Rohan Hack #1 - GM Commands

( Current Address Version: 251 )

I'll be explaining how to enable GM commands in this one.

First, go to the address 00411145 you should see this:
MOVZX EAX,BYTE PTR SS:[ESP+A9]

The command above reads your access level and moves it to the EAX Register (Padded with 0's), so what you need to do is create your own function to write your own access level.

So you create a call at that address to a code cave you found/created, in this example, I'll be using the address 00427AE2 as my code cave.

So you change the code at 00411145 to:
CALL 00427AE2
then you go to 00427AE2 and write this code:
MOV BYTE PTR SS:[ESP+0A9],0FA
MOVZX EAX,BYTE PTR SS:[ESP+0A9]
RETN

via sorien