[Release] HeroZServer - Hero Zero Server Files (still in development) - flash 123
Discussion on [Release] HeroZServer - Hero Zero Server Files (still in development) - flash 123 within the Browsergames forum part of the Other Online Games category.
[Release] HeroZServer - Hero Zero Server Files (still in development) - flash 123
Hey guys,
I've been working on a Hero Zero private server for a while now, started from the files. The base had the core stuff but a lot was either broken or straight up missing, so I've been rewriting and adding things to get it closer to how the real game works.
All game features are now fully implemented! The core game is fully functional with 89% SWF coverage. Future updates will focus on bug fixes, stability improvements and quality of life changes.
Current version: 2.0.0
Tech Stack
PHP 8.3 + MySQL 8.4 + Apache (Laragon)
Flash SWF client running through Ruffle.rs works in Chrome, no Flash needed
Node.js WebSocket server for real-time push
Local CDN proxy for Akamai assets (CORS workaround)
SWF Compatibility
Did a full analysis of the Flash client 234 total actions defined in the SWF source
Integrated with quests, duels, training, work, dungeons and league fights
Slot Machine
All 7 reward types working - coins, XP, stat points, quest energy, training sessions, boosters and items
Item rewards generate random equipment (type 1-7) with quality scaling based on how many reels match 3 match gives top quality, 2 match gives mid, no match gives basic
Booster rewards with 3 tiers (quest, stats, work) duration stacks with any active booster
Sidekick symbol falls back to coins since the SWF reward dialog has no display logic for sidekicks
Anti-exploit protection - server-side MySQL lock prevents double-spin during the animation window where the SWF briefly re-enables the spin button
Slot machine chat feed working - shows recent wins to other players in real-time
Tournaments
Weekly competitive events with XP, honor, and guild honor leaderboards
CLI lifecycle script for starting, ending and checking tournament status
Rewards - donuts for top character rankings, guild premium currency for top guilds
Leaderboards show real-time progress during the tournament week
All three tabs working - XP, honor, and guild honor with proper guild emblem display
World Boss
Server-wide boss events with HP tracking, damage ranking and reward distribution
Full two-step attack flow matching how the real game works - timer phase, then fight resolution with battle animation, then summary dialog with damage dealt and ranking
Instant finish with donuts, attack cancellation, and active attack persistence across page refreshes
Boss defeat triggers socket push to all connected players
CLI lifecycle script for spawning, processing and checking boss status
Rewards update in real-time after each attack - coins, XP, items, energy refills, training sessions
Event localization pulled from CDN translation files (PT/EN/PL)
Sewing Machine & Costume Collections
Sewing machine - change item skins for gold or donuts, tracks owned templates
1.0.5 (2026-03-15) - Guild battle history, voucher/promo code system with admin panel, item validation safety
1.0.4 (2026-03-15) - 10 new handlers: guild leader elections with majority voting, guild artifact release with cooldown, decline guild invitations, claim dungeon battle rewards, claim message item attachments, change email, delete account, stat redistribution. Fixed Config::get() crash pattern across multiple handlers. Full SWF compatibility report - analyzed all 234 client actions against server, documented 28 missing with priority tiers
1.0.3 (2026-03-14) - Slot machine fully operational with all 7 reward types, item generation, booster stacking, and double-spin exploit protection. World boss attack flow rewritten to match SWF two-step process, battle records include full profile stats, active attacks persist across refreshes. Tournament leaderboards fixed - guild honor tab no longer crashes, end-of-week processing handles stat decreases correctly
1.0.2 (2026-03-13) - Admin items page reworked into read-only template catalog, character inventory categorized by location (equipped/bag/shop/bank), give item tool with bag or bank destination
1.0.1 (2026-03-13) - Fixed in-game messaging crash, sent message format, stamina regeneration exceeding caps, admin SQL injection and CSRF on destructive actions
1.0.0 (2026-03-10) - Initial release with all core systems: Ruffle.rs integration, email system, admin panel, goals, herobook, tournaments, world boss, sewing machine, costume collections, guild dungeons, surprise box, socket server
What's next:
All game features are now fully implemented. Future updates will focus on bug fixes, stability improvements and quality of life changes.
This is a solo hobby project so updates come when I have the time. If anyone is messing with Hero Zero servers or has dealt with getting Ruffle.rs to play nice with Flash game backends, I'd like to hear about it.
It's great that someone has taken on the task of continuing the project
Thanks! I'll keep working on it and dropping updates. I actually already pushed a few updates that I forgot to post here, my bad lol. I'll catch up and post what's been done so far. Right now I'm finishing the Friend system, got some other projects coming soon too. Also planning to make it open source so everyone can use it!
PS: These updates go back a few days. Was going to post everything together once 1.0.4 was done, had the post ready last night but forgot to actually send it.
Update - March 15, 2026
Big batch of updates since the first post. Most of the stuff that was listed as "in progress" is now done - guild artifacts are fully working now, and I did a complete analysis of the SWF client to map out exactly what's left.
New Systems
Slot Machine - All 7 reward types fully working: coins, XP, stat points, quest energy, training sessions, boosters and items. Item rewards generate random equipment with quality scaling based on reel matches. Booster rewards stack duration with active boosters. Server-side double-spin protection prevents exploiting the brief window where the SWF re-enables the button during animation. Chat feed shows recent wins in real-time.
Tournaments - Weekly events with XP, honor and guild honor leaderboards. CLI script handles the full lifecycle (start/end/status). Top players get donuts, top guilds get premium currency. All three leaderboard tabs fully working with guild emblem display.
World Boss - Server-wide boss fights with HP tracking and damage rankings. Players attack with booster-reduced timers, boss defeat pushes a sync to all connected clients. CLI script for spawn/process/check. Rewards include coins, XP, items, energy and training sessions.
Sewing Machine - Change item skins for gold or donuts. Tracks all owned item templates per type.
Costume Collections - 33 themed sets with milestone rewards (stat points, items, training, energy). Progress tracked automatically on item purchases and goal rewards.
Guild Dungeons - Full attack and join flow now working. NPC team generation, complete battle resolution, goal tracking for fights won.
Surprise Box - Open type 10 items for 1-3 random equipment pieces. Items feed into owned templates and pattern tracking.
Guild Leader Elections - Vote-based leadership transfers with majority resolution. Auto-finishes when all eligible members have voted, or when the vote duration expires.
Guild Artifacts - Release artifacts for premium currency with cooldown timer and active battle checks.
Account Management - Change email with password verification, account deletion with full cascade cleanup, stat redistribution with point validation, claim item attachments from messages.
Goal Tracking
44 new goals now tracked thanks to the new systems - sewing (2), costumes (33), guild dungeons (2), surprise box (1), world boss (3), tournaments (3)
Total: 63 out of 67 goal types fully working. The remaining 4 are permanently blocked (no handler exists in the original server code)
Guild leader election system - initiate votes, cast ballots with majority-based resolution, auto-finish when all members voted or time expires
Guild artifact release - spend premium currency with cooldown and active battle checks
Guild invitation decline with 72-hour expiration validation
Guild dungeon battle reward claiming with gold and optional item placement
Message item claiming - collect items attached to messages via flag_value
Account email change with password verification and duplicate check
Account deletion with full cascade cleanup of all related data (items, quests, duels, guild membership, etc.)
Stat redistribution with total point validation against base stat minimum
Costume pattern selection stub (SWF notification only, no server action needed)
Fixed Config::get() crash pattern - was using ?: which throws on missing keys, replaced with proper 2nd argument default in releaseArtifact, voteForGuildLeader and reskillCharacterStats
Full SWF compatibility report - cross-referenced all 234 client actions against 171 server handlers, documented the 28 still missing with implementation priority tiers
v1.0.3 - Slot Machine, World Boss & Tournament Fixes
Slot machine fully operational - enabled by updating expired event dates, all 7 SWF-supported reward types implemented
Slot machine item rewards - random equipment (type 1-7) generated on matching reels, quality scales with how many match (3 same = top quality, 2 same = mid, none = basic)
Slot machine booster rewards - 3 tiers (quest/stats/work) with duration stacking on active boosters
Sidekick reel falls back to coins since the SWF reward dialog has no sidekick display logic
Fixed slot machine always winning - replaced hardcoded debug values with actual random rolls per reel
Fixed slot machine chat showing NaN - PHP 8 json_decode without the array flag returns stdClass which breaks current()
Fixed slot machine double-spin exploit - added MySQL GET_LOCK for sub-second race conditions and a DB check for the full animation window (~7-9 seconds)
Rewrote the world boss attack flow to match the real game's two-step process - timer phase runs the fight on completion, then a separate finish call returns the summary without fighting again
Battle records now save full profile stats for both player and NPC, fixing a crash on the attack completion dialog
Active attacks now persist across page refreshes and language changes - the login response includes pending attack data so the SWF can restore the timer
Reward display (coins, XP, ranking) updates in real-time after each attack instead of requiring a page refresh
Added instant finish with donuts and attack cancellation handlers
Event localization now pulls from CDN translation files so descriptions, briefings and summary texts show up in PT/EN/PL instead of raw key strings
Fixed tournament end crashing on MySQL 8 when character or guild stats decreased during the tournament week - unsigned integer subtraction was overflowing
Fixed tournament guild honor leaderboard crashing because the SWF expected short field names for guild data and emblem settings
v1.0.2 - Admin Panel Improvements
Items page reworked into a read-only catalog of all 779 item templates with search, type, quality and pattern filters
Character inventory now shows items split by location - equipped, bag, shop and bank - instead of a flat list
New "Give Item" tool picks from the template catalog and auto-generates stats based on character level, with a choice to send to bag or bank
v1.0.1 - Bug Fixes & Security
Fixed in-game message sending crashing the SWF - the message filter regex was using a Unicode property class without the required modifier, causing PHP 8.x to silently return NULL and empty out the message
Fixed sent message response format not matching what the SWF expects - character info wasn't keyed by ID like the message list endpoint does
Fixed admin panel message compose submitting twice on a single click
Fixed duel and league stamina regeneration exceeding maximum caps
Fixed duel reward claims crashing with "unknown error" - the winner field was being read from the wrong DB table (Duel instead of Battle)
Fixed guild emblem with default values (shape 0) crashing the entire SWF UI - emblem asset arrays start at index 1, not 0
Fixed league opponent list boundary bug in demotion conditions
Fixed guild dungeon battle resolution - NPC teams weren't being processed correctly
Fixed SQL injection in admin search queries - switched from addslashes to prepared statements across all controllers
Destructive admin actions (ban, delete, max stats, etc.) now require POST with CSRF token instead of plain GET links
Message ignore system (3 handlers) - block messages from specific players
Guild battle history (2 handlers) - query existing battle table
Quick wins (9 handlers) - locale, ToS acceptance, session refresh, shop/quest pool refresh
PS: Quick update - just pushed v1.0.5 a few days ago on the 15th.
v1.0.5 - Voucher System, Guild Battle History & Item Safety
Voucher / promo code system - redeem codes for gold, donuts, stat points, energy, training sessions. Supports usage limits, level and locale restrictions, expiry dates, and per-user codes
Admin voucher panel - create, view, toggle, delete vouchers with full redemption log (who used it, when, which character)
Guild battle history - view past guild attacks, defenses and dungeon fights with enemy guild emblems and reward details
Item validation safety - Player::getItems() and Player::createItem() now filter out items with identifiers not in GameSettings templates, preventing SWF crashes from invalid items
Fixed voucher redemption not updating donuts in real-time (premium_currency is on user object, not character)
Fixed new_user_voucher_ids format - SWF expects JSON array, not comma-separated string
2 new DB tables: vouchers, voucher_redemptions
Database Migration (for existing installs)
If you already have the database set up and just want to add the new tables, run these queries:
Code:
-- Voucher system (v1.0.5)
CREATE TABLE IF NOT EXISTS `vouchers` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`code` varchar(50) NOT NULL,
`rewards` text NOT NULL,
`uses_max` int(11) NOT NULL DEFAULT '1',
`uses_current` int(11) NOT NULL DEFAULT '0',
`min_level` int(11) NOT NULL DEFAULT '0',
`locale` varchar(10) NOT NULL DEFAULT '',
`user_id` int(11) NOT NULL DEFAULT '0',
`ts_start` int(11) NOT NULL DEFAULT '0',
`ts_end` int(11) NOT NULL DEFAULT '0',
`ts_creation` int(11) NOT NULL DEFAULT '0',
`status` tinyint(4) NOT NULL DEFAULT '1',
PRIMARY KEY (`id`),
UNIQUE KEY `idx_code` (`code`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE IF NOT EXISTS `voucher_redemptions` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`voucher_id` int(11) NOT NULL,
`user_id` int(11) NOT NULL,
`character_id` int(11) NOT NULL DEFAULT '0',
`ts_redeemed` int(11) NOT NULL DEFAULT '0',
PRIMARY KEY (`id`),
UNIQUE KEY `idx_unique` (`voucher_id`, `user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
Fresh installs can just import the updated hzpriv.sql which already includes everything.
Updated version history:
1.0.5 (2026-03-15) - Guild battle history, voucher/promo code system with admin panel, item validation safety, 2 new DB tables
Still left to do:
Friend system - add/remove friends, friend bar, invitations
Event quests - timed objectives with 10 tracking types and 6 reward types
Resource requests - send energy/spins to friends (depends on friend system)
Message ignore system - block messages from specific players
Quick wins - locale, ToS acceptance, session refresh, shop/quest pool refresh
PS: Quick update - pushed v1.0.6 yesterday.
setUserLocale handler - saves language preference when changing locale in-game
setUserLatestToS handler - accepts Terms of Service dialog
refreshQuests handler - refreshes quest list when quest booster expires or leaving guild with active booster
logoutUser handler - clears all session IDs and cookie on logout (was empty stub)
13 themed events: Halloween, Summer, Xmas (x2), Winter Olympics, Carnival, Easter, Ghostbusters, World Cup (x2), Birthday, Octoberfest, Olympia Rio
Each event has timed objectives players need to complete before the event ends
11 objective tracking types: quests completed, duels fought, training, honor earned, energy used, world boss defeated, event items collected, sewing machine used, shop refreshed, fight quests won, time quests completed
Event item drops on quest completion with configurable drop chance per item
3 reward items generated per event (event-specific or random epic/rare)
Progress tracked automatically in quest, duel, training, work, league and dungeon reward handlers
Admin panel to activate/deactivate events with date picker - only 1 event active at a time
Deactivating an event expires all player records immediately, no need for players to relog
4 new handlers: assignEventQuest, claimEventQuestObjectiveRewards, claimEventQuestRewards, instantFinishEventQuestObjective
New DB table: event_quests
Database Migration (for existing installs)
Code:
-- Event quest system (v2.0.0)
CREATE TABLE IF NOT EXISTS event_quests (
id INT AUTO_INCREMENT PRIMARY KEY,
character_id INT NOT NULL,
identifier VARCHAR(100) NOT NULL,
status INT NOT NULL DEFAULT 1,
end_date VARCHAR(30) NOT NULL DEFAULT '',
objective1_value INT NOT NULL DEFAULT 0,
objective2_value INT NOT NULL DEFAULT 0,
objective3_value INT NOT NULL DEFAULT 0,
objective4_value INT NOT NULL DEFAULT 0,
objective5_value INT NOT NULL DEFAULT 0,
objective6_value INT NOT NULL DEFAULT 0,
rewards TEXT NOT NULL,
reward_item1_id INT NOT NULL DEFAULT 0,
reward_item2_id INT NOT NULL DEFAULT 0,
reward_item3_id INT NOT NULL DEFAULT 0,
ts_creation INT NOT NULL DEFAULT 0,
INDEX idx_character (character_id),
INDEX idx_status (status)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
Fresh installs can just import the updated hzpriv.sql.
Updated version history:
2.0.0 (2026-03-21) - Event quest system with 13 themed events, admin panel, 11 objective types, event item drops
[DL] Hero Zero Serverfiles (flash_129) [works with ruffle.rs and flash] 05/18/2025 - Browsergames - 0 Replies Hey, at one time ruffle.rs is able to run the client of the game Hero Zero in one of the older versions that I happen to have on disk, it is of no use to me so I am uploading here the server files with added ruffle.rs
Download:
https://hzprivate.vip/hz129_update3.zip
Demo:
https://hzprivate.vip/
Manual installation:
*FLASH FLASH FLASH* 66er mk auf s9 04/17/2009 - Metin2 Trading - 7 Replies hey wie die ueberschrift schon sagt ich vk einen lvl 66er mk auf s9
was ich suche ? sachen auf s9 oder sura ab lvl 50
screens bekommt ihr ueber icq oder msn
![[Release] HeroZServer - Hero Zero Server Files (still in development) - flash 123](https://www.elitepvpers.com/forum/iconimages/browsergames/release-herozserver-hero-zero-server-files-still-development-flash-123-a_ltr.gif){kind=small}
files. The base had the core stuff but a lot was either broken or straight up missing, so I've been rewriting and adding things to get it closer to how the real game works.
