Cheat Engine

zn5 · How do I cheat? Reputation: 0 Joined: 29 Dec 2015 Posts: 4

If I understand right, I am not allowed to use the name of the game that I want help hacking, so I'll just refer to it as the Game.

The Game is an online, browser based, shockwave 3D shooter game with no registration, you only enter an username, pick one room out of 20, and play.. It's an extremely simple game from more than 10 years ago, graphics are very plain and simple, there is nothing advanced like crouching, or any special devices ingame. You just walk and shoot, basically.

So in this game, I have managed to perform fly hacks, speed hacks, teleport hacks, kicking other players, creating shockwave error on purpose, crashing rooms and others. But there is one I can't do. I can't hack health.

Of course, I can block the packets carrying weapons damage, and thereby prevent health from going down, but that's not hacking health directly, which is what I want.

Whenever I edit the health value, the game simply restarts the browser and I'm at the 'Welcome to Game' screen again, it's quite impossible. Me and others have tried other things as well and none of them work...

Could any of you assist me in this, tell me where to look, what to look for etc?

ParkourPenguin · Posted: Tue Dec 29, 2015 10:12 am Post subject:

This is just a total guess based on my experience in disassembling several flash games.

What probably happens when you take damage is that it asks the server for your current health value. It'll take whatever changes your health was suppose to receive, and update the value on the server with the new value. After that, it could throw away the local client-sided value, or it could keep it around as a red herring for people trying to cheat. In that case they'll check that red herring against the server's value periodically to make sure you're not cheating. So basically, there's no feasible way to change it by just searching and changing values.

If you have a pretty good understanding of ASM, you can use ultimap (video tutorial) to find the function that's called when you take damage. Then, just hook that function call or something else inside of it to make you not take any damage.

Alternatively, you can try disassembling the .swf to see how it does stuff yourself. Then modify the AVM bytecode to skip over taking damage or whatever.
SWF modification example (use JPEXS instead of the decompiler used in the video; JPEXS is free)

zn5 · How do I cheat? Reputation: 0 Joined: 29 Dec 2015 Posts: 4

Thanks! I will definitely try the things you said. So doing a 'what accesses' scan on the value, finding the associated adresses with codefinder and freezing them would do the job?

ParkourPenguin · Posted: Tue Dec 29, 2015 10:26 pm Post subject:

Maybe. It most likely won't be as simple as replacing an instruction with NOPs; you'd have to look at the ASM around instructions that access it.
More specifically, look at what it does with the value after it reads from that address and what it's done with a value before it writes the new value to the address (and what it does with that value afterwards).
This could mean analyzing anywhere from less than 100 to 10,000+ instructions.

So you probably can do it that way, but you'll have to have lots of time and patience.