Bullet Force hack to give money, camos, set player stats, etc

[esever171]

Simple program I made to hack Bullet Force. I decided to include the Python source with it for those eager to learn.

Make sure you are NOT logged in when you use it or it will not work properly.

How To Use:
1) Enter your username
2) Enter your password
3) Use the commands to change your stats and so forth

Q: Why does it need my password?

A: This hack relies on POST requests to the server to update player stats. The way the game server authenticates changes to player stats is with the players password. The password gets SHA512 hashed then the hex digest of its hash is sent to the server with the POST request to give you money and other things. At NO time WHAT SO EVER does your password or username get sent to anywhere but the game server. This is why I also included the Python script so everyone could see exactly what's going on.

Do NOT remove the txt files that come with it or take them out of the same directory as the exe or it will not work. These txt files contain POST request templates used by the script and if they are altered it may lead to malformed HTTP requests.

NOTE: You may notice that while the program is being executed there is an xml file named player.xml. This is a temporary file used to modify player stats quickly and is deleted when the program is exited.

I am NOT responsible for anything you may use this script/program for. I made it for educational purposes only. Enjoy.

Virus Total: https://www.virustotal.com/#/file/70...0b95/detection
Virus Jotti: https://virusscan.jotti.org/en-US/fi...job/4c928b7etq

[-Panda-]

IS this legit

[esever171]

IS this legit

It works, yes. Here's the Python source:

bf_hack.py

import socket
import ssl
import os
import hashlib
import re
import xml.etree.ElementTree as ET
from urllib import parse

def getPlayerInfo():
    getmessbefore1 = "<\?xml version=\"1\.0\" encoding=\"utf-16\"\?>"
    getmessbefore2 = "<AS_CustomInfo>"
    getmessbefore3 = "<AS_CustomInfo xmlns:xsi=\"https://www\.w3\.org/2001/XMLSchema-instance\" xmlns:xsd=\"https://www\.w3\.org/2001/XMLSchema\">"
    getmessafter = "</AS_CustomInfo>"
    
    ctx = ssl.create_default_context()
    ctx.verify_mode = ssl.CERT_REQUIRED
    ctx.check_hostname = True

    ssl_sock = ctx.wrap_socket(socket.socket(), server_hostname="server2.blayzegames.com")  
    ssl_sock.connect((socket.gethostbyname("server2.blayzegames.com"), 443))
    
    gai = open(os.getcwd() + "\\getaccountinfo.txt")
    gai_req = gai.read()
    gai.close()

    cnt_len = len("username={}&password={}".format(username, password))

    gai_req = gai_req.format(cnt_len, username, password)

    ssl_sock.send(gai_req.encode())

    start_chunking = False

    chunk_len = 0
    packet_len = 0

    data = ""

    while True:
        chunk = ssl_sock.recv(12000).decode()
        
        if "\r\n\r\n" in chunk and start_chunking is False:
            chunk = chunk.split("\r\n\r\n")[1]
            chunk_len = int(chunk.split("\r\n")[0], 16)
            data = chunk.split("\r\n")[1]
            start_chunking = True
        elif start_chunking and len(data) < chunk_len:
            data += chunk
        else:
            ssl_sock.close()
            break

    try:
        xml_start = re.search(getmessbefore1, data).span()[0]
    except AttributeError:
        try:
            xml_start = re.search(getmessbefore2, data).span()[0]
        except AttributeError:
            try:
                xml_start = re.search(getmessbefore3, data).span()[0]
            except AttributeError:
                print("Unknown XML header, exiting")

    xml_end = re.search(getmessafter, data).span()[1]

    xml = data[xml_start:xml_end]

    player_xml = open(os.getcwd() + "\\player.xml", "w", encoding="utf-16")
    player_xml.write(xml)
    player_xml.close()

    ssl_sock.close()

    data = data.replace(xml, "{}")
    
    return data[:-2]

def setPlayerInfo(data):
    ctx = ssl.create_default_context()
    ctx.verify_mode = ssl.CERT_REQUIRED
    ctx.check_hostname = True

    ssl_sock = ctx.wrap_socket(socket.socket(), server_hostname="server2.blayzegames.com")  
    ssl_sock.connect((socket.gethostbyname("server2.blayzegames.com"), 443))

    player_xml = open(os.getcwd() + "\\player.xml", "r")
    xml = player_xml.read()
    player_xml.close()

    temp_data = data.format(xml)
    temp_data = parse.quote_plus(temp_data)

    sai = open(os.getcwd() + "\\setaccountinfo.txt", newline="")
    sai_req = sai.read()
    sai.close()

    cnt_len = len("username={}&password={}&phpSecret=s3c7kalph14_)&info={}".format(username, password, temp_data))
    
    sai_req = sai_req.format(cnt_len, username, password, temp_data)

    ssl_sock.send(sai_req.encode())
    ssl_sock.recv(12000)
    ssl_sock.close()

def FiveMil(data):
    bai = root.find("bfAccountInfo")
    bai_money = bai.find("money")

    for money in range(1, 101):
        bai_money.text = str(money*50000)
        tree.write(player_xml_path)

        setPlayerInfo(data)

def APC(data):
    bai = root.find("bfAccountInfo")
    bai_cc = bai.find("characterCamos")
    bai_cc.text = "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19"
    tree.write(player_xml_path)

    setPlayerInfo(data)

def AWC(data):
    wi = root.find("weaponInfo")
    for weapon in wi:
        c = weapon.find("c")
        c.text = "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53"

    tree.write(player_xml_path)
    setPlayerInfo(data)

def UAGS(data):
    wi = root.find("weaponInfo")
    for weapon in wi:
        unlocked = weapon.find("unlocked")
        if unlocked.text == "1":
            s = weapon.find("s")
            s.text = "1,2,3,4,5,6,7,8,9,10"
        else:
            continue
        
    tree.write(player_xml_path)
    setPlayerInfo(data)

def UAGB(data):
    wi = root.find("weaponInfo")
    for weapon in wi:
        unlocked = weapon.find("unlocked")
        if unlocked.text == "1":
            b = weapon.find("b")
            b.text = "1,2"
        else:
            continue

    tree.write(player_xml_path)
    setPlayerInfo(data)

def UAGA(data):
    wi = root.find("weaponInfo")
    for weapon in wi:
        unlocked = weapon.find("unlocked")
        if unlocked.text == "1":
            a = weapon.find("a")
            a.text = "1,2"
        else:
            continue

    tree.write(player_xml_path)
    setPlayerInfo(data)

def setPlayerStat(stat, value, data):
    bai = root.find("bfAccountInfo")
    bai_stat = bai.find(stat)
    bai_stat.text = value

    tree.write(player_xml_path)
    setPlayerInfo(data)

player_xml_path = os.getcwd() + "\\player.xml"

print("bf_hack - Created by esever171\n")

print("Username: ", end="")
username = input()

print("Password: ", end="")
password = input()

h = hashlib.sha512()
h.update(password.encode())

password = h.hexdigest()

data = getPlayerInfo()

tree = ET.parse(player_xml_path)
root = tree.getroot()

print("\n\n" +
      "5mil - Gives you 5 million dollars\n" +
      "APC  - Gives you all player camos\n" +
      "AWC  - Gives you all gun camos\n" +
      "UAGS - Unlocks all gun sights\n" +
      "UAGB - Unlocks all gun barrels\n" +
      "UAGA - Unlocks all gun accessories\n" +
      "Set  - Sets a value for a particular stat\n" +
      "exit - Exits the program\n\n" +
      "NOTE: When using AWC, UAGS, UAGB, and UAGA please keep in mind that it will only be applied to guns you have previously bought\n")

cmd = ""

stats = ["xp", "streamer", "clan", "gold", "totalGoldBought", "hacker", "tKills", "tDeaths", "mWon", "mLost", "knifeKills", "explKills", "nukes", "highStrk", "mostKills"]

stat_format = ".*=.*"

while cmd != "EXIT":
    print("")
    cmd = input("> ").upper()

    if cmd == "5MIL":
        print("This might take a minute...")
        FiveMil(data)
        print("Done...")
    elif cmd == "APC":
        APC(data)
        print("Done...")
    elif cmd == "AWC":
        AWC(data)
        print("Done...")
    elif cmd == "UAGS":
        UAGS(data)
        print("Done...")
    elif cmd == "UAGB":
        UAGB(data)
        print("Done...")
    elif cmd == "UAGA":
        UAGA(data)
        print("Done...")
    elif cmd == "SET":
        print(stats)
        print("Type a stat name then an equals sign and a value. Ex. tKills=4000")
        cmd = input(">>> ")
        if re.match(stat_format, cmd) is None:
            print("Improper formatting")
            continue
        else:
            stat = cmd.split("=")[0]
            value = cmd.split("=")[1]

            if stat not in stats:
                print("Unknown stat name")
                continue
            else:
                setPlayerStat(stat, value, data)
                print("Done...")

os.remove(player_xml_path)

getaccountinfo.txt

POST /AccountSystem_BFWeb/getaccountinfoNEW.php HTTP/1.1
Host: server2.blayzegames.com
Connection: close
Content-Length: {}
Origin: https://www.crazygames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36
DNT: 1
Content-Type: application/x-www-form-urlencoded
Accept: text/html
Referer: https://www.crazygames.com/gameframe/bullet-force-multiplayer
Accept-Language: en-US,en;q=0.9

username={}&password={}&phpSecret=s3c7kalph14_)

setaccountinfo.txt

POST /AccountSystem_BFWeb/setaccountinfoNEW.php HTTP/1.1
Host: server2.blayzegames.com
Connection: close
Content-Length: {}
Origin: https://www.crazygames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36
DNT: 1
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: https://www.crazygames.com/gameframe/bullet-force-multiplayer
Accept-Language: en-US,en;q=0.9

username={}&password={}&phpSecret=s3c7kalph14_)&info={}

getaccountinfo.txt and setaccountinfo.txt need to be in the same directory/folder as bf_hack.py to work.

[[MPGH]Ahl]

Approved.

This has not been tested.

Use at your own risk

[Adrique240sx]

Does not work anymore

[Stifler18082]

Does not work anymore

Stillworks!!

1.Make a new acc on PC
2.logout
3.login
4.have fun

[testmane]

Does this require any modification to be run on Linux?

[ryancrowe]

I saw Bullet Force game on freegames66. Is it can be played on Android and IOS?

[TACHANKAv2]

IS this legit

This works 100% of the time for me I love it!

[darkmagekid]

Thanks! it still works

[5alad]

Working amazing loving it!

[esever171]

Glad to see people like it. I haven't come back to it since I made it. I'm making a better version at the moment. It's basically a glorified XML editor.

Bullet Force leaves updating player stats to the client which is, of course, a very bad idea. Basically the script just sends a POST request containing your username, password sha512 hex digest, and a php secret value. The server sends back a copy of your player stats in an XML file. Then all you have to do is edit that XML file and send it back to the server with your password and username as authentication. It ensures other users can't mess with your stats but you can of course change them however you like.

The new version I'm working on will allow you to have more control over how to change your stats. Overall the new version just has much cleaner code, no extra files like before and more control.

Happy hacking!

- - - Updated - - -

Does this require any modification to be run on Linux?

I haven't tested it on any Linux distributions. Only on Windows 10 but I can't imagine a reason why it would need modification. I didn't use any Windows API's or anything like that so I would expect it's pretty cross-platform.

Now, of course, you can't use the compiled executable without WINE on Linux distributions. But as far as the script goes you should just be able to run the script in the python interpreter and it run correctly (and make sure you run the script in the same directory as the txt files).

[i4mTh3Fr34kPr0]

Wow that's great. nice work dude!

[davidjensen]

I don't want 5mil i will have 100k can i make it to that?

[esever171]

I don't want 5mil i will have 100k can i make it to that?

No, I didn't make it to where you could directly assign money values. The reason at the time was because if you tried to change your money by more than $500 at a time the server would reject it. The 5mil command actually just sends multiple POST requests to the server, incrementing by $500 each time. That's why it takes so long.

My advice would be to not let the command fully run and to kill the program after the command runs for a few seconds.