Sorry for the necro. Been trying to figure it out myself for a few days now to no avail. Tried looking for 6A D8 40 and then 01 01 or 01 01 00. Tried looking for command-ran then 01 01, etc. I think this method has been patched on the latest version. That, or I'm too incompetent with the hex editor....