Bot for Flash Games / Embed in Flash

As part of the week bots for browser games.

This week is rich in articles about bots for browser games .
In all articles, AutoIT was used to control the bot. This is a simple and good way to start making the bot head-on, it does not require any knowledge about the game, except for knowledge of the rules and the graphical interface. For the server part of the game, such a bot will generally look like a regular user, if you do not take into account the incredible perseverance and performance of such a player.

But this method requires the recognition of the world, which adds a lot of errors, and sometimes it is impossible to determine the necessary value at all.
')
In the first article, I came across a comment referring to the post Adobe Profiler Fail , which prompted me to explore this feature in order to automate actions in Flash- games.

Victim selection

First of all, I tried this method on Diamond Dash on Google+, which immediately meekly agreed to fulfill all my wishes. For an article on Habré, I tried to choose some other of the games presented on Google+, but some of them require an understanding of the rules, a few more games with JavaScript, and the remaining simple ones with Flash turned out to be more stable and require considerable preliminary preparation. I will tell you about the implementation in the past in a separate article when I prepare the necessary tools.

Therefore, I will prepare again Diamond Dash. For one compare the results with the results of the first article.

Idea

The obvious solution to the problem of recognizing the world is to insert it into the game’s interior in order to obtain accurate data on the state of the world. Two ways come to mind:

1. Decompile, inject your code and reassemble
2. Some other way to access objects

If someone tried to compile the decompiled code, then he knows perfectly well that it is not so easy to do this, he will have to tinker with a long time restoring parts of the code that the decompiler failed to cope with. And if this is when there are several thousand lines, then the task does not justify itself.
And then we need to solve the problem of launching our SWF file in a trusted domain so that it can easily communicate with the server.

Therefore, we will go the second way. This will relieve us of studying the entire code and allow us to focus only on the most important.

Prerequisites

To complete our task we will need:

• Debug version of Flash Player
• De Monster Debugger (optional)
• Any ActionScript3 decompiler

Research

Let's start the study of the game with its connection to the De Monster Debugger. This is a very interesting tool for debugging Flash. Even if you are not going to set records in browser games, I recommend putting it at least in order to play a small quest that demonstrates the capabilities of this debugger.

After installing the Monster and completing the quest, we will write a small piece of code:

MonsterConnector.as
The resulting SWF file will serve as a wrapper for all loaded swfs and connect them to the debugger after we write the path to it in% USERPROFILE% \ mm.cfg:

  PreloadSWF = c: \ temp \ MonsterConnector.swf 

Restart the browser and go to play Diamond Dash. As soon as the game loads, our preloader connects it to the Monster Debugger:


You can dig deeper into the game through the debugger itself to understand its structure a little. In the future, it will relieve the analysis of the entire source code. In our case, after inspecting the playing field, you can quickly find out that the class of the cube is called Brick (unexpectedly, right?).

Now we still need to decompile the code, but not for the purpose of modifying it, but only to learn a little.
For these purposes, Sothink SWF Decompiler is perfect, or you can use free ASDec (it is still in the early beta stage, but it allows you to edit bytecode, which might be useful to someone in research).

First of all, find what happens when you click the mouse. Looking through the text of MouseEvent we come across a class Brick that we already know that reacts to a mouse click:



And it generates the event EVENT_BRICK_CRASH of the GameManager.instance with its coordinates:



As you can see, the GameManager class has a public static instance property. This is good for us - just find this class and you can start generating fake clicks.
Find the class:

  gameManager = loader.applicationDomain.getDefinition ('pl.fabrykagier.collapse :: GameManager'); 

Quickly looking through the GameManager class code we find the event EVENT_START_GAME . By subscribing to it, we will know when to start clicking.

Now let's play

Monster we no longer need, then we will work independently. You can delete the Monster code and add a check to the address of the loaded swf, so as not to try to play the banners on Habré :)

  if (loader.loaderURL! = 'https: //secure.f**tprint.net/w*ga/g**gle_test/Diamond.swf') return; 

And now we will try to generate clicks on all the cubes in a row:


MonsterConnector.as

Restart the browser, start the game ...



Works!
But we cannot achieve good results in this way, and we never see the crystals that appear with error-free clicks.

Now it's time to determine the state of the field and act more meaningfully.

Having a little examined the code, we find that all the cubes are stored in the grid property of an object of type GameArea , but the trouble is that this property is private and we cannot access it directly. The GameArea class itself does not provide us with any public methods for getting the position of the cubes. It also has a findBiggestGroup function to determine the largest group that could be useful to us, but it turned out to be private as well as evil.
But at the beginning of the article we already saw the Brick class in Monster. So we can just find all these cubes in the scene.

I did this simply by recursively sorting through all the visible objects in the scene. Perhaps there is a simpler way.



Well, now copy the findBiggestGroup function found earlier, adapting it to our data presentation. Lovers of algorithms and haters of recursive functions can write their own :)

Another launch ...



The whole field was unmistakably “dismantled”, for which we were given a bunch of crystals, which we forgot to collect. In spite of this, we got a good result by surpassing the bot on AutoIT !



Crystals are the same instances of a Brick , but with a value of color = 21 . We will click on them immediately upon detection.



Run again, wait a minute, and ...



In fact, the result should be a little less, because the bot continues to play when the game is already over and the bonus points are being counted.
You can fix this in a couple of lines of code. I propose to deal with this reader independently.

The final version of MonsterConnector.as

Results

Embedding into a Flash application is quite simple, especially if the developer kindly provided us with a link to an instance of the most important class.
It is not much harder to find objects in the scene knowing only the class name, and then use their properties if the developer did not separate the flies from the cutlets model from the presentation.

Next time I will try to tell what can be done if the developer was more prudent and did not leave public properties and functions, or simply strictly adheres to the MVC model, depriving us of the opportunity to find data in the scene.