youtube playables games save data is just plain json and…
0 reactions
youtube playables games save data is just plain json and you can edit it
so i was bored and decided to poke around in the dev tools on one of those youtube playables games (its like a supermarket idle game thing) and accidentally figured out you can just... edit your save data. No encryption nothing just raw json sitting there.
Took me \~1 hour to figure out but basically the game is built in unity and runs in an iframe so first you have to switch the console context to the iframe (the dropdown at the top of the chrome console that says "top", click that) otherwise ytgame is just undefined and you'll be confused for ages like i was
Anyway once you're in the right context you can just do the below and your entire save file just prints out in plain text. cash, gems, upgrades, unlocks, everything. i was NOT expecting that
` ytgame.game.loadData().then(data => console.log(data))`
To inject your own save you just run:
// Intercept loadData before game reads it const originalLoadData = ytgame.game.loadData.bind(ytgame.game)ytgame.game.loadData function() { return originalLoadData().then(data => { let saveData = JSON.parse(data) letplayerIndex = saveData.Key.indexOf("Player_Chef") let playerData = JSON.parse(saveData.ValueplayerIndex])console.log("Intercepted! Original cash:", playerData.cashAmount) playerData.cashAmount = 999999playerData.gemAmount = 999999 playerData.goldAmount = 999999 playerData.couponAmount = 999999saveData.Value[playerIndex] = JSON.stringify(playerData) console.log("Injected modified values!") returnJSON.stringify(saveData) }) } console.log("Intercept ready!")
The important bit is you have to paste that while the game is on the loading screen. Not before, not after, right during the load. It then intercepts the save data as the game reads it and swaps in your modified version. game loads up with 999999 cash
Also, location.reload() doesnt work. You have to actually manually reload the page yourself after pasting the intercept code.
No idea why they dont validate this server side or at least encrypt it. its a single player idle game so its not like it affects anyone else but still pretty funny
Proof: [ https://imgur.com/a/n1bC1gN https://imgur.com/a/n1bC1gN
#programming #dev #technology =
so i was bored and decided to poke around in the dev tools on one of those youtube playables games (its like a supermarket idle game thing) and accidentally figured out you can just... edit your save data. No encryption nothing just raw json sitting there.
Took me \~1 hour to figure out but basically the game is built in unity and runs in an iframe so first you have to switch the console context to the iframe (the dropdown at the top of the chrome console that says "top", click that) otherwise ytgame is just undefined and you'll be confused for ages like i was
Anyway once you're in the right context you can just do the below and your entire save file just prints out in plain text. cash, gems, upgrades, unlocks, everything. i was NOT expecting that
` ytgame.game.loadData().then(data => console.log(data))`
To inject your own save you just run:
// Intercept loadData before game reads it const originalLoadData = ytgame.game.loadData.bind(ytgame.game)ytgame.game.loadData function() { return originalLoadData().then(data => { let saveData = JSON.parse(data) letplayerIndex = saveData.Key.indexOf("Player_Chef") let playerData = JSON.parse(saveData.ValueplayerIndex])console.log("Intercepted! Original cash:", playerData.cashAmount) playerData.cashAmount = 999999playerData.gemAmount = 999999 playerData.goldAmount = 999999 playerData.couponAmount = 999999saveData.Value[playerIndex] = JSON.stringify(playerData) console.log("Injected modified values!") returnJSON.stringify(saveData) }) } console.log("Intercept ready!")
The important bit is you have to paste that while the game is on the loading screen. Not before, not after, right during the load. It then intercepts the save data as the game reads it and swaps in your modified version. game loads up with 999999 cash
Also, location.reload() doesnt work. You have to actually manually reload the page yourself after pasting the intercept code.
No idea why they dont validate this server side or at least encrypt it. its a single player idle game so its not like it affects anyone else but still pretty funny
Proof: [ https://imgur.com/a/n1bC1gN https://imgur.com/a/n1bC1gN
#programming #dev #technology =
| 2,000 mlx | |
| 2 | |
| 0 |