Wednesday, November 16, 2011

Kongregate Doom Forge Damage Hack AoB

I've been playing Doom Forge on Kongregate.com for the past few days and thought I'd share this damage hack with others. Have Fun.

If you need help just follow the tutorial I created for RotMG with how to replace the AoB's using HxD. --> http://opiumtest.blogspot.com/2010/08/how-to-cheat-in-realm-of-mad-god.html

UPDATED: Jan. 9th
//Change Power Strike Damage - Can change when in game
Search for: d030d01006000070ae21a257932c828d01d1a02cc27fa0d2a02cb69301
Replace with: d03025A846480070ae21a257932c828d01d1a02cc27fa0d2a02cb69301
Datatype: hex-values

Labels: , , , ,

Saturday, July 09, 2011

Dransik Macro Checker Sikuli Script Hack



I made this simple Dransik macro bypass hack back in mid March and decided to share with everyone. As you can see from the Sikuli script code it took me only 10 lines of code to have a 100% working macro check hack. The "a" variable in the script holds a region capture of the entire macro window in game, so just click the "Create Region" button in Sikuli when it pops up in game and capture the entire macro check window. The while/exists in the script is to make sure we continue to run the script only when the NPC guy pic in this case still exists in the region. You can stop the script by simply opening the skills window or covering it with the backpack. The code is self explanatory and one could easily incorporate more code to make a macro for different skills in game. I made a simple forging/smelting macro for example with the macro check script. I'm going to include a zip file containing the Sikuli script for quick custom script making, enjoy.

DOWNLOAD HERE - dransikbypass.zip
dransikbypass.sikuli macro check hack script

Wednesday, August 25, 2010

How to cheat in Realm of the Mad God

I have been playing Realm of the Mad God off and on since its debut but never have come across anyone who actually could successfully cheat in the game until a few days ago. I couldn't pass on some hacking Realm of the Mad God fun so I searched the AS3 code with Sothink for anything that would be helpful in doing so. I found a couple locations in the AS3 code or raw data which would handle cheaters in game("handleCheater") with one being the actual function and other calling the function. If you try changing any values in game without first stopping the function the game deletes your character and kicks you.

I chose both the function and function call shown below to NOP(02) using the free hex editor called HxD. You could use Cheat Engine or Memory Hacking Software but I believe this program makes the process simple and quick. I tried the hex editor tool in MHS but it didn't work for me. You do not have to just rely on hex editing/replacing AoB's you find but can change any values you find using CE or MHS as long as you NOP the handleCheater function first. I found that for Google Chrome browser the first process listed is the one you would need and for FireFox browser you need to locate the plugin-container.exe process when using HxD.

com>company>assembleegameclient>game>GameSprite :
//66 18
_as3_getproperty _-82
//66 42
_as3_getproperty player_
//46 26 00
_as3_callproperty toString(param count:0)
//4f d9 0a 02
_as3_callpropvoid failure(param count:2)
//47

and

com>company>assembleegameclient>object>Player :

//4f d3 18 00
_as3_callpropvoid handleCheater(param count:0)
//26
_as3_pushtrue
//48

I was fooling around with this function I found which obviously involves damage amount and shooting. I replaced the get damage_ property with a different one in the code. I wasn't sure what to expect but I ended up with completely disabling all enemies shooting projectiles.

com>company>assembleegameclient>net>_-Gs :

private function _-GL(param1:Shoot) : void
{
......
//66 94 05
_as3_getproperty damage_
//4f d4 0d 05
_as3_callpropvoid _-q(param count:5)
//d0
_as3_getlocal <0>
//66 1d

and chose the getproperty //66940c from GameObject to replace it.

I was using MHS/CE for searching my STR in game using long/4byte and changing the value for doing absurd damage. You would have to find the correct address every time you entered/exited a dungeon using this method so why not find a way to permanently set your attack with a value already used in the game by replacing some AoB's in memory. I did just that and it didn't take very long to do. I found that the game loads all your char attributes through a function after you selected a server and if you search through the code you'll find "HitPoints", "MaxHitPoints" or through the decrypted SWF you'll find "Attack", etc. You will find that "Attack" is associated with "_-Ka" throughout the whole code. I found a beneficial variable used in the same object that we can use instead of the "_-Ka". You'll notice it is used twice from the object below but we'll just replace both.

com>company>assembleegameclient>object>Player :

override public function toString() : String
{
........
var _loc_1:* = ...+ "" + _-Ka + "" +...

//11 72 00 00
_as3_iftrue offset: 114
//60 99 08
_as3_getlex _-Ka
//a0
_as3_add
//2c ab 05

and we'll replace with :
//60 86 0c
_as3_getlex _-6E (10000)
public static const _-6E:int = 10000;

The AoB's needed for cheating Realm of the Mad God are found below which I'll try and update once the game has been updated or you could find them yourself.

//Disable anti-cheat in game - Must replace at title screen - Need to Update
Search for: 661866424626004fd90a0247
Replace with: 020202020202000202020202
Datatype: hex-values

//Disable anti-cheat in game - Must replace when in game - Need to Update
Search for: 4fd318002648
Replace with: 020218000202
Datatype: hex-values

//Disable enemy shooting/damage - Must replace at title screen - Build #106 NEW - 10/22/10
Search for: 66d2034fcd0b05d06628
Replace with: 66f9014fcd0b05d06628
Datatype: hex-values

//Change Attack Damage - Must replace at title screen - Need to Update
Search for: 123b0000609908244ba3
Replace with: 123b000060860c244ba3
Datatype: hex-values

//Change Attack Damage - Must replace at title screen - Need to Update
Search for: 11720000609908a02cab05
Replace with: 1172000060860ca02cab05
Datatype: hex-values


Labels: , , , , , ,