Rohan Sorien Base Cheat

Hack Explanation #1 - GM Commands

Alright well, I guess I'll try my best to show/explain how some of the stuff is done.

First you need OllyDBG, which is a debugger.

Also, you need some experience with Assembly, or you'll be thinking "What the hell is that crap?".

I'll be explaining how to enable GM commands in this one.


First, go to the address 004110A5 in the non-hacked EXE (Version 244), you should see this:
MOVZX EAX,BYTE PTR SS:[ESP+A9]

The Command above reads your access level and moves it to the EAX Register (Padded with 0's), so what you need to do is create your own function to write your own access level.

So you create a call at that address to a code cave you found/created, in this example, I'll be using the address 008EF925 as my code cave. (To use this address, you'll need to write the command "RETN 4" to the address 008EF920, the function we will be using for the code cave is the error handler)

So you change the code at 004110A5 to:
CALL 008EF925
then you go to 008EF925 and write this code:

MOV BYTE PTR SS:[ESP+A9],0FA
MOVZX EAX,BYTE PTR SS:[ESP+A9]
RETN

and voila. ;p



Hack Explanation #2 - Disabling Gameguard
There are a few ways to do this, all of them are relatively simple.

The two main methods are just changing one jump position.

Method 1:
Change the code at 0043E8F2 to JMP 0043EB7C .

This method will completely stop Gameguard from loading at all, but can cause some problems, especially with Gameguard Authentication (If used.).

Method 2:
Change the code at 0043EB5B to JMP 0043EB6B .

This method will allow Gameguard to initialize some stuff but will stop it from loading completely.



Hack Explanation #3 - Increased Damage (Sorta)

Normally when you attack, you tell the server to start an attack on a target and the server handles everything from there, updating you when you attack and what not.

But there's a way to make attacking client-side, it's a pretty simple exploit, that once built into the game, can become a very good hack.

This hack does not increase your damage, it just makes you attack extremely fast.

You'll need to hack two different things for this one, you need to disable the animations for attacking while its in use and the actual attacking.

(If you leave the animation on, it won't work correctly.)

This is probably going to be a long one so bear with me. :x

Disable Attack Animation
Go to 0048A04B and change the command there to JE 0048A0DD .

This will disable the attack animation for players. (Yourself and others)


Damage Hack
I'm just going to copy and paste the code to make things shorter, and then explain what it does and what not.

For this hack, I'll be using 008EF976 as the code cave.

Go to 00487491 and change that code to CALL 008EF974.
This command will jump to our custom code.

Go to 00487497, right click it, go to Binary, and Fill With NOPs.
This change will disable the client from setting the current attack state.

Go to 004874C7, right click it, go to Binary, and Fill With NOPs.
This change will disable attack speed, so your next attack is called instantly.


Now go to 008EF976 and put this code. (Make sure it's perfect)

XOR EDI,EDI
MOV EDX,DWORD PTR DS:[0AEE1D4]
MOV EAX,DWORD PTR DS:[0AEE1D0]
MOV ECX,DWORD PTR DS:[0ABFEB8]
PUSH EDX
PUSH EAX
PUSH 0
PUSH 1308
CALL 00407010
MOV EDX,DWORD PTR DS:[0AEE1D4]
MOV EAX,DWORD PTR DS:[0AEE1D0]
PUSH EDX
PUSH EAX
LEA ECX,DWORD PTR SS:[ESP+1C]
PUSH ECX
MOV ECX,DWORD PTR DS:[0ABFEB8]
PUSH 1307
CALL 00407010
INC EDI
CMP EDI,4
JL SHORT 008EF978
MOV EDI,EBP
RETN

This code sends 4 sets of stop attacking / start attacking commands to the server.

The 4 in CMP EDI, 4 is how many loops it does, so you can change it to suit your needs.
(I dont suggest going over 20, 4 should be the perfect number for everyone.. Going too high may make you do less damage.)

I think that's everything I should post about this, but I'm tired.. So if I forgot anything, I'll edit it later.