Skip to content

Instantly share code, notes, and snippets.

@Auax
Last active December 9, 2022 19:55
Show Gist options
  • Save Auax/80ed85082e9392afea9b6dc4982ee04b to your computer and use it in GitHub Desktop.
Save Auax/80ed85082e9392afea9b6dc4982ee04b to your computer and use it in GitHub Desktop.
Game cash cheat for BloonsTD6 v.33
import pymem
import pymem.process
PROC_NAME = "BloonsTD6.exe"
MOD_NAME = "GameAssembly.dll"
BASE_OFFSET = 0x02AE9538
CASH_OFFSET = [0x1D8, 0x2B8, 0x18, 0x30, 0x10, 0x20]
def read_offsets(pm_instance, base, offsets):
"""
Read a pointer from memory by following a series of offsets from the given base address.
"""
value = base
for offset in offsets[:-1]:
value = pm_instance.read_longlong(value + offset)
return value + offsets[-1]
def main():
try:
print("Bloons TD6 Version 33 Cash Hack by Ibai Farina\n")
print("Instructions:\nDrop a monkey in-game\n")
input("Press enter to continue... ")
pm = pymem.Pymem(PROC_NAME)
game_module = pymem.process.module_from_name(
pm.process_handle, MOD_NAME)
# Get MOD_NAME (GameAssembly.dll) address
game_module_address = game_module.lpBaseOfDll
# Read pointer of [GameAssembly.dll] + BASE_OFFSET
base_address = pm.read_longlong(game_module_address + BASE_OFFSET)
# Trace pointers to desired address. The offsets were found using Cheat Engine
cash_address = read_offsets(pm, base_address, CASH_OFFSET)
pm.write_double(cash_address, -1.0)
print(f"Cash Address: {hex(cash_address)}")
print(f"Value read from cash address: {pm.read_double(cash_address)}")
print("Value changed to -1.0")
print("Process completed! You can now close this window.")
except Exception as E:
view_exception = input("Something went wrong! View traceback? y/n? ")
if view_exception.casefold() == "y":
raise E
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment