I’ve played this game and decided to search for game score address. Common searches for every data-type available had failed.
After several trial i found 2 addresses which was changed along with my score. They were static address (colored green in MHS Found Address window):
- 0x57CECC
- 0x57CED0
..their data-types were Unsigned Long.
Upon curiousity, i auto-hacked both addresses and MHS debugger landed on these code snipet:
- Code: Select all
00402C98 - MOV EAX, DWORD PTR [57CECC]
00402C9D - MOV ECX, DWORD PTR [57CED0]
00402CA3 - XOR EAX, ECX
00402CA5 - MOV DWORD PTR [ESP+4], EAX
00402CA9 - JMP 00434E10
I paused the game and note these:
- My score = 8760
- [0x57CECC] = 2541496581
- [0x57CED0] = 2541488957
Based from the snipet above, we can tell how this game determines my score:
2541496581 xor 2541488957. Pay attention to the code at 0x00402CA3 from above snipet...
I put this into MHS Expression Evaluator:
[0x0057CECC]^[0x0057CED0], and the result was
8760.. (The ‘
^’ stands for
bitwise XOR operator).
Such ‘encryption’ in this case causes any common methods of search/sub-search have failed...
Further, i made a simple experiment... I wanted to boost my score to 1 million. So here is what i did:
I put
[0x0057CECC]^1000000 into MHS Expression Evaluator, and the result was
2540923717.
I modified one of those two addresses so that their value were:
- [0x57CECC] = 2541496581
- [0x57CED0] = 2540923717 <--- i changed this
Back to the game, my score was immediately changed to 1000000 (one million) even when it was still in pause mode...
Upon loosing the game, the score was recorded into High Score hall. So, i can say this score hack is at least 50% legit (i can’t tell if this score affects to other game elements such as live bonus yet).. It was just a quick experiment and there are still lots to find...
PS:
- The target process is “Bengal.RWG”, and not “Bengal.exe”.
- I recommend to utilize MHS Speed Hack at its best for hacking this game.
.. to boldly go where no eagle has gone before...