Marvel War of Heroes
A Superhero "Card" Game by Mobage
Marvel War of Heroes Posted on: 02/15/2013 11:13pm
Quote Post
This game is available for free for Android and iOS. I have been playing it for some time now and it is a lot of fun, but I'm to the point where I either spend a ton of real cash to get better cards, or find some way to hack it... ?

I've hacked desktop games before, but never had any success with a mobile game, but I know it can be done.

WoH is an Web App (built with HTML, CSS, JavaScript) inside a wrapper (perhaps phonegap/cordova, appmobi, titanium, etc) and makes server calls. I know a good chunk of what goes on is predetermined by the server before the app "plays" the animations and such.

I wonder if there is a way to modify some of the javascript calls or perhaps the data as it passes between the phone and the server... or perhaps some other means to hack it.

I also wonder if there is a way to identify the URLs it calls to communicate with the server as perhaps there may be a way to exploit it via session spoofing and some scripting?

Any other thoughts or suggestions?

I know there are "trainers" out there, but I don't trust that stuff unless I know who made it.
Example here: http://www.mediafire.com/?w6p28gbpjap06rh

Thanks guys!
Kryptic



“You’ve enabled weakness within the individual for the sake of the whole, and now the whole is made up of weak individuals.”
~ Khaos

RE: Marvel War of Heroes Posted on: 02/16/2013 1:05am
Quote Post
TIM the Enchanter
Level: 1
ADR Info
No luck with GameCHI, GameGuardian, or SQL Lite Editor.

Down to direct editing / packet manipulation




Everything's coming up KongHack!

"When you know nothing matters, the universe is yours" ~Rick Sanchez

RE: Marvel War of Heroes Posted on: 02/16/2013 7:37am
Quote Post
Indeed. It seems largely server-side, but that doesn't mean it can't be done, just requires more effort.

I've seen some exploits (like users managing to land 12+ attacks in a matter of seconds during a raid event when it would normally take at least a second to accomplish just one attack), so I suspect it is quite possible.

And as I mentioned, you can find several "trainers" out there. They all seem to require your username and/or login info, so I assume they find a way to spoof a valid connection and run some type of scripts to trick the server...

Is it possible to break down the APK and extract files from within? If it contains JavaScript files I think that would be very helpful...



“You’ve enabled weakness within the individual for the sake of the whole, and now the whole is made up of weak individuals.”
~ Khaos

RE: Marvel War of Heroes Posted on: 03/22/2014 4:56pm
Quote Post

still no luck??