Bloons TD6

[Yers]

Please an update for Level EXP and Tower EXP

Tower EXP ==
Step 1. Scan current money (Double, Exact Value)
Step 2. Place some monkey, Scan current money.
Step 3. 2 Values should appear, Right Click the top one and click Browse Memory Region
Step 4. Right Click, Change Display Type to Double(This is just for ease of viewing)
Step 5. Find your money in the viewing panel.
Step 6. Scroll up by ONE line.
Step 7. You should see 4-5 values constantly changing over and over(they will be flashing red). MAKE SURE THIS IS ABOVE THE VALUE you found in Step 5, NOT BELOW.
Step 8. Alter that value. Turned negative? Alter it again.(What i do is add them all to my address list by Right Clicking>Add this address to the list and freeze them. If it goes down, unfreeze and refreeze til it increases)

[Csimbi]

That's a quite rudimentary way of tapping into the KonFuze class, but hey, if it works for you...

KonFuze stores all values (int, float, double) as doubles and often times (but not always) the values are re-encrypted even after a read operation, too.
KonFuze manages two seeds and a double[] array.
In the double array only one of the numbers are valid and there are better ways to find the right one.
But, I'd advise against trying to work it out - if you could not figure it out so far, chances are good that you won't in the future, either.

There is a general problem with any of these encrypted values: they seldom support direct operations; that includes basic stuff like addition, subtraction, too.
This means that the value has to be decrypted before any operation and re-encrypted after.
While this is a waste of CPU cycles for the most part, it does hold wannabies in bay.
Unfortunately, NinjaKiwi's KonFuze class does not even achieve that - as you can see, even your rudimentary way of hacking the value works, defeating NinjaKiwi's highly convoluted encryption with ease.
Note to NinjaKiwis: constantly changing values are easier to find than those that are static. By constantly changing them you are making them very easy to find -> you shot yourself in the leg.
True, there is a hack detection built into KonFuze, but I wonder what's point of the encryption then?
They knew their encryption were broken from the start? Just do hack detection and be done with it.
I hacked Bloons Adventure Time TD to smithereens as well, that did a far better job in the encryption department.

Sorry, I can get carried away when I see design nonsense like this.
Back to the issue at hand.
So, when you see an encrypted value, you should not waste much time on trying to understand how it works - unless it's a simple XOR or bit shift, there is no point.
Instead, tap into the functions that do the actual operations - you will always find member functions like 'SetX(...)', 'ResetX(...)', 'AddX(...)', 'RemoveX(...)', 'MultiplyX(...)', 'CompareX(...)', etc.
These member functions either implement the decryption/encryption themselves, or, they call an appropriate function that does that.
For example, let's take the hero class in BTD6:

public class Hero : TowerBehavior
{
...
public void AddXp(float amount);
...
}

If you debug that call, you will find that there's a whole lot of CPU cycles wasted to resolve the current XP.
Then, the 'amount' is added and there's another a whole lot of CPU cycles wasted to update the KonFuze class (random seeds and all doubles).
So, a smart guy ignores the nonsense before and after and sees about changing the amount.
Are you a smart guy?

[panzerfaust_942]

Hey, completely new to this Site and wanted to ask if it's possible to add only small amounts like 1k-3k gold in an active round?

[gamingflame99]

Is it possible to hack in tower exp with this? If so what value type do i need to search for in Cheat engine?

[Yers]

Can you update this cheat. I need a working way to get lvl 150....

[FunkyFight]

Can you update this cheat. I need a working way to get lvl 150....

I agree, I really need a update for Levels and Tower EXP

[cfemen]

ignore EXP, you can buy every upgrade:

Code: Select all

aobscanmodule(aobEXP,GameAssembly.dll,84 C0 0F 84 00 02 00 00 48 8B 05) // should be unique

aobEXP+2:
  db 90 90 90 90 90 90

registersymbol(aobEXP)

[DISABLE]

aobEXP+2:
  db 0F 84 00 02 00 00

unregistersymbol(aobEXP)

Instant win the current round (you can do that as often you want in one round to get the rewards)

Code: Select all

[ENABLE]

aobscanmodule(aobUpdates,GameAssembly.dll,F2 0F 5C F0 66 0F 2E 73 28) // should be unique
aobscanmodule(Win,GameAssembly.dll,48 83 EC 28 80 3D 60 46 95 01 00) // should be unique
alloc(newmem,$100,"GameAssembly.dll"+1C1B71)

label(code)
label(return)

label(once)

newmem:

code:
  subsd xmm6,xmm0
  ucomisd xmm6,[rbx+28]
  cmp [once],1
  je return
  mov [once],1
  sub rsp,20
  mov r11,Win
  call r11
  add rsp,20
  jmp return
once:
dd 0

aobUpdates:
  jmp newmem
  db 90 90 90 90
return:
registersymbol(aobUpdates)


[DISABLE]

aobUpdates:
  db F2 0F 5C F0 66 0F 2E 73 28

unregistersymbol(aobUpdates)
dealloc(newmem)

[HuruKotsi]

Hey Everyone just wanted to let you know that I have found the solution to the game crash at the loading screen.

Access your C: Drive and go to Users/''Your Username''/App Data/Roaming/...

Find the Folder Called ( Goldberg SteamEmu Saves ) And Delete it from your C: Drive then reboot your game

WARNING: It will reset everything but the game will boot up again.

I made the game crash multiple times on purpose to test this out and found that the crash has something to do within that folder.

Enjoy your game again.

[FunkyFight]

ignore EXP, you can buy every upgrade:

Code: Select all

aobscanmodule(aobEXP,GameAssembly.dll,84 C0 0F 84 00 02 00 00 48 8B 05) // should be unique

aobEXP+2:
  db 90 90 90 90 90 90

registersymbol(aobEXP)

[DISABLE]

aobEXP+2:
  db 0F 84 00 02 00 00

unregistersymbol(aobEXP)

Instant win the current round (you can do that as often you want in one round to get the rewards)

Code: Select all

[ENABLE]

aobscanmodule(aobUpdates,GameAssembly.dll,F2 0F 5C F0 66 0F 2E 73 28) // should be unique
aobscanmodule(Win,GameAssembly.dll,48 83 EC 28 80 3D 60 46 95 01 00) // should be unique
alloc(newmem,$100,"GameAssembly.dll"+1C1B71)

label(code)
label(return)

label(once)

newmem:

code:
  subsd xmm6,xmm0
  ucomisd xmm6,[rbx+28]
  cmp [once],1
  je return
  mov [once],1
  sub rsp,20
  mov r11,Win
  call r11
  add rsp,20
  jmp return
once:
dd 0

aobUpdates:
  jmp newmem
  db 90 90 90 90
return:
registersymbol(aobUpdates)


[DISABLE]

aobUpdates:
  db F2 0F 5C F0 66 0F 2E 73 28

unregistersymbol(aobUpdates)
dealloc(newmem)

Thanks you very much ! Do you think you can do the same for the levels?
It would be really great !

[MEGABZA]

ignore EXP, you can buy every upgrade:

Code: Select all

aobscanmodule(aobEXP,GameAssembly.dll,84 C0 0F 84 00 02 00 00 48 8B 05) // should be unique

aobEXP+2:
  db 90 90 90 90 90 90

registersymbol(aobEXP)

[DISABLE]

aobEXP+2:
  db 0F 84 00 02 00 00

unregistersymbol(aobEXP)

Instant win the current round (you can do that as often you want in one round to get the rewards)

Code: Select all

[ENABLE]

aobscanmodule(aobUpdates,GameAssembly.dll,F2 0F 5C F0 66 0F 2E 73 28) // should be unique
aobscanmodule(Win,GameAssembly.dll,48 83 EC 28 80 3D 60 46 95 01 00) // should be unique
alloc(newmem,$100,"GameAssembly.dll"+1C1B71)

label(code)
label(return)

label(once)

newmem:

code:
  subsd xmm6,xmm0
  ucomisd xmm6,[rbx+28]
  cmp [once],1
  je return
  mov [once],1
  sub rsp,20
  mov r11,Win
  call r11
  add rsp,20
  jmp return
once:
dd 0

aobUpdates:
  jmp newmem
  db 90 90 90 90
return:
registersymbol(aobUpdates)


[DISABLE]

aobUpdates:
  db F2 0F 5C F0 66 0F 2E 73 28

unregistersymbol(aobUpdates)
dealloc(newmem)

Forgive my ignorance , how to use these codes ?

[cfemen]

edit:
removed describtion and (old) tables, didnt like the game and wont do any updates/cheats for this.
decided to share this : viewtopic.php?f=2&t=8426&start=135#p127762
for anybody who has problems with negativ values or wants to change some specific values.

//

if you dont need to change any values, use this:
table from GreenHouse : viewtopic.php?t=11682

[MEGABZA]

/////
Forgive my ignorance , how to use these codes ?

well, i just made a table with it.

Features:

-Ignore Tower EXP
you can buy every upgrade 4 free ( you need more than 0 EXP for the first uprade, im too lazy for searching this check )

-Instant Win Round
activate script and you will get a message that you won the round, you can select "free play" and execute script again and stack the rewards.

-Player EXP
activate only in Main Menu!
wait a sec and you will see a random number like this:



in my example:
213500 = 580

if you want more just increase the number:



213700 = 780

so yeah you can give yourself every value(you can set a greater value than needed without problems)
to trigger a level up -> start a map and leave it or just play and every round you get a level up ( if EXP > EXP_NEEDED)

note : deactivate script if you have altered the value, my script manipulates parts of the anti-cheat and will cause a crash if its activ while the game loads maps !

thats it, i already uninstalled the game so i wont do any updates / more features ...
i also have coded own scripts for pointers to health and money, but i guess its not necessary to add coz linkff's table already covers health and money

PS : special thanks to KonFuze "anti-cheat" that
showed me all the protected vars (after i force killed all the fakes / randomizing key) its really pleasant to get all important values without scanning/searching xD

Very thanks ! It really helps posting.php?mode=quote&f=2&p=116583#

[cfemen]

mh i just updated table with more pointers:

Health
Money(Menu and Round)
Knowledge
Current Round

ok thats it ^^

edit : read the new instructions before you start using the pointers!

[Yers]

mh i just updated table with more pointers:

Health
Money(Menu and Round)
Knowledge
Current Round

ok thats it ^^

Money in Menu gives Player Level not money.

[cfemen]

mh i just updated table with more pointers:

Health
Money(Menu and Round)
Knowledge
Current Round

ok thats it ^^

Money in Menu gives Player Level not money.

-Money (Activate it in the POWERS Menu to get the correct pointer)