Endless fun with endless cash. =)

0x00 – Android

It is when I applied for Google Play's free trial of Play Pass that I first met Kingdom Rush saga. It's a pretty straightforward and addicting tower defence game with deep enough mechanics. Of course, the first thing I meet this type of games is to see if there's any way I can hack into it and change some of the attributes (for free).

On mobile, since I was playing through Play Pass, the game developer will get a calculated pay from Google for the duration of my gameplay. In addition, there is a shopfront for purchasing in-game currency – Gem, which the user will be spending those on items like sack of cash or full screen clear.

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/d81bd8f1-55f5-45e5-8e7a-7a4f491b2ffe/photo_2020-12-23_16.44.19.jpeg

It was simple to hack my way in. Execute

$ adb backup -apk <game.bundle.id>

using Android Debug Bridge and unpack the output Android backup archive. Inside of it are the game file itself along with the save files for individual slots that the game kept privately. From there it is able to edit the currency directly and restore such backup to Android phones and use such currency to purchase in-game items.

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/caed8914-8d19-434e-8b2f-9e315a8e6fe5/2020-12-23_17.15.32.png

slot_<N>.lua contains game profile save in plain text.

Edit: this method is no longer available as the game developer opt out Android backup. Also adb backup is deprecated so future availability will be none.

0x01 – iOS

Kingdom Rush is not published by Ironhide Game itself but Armor Games, as reflected by the change of bundle ID from com.ironhidegames.android.<version> to com.armorgames.<version>.

The original Kingdom Rush and its HD variant (for iPad) are available for free on iOS App Store. Since I don't have an iOS device on hand, I used Apple Configurator 2 to download the .ipa file and installed it directly to my Apple Silicon-powered Mac.

To my surprise, there is no where I can find the save file. I checked the container directory for iOS apps on macOS, none. But I did managed to spot out the cloud save local cache, in a .plist file. However, editing it didn't seem to work.

0x02 – macOS

The game is available on desktop as well. Upon my first impression, it seems the macOS version has assets in higher fidelity and...

NO STOREFRONT and IN-GAME ITEMS

Okay, I should probably address this earlier. For those who are not familiar with tower defence type of games...

The game requires the player to set up Towers which attacks Enemies that ****comes in waves and becomes stronger and stronger. The player at the start has limited funds to set up low level towers and needs to upgrade the towers with coins earned from defeated enemies.

With in-game items purchased using in-game currency, players are able to get a competitive advantages against the game. On mobile platforms, this is often carried out via "micro transactions" – essentially spending few dollars for a feeling of power and victory.