“Hacking” Facebook Messenger Games

Because social status in 2017 is largely determined by your Endless Lake score. Also because Messenger games are all run client-side, and that?s basically breaking the #1 rule in online games.

VERY IMPORTANT WARNING!

The method(s) I use to ?hack? (aka ?cheat?) these games involves executing code in your browser. YOU SHOULD NEVER TRUST ANY CODE SOMEONE ON THE INTERNET including me TELLS YOU TO RUN unless you know what you?re doing. For that reason, I?m going to purposely limit this to very simple stuff that you can easily verify yourself.

With that being said:

Method

For this, you?ll want to be using Chrome on a desktop, which has some very nice developer tools that make things like completely changing what a website looks like (just for you) super easy.

To get started:

1. Enable DevTools (https://developer.chrome.com/devtools)

2. Go to https://www.messenger.com or https://www.facebook.com/messages and find a person or group that you want to annoy

As you can see, I kinda suck at these games relative to my friends

3. Start a game (Nom Cat is cute)

4. Play the game for a bit, get frustrated, feel worse about yourself, or get bored

5. Open DevTools by either clicking the Chrome menu (three vertical dots in the top right corner of the window) > More Tools > Developer Tools or by right clicking anywhere on the page and selecting ?Inspect.? You should get something like:

NOTICE THE VERY IMPORTANT MESSAGE IN THE CONSOLE!!!!!!!!!!!!!!!!!!!!!!!!!!! (You may need to scroll up in the console). Please take this warning seriously. See https://www.facebook.com/selfxss

5.5. READ FACEBOOK?S WARNING!

6. At the top of DevTools, click the tab for ?Sources.? You should see a directory listing on the left. This is a list of all the files your browser downloads from a website to make it run. The one we?re interested in will usually (if you have a game open) be listed under ?index.html? > ?apps-123456789.apps?? > ?instant-bundle/123456789?? > ?js? > ?game.js? (numbers will vary). Depending on the game, the file could also be called something like ?game.min.js? and might be in a slightly different directory. Double-click game.js to open it. You should get something ugly like:

Giant wall of ugly ?minified? code. Ugh. Good thing Chrome can take care of that for us!

7. Click on the little curly braces ?{}? indicated to open up a much nicer version of the code:

Much better! ^^

The way we?ll be making modifications is to add a ?Conditional Breakpoint? at a specific line so we can get some desired result. These are intended for developers to stop the code execution (based on some condition, like ?the next object to be thrown is a bomb?) and look at all the variables and whatnot to see if things are happening as expected. We?ll be using them to instead actually change something about the game.

8. To add a conditional breakpoint, simply right-click (ctrl+click for Mac? Maybe?) on the number of the line of code you want (say line 9) and select ?Add conditional breakpoint??:

There?s nothing special about this line? it?s just an example.

You should get a blue box where you can type anything you want:

AGAIN, PLEASE READ THE WARNING AT THE TOP OF THE PAGE BEFORE COPY-PASTING ANYTHING INTO THIS BLUE BOX!!!!!!!!!

Any time the code execution runs by it, it?ll evaluate the condition you type in first. Try typing something like (console.log(“Hello world!”))*0 , hit enter, click ?Play Again?, and scroll to the bottom of the console. The extra ( )*0 around the command is to make the whole thing evaluate to zero/false, and so Chrome won?t actually pause the execution while you play.

Pretty cool, neh? =D

Now that we know how to run whatever line of code wherever we want, let?s change one of these games to make it easier. (You may want to disable or delete the breakpoint you just made or else your console will be spammed with Hello world messages).

Nom Cat

As an example case, let?s look at this cute (albeit conceptually horrifying) game where your job is to make sure the poor cats eat all the fish and none of the bombs being thrown at them. You know what would make this game a bit easier? If there were less bombs.

Like, none.

The game randomly generates either fish or bombs and throws them at your poor kittens (seen above crying). But we can just toss out (pun intended) the result of the randomness generator and just make the game give us whatever we want:

1. Click inside the ?game.js:formatted? tab, and type CTRL+F to open a search box under the code.
2. Search for t = s.getRandom (make sure to include the spaces, but capitalization shouldn?t matter). You should see a line of code (on line 8379 for me) like: t = s.getRandom(e) ? “fish” : “bomb”, . Oh look, a line of code that sets this variable ?t? to either ?fish? or ?bomb? based on the return value of a function called ?getRandom?. I got a better idea.
3. On the next line after that one, add a conditional breakpoint with the following code: (t = “fish”) * 0 (again, the ( ) * 0 is so the game doesn?t pause every time it tries to decide what to throw at you). This will reassign ?t? to ?fish? regardless of the results of the previous line.
4. Done. Play the game and spare sushi kitty from animal abuse.

Awwww look how happy they are ^^No bombs, no problems!

Once you get bored of holding down the left and right arrow keys, try changing it so the bombs do come, just less often: ( t = s.getRandom(200) < 2 ? “bomb” : “fish”) * 0 . Or?. swap bomb and fish for hard mode.

Endless Lake

Digging through Endless Lake?s code was more interesting in two main ways:

a) It?s far more complex than Nom Cat?s, which shouldn?t be surprising to anyone who played the game for any extended period of time.

b) The developer(s) are Spanish-speaking, so all the function names are in a language I don?t understand. I had to have Google Translate open in the beginning.

After spending a lot of time jumping (pun intended) from one function call to the next, I found that the developers actually made life very easy for anyone to cheat. They literally have a variable called inmortal (Spanish). If it equals 1, the little lake runner walks straight over the water like Jesus. I decide to add the conditional breakpoint right before the variable gets checked when you try to walk on water:

1. Search for 1 == this.inmortal (this took me to line 14411 in my game.min.js)
2. Add a conditional with (this.inmortal = 1) *0
3. Sit back and feel like the Son of God Himself

?O you of little faith, why did you doubt??

To end the game and get the score, you?ll need to change the breakpoint to set the variable to 0 again so you can fall into the water again.

A friend of mine suggested a much more fun alteration where you slow down time in the game, making it easier but not completely boring:

1. Search for game.Timer.time += to get to a long line that looks like: game.Timer.time += Math.min(…..) * game.Timer.speedFactor
2. The variable speedFactor is normally set to 1, so just add a conditional breakpoint with (game.Timer.speedFactor = 0.5) *0 for half speed or whatever fraction of full speed you want. I found 0.7 to be a nice number. Fair warning, this makes everything, including the menu animations slower.
3. Do the Matrix bullet dodge.

The Lazy Cheater?s Way

Facebook Messenger games aren?t actually developed by Facebook itself. Instead Facebook has an API that anyone can use to make their own games and tie the score into Messenger so you can rub it in your friend?s face. And so, for any game you play, you can also just tell the game to call the Facebook API with the exact score you want. This is really the most boring way to cheat and there are plenty of guides and YouTube videos on how to do this, but here?s how you do it with our conditional breakpoints method:

1. Search for FBInstant.setScore . You?ll see something like FBInstant.setScore(e); .
2. Whatever that variable is inside (for Nom Cat, it?s ?e?), add a conditional breakpoint that changes it. For example, (e = 1337) * 0
3. Play the game and let it end. When the game goes to contact Facebook?s API to tell it what score you got, it?ll send the new value you just set.
4. Question your priorities in life. Are you enjoying this? Are you having fun?

Reactions

Here are a couple of my friends? reactions:

Appropriate for Nom CatHe scored 140+ prior to this! He stopped trying after =(

And then:

Finally

Honestly, there are many ways you can modify any of these games and they don?t all necessarily make the game easier. I might add a few more as time goes on. But spend some time digging through the code and see what else you can play around with. Make the objects move slower? Make it so you only lose points if you eat a bomb instead of outright dying? Make it so you can triple jump? The possibilities are endless.

Just? be nice to your cats =(