Ghtw0aL!09(ecn.Nab=2igEXMS8z_vO*ZWA3($WN6{Zw8bBa=TBme
1
"Reinitialize Symbol Handler"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
[ENABLE]
openProcess('Chasm.exe')
debugProcess()
reinitializeSymbolhandler(true)
createThread(function()
sleep(100)
synchronize(function()
memrec.Active = false
end)
end)
[DISABLE]
3
"Activate First"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
[ENABLE]
-- Keep trying every 5 seconds
createThread(function()
local address = getAddressSafe('Chasm.Gameplay.World::Draw')
while not address do
sleep(5000)
reinitializeSymbolhandler(true)
address = getAddressSafe('Chasm.Gameplay.World::Draw')
end
registerSymbol('fWorld', address)
end)
[DISABLE]
unregisterSymbol('fWorld')
4
"Get World"
Auto Assembler Script
[ENABLE]
alloc(newmem,256,fWorld)
label(returnhere)
label(originalcode)
label(exit)
alloc(pWorld, 8)
registersymbol(pWorld)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov [pWorld], rcx
originalcode:
push rbp
push r15
push r14
exit:
jmp returnhere
fWorld:
jmp newmem
returnhere:
[DISABLE]
dealloc(newmem)
dealloc(pWorld)
unregistersymbol(pWorld)
fWorld:
db 55 41 57 41 56
//push rbp
//push r15
//push r14
5
"Show World Structure"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
[ENABLE]
local structWindow = createStructureForm('[pWorld]', 'World Structure', 'Chasm.Gameplay.World')
createThread(function()
synchronize(function()
sleep(50)
memrec.Active = false
end)
end)
[DISABLE]
17
"Pointers"
1
25
"Stats"
1
14
"INT"
Byte
[pWorld]+8
2A
98
15
"CON"
Byte
[pWorld]+8
2B
98
13
"STR"
Byte
[pWorld]+8
29
98
16
"LCK"
Byte
[pWorld]+8
2C
98
11
"MP"
4 Bytes
[pWorld]+8
10
98
10
"HP"
4 Bytes
[pWorld]+8
C
98
26
"Misc"
1
7
"invincibleTime"
Float
[pWorld]+8
48C
8
"itemUseTime"
Float
[pWorld]+8
4A0
12
"Gold"
4 Bytes
[pWorld]+8
1C
98
6
"HPCurrent"
4 Bytes
[pWorld]+8
450
9
"MPCurrent"
4 Bytes
[pWorld]+8
4E4
20
"Scripts"
1
28
"Get Player Update"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
[ENABLE]
-- Keep trying every 10 seconds
createThread(function()
local address = getAddressSafe('Chasm.Player::Update')
while not address do
sleep(10000)
reinitializeSymbolhandler(true)
address = getAddressSafe('Chasm.Player::Update')
end
registerSymbol('fPlayerUpdate', address)
end)
[DISABLE]
unregisterSymbol('fPlayerUpdate')
29
"Infinite Jump"
Auto Assembler Script
[ENABLE]
aobscanfunction(InfiniteJump,Chasm.Player::Update,80 BE 07 05 00 00 00 74 ** C4 E1 78 28 C6) // should be unique in this function
alloc(newmem,$1000,InfiniteJump)
label(code)
label(return)
newmem:
code:
mov byte ptr [rsi+System.IO.TextWriter._FlushDelegate+7],01
cmp byte ptr [rsi+System.IO.TextWriter._FlushDelegate+7],01
jmp return
InfiniteJump:
jmp newmem
nop 2
return:
registersymbol(InfiniteJump)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
InfiniteJump:
db 80 BE 07 05 00 00 00
unregistersymbol(InfiniteJump)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Chasm.Player::Update+5B2
Chasm.Player::Update+58B: C4 E1 78 28 D0 - vmovaps xmm2,xmm0
Chasm.Player::Update+590: C4 E1 6A 58 D6 - vaddss xmm2,xmm2,xmm6
Chasm.Player::Update+595: 41 8B 0C 24 - mov ecx,[r12]
Chasm.Player::Update+599: 49 8B CC - mov rcx,r12
Chasm.Player::Update+59C: 41 8B D7 - mov edx,r15d
Chasm.Player::Update+59F: 45 33 C9 - xor r9d,r9d
Chasm.Player::Update+5A2: E8 29 02 FF FF - call 7FFD5DA1A480
Chasm.Player::Update+5A7: FF C3 - inc ebx
Chasm.Player::Update+5A9: 44 3B F3 - cmp r14d,ebx
Chasm.Player::Update+5AC: 0F 8F 3E FF FF FF - jg Chasm.Player::Update+4F0
// ---------- INJECTING HERE ----------
Chasm.Player::Update+5B2: 80 BE 07 05 00 00 00 - cmp byte ptr [rsi+System.IO.TextWriter._FlushDelegate+7],00
// ---------- DONE INJECTING ----------
Chasm.Player::Update+5B9: 74 37 - je Chasm.Player::Update+5F2
Chasm.Player::Update+5BB: C4 E1 78 28 C6 - vmovaps xmm0,xmm6
Chasm.Player::Update+5C0: C4 E1 7A 58 86 BC 04 00 00 - vaddss xmm0,xmm0,[rsi+System.IO.TextReader._ReadDelegate+4]
Chasm.Player::Update+5C9: C4 E1 7A 11 86 BC 04 00 00 - vmovss [rsi+System.IO.TextReader._ReadDelegate+4],xmm0
Chasm.Player::Update+5D2: C4 E1 78 2E 05 31 22 00 00 - vucomiss xmm0,[7FFD5DA2C4BC]
Chasm.Player::Update+5DB: 76 15 - jna Chasm.Player::Update+5F2
Chasm.Player::Update+5DD: C6 86 07 05 00 00 00 - mov byte ptr [rsi+System.IO.TextWriter._FlushDelegate+7],00
Chasm.Player::Update+5E4: C4 E1 78 57 C0 - vxorps xmm0,xmm0,xmm0
Chasm.Player::Update+5E9: C4 E1 7A 11 86 BC 04 00 00 - vmovss [rsi+System.IO.TextReader._ReadDelegate+4],xmm0
Chasm.Player::Update+5F2: C4 E1 78 28 C6 - vmovaps xmm0,xmm6
}
22
"Get TryDrop Function"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
[ENABLE]
-- Keep trying every 5 seconds
createThread(function()
local address = getAddressSafe('Chasm.Gameplay.Enemy::TryDrop')
while not address do
sleep(5000)
reinitializeSymbolhandler(true)
address = getAddressSafe('Chasm.Gameplay.Enemy::TryDrop')
end
registerSymbol('fTryDrop', address)
end)
[DISABLE]
unregisterSymbol('fTryDrop')
24
"Drop Chance Cheat"
Auto Assembler Script
[ENABLE]
aobscanfunction(dropChance,Chasm.Gameplay.Enemy::TryDrop,C4 E1 40 57 FF)
alloc(newmem,$1000,dropChance)
label(code)
label(return)
alloc(chance, 4)
chance:
dd (float)100.0
newmem:
movss xmm7, [chance]
code:
//vxorps xmm7,xmm7,xmm7
jmp return
dropChance:
jmp newmem
return:
registersymbol(dropChance)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dropChance:
db C4 E1 40 57 FF
unregistersymbol(dropChance)
dealloc(newmem)
dealloc(chance)
{
// ORIGINAL CODE - INJECTION POINT: Chasm.Gameplay.Enemy::TryDrop+41
Chasm.Gameplay.Enemy::TryDrop+11: C5 F8 77 - vzeroupper
Chasm.Gameplay.Enemy::TryDrop+14: C4 E1 78 29 74 24 70 - vmovaps [rsp+70],xmm6
Chasm.Gameplay.Enemy::TryDrop+1B: C4 E1 78 29 7C 24 60 - vmovaps [rsp+60],xmm7
Chasm.Gameplay.Enemy::TryDrop+22: C4 61 78 29 44 24 50 - vmovaps [rsp+50],xmm8
Chasm.Gameplay.Enemy::TryDrop+29: 48 8B D9 - mov rbx,rcx
Chasm.Gameplay.Enemy::TryDrop+2C: 48 8B F2 - mov rsi,rdx
Chasm.Gameplay.Enemy::TryDrop+2F: 49 8B F8 - mov rdi,r8
Chasm.Gameplay.Enemy::TryDrop+32: 41 8B E9 - mov ebp,r9d
Chasm.Gameplay.Enemy::TryDrop+35: 45 33 F6 - xor r14d,r14d
Chasm.Gameplay.Enemy::TryDrop+38: C4 E1 7A 10 35 47 04 00 00 - vmovss xmm6,[7FFD5DB32498]
// ---------- INJECTING HERE ----------
Chasm.Gameplay.Enemy::TryDrop+41: C4 E1 40 57 FF - vxorps xmm7,xmm7,xmm7
// ---------- DONE INJECTING ----------
Chasm.Gameplay.Enemy::TryDrop+46: 48 8B 0C 25 B8 72 67 13 - mov rcx,[Chasm.GlobalShare.LocalPlayer]
Chasm.Gameplay.Enemy::TryDrop+4E: 48 8B 91 98 00 00 00 - mov rdx,[rcx+System.AppContextDefaultValues.SwitchDoNotAddrOfCspParentWindowHandle]
Chasm.Gameplay.Enemy::TryDrop+55: 0F B6 52 2C - movzx edx,byte ptr [rdx+2C]
Chasm.Gameplay.Enemy::TryDrop+59: E8 32 D1 FF FF - call Chasm.Player::CalcLCK
Chasm.Gameplay.Enemy::TryDrop+5E: 33 D2 - xor edx,edx
Chasm.Gameplay.Enemy::TryDrop+60: 85 C0 - test eax,eax
Chasm.Gameplay.Enemy::TryDrop+62: 7E 1F - jle Chasm.Gameplay.Enemy::TryDrop+83
Chasm.Gameplay.Enemy::TryDrop+64: C4 E1 42 58 FE - vaddss xmm7,xmm7,xmm6
Chasm.Gameplay.Enemy::TryDrop+69: C4 E1 78 2E 35 1A 04 00 00 - vucomiss xmm6,[7FFD5DB3249C]
Chasm.Gameplay.Enemy::TryDrop+72: 76 09 - jna Chasm.Gameplay.Enemy::TryDrop+7D
}
Chasm.Player::Update+5DD
7FFD5DA2A28D
22
00
00
76
15
C6
86
07
05
00
00
00
C4
E1
78
57
C0