!

Thanks, nice hacks :D