How do you find AoB hacks
-migrated-
|
Additional Info
|
How do you find AoB hacks for example how would u find one on platform racing 2 thanks
|
|
Additional Info
|
HACKING FAQ TO THE RESCUE
[spoiler= how to use:vmpbex3p][id=AoB:vmpbex3p]Array of Byte hacking[/id:vmpbex3p] 1) Find the AOB hack. Chances are, if you're here, you'll find it here. For an example, we'll use the following AOB hack from "Platform Racing 2" (credits to blahblahman) Quote Speedburst lasts for a long long time 2) Load up the game. DO NOT proceed past the initial screen/loader. Most games require that the game be freshly loaded into memory to apply the AOB hack - some even require you to apply the hack during the loader itself, which can get tricky as you try to do things quickly enough. CE's speedhack works well to help with that. 3) Start a search using "Array of Bytes" type of variable in CE. You want to search for the first value listed (in this case, 86 19 25 88 27 10). AOBs are usually of sufficient length and complexity that you will only get one result, unless the operation occurs multiple times in the code. So you should only have to search once. Select your result (or all of them, if multiples come up) and add them to your CE variable list. 4) Change the value of your result(s) to the indicated value - in this case, 86 19 2d 04 02 10. You'll note that the arrays are nearly identical, the only difference being that 25 88 27 of the code changed to 2d 04 02. Be sure that you get all the changes, sometimes more than one value changes. 5) You're done, go ahead and play the game. One of the disadvantages of AOB hacks is that often, an update to the game will change the code enough that the AOB hack no longer works. If you're sure you've done everything properly - ESPECIALLY the part about searching for the AOB right after the game loads - then that may be the case. There is no easy way to make an incorrect AOB work, you'll either have to wait for someone to come out with an updated one, or learn how to do it yourself. :) [spoiler=how to find:vmpbex3p] Quote from: "maximillian"
Quote from: "ActionScript 1 OpCodes" No Operation (NOP) = 0x02, Quote from: "ActionScript 3 opcodes" final int OP_bkpt = 0x01; I started to bytecode hack with CE myself I picked it pretty quickly it's very fun to create these kind of hacks its like editing assembly in native programs to create hacks like I used to in MMORPGS but one problem with editing bytecode in SWF.. my question is how do I NOP.. data in order to keep the size limit the same. Okay so here is some original data for a example game I want to hack Code: [Select] //96 10 00 00 73 63 6f 72 65 00 06 00 00 00 00 00 00 00 00 which means Code: [Select] score = 0;of course this is the initializer for start of game.. so if I initialize a higher ammo or score.. I'll hack the game now the values are 4 bytes aka DWORD but it's saved in reverse order small endian or idk.. but i know in C++ programming its easy to replicate using Lo/Hi's So changing ammo is easy I just modify these Code: [Select] 05 00 00 00 now what about score? when I try to edit score.. it changes assembly completely. Code: [Select] //96 0c 00 00 73 63 6f 72 65 00 07 [a3 07 64 00] I just changed it to Code: [Select] score = 6555555;of course I still managed to change the score.. but I changed the algorithm that generates the score like changing addition to multiplication making my score increase much more rapidly(easy bytecode hacks). But I want to modify the score to anything I want but you see the assembly is different.. so what must I do? so i'm changing This -> 96 10 00 00 73 63 6f 72 65 00 06 00 00 00 00 00 00 00 00 To This -> 96 0c 00 00 73 63 6f 72 65 00 07 a3 07 64 00 1d I have to nop 5 bytes in order for flash not to mess up the data by considering the extra 00 00 00 00 as another opcode.. and screwing up the flow. [spoiler=another guide on how to find aobs:vmpbex3p]The purpose of this guide is to introduce you to the art of bytecode hacking, also known as looking for array of bytes (AoBs). Now, if you are already a proficient bytecode hacker, these guides will probably do very little to help you, as most of my knowledge comes from this forum. Step 1: Download the .swf file In Firefox, the most common way is through AdBlock Plus, in which you simply look for the .swf file that has loaded on the page. More details here. In Google Chrome, one can use a slightly different method as outlined here. Kongregate: This will work for most kongregate games, and it is usually in the form of Code: [Select] http://chat.kongregate.com/gamez/####/####/live/GAME_NAME.swf?kongregate_game_version=###########. For example, for Robot Wants Kitty, the file is Code: [Select] http://chat.kongregate.com/gamez/0007/3913/live/robotkitty_kong.swf?kongregate_game_version=1268274573Newgrounds:This will work for most Newgrounds games, and is usually in the form of Code: [Select] http://uploads.ungrounded.net/#####/#####_GAME_NAME.swf For example, the game Hippolyta is at Code: [Select] http://uploads.ungrounded.net/530000/530069_Amazon.swfNote: Sometimes, due to encryption or something, you will not be able to find the correct file, or perhaps the file is unreadable. This can often be circumvented using Mr.White's great tool called swfmdump, which dumps the file from the computer memory. Step 2: Decompile the .swf file The tool that is used by the members on this forum (and is highly recommended) is called SoThink. You can easily get a torrent for SoThink and its key (use from 5.5). Now, open the .swf file with the installed decompiler. With SoThink, you can right-click on the file and click on SoThink, or alternatively, you can open the file through Sothink itself. Navigating SoThink shouldn't be too difficult. After you open it, hopefully it should look something like this: (broken image removed) Expand on the right side (circled in red) and you should see the different components. Usually, all the code is under "Action" so let's see what's there. Let's look with the section that says "Game." (broken image removed) If you look on the top (circled in red), there's 3 different types of views for the same piece of code. Source Code is the human-readable code, or what it looks like before decompiling. P-Code is the computer instructions associated with this code. (broken image removed) Raw data is all the bytes that are fed to the computer. These bytes are stored in the computer's memory, and it is these bytes that we want to change. Step 3: Changing the bytecode This is the most difficult part to become proficient at, and knowing what to change and what to change the bytes to requires a lot of skill; it is what makes the greatest hackers on this forum so great. Any experience in coding really helps, but is not necessary at all. Now, with AS2 (used in Flash 8 or before), you can use a tool called Flasm. Details are given in this video. However, most games these days are coded with AS3 (Flash 9 or later), so Flasm is useless. Let's first see the basics of how bytecode works. Take the game Creeper World Training Sim. After decompiling and searching through it, I find a function called calculateDamage. (broken image removed) You can see at the top it defines several variables (that don't really matter to us), and then it goes right into calculating the damage and executing commands based on the damage. The bytecode that corresponds to this code is here: Code: [Select] private function calculateDamage() : BooleanNow we must decide which bytes corresponds to which code. For now, we'll use key words such as "Destroy" or "health". So, Code: [Select] health = 0;corresponds to something like this:Code: [Select] //5e f9 02Note that in structuring bytes, it first lists the variable such as health, and then it pushes the byte 0 to assign 0 to health. In later tutorials, I will go into more detail on pushing numbers and such. Anyways, this piece of code corresponds to a structure that the player builds. Obviously, we don't want our own structures destroyed, so we'll NOP out the call to the function "destroy." So, copy+paste the 2 lines of code that correspond to this line: Code: [Select] destroy(); which would be Code: [Select] //5d a4 03The AoB we search for would be 5d a4 03 4f a4 03 00 and to NOP it out, we replace it with 02: 02 02 02 02 02 02 02 And there you have it! We have now found an AoB for invincible units! Step 4: Using the bytecode hack If you don't know how to use the Aob, look at the Hacking FAQ or the Guide to the Basics Also, now you can give back to this community and post your newly-found AoB on the forums!  |
|
Additional Info
|
And finally!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Don't ask questions here. This is not the help forum. You are lucky VxD was nice enough to help you. If you have questions, post them in the appropriate section. Don't kick mother English in the teeth. Use full sentences and make an effort to spell properly. "Leet-speek" may get you booted. Locked. |
|
Additional Info
|
I help all the people I can.
|