Cloudstone
-migrated-
Cloudstone
Submitted By:
Launch Trainer!
Action Adventure MMO Multiplayer RPG

Wondering where the hacks are at? Register or Sign In to find out!


Wondering where the sol files are at? Register or Sign In to find out!

Cloudstone

-migrated-
Last Updated: 07/02/2018 18:10

Cloudstone

Auto-Post
Last Updated: 12/30/2013 14:00

Cloudstone - 50 pts. (new window)
5
 

Socially Awesome Pwning

  Reach level 5 and summon a friend to help you fight
15
 

Player Puncher Pro

  Defeat 10 other players in pvp matches
30
 

Rift Warrior

  Clear floor #10 in the Arcane Rift

Game Dscription
CloudstoneMagic, mayhem, monsters and mysteries, and above all: Clouds (literally!). Join us in an action adventure that will take you where only your imaginat...
Re: Cloudstone Posted on: 11/27/2012 11:30am
Quote Post
If i search Admin Hack or the Console i dont find anything
Re: Cloudstone Posted on: 11/28/2012 9:24pm
Quote Post
So they patched the exploit that allowed the xp boost to affect xp gotten from house decorations (which was sad; 3mil+ exp every 5 hours was nice.)

Can anyone search around for "xp" or "buff" and see if there's a way to nullify what they did to the code?
Re: Cloudstone Posted on: 12/08/2012 5:54am
Quote Post
its possible to get ban if i use the chest cheat?
Re: Cloudstone Posted on: 12/23/2012 1:07am
Quote Post
The Laziest Man on KongHack
bumping/necro'ing. why? because people play it, people hack it, and blahblahblah.

just to get things started again i managed to salvage the 306 loot code from the swf along with the 2nd part of console.
306 loot
Code: [Select]
62 ?? 46 ?? ?? 00 62 ?? 2c ?? ?? 66 ?? ?? 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c ?? ?? 66 ?? ?? 62 ?? 2c ?? ??

47 ?? 47 ?? ?? 00 62 ?? 25 e5 01 25 e7 01 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c !! !! 66 ?? ?? 62 ?? 2c ??* ??*
(replace pasta: 47 ?? 47 ?? ?? 00 62 ?? 25 e5 01 25 e7 01 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c ?? ?? 66 ?? ?? 62 ?? 2c ?? ??)

replace the !! with the bytes marked with *. so 2c !! !! and da* 1b* --> 2c da 1b
unfortunately the second console part is useless since the first part is gone and i have no idea where kolonel found it, or how he edited it



Re: Cloudstone Posted on: 02/15/2013 3:26am
Quote Post
Any 1 know to remove the gold shards and items same as fast corps decay removing the lagg..the green circle "ITEMS LOOT" any code for removing? the animation? while the black circle "Shards" any one knows? to remove the animation? its making me lagg :// pls help http://postimage.org/image/y2xtyirdl/  <----here
Re: Cloudstone Posted on: 02/15/2013 4:13am
Quote Post
Any 1 know to remove the gold shards and items same as fast corps decay removing the lagg..the green circle "ITEMS LOOT" any code for removing? the animation? while the black circle "Shards" any one knows? to remove the animation? its making me lagg :// pls help http://postimage.org/image/y2xtyirdl/  <----here

jesus christ, that's some bad grammar and punctuation. You should at least make it readable if you're making a request.
Re: Cloudstone Posted on: 02/15/2013 9:34am
Quote Post
I know this is somewhat of an old thread on here, but does anyone have an update for the console code? Or did that finally get patched?
Re: Cloudstone Posted on: 02/16/2013 4:10am
Quote Post
I know this is somewhat of an old thread on here, but does anyone have an update for the console code? Or did that finally get patched?
haha, i was on a hurry to post,and so i dint manage to read my post (broken image removed),any one can help me? (code: Removing the animation like shards,gold,and items loot. ) cause its laging me.

http://postimage.org/image/y2xtyirdl/ <----
Re: Cloudstone Posted on: 02/28/2013 3:04pm
Quote Post
The Laziest Man on KongHack
wow. this game is back on page 1. im surprised

Quote
part one enables the "local save" command and changes the key from ctrl+s to f3
part two rips out all of the guts from private function localSave() : void and replaces them

i looked around the swf and noticed that they changed the getlocalsave function, along with the determine admin function since its called pretty much everywhere. i tried to change the _get property is admin to SET property, but the game crashes
Code: [Select]
private function localSave() : void
        {
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//d0
_as3_getlocal <0>
//66 85 55
_as3_getproperty _userData
//46 c4 06 00
_as3_callproperty toJson(param count:0)
//85
_as3_coerce_s
//d5
_as3_setlocal <1>
//60 b8 67
_as3_getlex flash.system::System
//d1
_as3_getlocal <1>
//4f e7 7c 01
_as3_callpropvoid setClipboard(param count:1)
//5d 84 32
_as3_findpropstrict flash.net::FileReference
//4a 84 32 00
_as3_constructprop flash.net::FileReference(param count:0)
//80 84 32
_as3_coerce flash.net::FileReference
//d6
_as3_setlocal <2>
//d2
_as3_getlocal <2>
//60 0f
_as3_getlex flash.events::Event
//66 b1 76
_as3_getproperty SELECT
//d0
_as3_getlocal <0>
//66 aa 55
_as3_getproperty onLocalSaveSelected
//27
_as3_pushfalse
//24 00
_as3_pushbyte 0
//26
_as3_pushtrue
//4f de 17 05
_as3_callpropvoid addEventListener(param count:5)
//d2
_as3_getlocal <2>
//d0
_as3_getlocal <0>
//66 85 55
_as3_getproperty _userData
//46 c4 06 00
_as3_callproperty toJson(param count:0)
//d0
_as3_getlocal <0>
//66 8f 55
_as3_getproperty _localSaveName
//4f a5 82 01 02
_as3_callpropvoid save(param count:2)
//47
_as3_returnvoid
        }// end function

and
Code: [Select]
private function determineAdmin() : Boolean
        {
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//d0
_as3_getlocal <0>
//46 84 56 00
_as3_callproperty determineWebServer(param count:0)
//27
_as3_pushfalse
//ab
_as3_equals
//2a
_as3_dup
//11 0c 00 00
_as3_iftrue offset: 12
//29
_as3_pop
//60 e1 4c
_as3_getlex flashVars
//66 a3 82 01
_as3_getproperty asdfPOIJasdfOIUH
//2c ed 7e
_as3_pushstring "vnzfdsoziufawe234roa23809a9"
//ab
_as3_equals
//12 02 00 00
_as3_iffalse offset: 2
//26
_as3_pushtrue
//48
_as3_returnvalue
//27
_as3_pushfalse
//48
_as3_returnvalue
        }// end function

does anyone know where the strings "asdfPOIJasdfOIUH" and "vnzfdsoziufawe234roa23809a9" are stored. they call the first and push the second. i tried a search all but there were the only two instances i found it and one of them is the function itself.

if its doing the equivalent of a call, cmp, jnz kinda thing, we could nop the conditionals. in this case it would be the "if _ is false, push offset _"
ive got the theory aspect, but im not used to swf's or bytecodes. anyone wanna fix the konsole and explain what they did?

also, i found something interesting
Code: [Select]
public function getOct17RollbackCompensation(param1:Number)
        {
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//60 e5 02
_as3_getlex com.playsaurus.model::ActivityQueue
//66 99 57
_as3_getproperty instance
//d0
_as3_getlocal <0>
//2c cc 2e
_as3_pushstring "getOct17RollbackCompensation"
//d1
_as3_getlocal <1>
//4f d7 2e 03
_as3_callpropvoid record(param count:3)
//d0
_as3_getlocal <0>
//26
_as3_pushtrue
//61 e7 2d
_as3_setproperty gotOct17RollbackCompensation
//60 e5 02
_as3_getlex com.playsaurus.model::ActivityQueue
//66 99 57
_as3_getproperty instance
//4f dd 2e 00
_as3_callpropvoid sendSoon(param count:0)
//47
_as3_returnvoid
        }// end function



Re: Cloudstone Posted on: 02/28/2013 5:34pm
Quote Post
Never let a computer tell me shit.
i tried to change the _get property is admin to SET property, but the game crashes
Then you probably, 99% chance, you didnt properly manage the stack

does anyone know where the strings "asdfPOIJasdfOIUH" and "vnzfdsoziufawe234roa23809a9" are stored. they call the first and push the second. i tried a search all but there were the only two instances i found it and one of them is the function itself.
these are flashvars -  variables which can be passed from a web page to a Flash (SWF) file. This means that you can define any variables you like in the HTML of a page and these variables can be used by the Flash file.

if its doing the equivalent of a call, cmp, jnz kinda thing, we could nop the conditionals. in this case it would be the "if _ is false, push offset _"
ive got the theory aspect, but im not used to swf's or bytecodes. anyone wanna fix the konsole and explain what they did?
id say the hack is probably a lot easier if you ignore all the bullshit and just do what you want then leave, e.g.
mov   - store true in memory pointed to by _isAdmin
pop    - store the return address in a register // stack management
push  - push true onto the stack
push  - push return address back onto stack
ret     - return to calling function.

I hope that makes as much sense as I think it does. anyways its bedtime for me. I will probably revisit this with a solution later.



I use this AoB tool to make all the AoBs I post. Try the online version if you dont feel like downloading it.
"Obviously, windows are central to Windows. They are so important that they named the operating system after them. But what is a window?"

Re: Cloudstone Posted on: 02/28/2013 9:13pm
Quote Post
The Laziest Man on KongHack
well, it does make some sense, but i doubt its as much as you wanted it to (broken image removed)
i mean, i know im still learning but shouldnt it look more like

mov whatever address being pointed to into an unused register like esp
push true ontostack
mov true to register
pop the true so it goes back to all 0000
push the registers value back onto the stack
ret back to whatever called the function in the first place

or is that all kinds of messed up? i wouldnt be surprised honestly. the extent of my knowledge in ASM is what the opcodes do and their syntax. i have yet to learn how they interact

edit: i guess it really doesnt matter. im still going to look at how you fix it and im still going to try and understand why it worked



Re: Cloudstone Posted on: 03/04/2013 5:35am
Quote Post
Never let a computer tell me shit.
ok so lets start with determine admin()
Original
Code: [Select]
private function determineAdmin() : Boolean
{
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//d0
_as3_getlocal <0>
//46 84 56 00
_as3_callproperty determineWebServer(param count:0)
//27
_as3_pushfalse
//ab
_as3_equals
//2a
_as3_dup
//11 0c 00 00
_as3_iftrue offset: 12
//29
_as3_pop
//60 e1 4c
_as3_getlex flashVars
//66 a3 82 01
_as3_getproperty asdfPOIJasdfOIUH
//2c ed 7e
_as3_pushstring "vnzfdsoziufawe234roa23809a9"
//ab
_as3_equals
//12 02 00 00
_as3_iffalse offset: 2
//26
_as3_pushtrue
//48
_as3_returnvalue
//27
_as3_pushfalse
//48
_as3_returnvalue
}// end function
easiest solution
Code: [Select]
private function determineAdmin() : Boolean
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//26
_as3_pushtrue
//48 02 02 02
_as3_returnvalue
//27
_as3_pushfalse
//ab
_as3_equals
//2a
_as3_dup
//11 0c 00 00
_as3_iftrue offset: 12
//29
_as3_pop
//60 e1 4c
_as3_getlex flashVars
//66 a3 82 01
_as3_getproperty asdfPOIJasdfOIUH
//2c ed 7e
_as3_pushstring "vnzfdsoziufawe234roa23809a9"
//ab
_as3_equals
//12 02 00 00
_as3_iffalse offset: 2
//26
_as3_pushtrue
//48
_as3_returnvalue
//27
_as3_pushfalse
//48
_as3_returnvalue
}// end function

secondary solution modifying branches
Code: [Select]
private function determineAdmin() : Boolean
//d0
_as3_getlocal <0>
//30
_as3_pushscope
//d0
_as3_getlocal <0>
//46 84 56 00
_as3_callproperty determineWebServer(param count:0)
//27
_as3_pushfalse
//ab
_as3_equals
//2a
_as3_dup
//10 0c 00 00
_as3_branch offset: 12
//29
_as3_pop
//60 e1 4c
_as3_getlex flashVars
//66 a3 82 01
_as3_getproperty asdfPOIJasdfOIUH
//2c ed 7e
_as3_pushstring "vnzfdsoziufawe234roa23809a9"
//ab
_as3_equals
//12 00 00 00
_as3_iffalse offset: 0
//26
_as3_pushtrue
//48
_as3_returnvalue
//27
_as3_pushfalse
//48
_as3_returnvalue
}// end function

enable admin !!dont forget speedhack!!
d0 30 d0 46 84 56 00 27 ab 2a 11 0c 00 00 29 60 e1 4c 66 a3 82 01 2c ed 7e ab 12 02 00 00 26 48 27 48
d0 30 d0 46 84 56 00 27 ab 2a 10 0c 00 00 29 60 e1 4c 66 a3 82 01 2c ed 7e ab 12 00 00 00 26 48 27 48

and there you go. admin controls, and console. you will have to speed hack to put the code in when the loading bar is about 1mm long. that was the whole purpose of ripping out the guts of local save. poke around for a full explanation.
sorry ive not much time, deadlines at work and such.

oh, but here goes a screenshot just to prove it works since it will likely take several tries to get the timing right.
http://pasteboard.co/G8bNODq.png



I use this AoB tool to make all the AoBs I post. Try the online version if you dont feel like downloading it.
"Obviously, windows are central to Windows. They are so important that they named the operating system after them. But what is a window?"

Re: Cloudstone Posted on: 03/04/2013 9:12am
Quote Post
Are you still using the ~ button to bring up the console?
Re: Cloudstone Posted on: 03/04/2013 10:13am
Quote Post
Never let a computer tell me shit.
yes



I use this AoB tool to make all the AoBs I post. Try the online version if you dont feel like downloading it.
"Obviously, windows are central to Windows. They are so important that they named the operating system after them. But what is a window?"

Re: Cloudstone Posted on: 03/06/2013 10:18pm
Quote Post
The Laziest Man on KongHack
heres some random stuff. might try and do more but eh, dont hold your breath.

disable hackFastKills
60 ?? ?? 66 ?? ?? 24 50 0f ?? 00 00
60 ?? ?? 66 ?? ?? 24 50 0f 00 00 00

notes: someone check this one. it might or might not work. i set the first offset to be 0, since if kills > 80 (which im assuming is the cheat detection part) it sets the offset. therefore no offset = no cheat. i hope. if anyone wants to take a look at it (preferably someone like kolonel or lolwut so they can explain where i effed up if i did mess something up), its directly above the recordCheatUsage. just search for "craisins"

disable recordCheatUsage
d0 30 5d 05 d1 2c ?? ?? 46 ?? ?? 01 46 05 01 73 d6 d1 2c ?? ?? 5d 01 d2 24 01 a0 46 01 01 4f ?? ?? 02 47
d0 30 02 02 02 02 02 02 02 02 02 02 02 02 20 02 d6 d1 2c ?? ?? 5d 01 d2 02 02 02 46 01 01 4f ?? ?? 02 47

306 loot
Code: [Select]
it disconnects you after you open the chest, but you retain them after refreshing

62 ?? 46 ?? ?? 00 62 ?? 2c ?? ?? 66 ?? ?? 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c ?? ?? 66 ?? ?? 62 ?? 2c ?? ??

47 ?? 47 ?? ?? 00 62 ?? 25 e5 01 25 e7 01 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c !! !! 66 ?? ?? 62 ?? 2c ??* ??*
(replace pasta: 47 ?? 47 ?? ?? 00 62 ?? 25 e5 01 25 e7 01 0d 23 00 00 60 ?? ?? 62 ?? 62 ?? 2c ?? ?? 66 ?? ?? 62 ?? 2c ?? ??)

replace the !! with the bytes marked with *. so 2c !! !! and da* 1b* --> 2c da 1b

might edit in more things later