[Gamersafe] Swordless Ninja (Berzerk Studio)

Some of the "old bytecoders" might *facepalm* now, when they see this post, but everybody starts as noob. So here is my problem:

Swordless Ninja http://www.berzerkstudio.com/games/swordless_ninja/

At first I thought this is funny, but now (completed 3x100%,1x99%) it is really nerving.

For Gamersafe you need to complete it all 4 Modes Samurai (3HP), Normal (3HP), Hard (2 HP), Ninja-Mode (1HP).

The first three I managed without any problems, but @ Ninja Mode I got stuck. It is so frustrating to replay the whole level, when you died to get to the boss again.

So I read the bycode Tutorial and thought, maybe I could hack the game, because the hacks pulished in the other topics did not work.

I dumped the swf and found a function:

public function get invincible() : Boolean
{
return _12fc;
}// end function

I thought maybe I could change it to

public function get invincible() : Boolean
{
return true;
}// end function

I tried to understand the byte-code but I noticed this is too much for me.

public function get invincible() : Boolean
{
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//60 ac 09
_as3_getlex _12fc
//48
_as3_returnvalue
}// end function

What do I have to do no? Can I change it to 26 00?? or is there another possibility?

-- TTN

Invincibility
5e ac 09 27 68 ac 09 -> 5e ac 09 26 68 ac 09

Not sure about your example, it could be possible that way but I didn't bother trying. I just used the variable you mentioned (ac 09) and changed any instance of it equalling false to true (using 5e - findproperty and 68 - initproperty).

Snap (from the MoFunZone thread):
27 68 bf 09
26 68 bf 09

:-)

I'm not exactly sure how a function can return 12fc when the type is obviously a Boolean...

If you want to return the value for true, which is 26, then you would have to do 26 02 because 02 is the NOP code, which doesn't do anything.

As for whether you CAN return the value for true, it depends on the functions that call it...

Invincibility
5e ac 09 27 68 ac 09 -> 5e ac 09 26 68 ac 09

Not sure about your example, it could be possible that way but I didn't bother trying. I just used the variable you mentioned (ac 09) and changed any instance of it equalling false to true (using 5e - findproperty and 68 - initproperty).

Thanks. That worked perfectly... Now I have finished the game and will not look at it again... so many hours of frustration and such a simple solution :-)

Snap (from the MoFunZone thread):
27 68 bf 09
26 68 bf 09

:-)

Does not work at berzerk studio, because the the variable has another name.

I'm not exactly sure how a function can return 12fc when the type is obviously a Boolean...

If you want to return the value for true, which is 26, then you would have to do 26 02 because 02 is the NOP code, which doesn't do anything.

As for whether you CAN return the value for true, it depends on the functions that call it...

12fc is the name of the variable that stores whether the hero is invincible or not (true/false)... I'm new to byte-coding and flash but I have some experiences in C/C++ and as it seems to be the same:

The function is an oop one-liner to readout a "private" variable of a class.

But there must be another function which readout this variable because my solution did not work. (Even with 26 02)

Thank you folks, what would I do without you... (maybe take a bite of my keyboard :lol: )

-- TTN

[code]
public function get invincible() : Boolean
{
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//60 ac 09
_as3_getlex _12fc
//48
_as3_returnvalue
}// end function

It's been ages since I hacked this one for mofunzone (and it's a different bloody version - typical). But in essense, you don't need to worry about the op code as you can change it. The important thing we want is for the function to always return true, so we need to change:
60 ac 09 // push getlex _12fc
48 //return value

to
26 // push true
48 // return
02 02 // nop twice

The 02 (nop -- no operation) is the most important instruction in byte code!

I'm still not certain that doing above is going to do what you want though, as both Derek's and my hack change it do that the variable is never set to false.

I'm still not certain that doing above is going to do what you want though, as both Derek's and my hack change it do that the variable is never set to false.

Nope it does not work. I think it is better if you change the variable than try to change the function, because it seems, as I wrote above, that there is another function which readout the variable... never the less I got a working hack and I learned something 'bout bytecoding...

Now I try another game.

--TTN

Having had a quick refresh through the code - it looks like this code is never actually called and the _12fc variable is directly set in the game.

Hence the other hack to alter the default value in the com/hero/Hero.Init function.

Okay...

Master, I bow to you ;-)

I see I've still much to learn (e.g. read everything in the source code...)

Thanks for you help and for your calm with a bloody noob :-)