It's no trouble; if it were, I wouldn't do it for fun  (broken image removed)

Can always purchase skillz:
12 0a 00 00 62 05 26 61 bb 02
12 00 00 00 62 05 26 61 bb 02

Only enemies can take damage: (woops, you can't lose...)
12 05 00 00 29 60 83 06 76 12 ad 00 00
12 05 00 00 29 d0 66 a6 06 12 ad 00 00

Here's how I got to finding out the AoBs:

First, I thought about what I wanted to change. Starting out with "being able to always buy stuff is good", I went to the swf, and did a global search for points (case insensitive.) The first result was this:

(inside of com->helixfox->games->data->PlayerData)
public static const POINTS_PER_TIER:uint = 2;

That looked promising, so I copied the name and did a global search for that. Looking through the result, one thing looked like what we wanted:

(third result, com->helixfox->games->upgrade->UpgradeScreen)
                if (_loc_2 < _loc_4 && _loc_2 >= _loc_5.talentData.tier * PlayerData.POINTS_PER_TIER)
                {
                    _loc_5.active = true;
                }

Basically, ignoring the annoying variables and checks, if the "if" statement is executed, _loc_5 is going to be active. What's _loc_5? Looking a little further up the code, we see that _loc_5 is declared as a TalentButton. Even without knowing what that does exactly, we can guess: If it's active, we can potentially click it!

Going to the raw data and searching for POINTS_PER_TIER some times got me here:

(line ~1434)
//66 ff 0b
_as3_getproperty POINTS_PER_TIER
//a2
_as3_multiply
//b0
_as3_greaterequals
//12 0a 00 00
_as3_iffalse offset: 10
//62 05
_as3_getlocal <5>
//26
_as3_pushtrue
//61 bb 02
_as3_setproperty active

Now, there's an if statement right there. The second byte (in this case 0a) is how many bytes you skip if the if statement fails. Since we always want the statement to execute, let's make it not skip any byte, change the offset to 0 in other words. (The cool thing is, the "else" statement code bytes are skipped when the if statement reaches the end, so we don't need to worry about them!)

Now, the health hack was a little bit more complex, but nothing too daunting.

I started by searching for damage, a very likely suspect. It got me tons of results. So I started weeding them out by looking at the file names: We probably won't care about it in TalentData or Projectile, so we reach the Ship class. Looking over the result, we see a promising function called "damage".
Now, looking inside the function (and some time searching the other files) I saw that the game doesn't care (health-reduction wise) if the target hit is friend or foe. So we can't do anything directly to that.
Instead, there's a giant block that's skipped inside this nice if statement in the previously found damage function:

if (active && alive)If we can change it to something like "if (targetIsEnemy)", that'd solve all the trouble! So, I started looking around the file for something similar. It didn't take long before finding this baby, two functions above our found function:
if (!this.isEnemy)
Sweet! We now know how to do it.

Searching for the active and alive part in the raw code brought me here:
//60 bb 02
_as3_getlex active
//76
_as3_convert_b
//2a
_as3_dup
//12 05 00 00
_as3_iffalse offset: 5
//29
_as3_pop
//60 83 06
_as3_getlex alive
//76
_as3_convert_b
//12 ad 00 00
_as3_iffalse offset: 173


Since we only need to change one thing, I changed the latter. To what, you ask? To what "!isEnemy" looks like in the raw data:

//d0
_as3_getlocal <0>
//66 a6 06
_as3_getproperty _isEnemy

From here on, the AoB was simple:

//60 83 06
_as3_getlex alive
//76
_as3_convert_b

===>

//d0
_as3_getlocal <0>
//66 a6 06
_as3_getproperty _isEnemy

Hope this somehow helped.

My first AOB!  Yes, it's somewhat redundant since there's the "can always purchase talents" AOB above, but I'm just glad I finally got one working.  And hey, all talents, two clicks!  (broken image removed)

[aob:prcc6xxt]Hit Reset (and confirm) to purchase all talents:
66 d8 04 27-> 66 d8 04 26[/aob:prcc6xxt]