Thus far 1) the swf is obfuscated but I managed to get an obfuscated version. Decompiled both swf and searched around for values to modify buildTime, resources, ect and tried to set them to 0 (pushbyte 0). Come to find out all unit data is sent from the server via a JSON manifest and is hashed with SHA1 the game checks this and throws an error if the file has been modified. So I modified the Hash comparison check and modified the JSON manifest. Result - the dialogs displayed properly with no error but still returned proper build times instead of instant. Come to find out ALL time, resources and such is done server side and timing is sent back via a sync proxy to the client (us) So modifications would have to be done server-side for anything to work. How it works in a nutshell:
step 1) you click to build a turrent
step 2) request is sent to the server to build said turret
step 3) an application server side takes your id, base and info about that turret and sets a timestamp back to your client with how many resources needs to be deducted, time it takes ect. This is then synced with the server database.
EDIT: it MAY be possible to spoof the return maifest file but each one is unique. It will most definitly require more time and research. Player data is also returned to the client on game load up. A method to require many resources here MIGHT work.
So dosen't look like its hackable just yet. I give these guys props for security.
Ican give you hacks for $free with updates.