From a16e32bc0f85e2235131540f140b7cd2d3c39e89 Mon Sep 17 00:00:00 2001 From: Extrems Date: Sat, 29 Apr 2023 22:01:07 -0400 Subject: [PATCH] - Build cheat engine from source. --- cube/patches/Makefile | 10 +- cube/patches/cheats/codehandler.ld | 8 + cube/patches/cheats/codehandler.s | 1674 +++++++++++++++++ cube/patches/cheats/codehandleronly.s | 984 ++++++++++ cube/swiss/source/cheats/cheats.c | 2 +- .../swiss/{include => source/cheats}/cheats.h | 6 +- cube/swiss/source/cheats/kenobigc.bin | Bin 2736 -> 0 bytes cube/swiss/source/cheats/kenobigc.s | 183 -- cube/swiss/source/cheats/kenobigc_dbg.bin | Bin 4288 -> 0 bytes cube/swiss/source/cheats/kenobigc_dbg.s | 280 --- 10 files changed, 2678 insertions(+), 469 deletions(-) create mode 100644 cube/patches/cheats/codehandler.ld create mode 100644 cube/patches/cheats/codehandler.s create mode 100644 cube/patches/cheats/codehandleronly.s rename cube/swiss/{include => source/cheats}/cheats.h (91%) delete mode 100644 cube/swiss/source/cheats/kenobigc.bin delete mode 100644 cube/swiss/source/cheats/kenobigc.s delete mode 100644 cube/swiss/source/cheats/kenobigc_dbg.bin delete mode 100644 cube/swiss/source/cheats/kenobigc_dbg.s diff --git a/cube/patches/Makefile b/cube/patches/Makefile index 881c68aad..874c5a2cc 100644 --- a/cube/patches/Makefile +++ b/cube/patches/Makefile @@ -12,7 +12,7 @@ DEST = ../swiss/source/patches DISASM = disassembly .NOTPARALLEL: -all: clean cpatches stub sdpatch ideexipatch dvdpatch usbgeckopatch wkfpatch fsppatch gcloaderpatch +all: clean codehandler cpatches stub sdpatch ideexipatch dvdpatch usbgeckopatch wkfpatch fsppatch gcloaderpatch stub: reboot.bin stub.bin sdpatch: sd.bin sd.card.bin sd.dtk.bin @@ -28,6 +28,14 @@ clean: @rm -f $(DEST)/*.bin.s $(DEST)/*_bin.h @rm -fr $(DISASM) +codehandler: + @echo Building Codehandler ... + @$(CC) -nostartfiles -nodefaultlibs -nostdlib -o kenobigc.bin -T cheats/codehandler.ld cheats/codehandleronly.s + @$(CC) -nostartfiles -nodefaultlibs -nostdlib -o kenobigc.dbg.bin -T cheats/codehandler.ld cheats/codehandler.s + @$(BIN2S) -H $(DEST)/kenobigc_bin.h kenobigc.bin > $(DEST)/kenobigc.bin.s + @$(BIN2S) -H $(DEST)/kenobigc_dbg_bin.h kenobigc.dbg.bin > $(DEST)/kenobigc.dbg.bin.s + @rm -f *.bin + cpatches: @echo Building C Patches ... @$(CC) -O3 $(OPTS) -c base/memmove.S -DBACKWARDS_MEMCPY -o backwards_memcpy.o diff --git a/cube/patches/cheats/codehandler.ld b/cube/patches/cheats/codehandler.ld new file mode 100644 index 000000000..3bdddf7b0 --- /dev/null +++ b/cube/patches/cheats/codehandler.ld @@ -0,0 +1,8 @@ +OUTPUT_FORMAT(binary) +OUTPUT_ARCH(powerpc:common) +ENTRY(_start) + +SECTIONS +{ + . = 0x817FE000; +} diff --git a/cube/patches/cheats/codehandler.s b/cube/patches/cheats/codehandler.s new file mode 100644 index 000000000..9844c95af --- /dev/null +++ b/cube/patches/cheats/codehandler.s @@ -0,0 +1,1674 @@ +.text + +.set r0,0; .set r1,1; .set r2,2; .set r3,3; .set r4,4 +.set r5,5; .set r6,6; .set r7,7; .set r8,8; .set r9,9 +.set r10,10; .set r11,11; .set r12,12; .set r13,13; .set r14,14 +.set r15,15; .set r16,16; .set r17,17; .set r18,18; .set r19,19 +.set r20,20; .set r21,21; .set r22,22; .set r23,23; .set r24,24 +.set r25,25; .set r26,26; .set r27,27; .set r28,28; .set r29,29 +.set r30,30; .set r31,31; .set f0,0; .set f2,2; .set f3,3 + +.globl _start + +gameid: +.long 0,0 +cheatdata: +.long frozenvalue +.space 39*4 + +_start: + stwu r1,-168(r1) # stores sp + stw r0,8(r1) # stores r0 + + mflr r0 + stw r0,172(r1) # stores lr + + mfcr r0 + stw r0,12(r1) # stores cr + + mfctr r0 + stw r0,16(r1) # stores ctr + + mfxer r0 + stw r0,20(r1) # stores xer + + stmw r3,24(r1) # saves r3-r31 + + mfmsr r20 + ori r26,r20,0x2000 #enable floating point ? + andi. r26,r26,0xF9FF + mtmsr r26 + + stfd f2,152(r1) # stores f2 + stfd f3,160(r1) # stores f3 + + lis r31,_start@h + + lis r3, 0xCC00 + lhz r28, 0x4010(r3) + ori r21, r28, 0xFF + sth r21, 0x4010(r3) # disable MP3 memory protection + + bl _codehandler + +_setvalues: + li r21,0 + li r22,0x19 + li r23,0xD0 + lis r24,0xCC00 # Changed for GCN + + ori r18, r31, frozenvalue@l # read buffer just store in lowmem + lwz r0,172(r1) # loads lr + stw r0,4(r18) # stores lr + stw r21, 0x643C(r24) # exi speed up + +frozen: + bl exireceivebyte + beq finish # r3 returns 1 or 0, one for byte received ok + +checkcommand: + + cmpwi r29, 0x04 # checks lf 8/1/32 bits write command + bge _nextcommand + cmpwi r29, 0x01 + blt finish + b writedword #write value to address +_nextcommand: + beq readmem + cmpwi r29, 0x06 + beq freezegame + cmpwi r29, 0x07 + beq unfreezegame + cmpwi r29, 0x08 + beq resumegame + cmpwi r29, 0x09 + beq breakpoints #ibp + cmpwi r29, 0x10 + beq breakpoints #dbp + cmpwi r29, 0x2F + beq upbpdata + cmpwi r29, 0x30 + beq getbpdata + cmpwi r29, 0x38 + beq cancelbreakpoints + cmpwi r29, 0x40 + beq sendcheats + cmpwi r29, 0x41 + beq uploadcode + cmpwi r29, 0x44 + beq breakpoints #step + cmpwi r29, 0x50 + beq pausestatus + cmpwi r29, 0x60 + beq executecodes + cmpwi r29, 0x89 + beq breakpoints #aligned dbp + cmpwi r29, 0x99 + beq versionnumber + b finish + +#*************************************************************************** +# subroutine: getpausestatus: +# one running, two paused, three on a breakpoint +#*************************************************************************** + +pausestatus: + lwz r3,0(r18) + bl exisendbyte + b finish + + +#*************************************************************************** +# subroutine: executecodes: +# executes the code handler +#*************************************************************************** + +executecodes: + bl _codehandler + b finish + + +#*************************************************************************** +# subroutine: freezegame: +# Write a 1 to a memory location to freeze +#*************************************************************************** + +freezegame: + li r4, 1 + stw r4, 0(r18) + b finish + +#*************************************************************************** +# subroutine: upload bp data: +# receive the dp databuffer from the PC +#*************************************************************************** + +upbpdata: + bl exisendbyteAA + + li r16, 40*4 # 42 "registers rN" * 4 + ori r12, r31, regbuffer@l + b upload + +#*************************************************************************** +# subroutine: getbp data: +# send the dp databuffer to the PC +#*************************************************************************** + +getbpdata: + li r3, 72*4 # register buffer + ori r12, r31, regbuffer@l + bl exisendbuffer # send it, less than a packet + b finish + + +#*************************************************************************** +# subroutine: breakpoints: +# handles data/instruction address breakpoints +#*************************************************************************** + +breakpoints: + + cmpwi cr6,r29,0x10 # 0x10 = instruction, 0x09/0x89 = data + cmpwi cr5,r29,0x44 # 0x44 = step + + ori r4,r31,bphandler@l #used for writebranch (= source address) + + lis r3,0x8000 + ori r3,r3,0x304 # bprw 0x80000300 + bl writebranch + + lis r3,0x8000 + ori r3,r3,0xD00 # trace 0x80000D00 + bl writebranch + + ori r12, r31, bpbuffer@l # read buffer just store in lowmem + + stw r21,0(r12) # clears inst bp + stw r21,4(r12) # clears data bp + stw r21,8(r12) # clears alignement + + ori r4, r31, regbuffer@l + lwz r9,0x18(r4) + + lwz r3,0(r18) + cmpwi r3,2 # checks lf the gecko is on a breakpoint + bne +12 + beq cr5,+12 + b bp + li r3,0 + stw r3,12(r12) # lf not, clears the previous "broken on" address + + bne bp + + bne cr5,bp + ori r9,r9,0x400 + stw r9,0x18(r4) + b unfreezegame + +bp: + rlwinm r9,r9,0,22,20 + stw r9,0x18(r4) + beq cr5,finish + beq cr6,+8 + addi r12,r12,4 # lf databp r12=r12+4 + + li r3, 4 # 4 bytes + bl exireceivebuffer + + ble cr6,noalignement # lf not aligned data bp (0x89) + + addi r12,r12,4 + + li r3, 4 # 4 bytes + bl exireceivebuffer + +noalignement: + ori r4, r31, bpbuffer@l # read buffer just store in lowmem + + lwz r3, 0(r4) + lwz r4, 4(r4) + mtspr 1010, r3 # set IABR + mtspr 1013, r4 # set DABR + b finish + +#*************************************************************************** +# subroutine: bphandler +# Data/Instruction address breakpoint handler, save context and return +#*************************************************************************** + +bphandler: + mtsprg 2,r1 # sprg2 = r1 + mfsrr0 r1 # r1=srr0 + mtsprg 3,r3 # sprg3 = r3 + mfsrr1 r3 + # r3=srr1 + rlwinm r3,r3,0,22,20 # clear trace + stw r3,regbuffer@l+0x18(r0) # store srr1 with trace cleared in regbuffer + rlwinm r3,r3,0,24,15 + ori r3,r3,0x2000 +# rlwinm r3,r3,0,17,15 # clear hw interrupt + mtsrr1 r3 # restore srr1 with hw interrupt & trace cleared + + lis r3,break@h + ori r3,r3,break@l + mtsrr0 r3 + rfi + +break: + lis r3, regbuffer@h + ori r3, r3, regbuffer@l + stw r1,0x14(r3) #stores srr0 + + mr r1,r3 + mfsprg r3,3 + stmw r2,0x24(r1) #saves r2-r31 + mr r4,r1 + mfsprg r1,2 + + stw r0,0x1C(r4) + stw r1,0x20(r4) + + mflr r3 + stw r3, 0x9C(r4) # Store LR + + mfcr r3 + stw r3, 0x0(r4) # Store CR + + mfxer r3 + stw r3, 0x4(r4) # Store XER + + mfctr r3 + stw r3, 0x8(r4) # Store CTR + + mfdsisr r3 + stw r3, 0xC(r4) # Store DSISR + + mfdar r3 + stw r3, 0x10(r4) # Store DAR + + li r9,0 + mtspr 1010,r9 # Clear IABR + mtspr 1013,r9 # Clear DABR + + lis r5,floatstore@h + ori r5,r5,floatstore@l # Set r5 to instruction address + lis r31,0xD004 + ori r31,r31,0x00A0 # Set r31 to 'stfs f0,0xA0(r4)' (==0xD00400A0) + floatloop: + stw r31,0(r5) + dcbst r0,r5 + sync + icbi r0,r5 + isync + floatstore: + stfs f0,0xA0(r4) + addi r31,r31,4 # Advance instruction offset + addis r31,r31,0x20 # Advance instruction register + rlwinm. r16,r31,0,5,5 # Check for register > 31 + beq floatloop + +skip_floating_point: + lis r31,_start@h + ori r5,r31,bpbuffer@l + + lwz r16,0(r5) + lwz r17,4(r5) + lwz r19,12(r5) + + cmpwi r19,0 + beq _redobp + + cmpwi r19,2 + bne +24 + lwz r9,0x14(r4) + addi r9,r19,3 + stw r9,0(r5) + stw r9,12(r5) + b _executebp + + cmpw r16,r19 + beq _step + + cmpw r17,r19 + beq _step + + add r9,r16,r17 + stw r9,12(r5) + +_alignementcheck: + lwz r16,8(r5) + cmpwi r16,0 + beq _executebp # no alignement = normal break + + lwz r3,0x10(r4) + cmpw r16,r3 # we check lf address = aligned address + bne _step # lf no, we need to set a bp on the next instruction + + li r16,0 + stw r16,8(r5) # lf we are on the good address we clear the aligned bp check + b _executebp # and we break + +_step: + li r17,0 + stw r17,12(r5) + lwz r9,0x18(r4) + ori r9,r9,0x400 + stw r9,0x18(r4) + b _skipbp #and we don't break right now + +_redobp: + mtspr 1010,r16 # we set back the instbp with the original value + mtspr 1013,r17 # we set back the databp with the original value + li r9,1 + stw r9,12(r5) + b _skipbp # and we don't break + +_executebp: + li r5, 2 + ori r4, r31, frozenvalue@l # Freeze once returned to let user know there is a breakpoint hit + stw r5, 0(r4) + + li r3, 0x11 + bl exisendbyte # tell the PC a bp has happened (send 0x11) + + bl _start # bl mainloop, so you can set up a new breakpoint. + +_skipbp: + mfmsr r1 + rlwinm r1,r1,0,31,29 + rlwinm r1,r1,0,17,15 + mtmsr r1 # we disable the interrupt so nothing interfers with the restore + + ori r1, r31, regbuffer@l + + lwz r3,0x0(r1) + mtcr r3 # restores CR + lwz r3,0x14(r1) + mtsrr0 r3 # restores SRR0 + lwz r3,0x18(r1) + mtsrr1 r3 # restores SRR1 + lwz r3,0x9C(r1) + mtlr r3 # restores LR + + lmw r2,0x24(r1) # restores r2-r31 + + lwz r0,0x1C(r1) # restores r0 + lwz r1,0x20(r1) # restores r1 + + + rfi # back to the game + +#*************************************************************************** +# subroutine: unfreezegame: +# Write a 0 to a memory location to unfreeze +#*************************************************************************** + +unfreezegame: + stw r21, 0(r18) + b resumegame + +#*************************************************************************** +# subroutine: write dword: +# Write a long word value to memory sent from PC +#*************************************************************************** + +writedword: + cmpwi cr5,r29,2 + li r3, 8 # 8 bytes (location 4 / Value 4) + + ori r12, r31, dwordbuffer@l # buffer + bl exireceivebuffer + + lwz r5, 0(r12) + lwz r3, 4(r12) # read the value + stb r3, 0(r5) # write to location + blt cr5,skipp + sth r3, 0(r5) # write to location + beq cr5,skipp + stw r3, 0(r5) # write to location + skipp: + dcbf r0, r5 # data cache block flush + sync + icbi r0, r5 + isync + b finish + +#*************************************************************************** +# subroutine: SendCheats : +# Fill memory with value +#*************************************************************************** + +sendcheats: + bl exisendbyteAA + + li r3, 4 # 4 bytes + ori r12, r31, dwordbuffer@l # buffer + bl exireceivebuffer + + lwz r16, 0(r12) + + lis r12, codelist@h + ori r12, r12, codelist@l + + b upload + +#*************************************************************************** +# subroutine: Upload : +# Fill memory with value +#*************************************************************************** + +uploadcode: + bl exisendbyteAA + + li r3, 8 # 8 bytes + ori r12, r31, dwordbuffer@l # buffer + + bl exireceivebuffer + + lwz r16, 4(r12) + lwz r12, 0(r12) + +upload: + ori r27, r31, rem@l # Remainder of bytes upload code + li r17,0xF80 + bl _packetdivide + beq douploadremainder + +nextrecpacket: + mr r3,r17 + bl exireceivebuffer # r12 start = start of buffer + +uploadwait: + bl exisendbyteAA + beq uploadwait + add r12,r12,r14 + + subic. r11, r11, 1 # decrease loop counter + bgt nextrecpacket + +douploadremainder: # send the remainder bytes + lwz r3, 0(r27) # remainder + cmpwi r3,0 + beq finishupload + bl exireceivebuffer +finishupload: + dcbf r0, r12 # data cache block flush + sync + icbi r0, r12 # instruction cache block flush + isync + b finish + +#*************************************************************************** +# subroutine: exireceivebyte: +# Return 1(r3) lf byte receive, 0(r3) lf no byte +# Command byte is stored at 0x800027ff +#*************************************************************************** + +exireceivebyte: + mflr r30 + lis r3, 0xA000 # EXI read command + + bl checkexisend + + andis. r3, r16, 0x800 + rlwinm r29,r16,16,24,31 + mtlr r30 + blr + +#*************************************************************************** +# subroutine: checkexisend: +# +#*************************************************************************** + +checkexisend: + stw r23, 0x6814(r24) # 32mhz Port B + stw r3, 0x6824(r24) + stw r22, 0x6820(r24) # 0xCC006820 (Channel 1 Control Register) + +exicheckreceivewait: + lwz r5, 0x6820(r24) + andi. r5, r5, 1 + bne exicheckreceivewait # while((exi_chan1cr)&1); + + lwz r16, 0x6824(r24) + stw r5, 0x6814(r24) + + blr + +#*************************************************************************** +# subroutine: exireceivebuffer: +# r3 byte counter, r12 points to buffer, r3 gets copied as gets destroyed +#*************************************************************************** + +exireceivebuffer: + mflr r10 # save link register + mtctr r3 # counter + li r14,0 + +bufferloop: + bl exicheckreceive + bl exicheckreceive + bl exireceivebyte + beq bufferloop # r3 returns 1 or 0, one for byte received ok + + stbx r29, r14,r12 # store byte into buffer + + addi r14, r14, 1 # increase buffer by 1 + bdnz bufferloop + + mtlr r10 # retore link register + blr # return to command check + +#*************************************************************************** +# exisendbuffer: +# r3 byte counter, r12 points to buffer, r3 gets copied as gets destroyed +#*************************************************************************** + +exisendbuffer: + mflr r10 # save link register + mtctr r3 # r3->counter + li r14,0 + +sendloop: + lbzx r3, r12,r14 + bl exisendbyte + beq sendloop + + addi r14, r14, 1 # increase buffer + bdnz sendloop + mtlr r10 # restore link register + blr + +#*************************************************************************** +# exisendbyte:12345678 +# r3 byte to send, returns 1 lf sent, 0 lf fail (!!! called by breakpoint) +#*************************************************************************** +exisendbyteAA: + li r3,0xAA + +exisendbyte: # r3, send value + mflr r30 + slwi r3, r3, 20 # (sendbyte<<20); + oris r3, r3, 0xB000 # 0xB0000000 | (OR) + li r22,0x19 + li r23,0xD0 + lis r24,0xCC00 # changed for GCN + + bl checkexisend + + extrwi. r3, r16, 1,5 # returns either 0 or 1, one for byte received ok + mtlr r30 + blr + +#*************************************************************************** +# subroutine: exicheckrecieve: +# Return 1(r3) lf byte receive, 0(r3) lf no byte +#*************************************************************************** + +exicheckreceive: + mflr r30 +exicheckreceive2: + lis r3, 0xD000 # EXI check status command + + bl checkexisend + + rlwinm. r3,r16,6,31,31 # returns either 0 or 1 for r3 + + beq exicheckreceive2 + mtlr r30 + blr + +#*************************************************************************** +# Readmem: (reads a memory range back to PC) +# r3 byte to send, returns 1 lf sent, 0 lf fail +#*************************************************************************** + +readmem: + bl exisendbyteAA + + li r3, 8 # 8 bytes + ori r12, r31, dwordbuffer@l # buffer + + bl exireceivebuffer + + lwz r5, 4(r12) + lwz r12, 0(r12) + + ori r27, r31, rem@l # place holder for remainder bytes + + ori r17, r21, 0xF800 # 64K packet + sub r16, r5, r12 # memrange = (*endlocation - *startlocation) + + bl _packetdivide + +nextsendpacket: + bgt transfer #compares r11 and 0 + lwz r17, 0(r27) # remainder + cmpwi r17,0 + beq finish +transfer: + mr r3,r17 # number of bytes + bl exisendbuffer + +bytewait1: + bl exicheckreceive + bl exicheckreceive + bl exireceivebyte + beq bytewait1 # r3 returns 1 or 0, one for byte received ok + cmpwi r29, 0xCC # cancel code + beq finish + cmpwi r29, 0xBB # retry code + beq transfer + cmpwi r29, 0xAA + bne bytewait1 + add r12,r12,r14 + subic. r11, r11, 1 # decrease loop counter + blt finish + b nextsendpacket + +#*************************************************************************** +# Cancel Breakpoints +# Clears instruction and data and step breakpoints +#*************************************************************************** + +cancelbreakpoints: + mtspr 1013, r21 # clear the DABR + mtspr 1010, r21 # clear the IABR + ori r4, r31, regbuffer@l + lwz r9,0x18(r4) + rlwinm r9,r9,0,22,20 + stw r9,0x18(r4) + b finish + +#*************************************************************************** +# subroutine: version number +# Sends back the current gecko version number. +#*************************************************************************** + +versionnumber: + li r3, 0x80 #0x80 = Wii, 0x81 = NGC + bl exisendbyte + #b finish + +#*************************************************************************** +# Finish +# Check lf the gecko has been paused. lf no return to game +#*************************************************************************** + +finish: + lwz r4, 0(r18) + cmpwi r4, 0 # check to see lf we have frozen the game + bne frozen # loop around lf we have (changed to return for the bp) + +resumegame: + lis r3, 0xCC00 + sth r28,0x4010(r3) # restore memory protection value + + lfd f2,152(r1) # loads f2 + lfd f3,160(r1) # loads f3 + + mtmsr r20 # restore msr + + lwz r0,172(r1) + mtlr r0 # restores lr + + lwz r0,12(r1) + mtcr r0 # restores cr + + lwz r0,16(r1) + mtctr r0 # restores ctr + + lwz r0,20(r1) + mtxer r0 # restores xer + + lmw r3,24(r1) # restores r3-r31 + + lwz r0,8(r1) # loads r0 + + addi r1,r1,168 + + isync + + blr # return back to game + +#*************************************************************************** +# Write branch +# r3 - source (our mastercode location) +# r4 - destination (lowmem area 0x80001800 address which will branch to +#*************************************************************************** + +writebranch: + subf r17, r3, r4 # subtract r3 from r4 and place in r17 + lis r5, 0x4800 # 0x48000000 + rlwimi r5,r17,0,6,29 + stw r5, 0(r3) # result in r3 + + dcbf r0, r3 # data cache block flush + sync + icbi r0, r3 + isync + + blr # return + + +#*************************************************************************** +# Packet Divide +# Used by the down/up routines to calculate the number of packet to send +#*************************************************************************** + +_packetdivide: + divw. r11, r16, r17 # fullpackets = memrange / 0xF80 (r11 is full packets) + mullw r10, r11, r17 + subf r10, r10, r16 # r10 holds remainder byte counter + stw r10, 0(r27) # store remainder + blr + +#================================================================================ + +_codehandler: + mflr r29 + lis r15, codelist@h + ori r15, r15, codelist@l + + ori r7, r31, cheatdata@l # set pointer for storing data (before the codelist) + + lis r6,0x8000 # default base address = 0x80000000 (code handler) + + mr r16,r6 # default pointer =0x80000000 (code handler) + + li r8,0 # code execution status set to true (code handler) + + lis r3,0x00D0 + ori r3,r3,0xC0DE + + lwz r4,0(r15) + cmpw r3,r4 + bne- _exitcodehandler + lwz r4,4(r15) + cmpw r3,r4 + bne- _exitcodehandler # lf no code list skip code handler + addi r15,r15,8 + b _readcodes + +_exitcodehandler: + mtlr r29 + blr + +_readcodes: + lwz r3,0(r15) #load code address + lwz r4,4(r15) #load code value + + addi r15,r15,8 #r15 points to next code + + andi. r9,r8,1 + cmpwi cr7,r9,0 #check code execution status in cr7. eq = true, ne = false + + li r9,0 #Clears r9 + + rlwinm r10,r3,3,29,31 #r10 = extract code type, 3 bits + rlwinm r5,r3,7,29,31 #r5 = extract sub code type 3 bits + + andis. r11,r3,0x1000 #test pointer + rlwinm r3,r3,0,7,31 #r3 = extract address in r3 (code type 0/1/2) #0x01FFFFFF + + bne +12 #jump lf the pointer is used + + rlwinm r12,r6,0,0,6 #lf pointer is not used, address = base address + b +8 + + mr r12,r16 #lf pointer is used, address = pointer + + cmpwi cr4,r5,0 #compares sub code type with 0 in cr4 + + cmpwi r10,1 + blt+ _write #code type 0 : write + beq+ _conditional #code type 1 : conditional + + cmpwi r10,3 + blt+ _ba_pointer #Code type 2 : base address operation + + beq- _repeat_goto #Code type 3 : Repeat & goto + + cmpwi r10,5 + blt- _operation_rN #Code type 4 : rN Operation + beq+ _compare16_NM_counter #Code type 5 : compare [rN] with [rM] + + cmpwi r10,7 + blt+ _hook_execute #Code type 6 : hook, execute code + + b _terminator_onoff_ #code type 7 : End of code list + +#CT0============================================================================= +#write 8bits (0): 00XXXXXX YYYY00ZZ +#write 16bits (1): 02XXXXXX YYYYZZZZ +#write 32bits (2): 04XXXXXX ZZZZZZZZ +#string code (3): 06XXXXXX YYYYYYYY, d1d1d1d1 d2d2d2d2, d3d3d3d3 .... +#Serial Code (4): 08XXXXXX YYYYYYYY TNNNZZZZ VVVVVVVV + +_write: + add r12,r12,r3 #address = (ba/po)+(XXXXXX) + cmpwi r5,3 + beq- _write_string #r5 == 3, goto string code + bgt- _write_serial #r5 >= 4, goto serial code + + bne- cr7,_readcodes #lf code execution set to false skip code + + cmpwi cr4,r5,1 #compares sub code type and 1 in cr4 + + bgt- cr4,_write32 #lf sub code type == 2, goto write32 + + #lf sub code type = 0 or 1 (8/16bits) + rlwinm r10,r4,16,16,31 #r10 = extract number of times to write (16bits value) + +_write816: + beq cr4,+16 #lf r5 = 1 then 16 bits write + stbx r4,r9,r12 #write byte + addi r9,r9,1 + b +12 + sthx r4,r9,r12 #write halfword + addi r9,r9,2 + subic. r10,r10,1 #number of times to write -1 + bge- _write816 + b _readcodes + +_write32: + rlwinm r12,r12,0,0,29 #32bits align adress + stw r4,0(r12) #write word to address + b _readcodes + +_write_string: #endianess ? + mr r9,r4 + bne- cr7,_skip_and_align #lf code execution is false, skip string code data + + _stb: + subic. r9,r9,1 #r9 -= 1 (and compares r9 with 0) + blt- _skip_and_align #lf r9 < 0 then exit + lbzx r5,r9,r15 + stbx r5,r9,r12 #loop until all the data has been written + b _stb + +_write_serial: + addi r15,r15,8 #r15 points to the code after the serial code + bne- cr7,_readcodes #lf code execution is false, skip serial code + + lwz r5,-8(r15) #load TNNNZZZZ + lwz r11,-4(r15) #r11 = load VVVVVVVV + + rlwinm r17,r5,0,16,31 #r17 = ZZZZ + rlwinm r10,r5,16,20,31 #r10 = NNN (# of times to write -1) + rlwinm r5,r5,4,28,31 #r5 = T (0:8bits/1:16bits/2:32bits) + +_loop_serial: + cmpwi cr5,r5,1 + beq- cr5,+16 #lf 16bits + bgt+ cr5,+20 #lf 32bits + + stbx r4,r9,r12 #write serial byte (CT04,T=0) + b +16 + + sthx r4,r9,r12 #write serial halfword (CT04,T=1) + b +8 + + stwx r4,r9,r12 #write serial word (CT04,T>=2) + + add r4,r4,r11 #value +=VVVVVVVV + add r9,r9,r17 #address +=ZZZZ + subic. r10,r10,1 + bge+ _loop_serial #loop until all the data has been written + + b _readcodes + +#CT1============================================================================= +#32bits conditional (0,1,2,3): 20XXXXXX YYYYYYYY +#16bits conditional (4,5,6,7): 28XXXXXX ZZZZYYYY + +#PS : 31 bit of address = endlf. + +_conditional: + rlwinm. r9,r3,0,31,31 #r10 = (bit31 & 1) (endlf enabled?) + + beq +16 #jump lf endlf is not enabled + + rlwinm r8,r8,31,1,31 #Endlf (r8>>1) + andi. r9,r8,1 #r9=code execution status + cmpwi cr7,r9,0 #check code execution status in cr7 + cmpwi cr5,r5,4 #compares sub code type and 4 in cr5 + cmpwi cr3,r10,5 #compares code type and 5 in cr3 + + rlwimi r8,r8,1,0,30 #r8<<1 and current execution status = old execution status + bne- cr7,_true_end #lf code execution is set to false -> exit + + bgt cr3,_addresscheck2 #lf code type==6 -> address check + add r12,r12,r3 #address = (ba/po)+(XXXXXX) + + blt cr3,+12 #jump lf code type <5 (==1) + blt cr5,_condition_sub #compare [rN][rM] + b _conditional16_2 #counter compare + bge cr5,_conditional16 #lf sub code type>=4 -> 16 bits conditional + +_conditional32: + rlwinm r12,r12,0,0,29 #32bits align + lwz r11,0(r12) + b _condition_sub + +_conditional16: + rlwinm r12,r12,0,0,30 #16bits align + lhz r11,0(r12) +_conditional16_2: + nor r9,r4,r4 + rlwinm r9,r9,16,16,31 #r9 = extract mask + and r11,r11,r9 #r11 &= r9 + rlwinm r4,r4,0,16,31 #r4 = extract data to check against + +_condition_sub: + cmpl cr6,r11,r4 #Unsigned compare. r11=data at address, r4=YYYYYYYY + andi. r9,r5,3 + beq _skip_NE #lf sub code (type & 3) == 0 + cmpwi r9,2 + beq _skip_LE #lf sub code (type & 3) == 2 + bgt _skip_GE #lf sub code (type & 3) == 3 + +_skip_EQ:#1 + bne- cr6,_true_end #CT21, CT25, CT29 or CT2D (lf !=) + b _skip + +_skip_NE:#0 + beq- cr6,_true_end #CT20, CT24, CT28 or CT2C (lf==) + b _skip + +_skip_LE:#2 + bgt- cr6,_true_end #CT22, CT26, CT2A or CT2E (lf r4>[]) + b _skip + +_skip_GE:#3 + blt- cr6,_true_end #CT23, CT27, CT2B or CT2F (lf r4 5 + blt cr5,_readcodes + lwz r11,-8(r15) #load counter + bne cr7,_clearcounter #lf previous code execution false clear counter + andi. r12,r3,0x8 #else lf clear counter bit not set increase counter + beq _increase_counter + andi. r12,r8,0x1 #else lf.. code result true clear counter + beq _clearcounter + +_increase_counter: + addi r12,r11,0x10 #else increase the counter + rlwimi r11,r12,0,12,27 #update counter + b _savecounter + +_clearcounter: + rlwinm r11,r11,0,28,11 #clear the counter +_savecounter: + stw r11,-8(r15) #save counter + b _readcodes + + +#CT2============================================================================ + +#load base adress (0): 40TYZ00N XXXXXXXX = (load/add:T) ba from [(ba/po:Y)+XXXXXXXX(+rN:Z)] + +#set base address (1): 42TYZ00N XXXXXXXX = (set/add:T) ba to (ba/po:Y)+XXXXXXXX(+rN:Z) + +#store base address (2): 440Y0000 XXXXXXXX = store base address to [(ba/po)+XXXXXXXX] +#set base address to (3): 4600XXXX 00000000 = set base address to code address+XXXXXXXX +#load pointer (4): 48TYZ00N XXXXXXXX = (load/add:T) po from [(ba/po:Y)+XXXXXXXX(+rN:Z)] + +#set pointer (5): 4ATYZ00N XXXXXXXX = (set/add:T) po to (ba/po:Y)+XXXXXXXX(+rN:Y) + +#store pointer (6): 4C0Y0000 XXXXXXXX = store pointer to [(ba/po)+XXXXXXXX] +#set pointer to (7): 4E00XXXX 00000000 = set pointer to code address+XXXXXXXX + +_ba_pointer: + bne- cr7,_readcodes + + rlwinm r9,r3,2,26,29 #r9 = extract N, makes N*4 + + rlwinm r14,r3,16,31,31 #r3 = add ba/po flag bit (Y) + cmpwi cr3,r14,0 + + cmpwi cr4,r5,4 #cr4 = compare sub code type with 4 (ba/po) + andi. r14,r5,3 #r14 = sub code type and 3 + + cmpwi cr5,r14,2 #compares sub code type and 2 + + blt- cr5,_p01 + beq- cr5,_p2 #sub code type 2 + +_p3: + extsh r4,r3 + add r4,r4,r15 #r4=XXXXXXXX+r15 (code location in memory) + b _pend + +_p01: + rlwinm. r5,r3,20,31,31 #r3 = rN use bit (Z) + beq +12 #flag is not set(=0), address = XXXXXXXX + + lwzx r9,r7,r9 #r9 = load register N + add r4,r4,r9 #flag is set (=1), address = XXXXXXXX+rN + + beq cr3,+8 #(Y) flag is not set(=0), address = XXXXXXXX (+rN) + + add r4,r12,r4 #address = XXXXXXXX (+rN) + (ba/po) + + cmpwi cr5,r14,1 + beq cr5,+8 #address = (ba/po)+XXXXXXXX(+rN) + lwz r4,0(r4) #address = [(ba/po)+XXXXXXXX(+rN)] + + rlwinm. r3,r3,12,31,31 #r5 = add/replace flag (T) + beq _pend #flag is not set (=0), (ba/po)= XXXXXXXX (+rN) + (ba/po) + bge cr4,+12 + add r4,r4,r6 #ba += XXXXXXXX (+rN) + (ba/po) + b _pend + add r4,r4,r16 #po += XXXXXXXX (+rN) + (ba/po) + b _pend + +_p2: + rlwinm. r5,r3,20,31,31 #r3 = rN use bit (Z) + beq +12 #flag is not set(=0), address = XXXXXXXX + + lwzx r9,r7,r9 #r9 = load register N + add r4,r4,r9 #flag is set (=1), address = XXXXXXXX+rN + + bge cr4,+12 + stwx r6,r12,r4 #[(ba/po)+XXXXXXXX] = base address + b _readcodes + stwx r16,r12,r4 #[(ba/po)+XXXXXXXX] = pointer + b _readcodes + +_pend: + bge cr4,+12 + mr r6,r4 #store result to base address + b _readcodes + mr r16,r4 #store result to pointer + b _readcodes + + +#CT3============================================================================ +#set repeat (0): 6000ZZZZ 0000000P = set repeat +#execute repeat (1): 62000000 0000000P = execute repeat +#return (2): 64S00000 0000000P = return (lf true/false/always) +#goto (3): 66S0XXXX 00000000 = goto (lf true/false/always) +#gosub (4): 68S0XXXX 0000000P = gosub (lf true/false/always) + +_repeat_goto: + rlwinm r9,r4,3,25,28 #r9 = extract P, makes P*8 + addi r9,r9,0x40 #offset that points to block P's + cmpwi r5,2 #compares sub code type with 2 + blt- _repeat + + rlwinm. r11,r3,10,0,1 #extract (S&3) + beq +20 #S=0, skip lf true, don't skip lf false + bgt +8 + b _b_bl_blr_nocheck #S=2/3, always skip (code exec status turned to true) + beq- cr7,_readcodes #S=1, skip lf false, don't skip lf true + b _b_bl_blr_nocheck + +_b_bl_blr: + bne- cr7,_readcodes #lf code execution set to false skip code + +_b_bl_blr_nocheck: + cmpwi r5,3 + + bgt- _bl #sub code type >=4, bl + beq+ _b #sub code type ==3, b + +_blr: + lwzx r15,r7,r9 #loads the next code address + b _readcodes + +_bl: + stwx r15,r7,r9 #stores the next code address in block P's address +_b: + extsh r4,r3 #XXXX becomes signed + rlwinm r4,r4,3,9,28 + + add r15,r15,r4 #next code address +/-=line XXXX + b _readcodes + +_repeat: + bne- cr7,_readcodes #lf code execution set to false skip code + + add r5,r7,r9 #r5 points to P address + bne- cr4,_execute_repeat #branch lf sub code type == 1 + +_set_repeat: + rlwinm r4,r3,0,16,31 #r4 = extract NNNNN + stw r15,0(r5) #store current code address to [bP's address] + stw r4,4(r5) #store NNNN to [bP's address+4] + + b _readcodes + +_execute_repeat: + lwz r9,4(r5) #load NNNN from [M+4] + cmpwi r9,0 + beq- _readcodes + subi r9,r9,1 + stw r9,4(r5) #saves (NNNN-1) to [bP's address+4] + lwz r15,0(r5) #load next code address from [bP's address] + b _readcodes + +#CT4============================================================================ +#set/add to rN(0) : 80SY000N XXXXXXXX = rN = (ba/po) + XXXXXXXX +#load rN (1) : 82UY000N XXXXXXXX = rN = [XXXXXXXX] (offset support) (U:8/16/32) +#store rN (2) : 84UYZZZN XXXXXXXX = store rN in [XXXXXXXX] (offset support) (8/16/32) + +#operation 1 (3) : 86TY000N XXXXXXXX = operation rN?XXXXXXXX ([rN]?XXXXXXXX) +#operation 2 (4) : 88TY000N 0000000M = operation rN?rM ([rN]?rM, rN?[rM], [rN]?[rM]) + +#copy1 (5) : 8AYYYYNM XXXXXXXX = copy YYYY bytes from [rN] to ([rM]+)XXXXXXXX +#copy2 (6) : 8CYYYYNM XXXXXXXX = copy YYYY bytes from ([rN]+)XXXXXX to [rM] + + +#for copy1/copy2, lf register == 0xF, base address is used. + +#of course, sub codes types 0/1, 2/3 and 4/5 can be put together lf we need more subtypes. + + +_operation_rN: + bne- cr7,_readcodes + + rlwinm r11,r3,2,26,29 #r11 = extract N, makes N*4 + add r26,r7,r11 #1st value address = rN's address + lwz r9,0(r26) #r9 = rN + + rlwinm r14,r3,12,30,31 #extracts S, U, T (3bits) + + beq- cr4,_op0 #lf sub code type = 0 + + cmpwi cr4,r5,5 + bge- cr4,_op56 #lf sub code type = 5/6 + + cmpwi cr4,r5,3 + bge- cr4,_op34 #lf sub code type = 3/4 + + cmpwi cr4,r5,1 + +_op12: #load/store + rlwinm. r5,r3,16,31,31 #+(ba/po) flag : Y + beq +8 #address = XXXXXXXX + add r4,r12,r4 + + cmpwi cr6,r14,1 + bne- cr4,_store + +_load: + bgt+ cr6,+24 + beq- cr6,+12 + + lbz r4,0(r4) #load byte at address + b _store_reg + + lhz r4,0(r4) #load halfword at address + b _store_reg + + lwz r4,0(r4) #load word at address + b _store_reg + +_store: + rlwinm r19,r3,28,20,31 #r9=r3 ror 12 (N84UYZZZ) + +_storeloop: + bgt+ cr6,+32 + beq- cr6,+16 + + stb r9,0(r4) #store byte at address + addi r4,r4,1 + b _storeloopend + + sth r9,0(r4) #store byte at address + addi r4,r4,2 + b _storeloopend + + stw r9,0(r4) #store byte at address + addi r4,r4,4 +_storeloopend: + subic. r19,r19,1 + bge _storeloop + b _readcodes + +_op0: + rlwinm. r5,r3,16,31,31 #+(ba/po) flag : Y + beq +8 #value = XXXXXXXX + add r4,r4,r12 #value = XXXXXXXX+(ba/po) + + andi. r5,r14,1 #add flag : S + beq _store_reg #add flag not set (=0), rN=value + add r4,r4,r9 #add flag set (=1), rN=rN+value + b _store_reg + +_op34: #operation 1 & 2 + rlwinm r10,r3,16,30,31 #extracts Y + + rlwinm r14,r4,2,26,29 #r14 = extract M (in r4), makes M*=4 + + add r19,r7,r14 #2nd value address = rM's address + bne cr4,+8 + subi r19,r15,4 #lf CT3, 2nd value address = XXXXXXXX's address + + lwz r4,0(r26) #1st value = rN + + lwz r9,0(r19) #2nd value = rM/XXXXXXXX + + andi. r11,r10,1 #lf [] for 1st value + beq +8 + mr r26,r4 + + andi. r11,r10,2 #lf [] for 2nd value + beq +16 + mr r19,r9 + bne+ cr4,+8 + add r19,r12,r19 #lf CT3, 2nd value address = XXXXXXXX+(ba/op) + + rlwinm. r5,r3,12,28,31 #operation # flag : T + + cmpwi r5,9 + bge _op_float + +_operation_bl: + bl _operation_bl_return + +_op450: + add r4,r9,r4 #N + M + b _store_reg + +_op451: + mullw r4,r9,r4 #N * M + b _store_reg + +_op452: + or r4,r9,r4 #N | M + b _store_reg + +_op453: + and r4,r9,r4 #N & M + b _store_reg + +_op454: + xor r4,r9,r4 #N ^ M + b _store_reg + +_op455: + slw r4,r9,r4 #N << M + b _store_reg + +_op456: + srw r4,r9,r4 #N >> M + b _store_reg + +_op457: + rlwnm r4,r9,r4,0,31 #N rol M + b _store_reg + +_op458: + sraw r4,r9,r4 #N asr M + +_store_reg: + stw r4,0(r26) #Store result in rN/[rN] + b _readcodes + +_op_float: + cmpwi r5,0xA + bgt _readcodes + + lfs f2,0(r26) #f2 = load 1st value + lfs f3,0(r19) #f3 = load 2nd value + beq- _op45A + +_op459: + fadds f2,f3,f2 #N = N + M (float) + b _store_float + +_op45A: + fmuls f2,f3,f2 #N = N * M (float) + +_store_float: + stfs f2,0(r26) #Store result in rN/[rN] + b _readcodes + +_operation_bl_return: + mflr r10 + rlwinm r5,r5,3,25,28 #r5 = T*8 + add r10,r10,r5 #jumps to _op5: + r5 + + lwz r4,0(r26) #load [rN] + lwz r9,0(r19) #2nd value address = rM/XXXXXXXX + + mtlr r10 + blr + +#copy1 (5) : 8AYYYYNM XXXXXXXX = copy YYYY bytes from [rN] to ([rM]+)XXXXXXXX +#copy2 (6) : 8CYYYYNM XXXXXXXX = copy YYYY bytes from ([rN]+)XXXXXX to [rM] + +_op56: + + bne- cr7,_readcodes #lf code execution set to false skip code + + rlwinm r9,r3,24,0,31 #r9=r3 ror 8 (NM8AYYYY, NM8CYYYY) + mr r14,r12 #r14=(ba/po) + bl _load_NM + + beq- cr4,+12 + add r17,r17,r4 #lf sub code type==0 then source+=XXXXXXXX + b +8 + add r9,r9,r4 #lf sub code type==1 then destination+=XXXXXXXX + + rlwinm. r4,r3,24,16,31 #Extracts YYYY, compares it with 0 + li r5,0 + + _copy_loop: + beq _readcodes #Loop until all bytes have been copied. + lbzx r10,r5,r17 + stbx r10,r5,r9 + addi r5,r5,1 + cmpw r5,r4 + b _copy_loop + + +#=============================================================================== +#This is a routine called by _memory_copy and _compare_NM_16 + +_load_NM: + cmpwi cr5,r10,4 #compare code type and 4(rn Operations) in cr5 + + rlwinm r17,r9,6,26,29 #Extracts N*4 + cmpwi r17,0x3C + lwzx r17,r7,r17 #Loads rN value in r17 + bne +8 + mr r17,r14 #lf N==0xF then source address=(ba/po)(+XXXXXXXX, CT5) + + beq cr5,+8 + lhz r17,0(r17) #...and lf CT5 then N = 16 bits at [XXXXXX+base address] + + rlwinm r9,r9,10,26,29 #Extracts M*4 + cmpwi r9,0x3C + lwzx r9,r7,r9 #Loads rM value in r9 + bne +8 + mr r9,r14 #lf M==0xF then dest address=(ba/po)(+XXXXXXXX, CT5) + + beq cr5,+8 + lhz r9,0(r9) #...and lf CT5 then M = 16 bits at [XXXXXX+base address] + + blr + +#CT5============================================================================ +#16bits conditional (0,1,2,3): A0XXXXXX NM00YYYY (unknown values) +#16bits conditional (4,5,6,7): A8XXXXXX ZZZZYYYY (counter) + +#sub codes types 0,1,2,3 compare [rN] with [rM] (both 16bits values) +#lf register == 0xF, the value at [base address+XXXXXXXX] is used. + +_compare16_NM_counter: + cmpwi r5,4 + bge _compare16_counter + +_compare16_NM: + mr r9,r4 #r9=NM00YYYY + + add r14,r3,r12 #r14 = XXXXXXXX+(ba/po) + + rlwinm r14,r14,0,0,30 #16bits align (base address+XXXXXXXX) + + bl _load_NM #r17 = N's value, r9 = M's value + + nor r4,r4,r4 #r4=!r4 + rlwinm r4,r4,0,16,31 #Extracts !YYYY + + and r11,r9,r4 #r3 = (M AND !YYYY) + and r4,r17,r4 #r4 = (N AND !YYYY) + + b _conditional + +_compare16_counter: + rlwinm r11,r3,28,16,31 #extract counter value from r3 in r11 + b _conditional + +#=============================================================================== +#execute (0) : C0000000 NNNNNNNN = execute +#hook1 (2) : C4XXXXXX NNNNNNNN = insert instructions at XXXXXX +#hook2 (3) : C6XXXXXX YYYYYYYY = branch from XXXXXX to YYYYYY +#on/off (6) : CC000000 00000000 = on/off switch +#range check (7) : CE000000 XXXXYYYY = is ba/po in XXXX0000-YYYY0000 + +_hook_execute: + mr r26,r4 #r18 = 0YYYYYYY + rlwinm r4,r4,3,0,28 #r4 = NNNNNNNN*8 = number of lines (and not number of bytes) + bne- cr4,_hook_addresscheck #lf sub code type != 0 + bne- cr7,_skip_and_align + +_execute: + mtlr r15 + blrl + +_skip_and_align: + add r15,r4,r15 + addi r15,r15,7 + rlwinm r15,r15,0,0,28 #align 64-bit + b _readcodes + +_hook_addresscheck: + + cmpwi cr4,r5,3 + bgt- cr4,_addresscheck1 #lf sub code type ==6 or 7 + lis r5,0x4800 + add r12,r3,r12 + rlwinm r12,r12,0,0,29 #align address + + bne- cr4,_hook1 #lf sub code type ==2 + +_hook2: + bne- cr7,_readcodes + + rlwinm r4,r26,0,0,29 #address &=0x01FFFFFC + + sub r4,r4,r12 #r4 = to-from + rlwimi r5,r4,0,6,29 #r5 = (r4 AND 0x03FFFFFC) OR 0x48000000 + rlwimi r5,r3,0,31,31 #restore lr bit + stw r5,0(r12) #store opcode + b _readcodes + +_hook1: + bne- cr7,_skip_and_align + + sub r9,r15,r12 #r9 = to-from + rlwimi r5,r9,0,6,29 #r5 = (r9 AND 0x03FFFFFC) OR 0x48000000 + stw r5,0(r12) #stores b at the hook place (over original instruction) + addi r12,r12,4 + add r11,r15,r4 + subi r11,r11,4 #r11 = address of the last work of the hook1 code + sub r9,r12,r11 + rlwimi r5,r9,0,6,29 #r5 = (r9 AND 0x03FFFFFC) OR 0x48000000 + stw r5,0(r11) #stores b at the last word of the hook1 code + b _skip_and_align + +_addresscheck1: + cmpwi cr4,r5,6 + beq cr4,_onoff + b _conditional +_addresscheck2: + rlwinm r12,r12,16,16,31 + rlwinm r4,r26,16,16,31 + rlwinm r26,r26,0,16,31 + cmpw r12,r4 + blt _skip + cmpw r12,r26 + bge _skip + b _readcodes + +_onoff: + rlwinm r5,r26,31,31,31 #extracts old exec status (x b a) + xori r5,r5,1 + andi. r3,r8,1 #extracts current exec status + cmpw r5,r3 + beq _onoff_end + rlwimi r26,r8,1,30,30 + xori r26,r26,2 + + rlwinm. r5,r26,31,31,31 #extracts b + beq +8 + + xori r26,r26,1 + + stw r26,-4(r15) #updates the code value in the code list + +_onoff_end: + rlwimi r8,r26,0,31,31 #current execution status = a + + b _readcodes + +#=============================================================================== +#Full terminator (0) = E0000000 XXXXXXXX = full terminator +#Endlfs/Else (1) = E2T000VV XXXXXXXX = endlfs (+else) +#End code handler = F0000000 00000000 + +_terminator_onoff_: + cmpwi r11,0 #lf code type = 0xF + beq _notTerminator + cmpwi r5,1 + beq _asmTypeba + cmpwi r5,2 + beq _asmTypepo + cmpwi r5,3 + beq _patchType + b _exitcodehandler +_asmTypeba: + rlwinm r12,r6,0,0,6 # use base address +_asmTypepo: + rlwinm r23,r4,8,24,31 # extract number of half words to XOR + rlwinm r24,r4,24,16,31 # extract XOR checksum + rlwinm r4,r4,0,24,31 # set code value to number of ASM lines only + bne cr7,_goBackToHandler #skip code if code execution is set to false + rlwinm. r25,r23,0,24,24 # check for negative number of half words + mr r26,r12 # copy ba/po address + add r26,r3,r26 # add code offset to ba/po code address + rlwinm r26,r26,0,0,29 # clear last two bits to align address to 32-bit + beq _positiveOffset # if number of half words is negative, extra setup needs to be done + extsb r23,r23 + neg r23,r23 + mulli r25,r23,2 + addi r25,r25,4 + subf r26,r25,r26 +_positiveOffset: + cmpwi r23,0 + beq _endXORLoop + li r25,0 + mtctr r23 +_XORLoop: + lhz r27,4(r26) + xor r25,r27,r25 + addi r26,r26,2 + bdnz _XORLoop +_endXORLoop: + cmpw r24,r25 + bne _goBackToHandler + b _hook_execute +_patchType: + rlwimi r8,r8,1,0,30 #r8<<1 and current execution status = old execution status + bne cr7,_exitpatch #lf code execution is set to false -> exit + rlwinm. r23,r3,22,0,1 + bgt _patchfail + blt _copytopo +_runpatch: + rlwinm r30,r3,0,24,31 + mulli r30,r30,2 + rlwinm r23,r4,0,0,15 + xoris r24,r23,0x8000 + cmpwi r24,0 + bne- _notincodehandler + ori r23,r23,0x3000 +_notincodehandler: + rlwinm r24,r4,16,0,15 + mulli r25,r30,4 + subf r24,r25,r24 +_patchloop: + li r25,0 +_patchloopnext: + mulli r26,r25,4 + lwzx r27,r15,r26 + lwzx r26,r23,r26 + addi r25,r25,1 + cmplw r23,r24 + bgt _failpatchloop + cmpw r25,r30 + bgt _foundaddress + cmpw r26,r27 + beq _patchloopnext + addi r23,r23,4 + b _patchloop +_foundaddress: + lwz r3,-8(r15) + ori r3,r3,0x300 + stw r3,-8(r15) + stw r23,-4(r15) + mr r16,r23 + b _exitpatch +_failpatchloop: + lwz r3,-8(r15) + ori r3,r3,0x100 + stw r3,-8(r15) +_patchfail: + ori r8,r8,1 #r8|=1 (execution status set to false) + b _exitpatch +_copytopo: + mr r16,r4 +_exitpatch: + rlwinm r4,r3,0,24,31 # set code to number of lines only +_goBackToHandler: + mulli r4,r4,8 + add r15,r4,r15 # skip the lines of the code + b _readcodes + +_notTerminator: + +_terminator: + bne cr4,+12 #check lf sub code type == 0 + li r8,0 #clear whole code execution status lf T=0 + b +20 + + rlwinm. r9,r3,0,27,31 #extract VV +# bne +8 #lf VV!=0 +# bne- cr7,+16 + + rlwinm r5,r3,12,31,31 #extract "else" bit + + srw r8,r8,r9 #r8>>VV, meaning endlf VV lfs + + rlwinm. r23,r8,31,31,31 + bne +8 # execution is false if code execution >>, so don't invert code status + xor r8,r8,r5 #lf 'else' is set then invert current code status + +_load_baseaddress: + rlwinm. r5,r4,0,0,15 + beq +8 + mr r6,r5 #base address = r4 + rlwinm. r5,r4,16,0,15 + beq +8 + mr r16,r5 #pointer = r4 + b _readcodes + +#=============================================================================== + +frozenvalue: #frozen value, then LR +.long 0,0 +dwordbuffer: +.long 0,0 +rem: +.long 0 +bpbuffer: +.long 0 #int address to bp on +.long 0 #data address to bp on +.long 0 #alignement check +.long 0 #counter for alignement + +regbuffer: +.space 72*4 + +.align 3 + +codelist: +.space 2*4 +.end diff --git a/cube/patches/cheats/codehandleronly.s b/cube/patches/cheats/codehandleronly.s new file mode 100644 index 000000000..e13391f4b --- /dev/null +++ b/cube/patches/cheats/codehandleronly.s @@ -0,0 +1,984 @@ +.text + +.set r0,0; .set r1,1; .set r2,2; .set r3,3; .set r4,4 +.set r5,5; .set r6,6; .set r7,7; .set r8,8; .set r9,9 +.set r10,10; .set r11,11; .set r12,12; .set r13,13; .set r14,14 +.set r15,15; .set r16,16; .set r17,17; .set r18,18; .set r19,19 +.set r20,20; .set r21,21; .set r22,22; .set r23,23; .set r24,24 +.set r25,25; .set r26,26; .set r27,27; .set r28,28; .set r29,29 +.set r30,30; .set r31,31; .set f0,0; .set f2,2; .set f3,3 + +.globl _start + +gameid: +.long 0,0 +cheatdata: +.long frozenvalue +.space 39*4 + +_start: + stwu r1,-168(r1) # stores sp + stw r0,8(r1) # stores r0 + + mflr r0 + stw r0,172(r1) # stores lr + + mfcr r0 + stw r0,12(r1) # stores cr + + mfctr r0 + stw r0,16(r1) # stores ctr + + mfxer r0 + stw r0,20(r1) # stores xer + + stmw r3,24(r1) # saves r3-r31 + + mfmsr r20 + ori r26,r20,0x2000 #enable floating point ? + andi. r26,r26,0xF9FF + mtmsr r26 + + stfd f2,152(r1) # stores f2 + stfd f3,160(r1) # stores f3 + + lis r31,_start@h + + lis r3, 0xCC00 + lhz r28, 0x4010(r3) + ori r21, r28, 0xFF + sth r21, 0x4010(r3) # disable MP3 memory protection + + mflr r29 + lis r15, codelist@h + ori r15, r15, codelist@l + + ori r7, r31, cheatdata@l # set pointer for storing data (before the codelist) + + lis r6,0x8000 # default base address = 0x80000000 (code handler) + + mr r16,r6 # default pointer =0x80000000 (code handler) + + li r8,0 # code execution status set to true (code handler) + + lis r3,0x00D0 + ori r3,r3,0xC0DE + + lwz r4,0(r15) + cmpw r3,r4 + bne- _exitcodehandler + lwz r4,4(r15) + cmpw r3,r4 + bne- _exitcodehandler # lf no code list skip code handler + addi r15,r15,8 + b _readcodes + +_exitcodehandler: + mtlr r29 + +resumegame: + lis r3, 0xCC00 + sth r28,0x4010(r3) # restore memory protection value + + lfd f2,152(r1) # loads f2 + lfd f3,160(r1) # loads f3 + + mtmsr r20 # restore msr + + lwz r0,172(r1) + mtlr r0 # restores lr + + lwz r0,12(r1) + mtcr r0 # restores cr + + lwz r0,16(r1) + mtctr r0 # restores ctr + + lwz r0,20(r1) + mtxer r0 # restores xer + + lmw r3,24(r1) # restores r3-r31 + + lwz r0,8(r1) # loads r0 + + addi r1,r1,168 + + isync + + blr # return back to game + +_readcodes: + lwz r3,0(r15) #load code address + lwz r4,4(r15) #load code value + + addi r15,r15,8 #r15 points to next code + + andi. r9,r8,1 + cmpwi cr7,r9,0 #check code execution status in cr7. eq = true, ne = false + + li r9,0 #Clears r9 + + rlwinm r10,r3,3,29,31 #r10 = extract code type, 3 bits + rlwinm r5,r3,7,29,31 #r5 = extract sub code type 3 bits + + andis. r11,r3,0x1000 #test pointer + rlwinm r3,r3,0,7,31 #r3 = extract address in r3 (code type 0/1/2) #0x01FFFFFF + + bne +12 #jump lf the pointer is used + + rlwinm r12,r6,0,0,6 #lf pointer is not used, address = base address + b +8 + + mr r12,r16 #lf pointer is used, address = pointer + + cmpwi cr4,r5,0 #compares sub code type with 0 in cr4 + + cmpwi r10,1 + blt+ _write #code type 0 : write + beq+ _conditional #code type 1 : conditional + + cmpwi r10,3 + blt+ _ba_pointer #Code type 2 : base address operation + + beq- _repeat_goto #Code type 3 : Repeat & goto + + cmpwi r10,5 + blt- _operation_rN #Code type 4 : rN Operation + beq+ _compare16_NM_counter #Code type 5 : compare [rN] with [rM] + + cmpwi r10,7 + blt+ _hook_execute #Code type 6 : hook, execute code + + b _terminator_onoff_ #code type 7 : End of code list + +#CT0============================================================================= +#write 8bits (0): 00XXXXXX YYYY00ZZ +#write 16bits (1): 02XXXXXX YYYYZZZZ +#write 32bits (2): 04XXXXXX ZZZZZZZZ +#string code (3): 06XXXXXX YYYYYYYY, d1d1d1d1 d2d2d2d2, d3d3d3d3 .... +#Serial Code (4): 08XXXXXX YYYYYYYY TNNNZZZZ VVVVVVVV + +_write: + add r12,r12,r3 #address = (ba/po)+(XXXXXX) + cmpwi r5,3 + beq- _write_string #r5 == 3, goto string code + bgt- _write_serial #r5 >= 4, goto serial code + + bne- cr7,_readcodes #lf code execution set to false skip code + + cmpwi cr4,r5,1 #compares sub code type and 1 in cr4 + + bgt- cr4,_write32 #lf sub code type == 2, goto write32 + + #lf sub code type = 0 or 1 (8/16bits) + rlwinm r10,r4,16,16,31 #r10 = extract number of times to write (16bits value) + +_write816: + beq cr4,+16 #lf r5 = 1 then 16 bits write + stbx r4,r9,r12 #write byte + addi r9,r9,1 + b +12 + sthx r4,r9,r12 #write halfword + addi r9,r9,2 + subic. r10,r10,1 #number of times to write -1 + bge- _write816 + b _readcodes + +_write32: + rlwinm r12,r12,0,0,29 #32bits align adress + stw r4,0(r12) #write word to address + b _readcodes + +_write_string: #endianess ? + mr r9,r4 + bne- cr7,_skip_and_align #lf code execution is false, skip string code data + + _stb: + subic. r9,r9,1 #r9 -= 1 (and compares r9 with 0) + blt- _skip_and_align #lf r9 < 0 then exit + lbzx r5,r9,r15 + stbx r5,r9,r12 #loop until all the data has been written + b _stb + +_write_serial: + addi r15,r15,8 #r15 points to the code after the serial code + bne- cr7,_readcodes #lf code execution is false, skip serial code + + lwz r5,-8(r15) #load TNNNZZZZ + lwz r11,-4(r15) #r11 = load VVVVVVVV + + rlwinm r17,r5,0,16,31 #r17 = ZZZZ + rlwinm r10,r5,16,20,31 #r10 = NNN (# of times to write -1) + rlwinm r5,r5,4,28,31 #r5 = T (0:8bits/1:16bits/2:32bits) + +_loop_serial: + cmpwi cr5,r5,1 + beq- cr5,+16 #lf 16bits + bgt+ cr5,+20 #lf 32bits + + stbx r4,r9,r12 #write serial byte (CT04,T=0) + b +16 + + sthx r4,r9,r12 #write serial halfword (CT04,T=1) + b +8 + + stwx r4,r9,r12 #write serial word (CT04,T>=2) + + add r4,r4,r11 #value +=VVVVVVVV + add r9,r9,r17 #address +=ZZZZ + subic. r10,r10,1 + bge+ _loop_serial #loop until all the data has been written + + b _readcodes + +#CT1============================================================================= +#32bits conditional (0,1,2,3): 20XXXXXX YYYYYYYY +#16bits conditional (4,5,6,7): 28XXXXXX ZZZZYYYY + +#PS : 31 bit of address = endlf. + +_conditional: + rlwinm. r9,r3,0,31,31 #r10 = (bit31 & 1) (endlf enabled?) + + beq +16 #jump lf endlf is not enabled + + rlwinm r8,r8,31,1,31 #Endlf (r8>>1) + andi. r9,r8,1 #r9=code execution status + cmpwi cr7,r9,0 #check code execution status in cr7 + cmpwi cr5,r5,4 #compares sub code type and 4 in cr5 + cmpwi cr3,r10,5 #compares code type and 5 in cr3 + + rlwimi r8,r8,1,0,30 #r8<<1 and current execution status = old execution status + bne- cr7,_true_end #lf code execution is set to false -> exit + + bgt cr3,_addresscheck2 #lf code type==6 -> address check + add r12,r12,r3 #address = (ba/po)+(XXXXXX) + + blt cr3,+12 #jump lf code type <5 (==1) + blt cr5,_condition_sub #compare [rN][rM] + b _conditional16_2 #counter compare + bge cr5,_conditional16 #lf sub code type>=4 -> 16 bits conditional + +_conditional32: + rlwinm r12,r12,0,0,29 #32bits align + lwz r11,0(r12) + b _condition_sub + +_conditional16: + rlwinm r12,r12,0,0,30 #16bits align + lhz r11,0(r12) +_conditional16_2: + nor r9,r4,r4 + rlwinm r9,r9,16,16,31 #r9 = extract mask + and r11,r11,r9 #r11 &= r9 + rlwinm r4,r4,0,16,31 #r4 = extract data to check against + +_condition_sub: + cmpl cr6,r11,r4 #Unsigned compare. r11=data at address, r4=YYYYYYYY + andi. r9,r5,3 + beq _skip_NE #lf sub code (type & 3) == 0 + cmpwi r9,2 + beq _skip_LE #lf sub code (type & 3) == 2 + bgt _skip_GE #lf sub code (type & 3) == 3 + +_skip_EQ:#1 + bne- cr6,_true_end #CT21, CT25, CT29 or CT2D (lf !=) + b _skip + +_skip_NE:#0 + beq- cr6,_true_end #CT20, CT24, CT28 or CT2C (lf==) + b _skip + +_skip_LE:#2 + bgt- cr6,_true_end #CT22, CT26, CT2A or CT2E (lf r4>[]) + b _skip + +_skip_GE:#3 + blt- cr6,_true_end #CT23, CT27, CT2B or CT2F (lf r4 5 + blt cr5,_readcodes + lwz r11,-8(r15) #load counter + bne cr7,_clearcounter #lf previous code execution false clear counter + andi. r12,r3,0x8 #else lf clear counter bit not set increase counter + beq _increase_counter + andi. r12,r8,0x1 #else lf.. code result true clear counter + beq _clearcounter + +_increase_counter: + addi r12,r11,0x10 #else increase the counter + rlwimi r11,r12,0,12,27 #update counter + b _savecounter + +_clearcounter: + rlwinm r11,r11,0,28,11 #clear the counter +_savecounter: + stw r11,-8(r15) #save counter + b _readcodes + + +#CT2============================================================================ + +#load base adress (0): 40TYZ00N XXXXXXXX = (load/add:T) ba from [(ba/po:Y)+XXXXXXXX(+rN:Z)] + +#set base address (1): 42TYZ00N XXXXXXXX = (set/add:T) ba to (ba/po:Y)+XXXXXXXX(+rN:Z) + +#store base address (2): 440Y0000 XXXXXXXX = store base address to [(ba/po)+XXXXXXXX] +#set base address to (3): 4600XXXX 00000000 = set base address to code address+XXXXXXXX +#load pointer (4): 48TYZ00N XXXXXXXX = (load/add:T) po from [(ba/po:Y)+XXXXXXXX(+rN:Z)] + +#set pointer (5): 4ATYZ00N XXXXXXXX = (set/add:T) po to (ba/po:Y)+XXXXXXXX(+rN:Y) + +#store pointer (6): 4C0Y0000 XXXXXXXX = store pointer to [(ba/po)+XXXXXXXX] +#set pointer to (7): 4E00XXXX 00000000 = set pointer to code address+XXXXXXXX + +_ba_pointer: + bne- cr7,_readcodes + + rlwinm r9,r3,2,26,29 #r9 = extract N, makes N*4 + + rlwinm r14,r3,16,31,31 #r3 = add ba/po flag bit (Y) + cmpwi cr3,r14,0 + + cmpwi cr4,r5,4 #cr4 = compare sub code type with 4 (ba/po) + andi. r14,r5,3 #r14 = sub code type and 3 + + cmpwi cr5,r14,2 #compares sub code type and 2 + + blt- cr5,_p01 + beq- cr5,_p2 #sub code type 2 + +_p3: + extsh r4,r3 + add r4,r4,r15 #r4=XXXXXXXX+r15 (code location in memory) + b _pend + +_p01: + rlwinm. r5,r3,20,31,31 #r3 = rN use bit (Z) + beq +12 #flag is not set(=0), address = XXXXXXXX + + lwzx r9,r7,r9 #r9 = load register N + add r4,r4,r9 #flag is set (=1), address = XXXXXXXX+rN + + beq cr3,+8 #(Y) flag is not set(=0), address = XXXXXXXX (+rN) + + add r4,r12,r4 #address = XXXXXXXX (+rN) + (ba/po) + + cmpwi cr5,r14,1 + beq cr5,+8 #address = (ba/po)+XXXXXXXX(+rN) + lwz r4,0(r4) #address = [(ba/po)+XXXXXXXX(+rN)] + + rlwinm. r3,r3,12,31,31 #r5 = add/replace flag (T) + beq _pend #flag is not set (=0), (ba/po)= XXXXXXXX (+rN) + (ba/po) + bge cr4,+12 + add r4,r4,r6 #ba += XXXXXXXX (+rN) + (ba/po) + b _pend + add r4,r4,r16 #po += XXXXXXXX (+rN) + (ba/po) + b _pend + +_p2: + rlwinm. r5,r3,20,31,31 #r3 = rN use bit (Z) + beq +12 #flag is not set(=0), address = XXXXXXXX + + lwzx r9,r7,r9 #r9 = load register N + add r4,r4,r9 #flag is set (=1), address = XXXXXXXX+rN + + bge cr4,+12 + stwx r6,r12,r4 #[(ba/po)+XXXXXXXX] = base address + b _readcodes + stwx r16,r12,r4 #[(ba/po)+XXXXXXXX] = pointer + b _readcodes + +_pend: + bge cr4,+12 + mr r6,r4 #store result to base address + b _readcodes + mr r16,r4 #store result to pointer + b _readcodes + + +#CT3============================================================================ +#set repeat (0): 6000ZZZZ 0000000P = set repeat +#execute repeat (1): 62000000 0000000P = execute repeat +#return (2): 64S00000 0000000P = return (lf true/false/always) +#goto (3): 66S0XXXX 00000000 = goto (lf true/false/always) +#gosub (4): 68S0XXXX 0000000P = gosub (lf true/false/always) + +_repeat_goto: + rlwinm r9,r4,3,25,28 #r9 = extract P, makes P*8 + addi r9,r9,0x40 #offset that points to block P's + cmpwi r5,2 #compares sub code type with 2 + blt- _repeat + + rlwinm. r11,r3,10,0,1 #extract (S&3) + beq +20 #S=0, skip lf true, don't skip lf false + bgt +8 + b _b_bl_blr_nocheck #S=2/3, always skip (code exec status turned to true) + beq- cr7,_readcodes #S=1, skip lf false, don't skip lf true + b _b_bl_blr_nocheck + +_b_bl_blr: + bne- cr7,_readcodes #lf code execution set to false skip code + +_b_bl_blr_nocheck: + cmpwi r5,3 + + bgt- _bl #sub code type >=4, bl + beq+ _b #sub code type ==3, b + +_blr: + lwzx r15,r7,r9 #loads the next code address + b _readcodes + +_bl: + stwx r15,r7,r9 #stores the next code address in block P's address +_b: + extsh r4,r3 #XXXX becomes signed + rlwinm r4,r4,3,9,28 + + add r15,r15,r4 #next code address +/-=line XXXX + b _readcodes + +_repeat: + bne- cr7,_readcodes #lf code execution set to false skip code + + add r5,r7,r9 #r5 points to P address + bne- cr4,_execute_repeat #branch lf sub code type == 1 + +_set_repeat: + rlwinm r4,r3,0,16,31 #r4 = extract NNNNN + stw r15,0(r5) #store current code address to [bP's address] + stw r4,4(r5) #store NNNN to [bP's address+4] + + b _readcodes + +_execute_repeat: + lwz r9,4(r5) #load NNNN from [M+4] + cmpwi r9,0 + beq- _readcodes + subi r9,r9,1 + stw r9,4(r5) #saves (NNNN-1) to [bP's address+4] + lwz r15,0(r5) #load next code address from [bP's address] + b _readcodes + +#CT4============================================================================ +#set/add to rN(0) : 80SY000N XXXXXXXX = rN = (ba/po) + XXXXXXXX +#load rN (1) : 82UY000N XXXXXXXX = rN = [XXXXXXXX] (offset support) (U:8/16/32) +#store rN (2) : 84UYZZZN XXXXXXXX = store rN in [XXXXXXXX] (offset support) (8/16/32) + +#operation 1 (3) : 86TY000N XXXXXXXX = operation rN?XXXXXXXX ([rN]?XXXXXXXX) +#operation 2 (4) : 88TY000N 0000000M = operation rN?rM ([rN]?rM, rN?[rM], [rN]?[rM]) + +#copy1 (5) : 8AYYYYNM XXXXXXXX = copy YYYY bytes from [rN] to ([rM]+)XXXXXXXX +#copy2 (6) : 8CYYYYNM XXXXXXXX = copy YYYY bytes from ([rN]+)XXXXXX to [rM] + + +#for copy1/copy2, lf register == 0xF, base address is used. + +#of course, sub codes types 0/1, 2/3 and 4/5 can be put together lf we need more subtypes. + + +_operation_rN: + bne- cr7,_readcodes + + rlwinm r11,r3,2,26,29 #r11 = extract N, makes N*4 + add r26,r7,r11 #1st value address = rN's address + lwz r9,0(r26) #r9 = rN + + rlwinm r14,r3,12,30,31 #extracts S, U, T (3bits) + + beq- cr4,_op0 #lf sub code type = 0 + + cmpwi cr4,r5,5 + bge- cr4,_op56 #lf sub code type = 5/6 + + cmpwi cr4,r5,3 + bge- cr4,_op34 #lf sub code type = 3/4 + + cmpwi cr4,r5,1 + +_op12: #load/store + rlwinm. r5,r3,16,31,31 #+(ba/po) flag : Y + beq +8 #address = XXXXXXXX + add r4,r12,r4 + + cmpwi cr6,r14,1 + bne- cr4,_store + +_load: + bgt+ cr6,+24 + beq- cr6,+12 + + lbz r4,0(r4) #load byte at address + b _store_reg + + lhz r4,0(r4) #load halfword at address + b _store_reg + + lwz r4,0(r4) #load word at address + b _store_reg + +_store: + rlwinm r19,r3,28,20,31 #r9=r3 ror 12 (N84UYZZZ) + +_storeloop: + bgt+ cr6,+32 + beq- cr6,+16 + + stb r9,0(r4) #store byte at address + addi r4,r4,1 + b _storeloopend + + sth r9,0(r4) #store byte at address + addi r4,r4,2 + b _storeloopend + + stw r9,0(r4) #store byte at address + addi r4,r4,4 +_storeloopend: + subic. r19,r19,1 + bge _storeloop + b _readcodes + +_op0: + rlwinm. r5,r3,16,31,31 #+(ba/po) flag : Y + beq +8 #value = XXXXXXXX + add r4,r4,r12 #value = XXXXXXXX+(ba/po) + + andi. r5,r14,1 #add flag : S + beq _store_reg #add flag not set (=0), rN=value + add r4,r4,r9 #add flag set (=1), rN=rN+value + b _store_reg + +_op34: #operation 1 & 2 + rlwinm r10,r3,16,30,31 #extracts Y + + rlwinm r14,r4,2,26,29 #r14 = extract M (in r4), makes M*=4 + + add r19,r7,r14 #2nd value address = rM's address + bne cr4,+8 + subi r19,r15,4 #lf CT3, 2nd value address = XXXXXXXX's address + + lwz r4,0(r26) #1st value = rN + lwz r9,0(r19) #2nd value = rM/XXXXXXXX + + andi. r11,r10,1 #lf [] for 1st value + beq +8 + mr r26,r4 + + andi. r11,r10,2 #lf [] for 2nd value + beq +16 + mr r19,r9 + bne+ cr4,+8 + add r19,r12,r19 #lf CT3, 2nd value address = XXXXXXXX+(ba/op) + + rlwinm. r5,r3,12,28,31 #operation # flag : T + + cmpwi r5,9 + bge _op_float + +_operation_bl: + bl _operation_bl_return + +_op450: + add r4,r9,r4 #N + M + b _store_reg + +_op451: + mullw r4,r9,r4 #N * M + b _store_reg + +_op452: + or r4,r9,r4 #N | M + b _store_reg + +_op453: + and r4,r9,r4 #N & M + b _store_reg + +_op454: + xor r4,r9,r4 #N ^ M + b _store_reg + +_op455: + slw r4,r9,r4 #N << M + b _store_reg + +_op456: + srw r4,r9,r4 #N >> M + b _store_reg + +_op457: + rlwnm r4,r9,r4,0,31 #N rol M + b _store_reg + +_op458: + sraw r4,r9,r4 #N asr M + +_store_reg: + stw r4,0(r26) #Store result in rN/[rN] + b _readcodes + +_op_float: + cmpwi r5,0xA + bgt _readcodes + + lfs f2,0(r26) #f2 = load 1st value + lfs f3,0(r19) #f3 = load 2nd value + beq- _op45A + +_op459: + fadds f2,f3,f2 #N = N + M (float) + b _store_float + +_op45A: + fmuls f2,f3,f2 #N = N * M (float) + +_store_float: + stfs f2,0(r26) #Store result in rN/[rN] + b _readcodes + +_operation_bl_return: + mflr r10 + rlwinm r5,r5,3,25,28 #r5 = T*8 + add r10,r10,r5 #jumps to _op5: + r5 + + lwz r4,0(r26) #load [rN] + lwz r9,0(r19) #2nd value address = rM/XXXXXXXX + + mtlr r10 + blr + +#copy1 (5) : 8AYYYYNM XXXXXXXX = copy YYYY bytes from [rN] to ([rM]+)XXXXXXXX +#copy2 (6) : 8CYYYYNM XXXXXXXX = copy YYYY bytes from ([rN]+)XXXXXX to [rM] + +_op56: + bne- cr7,_readcodes #lf code execution set to false skip code + + rlwinm r9,r3,24,0,31 #r9=r3 ror 8 (NM8AYYYY, NM8CYYYY) + mr r14,r12 #r14=(ba/po) + bl _load_NM + + beq- cr4,+12 + add r17,r17,r4 #lf sub code type==0 then source+=XXXXXXXX + b +8 + add r9,r9,r4 #lf sub code type==1 then destination+=XXXXXXXX + + rlwinm. r4,r3,24,16,31 #Extracts YYYY, compares it with 0 + li r5,0 + + _copy_loop: + beq _readcodes #Loop until all bytes have been copied. + lbzx r10,r5,r17 + stbx r10,r5,r9 + addi r5,r5,1 + cmpw r5,r4 + b _copy_loop + + +#=============================================================================== +#This is a routine called by _memory_copy and _compare_NM_16 + +_load_NM: + cmpwi cr5,r10,4 #compare code type and 4(rn Operations) in cr5 + + rlwinm r17,r9,6,26,29 #Extracts N*4 + cmpwi r17,0x3C + lwzx r17,r7,r17 #Loads rN value in r17 + bne +8 + mr r17,r14 #lf N==0xF then source address=(ba/po)(+XXXXXXXX, CT5) + + beq cr5,+8 + lhz r17,0(r17) #...and lf CT5 then N = 16 bits at [XXXXXX+base address] + + rlwinm r9,r9,10,26,29 #Extracts M*4 + cmpwi r9,0x3C + lwzx r9,r7,r9 #Loads rM value in r9 + bne +8 + mr r9,r14 #lf M==0xF then dest address=(ba/po)(+XXXXXXXX, CT5) + + beq cr5,+8 + lhz r9,0(r9) #...and lf CT5 then M = 16 bits at [XXXXXX+base address] + + blr + +#CT5============================================================================ +#16bits conditional (0,1,2,3): A0XXXXXX NM00YYYY (unknown values) +#16bits conditional (4,5,6,7): A8XXXXXX ZZZZYYYY (counter) + +#sub codes types 0,1,2,3 compare [rN] with [rM] (both 16bits values) +#lf register == 0xF, the value at [base address+XXXXXXXX] is used. + +_compare16_NM_counter: + cmpwi r5,4 + bge _compare16_counter + +_compare16_NM: + mr r9,r4 #r9=NM00YYYY + + add r14,r3,r12 #r14 = XXXXXXXX+(ba/po) + + rlwinm r14,r14,0,0,30 #16bits align (base address+XXXXXXXX) + + bl _load_NM #r17 = N's value, r9 = M's value + + nor r4,r4,r4 #r4=!r4 + rlwinm r4,r4,0,16,31 #Extracts !YYYY + + and r11,r9,r4 #r3 = (M AND !YYYY) + and r4,r17,r4 #r4 = (N AND !YYYY) + + b _conditional + +_compare16_counter: + rlwinm r11,r3,28,16,31 #extract counter value from r3 in r11 + b _conditional + +#=============================================================================== +#execute (0) : C0000000 NNNNNNNN = execute +#hook1 (2) : C4XXXXXX NNNNNNNN = insert instructions at XXXXXX +#hook2 (3) : C6XXXXXX YYYYYYYY = branch from XXXXXX to YYYYYY +#on/off (6) : CC000000 00000000 = on/off switch +#range check (7) : CE000000 XXXXYYYY = is ba/po in XXXX0000-YYYY0000 + +_hook_execute: + mr r26,r4 #r18 = 0YYYYYYY + rlwinm r4,r4,3,0,28 #r4 = NNNNNNNN*8 = number of lines (and not number of bytes) + bne- cr4,_hook_addresscheck #lf sub code type != 0 + bne- cr7,_skip_and_align + +_execute: + mtlr r15 + blrl + +_skip_and_align: + add r15,r4,r15 + addi r15,r15,7 + rlwinm r15,r15,0,0,28 #align 64-bit + b _readcodes + +_hook_addresscheck: + + cmpwi cr4,r5,3 + bgt- cr4,_addresscheck1 #lf sub code type ==6 or 7 + lis r5,0x4800 + add r12,r3,r12 + rlwinm r12,r12,0,0,29 #align address + + bne- cr4,_hook1 #lf sub code type ==2 + +_hook2: + bne- cr7,_readcodes + + rlwinm r4,r26,0,0,29 #address &=0x01FFFFFC + + sub r4,r4,r12 #r4 = to-from + rlwimi r5,r4,0,6,29 #r5 = (r4 AND 0x03FFFFFC) OR 0x48000000 + rlwimi r5,r3,0,31,31 #restore lr bit + stw r5,0(r12) #store opcode + b _readcodes + +_hook1: + bne- cr7,_skip_and_align + + sub r9,r15,r12 #r9 = to-from + rlwimi r5,r9,0,6,29 #r5 = (r9 AND 0x03FFFFFC) OR 0x48000000 + stw r5,0(r12) #stores b at the hook place (over original instruction) + addi r12,r12,4 + add r11,r15,r4 + subi r11,r11,4 #r11 = address of the last work of the hook1 code + sub r9,r12,r11 + rlwimi r5,r9,0,6,29 #r5 = (r9 AND 0x03FFFFFC) OR 0x48000000 + stw r5,0(r11) #stores b at the last word of the hook1 code + b _skip_and_align + +_addresscheck1: + cmpwi cr4,r5,6 + beq cr4,_onoff + b _conditional +_addresscheck2: + rlwinm r12,r12,16,16,31 + rlwinm r4,r26,16,16,31 + rlwinm r26,r26,0,16,31 + cmpw r12,r4 + blt _skip + cmpw r12,r26 + bge _skip + b _readcodes + +_onoff: + rlwinm r5,r26,31,31,31 #extracts old exec status (x b a) + xori r5,r5,1 + andi. r3,r8,1 #extracts current exec status + cmpw r5,r3 + beq _onoff_end + rlwimi r26,r8,1,30,30 + xori r26,r26,2 + + rlwinm. r5,r26,31,31,31 #extracts b + beq +8 + + xori r26,r26,1 + + stw r26,-4(r15) #updates the code value in the code list + +_onoff_end: + rlwimi r8,r26,0,31,31 #current execution status = a + + b _readcodes + +#=============================================================================== +#Full terminator (0) = E0000000 XXXXXXXX = full terminator +#Endlfs/Else (1) = E2T000VV XXXXXXXX = endlfs (+else) +#End code handler = F0000000 00000000 + +_terminator_onoff_: + cmpwi r11,0 #lf code type = 0xF + beq _notTerminator + cmpwi r5,1 + beq _asmTypeba + cmpwi r5,2 + beq _asmTypepo + cmpwi r5,3 + beq _patchType + b _exitcodehandler +_asmTypeba: + rlwinm r12,r6,0,0,6 # use base address +_asmTypepo: + rlwinm r23,r4,8,24,31 # extract number of half words to XOR + rlwinm r24,r4,24,16,31 # extract XOR checksum + rlwinm r4,r4,0,24,31 # set code value to number of ASM lines only + bne cr7,_goBackToHandler #skip code if code execution is set to false + rlwinm. r25,r23,0,24,24 # check for negative number of half words + mr r26,r12 # copy ba/po address + add r26,r3,r26 # add code offset to ba/po code address + rlwinm r26,r26,0,0,29 # clear last two bits to align address to 32-bit + beq _positiveOffset # if number of half words is negative, extra setup needs to be done + extsb r23,r23 + neg r23,r23 + mulli r25,r23,2 + addi r25,r25,4 + subf r26,r25,r26 +_positiveOffset: + cmpwi r23,0 + beq _endXORLoop + li r25,0 + mtctr r23 +_XORLoop: + lhz r27,4(r26) + xor r25,r27,r25 + addi r26,r26,2 + bdnz _XORLoop +_endXORLoop: + cmpw r24,r25 + bne _goBackToHandler + b _hook_execute +_patchType: + rlwimi r8,r8,1,0,30 #r8<<1 and current execution status = old execution status + bne cr7,_exitpatch #lf code execution is set to false -> exit + rlwinm. r23,r3,22,0,1 + bgt _patchfail + blt _copytopo +_runpatch: + rlwinm r30,r3,0,24,31 + mulli r30,r30,2 + rlwinm r23,r4,0,0,15 + xoris r24,r23,0x8000 + cmpwi r24,0 + bne- _notincodehandler + ori r23,r23,0x3000 +_notincodehandler: + rlwinm r24,r4,16,0,15 + mulli r25,r30,4 + subf r24,r25,r24 +_patchloop: + li r25,0 +_patchloopnext: + mulli r26,r25,4 + lwzx r27,r15,r26 + lwzx r26,r23,r26 + addi r25,r25,1 + cmplw r23,r24 + bgt _failpatchloop + cmpw r25,r30 + bgt _foundaddress + cmpw r26,r27 + beq _patchloopnext + addi r23,r23,4 + b _patchloop +_foundaddress: + lwz r3,-8(r15) + ori r3,r3,0x300 + stw r3,-8(r15) + stw r23,-4(r15) + mr r16,r23 + b _exitpatch +_failpatchloop: + lwz r3,-8(r15) + ori r3,r3,0x100 + stw r3,-8(r15) +_patchfail: + ori r8,r8,1 #r8|=1 (execution status set to false) + b _exitpatch +_copytopo: + mr r16,r4 +_exitpatch: + rlwinm r4,r3,0,24,31 # set code to number of lines only +_goBackToHandler: + mulli r4,r4,8 + add r15,r4,r15 # skip the lines of the code + b _readcodes + +_notTerminator: + +_terminator: + bne cr4,+12 #check lf sub code type == 0 + li r8,0 #clear whole code execution status lf T=0 + b +20 + + rlwinm. r9,r3,0,27,31 #extract VV +# bne +8 #lf VV!=0 +# bne- cr7,+16 + + rlwinm r5,r3,12,31,31 #extract "else" bit + + srw r8,r8,r9 #r8>>VV, meaning endlf VV lfs + + rlwinm. r23,r8,31,31,31 + bne +8 # execution is false if code execution >>, so don't invert code status + xor r8,r8,r5 #lf 'else' is set then invert current code status + +_load_baseaddress: + rlwinm. r5,r4,0,0,15 + beq +8 + mr r6,r5 #base address = r4 + rlwinm. r5,r4,16,0,15 + beq +8 + mr r16,r5 #pointer = r4 + b _readcodes + +#=============================================================================== + +frozenvalue: #frozen value, then LR +.long 0,0 +dwordbuffer: +.long 0,0 +rem: +.long 0 +bpbuffer: +.long 0 #int address to bp on +.long 0 #data address to bp on +.long 0 #alignement check +.long 0 #counter for alignement + +regbuffer: +.space 72*4 + +.align 3 + +codelist: +.space 2*4 +.end diff --git a/cube/swiss/source/cheats/cheats.c b/cube/swiss/source/cheats/cheats.c index 393cbd0d6..ddb671366 100644 --- a/cube/swiss/source/cheats/cheats.c +++ b/cube/swiss/source/cheats/cheats.c @@ -166,7 +166,7 @@ CheatEntries* getCheats() { void kenobi_install_engine() { int isDebug = swissSettings.wiirdDebug; // If high memory is in use, we'll use low, otherwise high. - u8 *ptr = isDebug ? kenobigc_dbg_bin : kenobigc_bin; + const u8 *ptr = isDebug ? kenobigc_dbg_bin : kenobigc_bin; u32 size = isDebug ? kenobigc_dbg_bin_size : kenobigc_bin_size; print_gecko("Copying kenobi%s to %08X\r\n", (isDebug?"_dbg":""),(u32)CHEATS_ENGINE); diff --git a/cube/swiss/include/cheats.h b/cube/swiss/source/cheats/cheats.h similarity index 91% rename from cube/swiss/include/cheats.h rename to cube/swiss/source/cheats/cheats.h index e0a55e846..63fb69dcd 100644 --- a/cube/swiss/include/cheats.h +++ b/cube/swiss/source/cheats/cheats.h @@ -1,10 +1,8 @@ #ifndef __CHEATS_H #define __CHEATS_H -extern int kenobigc_bin_size; -extern u8 kenobigc_bin[]; -extern int kenobigc_dbg_bin_size; -extern u8 kenobigc_dbg_bin[]; +#include "kenobigc_bin.h" +#include "kenobigc_dbg_bin.h" #define CHEATS_MAX_SIZE(size) (WIIRD_ENGINE_SPACE-size-8) #define CHEATS_LOCATION(size) ((void*)(WIIRD_ENGINE + size - 8)) diff --git a/cube/swiss/source/cheats/kenobigc.bin b/cube/swiss/source/cheats/kenobigc.bin deleted file mode 100644 index 2cca1fe1078418afa05364895f52f3d5e1549cf7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2736 zcmeHJZ)_9i8Gp`pl1qD9J?R84ipV9nB>~qBqcA&o$K8O<#nooC*UcJjQi2mvnh25w zX;*Y-pTP`5z06_RN~5ZBgK)!^Wi8XBE<;hIF^NrR@+LI#p{n>m1)Y$RNtH0f`1X4* zun+sZ5Bo4n(eu3T`@GMe-}8H)3(?vym;HR;vHCwLrrMnE76lSb(Nl(;Gl`yul+0## z?KcHi%2)a+kg=(Ja9W|U-Um)r6M{E&I)AgDO1p36va!DFbm64tPydXZ%NI0%cGgq= z8ut5_|1q1sb4!dZ*<@C>8&RMT>!V6vdg)X9Cq$-KA?*YOp!*){QgoTbI8ib?>n(G? zzk%Oth;mQ9L%l!(XR zzDJu$cyXL4st~a^S~F~LcjnlTpIBO`BNvHXCkgSzjC9fnHxPxMB0(=vNS~qG(7k#| znA1;qlF%D;+jB#o@!f*nq?a0SuVKY1Y>-0@uscCGm#MjVc??X4om1?RpuUbR#2+RA_?9+-ia>>Oe5Nak5Vg-Ovi#AOP?gjK|3PAex zcgPPZ>gP%97fH}2>Y6@PkDR*KISzdG%lZVc zDzwY6=U9q%9-K)Z;x;j@h~DMD!tZsN`4e1r{O5hw=6YK=;XJZ4k}C~&??;;q>b7Rx&@>FKg#WW&=KT@-w0$dYN!)U*w)6AMhuArgk?9UQJ@1!#U1wYKyfS zY-rs=_M5$Ot{e3pIkX7Qat=3WMd28v7c~?)r`h0Xj)jZSi(f*Y&QVbRo!dw046s7Z z)zX?=;n-n)myLacB6;^61U_2RJ+P4`*L2^`F}w+vn>FpCvle7$Low{xGGIo|en$cPo(WI%RVK_vp&VFlayTEUugKVSueT>8HsR8&aO z3O?UeMC^pKT7ciD^xSHGsh4PJ40wZE_xAX=aJzeZ=yC=7up6-Ao-(_*(XjS!k)Pyk z#l2-dyR^mCz3lLkYE7hh+#TqJl-cIyC|aHE=H@eBkkLz)L$qDzrQl`N|nE9YpW8;02|bCl?~liA+K<(Sw0X!FBH62$-3*-(q`R0 zE@NgjrIrcy4~IFIFc-fUE5*q=3E!9@?w!Sl$)3H`Z5EVd@|3WU9Bir==QvgmBbawr ztdNmB@SL!~_o4;zSx4LD=#W#hw)U;<|B~A}Q}EviygHCmN2-uld-me5*Qc72Lb|;= zYf2T;?A21jd2p*|pHqJwxQ%)_b^+e2mIE7}xiZvC9-O&6hc5i|+fMB}@uoWN%!Quj zxC{JE@;MZMC#_vU~m}_w-UXzni(= zbS!h9Dy?57&#ox>vaeN=q4h3jT6W=EmHFITzHl7-Z~ocXg`B=l&KG9j8vlOIVb&EN z&*yj94?px`Zk)j!DX>hV+WIMZ*xR)6NY$oL0K`WB58m%0cHZ9Ds>0v1OG)m(^)={6 zE8%QUC5-rjxqeB5pO?&MR|rxzH{3+6&L`dX`3!L?HfC&J+Dk>qbIVRGv+{e+&z7}) z!QJPxn{%DdIX2L!w&cM*a3JASN6=@9|383pnH_F)@DA&i_)1r5J>ER$sJO*or>GU! Zh-P^!bbC$za4TkKwF_7O|NAc?@GpfA**yRN diff --git a/cube/swiss/source/cheats/kenobigc.s b/cube/swiss/source/cheats/kenobigc.s deleted file mode 100644 index 6fd57f570..000000000 --- a/cube/swiss/source/cheats/kenobigc.s +++ /dev/null @@ -1,183 +0,0 @@ -/* Generated by BIN2S - please don't edit directly */ - .section .rodata - .balign 4 - .global kenobigc_bin_size - .global kenobigc_bin -kenobigc_bin: - .byte 0, 0, 0, 0, 0, 0, 0, 0,129,127,233,100, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0,148, 33,255, 88,144, 1, 0, 8 - .byte 124, 8, 2,166,144, 1, 0,172,124, 0, 0, 38,144, 1, 0, 12 - .byte 124, 9, 2,166,144, 1, 0, 16,124, 1, 2,166,144, 1, 0, 20 - .byte 188, 97, 0, 24,126,128, 0,166, 98,154, 32, 0,115, 90,249,255 - .byte 127, 64, 1, 36,216, 65, 0,152,216, 97, 0,160, 63,224,129,127 - .byte 60, 96,204, 0,163,131, 64, 16, 99,149, 0,255,178,163, 64, 16 - .byte 127,168, 2,166, 61,224,129,127, 97,239,234,168, 99,231,224, 8 - .byte 60,192,128, 0,124,208, 51,120, 57, 0, 0, 0, 60, 96, 0,208 - .byte 96, 99,192,222,128,143, 0, 0,124, 3, 32, 0, 64,130, 0, 24 - .byte 128,143, 0, 4,124, 3, 32, 0, 64,130, 0, 12, 57,239, 0, 8 - .byte 72, 0, 0, 80,127,168, 3,166, 60, 96,204, 0,179,131, 64, 16 - .byte 200, 65, 0,152,200, 97, 0,160,126,128, 1, 36,128, 1, 0,172 - .byte 124, 8, 3,166,128, 1, 0, 12,124, 15,241, 32,128, 1, 0, 16 - .byte 124, 9, 3,166,128, 1, 0, 20,124, 1, 3,166,184, 97, 0, 24 - .byte 128, 1, 0, 8, 56, 33, 0,168, 76, 0, 1, 44, 78,128, 0, 32 - .byte 128,111, 0, 0,128,143, 0, 4, 57,239, 0, 8,113, 9, 0, 1 - .byte 47,137, 0, 0, 57, 32, 0, 0, 84,106, 31,126, 84,101, 63,126 - .byte 116,107, 16, 0, 84, 99, 1,254, 64,130, 0, 12, 84,204, 0, 12 - .byte 72, 0, 0, 8,126, 12,131,120, 46, 5, 0, 0, 44, 10, 0, 1 - .byte 65,160, 0, 44, 65,162, 0,228, 44, 10, 0, 3, 65,160, 1,172 - .byte 65,130, 2, 80, 44, 10, 0, 5, 65,128, 2,212, 65,162, 4,224 - .byte 44, 10, 0, 7, 65,160, 5, 12, 72, 0, 5,240,125,140, 26, 20 - .byte 44, 5, 0, 3, 65,130, 0, 72, 65,129, 0, 96, 64,190,255,132 - .byte 46, 5, 0, 1, 65,145, 0, 44, 84,138,132, 62, 65,146, 0, 16 - .byte 124,137, 97,174, 57, 41, 0, 1, 72, 0, 0, 12,124,137, 99, 46 - .byte 57, 41, 0, 2, 53, 74,255,255, 64,160,255,228, 75,255,255, 84 - .byte 85,140, 0, 58,144,140, 0, 0, 75,255,255, 72,124,137, 35,120 - .byte 64,158, 4,200, 53, 41,255,255, 65,128, 4,192,124,169,120,174 - .byte 124,169, 97,174, 75,255,255,240, 57,239, 0, 8, 64,190,255, 36 - .byte 128,175,255,248,129,111,255,252, 84,177, 4, 62, 84,170,133, 62 - .byte 84,165, 39, 62, 46,133, 0, 1, 65,150, 0, 16, 65,181, 0, 20 - .byte 124,137, 97,174, 72, 0, 0, 16,124,137, 99, 46, 72, 0, 0, 8 - .byte 124,137, 97, 46,124,132, 90, 20,125, 41,138, 20, 53, 74,255,255 - .byte 64,128,255,212, 75,255,254,220, 84,105, 7,255, 65,130, 0, 16 - .byte 85, 8,248,126,113, 9, 0, 1, 47,137, 0, 0, 46,133, 0, 4 - .byte 45,138, 0, 5, 81, 8, 8, 60, 64,158, 0,120, 65,141, 4,184 - .byte 125,140, 26, 20, 65,140, 0, 12, 65,148, 0, 48, 72, 0, 0, 28 - .byte 64,148, 0, 16, 85,140, 0, 58,129,108, 0, 0, 72, 0, 0, 28 - .byte 85,140, 0, 60,161,108, 0, 0,124,137, 32,248, 85, 41,132, 62 - .byte 125,107, 72, 56, 84,132, 4, 62,127, 11, 32, 64,112,169, 0, 3 - .byte 65,130, 0, 24, 44, 9, 0, 2, 65,130, 0, 24, 65,129, 0, 28 - .byte 64,154, 0, 32, 72, 0, 0, 24, 65,154, 0, 24, 72, 0, 0, 16 - .byte 65,153, 0, 16, 72, 0, 0, 8, 65,152, 0, 8, 97, 8, 0, 1 - .byte 64,142,254, 64, 65,148,254, 60,129,111,255,248, 64,158, 0, 32 - .byte 112,108, 0, 8, 65,130, 0, 12,113, 12, 0, 1, 65,130, 0, 16 - .byte 57,139, 0, 16, 81,139, 3, 54, 72, 0, 0, 8, 85,107, 7, 22 - .byte 145,111,255,248, 75,255,254, 12, 64,190,254, 8, 84,105, 22,186 - .byte 84,110,135,254, 45,142, 0, 0, 46, 5, 0, 4,112,174, 0, 3 - .byte 46,142, 0, 2, 65,148, 0, 20, 65,150, 0, 80,124,100, 7, 52 - .byte 124,132,122, 20, 72, 0, 0,104, 84,101,167,255, 65,130, 0, 12 - .byte 125, 39, 72, 46,124,132, 74, 20, 65,142, 0, 8,124,140, 34, 20 - .byte 46,142, 0, 1, 65,150, 0, 8,128,132, 0, 0, 84, 99,103,255 - .byte 65,130, 0, 60, 64,144, 0, 12,124,132, 50, 20, 72, 0, 0, 48 - .byte 124,132,130, 20, 72, 0, 0, 40, 84,101,167,255, 65,130, 0, 12 - .byte 125, 39, 72, 46,124,132, 74, 20, 64,144, 0, 12,124,204, 33, 46 - .byte 75,255,253,128,126, 12, 33, 46, 75,255,253,120, 64,144, 0, 12 - .byte 124,134, 35,120, 75,255,253,108,124,144, 35,120, 75,255,253,100 - .byte 84,137, 30,120, 57, 41, 0, 64, 44, 5, 0, 2, 65,128, 0, 72 - .byte 84,107, 80, 3, 65,130, 0, 20, 65,129, 0, 8, 72, 0, 0, 16 - .byte 65,190,253, 64, 72, 0, 0, 8, 64,190,253, 56, 44, 5, 0, 3 - .byte 65,129, 0, 16, 65,162, 0, 16,125,231, 72, 46, 75,255,253, 36 - .byte 125,231, 73, 46,124,100, 7, 52, 84,132, 26,120,125,239, 34, 20 - .byte 75,255,253, 16, 64,190,253, 12,124,167, 74, 20, 64,146, 0, 20 - .byte 84,100, 4, 62,145,229, 0, 0,144,133, 0, 4, 75,255,252,244 - .byte 129, 37, 0, 4, 44, 9, 0, 0, 65,162,252,232, 57, 41,255,255 - .byte 145, 37, 0, 4,129,229, 0, 0, 75,255,252,216, 64,190,252,212 - .byte 84,107, 22,186,127, 71, 90, 20,129, 58, 0, 0, 84,110,103,190 - .byte 65,146, 0,132, 46, 5, 0, 5, 64,144, 1,116, 46, 5, 0, 3 - .byte 64,144, 0,144, 46, 5, 0, 1, 84,101,135,255, 65,130, 0, 8 - .byte 124,140, 34, 20, 47, 14, 0, 1, 64,146, 0, 36, 65,185, 0, 24 - .byte 65,154, 0, 12,136,132, 0, 0, 72, 0, 0,248,160,132, 0, 0 - .byte 72, 0, 0,240,128,132, 0, 0, 72, 0, 0,232, 84,115,229, 62 - .byte 65,185, 0, 32, 65,154, 0, 16,153, 36, 0, 0, 56,132, 0, 1 - .byte 72, 0, 0, 24,177, 36, 0, 0, 56,132, 0, 2, 72, 0, 0, 12 - .byte 145, 36, 0, 0, 56,132, 0, 4, 54,115,255,255, 64,128,255,212 - .byte 75,255,252, 64, 84,101,135,255, 65,130, 0, 8,124,132, 98, 20 - .byte 113,197, 0, 1, 65,130, 0,156,124,132, 74, 20, 72, 0, 0,148 - .byte 84,106,135,190, 84,142, 22,186,126,103,114, 20, 64,146, 0, 8 - .byte 58,111,255,252,128,154, 0, 0,129, 51, 0, 0,113, 75, 0, 1 - .byte 65,130, 0, 8,124,154, 35,120,113, 75, 0, 2, 65,130, 0, 16 - .byte 125, 51, 75,120, 64,178, 0, 8,126,108,154, 20, 84,101,103, 63 - .byte 44, 5, 0, 9, 64,128, 0, 84, 72, 0, 0,121,124,137, 34, 20 - .byte 72, 0, 0, 64,124,137, 33,214, 72, 0, 0, 56,125, 36, 35,120 - .byte 72, 0, 0, 48,125, 36, 32, 56, 72, 0, 0, 40,125, 36, 34,120 - .byte 72, 0, 0, 32,125, 36, 32, 48, 72, 0, 0, 24,125, 36, 36, 48 - .byte 72, 0, 0, 16, 93, 36, 32, 62, 72, 0, 0, 8,125, 36, 38, 48 - .byte 144,154, 0, 0, 75,255,251,140, 44, 5, 0, 10, 65,129,251,132 - .byte 192, 90, 0, 0,192,115, 0, 0, 65,130, 0, 12,236, 67, 16, 42 - .byte 72, 0, 0, 8,236, 67, 0,178,208, 90, 0, 0, 75,255,251,100 - .byte 125, 72, 2,166, 84,165, 30,120,125, 74, 42, 20,128,154, 0, 0 - .byte 129, 51, 0, 0,125, 72, 3,166, 78,128, 0, 32, 64,190,251, 68 - .byte 84,105,192, 62,125,142, 99,120, 72, 0, 0, 53, 65,146, 0, 12 - .byte 126, 49, 34, 20, 72, 0, 0, 8,125, 41, 34, 20, 84,100,196, 63 - .byte 56,160, 0, 0, 65,130,251, 28,125, 69,136,174,125, 69, 73,174 - .byte 56,165, 0, 1,124, 5, 32, 0, 75,255,255,236, 46,138, 0, 4 - .byte 85, 49, 54,186, 44, 17, 0, 60,126, 39,136, 46, 64,130, 0, 8 - .byte 125,209,115,120, 65,150, 0, 8,162, 49, 0, 0, 85, 41, 86,186 - .byte 44, 9, 0, 60,125, 39, 72, 46, 64,130, 0, 8,125,201,115,120 - .byte 65,150, 0, 8,161, 41, 0, 0, 78,128, 0, 32, 44, 5, 0, 4 - .byte 64,128, 0, 40,124,137, 35,120,125,195, 98, 20, 85,206, 0, 60 - .byte 75,255,255,173,124,132, 32,248, 84,132, 4, 62,125, 43, 32, 56 - .byte 126, 36, 32, 56, 75,255,251,196, 84,107,228, 62, 75,255,251,188 - .byte 124,154, 35,120, 84,132, 24, 56, 64,146, 0, 32, 64,158, 0, 12 - .byte 125,232, 3,166, 78,128, 0, 33,125,228,122, 20, 57,239, 0, 7 - .byte 85,239, 0, 56, 75,255,250,108, 46, 5, 0, 3, 65,145, 0, 92 - .byte 60,160, 72, 0,125,131, 98, 20, 85,140, 0, 58, 64,146, 0, 32 - .byte 64,190,250, 80, 87, 68, 0, 58,124,140, 32, 80, 80,133, 1,186 - .byte 80,101, 7,254,144,172, 0, 0, 75,255,250, 56, 64,190,255,188 - .byte 125, 44,120, 80, 81, 37, 1,186,144,172, 0, 0, 57,140, 0, 4 - .byte 125,111, 34, 20, 57,107,255,252,125, 43, 96, 80, 81, 37, 1,186 - .byte 144,171, 0, 0, 75,255,255,148, 46, 5, 0, 6, 65,146, 0, 40 - .byte 75,255,251, 40, 85,140,132, 62, 87, 68,132, 62, 87, 90, 4, 62 - .byte 124, 12, 32, 0, 65,128,251,168,124, 12,208, 0, 64,128,251,160 - .byte 75,255,249,224, 87, 69,255,254,104,165, 0, 1,113, 3, 0, 1 - .byte 124, 5, 24, 0, 65,130, 0, 28, 81, 26, 15,188,107, 90, 0, 2 - .byte 87, 69,255,255, 65,130, 0, 8,107, 90, 0, 1,147, 79,255,252 - .byte 83, 72, 7,254, 75,255,249,172, 44, 11, 0, 0, 65,130, 1, 56 - .byte 44, 5, 0, 1, 65,130, 0, 24, 44, 5, 0, 2, 65,130, 0, 20 - .byte 44, 5, 0, 3, 65,130, 0,112, 75,255,249, 60, 84,204, 0, 12 - .byte 84,151, 70, 62, 84,152,196, 62, 84,132, 6, 62, 64,158, 0,252 - .byte 86,249, 6, 49,125,154, 99,120,127, 67,210, 20, 87, 90, 0, 58 - .byte 65,130, 0, 24,126,247, 7,116,126,247, 0,208, 31, 55, 0, 2 - .byte 59, 57, 0, 4,127, 89,208, 80, 44, 23, 0, 0, 65,130, 0, 28 - .byte 59, 32, 0, 0,126,233, 3,166,163,122, 0, 4,127,121,202,120 - .byte 59, 90, 0, 2, 66, 0,255,244,124, 24,200, 0, 64,130, 0,172 - .byte 75,255,254,144, 81, 8, 8, 60, 64,158, 0,156, 84,119,176, 3 - .byte 65,129, 0,136, 65,128, 0,140, 84,126, 6, 62, 31,222, 0, 2 - .byte 84,151, 0, 30,110,248,128, 0, 44, 24, 0, 0, 64,130, 0, 8 - .byte 98,247, 48, 0, 84,152,128, 30, 31, 62, 0, 4,127, 25,192, 80 - .byte 59, 32, 0, 0, 31, 89, 0, 4,127,111,208, 46,127, 87,208, 46 - .byte 59, 57, 0, 1,124, 23,192, 64, 65,129, 0, 52,124, 25,240, 0 - .byte 65,129, 0, 20,124, 26,216, 0, 65,130,255,220, 58,247, 0, 4 - .byte 75,255,255,208,128,111,255,248, 96, 99, 3, 0,144,111,255,248 - .byte 146,239,255,252,126,240,187,120, 72, 0, 0, 28,128,111,255,248 - .byte 96, 99, 1, 0,144,111,255,248, 97, 8, 0, 1, 72, 0, 0, 8 - .byte 124,144, 35,120, 84,100, 6, 62, 28,132, 0, 8,125,228,122, 20 - .byte 75,255,248,112, 64,146, 0, 12, 57, 0, 0, 0, 72, 0, 0, 20 - .byte 84,105, 6,255, 84,101,103,254,125, 8, 76, 48, 85, 23,255,255 - .byte 64,130, 0, 8,125, 8, 42,120, 84,133, 0, 31, 65,130, 0, 8 - .byte 124,166, 43,120, 84,133,128, 31, 65,130, 0, 8,124,176, 43,120 - .byte 75,255,248, 48, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - .byte 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 - - .global kenobigc_bin_end -kenobigc_bin_end: - - .align -kenobigc_bin_size: .int 2736 diff --git a/cube/swiss/source/cheats/kenobigc_dbg.bin b/cube/swiss/source/cheats/kenobigc_dbg.bin deleted file mode 100644 index a3562d71000dc3f89477cac221891b01e608fb24..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4288 zcmeHKe{5UT6+X{?PF}zphP@Tjh32Jkp`j*CTMABUocCziOoKLedud1ZLr$Hj35jUh zgw2%u>}S`7q|G`fgc72HOuL%GLRPvVh0sNj22wXwC`^cTQiVE}icYGOFd;Q<(!725 zB>}d-_s9NNBI{+g9k1>bp%2F^E7uI6GY8H}Ez?=Y2v7k=f!wbf z7y-VBc~Y2MZgVdY_O}W)(A5olCSa0~?X&x@pzW$A%Ehis4Pd{XKvYl`?e{QtZY}m! z@e*x`O@4AJ7&R#xbBc&lv|xXY$G!pouD&56{6zeu*yPke%12(lw%RS~a$ULWB)7FAqOJ{+RMkTw{IQ<1NPUq!U$!0Butt~J zNMvS6WP4}x?D^R|_EOB&Z_cx7N1k;6pLXQ+nCoOVI(15q6|9KH6k<<1^TB8;8I651 z$@V$(j}kR5w5JBLWhAqPZ^c>1L-{ir`IztKI9vZvJ}Xjj)<+6!hK3sHD2qZ{SerH2 zZIQLuD6zdZx><*fo+^dNSU;OLHqPdQIjni&?`<^~C&ZXVx#uonKCNzJBtolehaM%t zKOs_XlSN{UMaqt8p;k*<7q}*4m!`VXE~4}*64OoO_J4y2dF}*qZoS}IuG&D(-c>~S zah}_lXMp~B*8W&_T= z`!fY7bMAp&o)6$r*6hrWfOFidVzZPKo|nGUT%!&h`g0(*1f4PL?}iDjnQbHvG~pcm zW-8gxGd+TM#TXa968|NPi>V%>*z8oM zTDiqUj0eG`k|;YAhrfZ}2guEw(X&_H*lJl?%DQYmZEKx#&N+OHQFL)1yX@Rz4KsPx z0qx~*Ci>>joDyxn^O;cctTX>zla#)hW;q*g_Vt}_R?LxRrTqj6YTBAfdz*dPk!G3u z7-8tT#hI@f=e*EU_&r%`S#Mx3pC^YKhO6Eu;UTgv8{vhRU-f5g?ZfcD6TUNxe$z{S zIQ#2-Z+a}ZtTA@#-)bG=w`_MlU@h%);S3Xm{%yS9UVHHj=zDvKN7!}9(-%DMd~=2p z?$r_O;WI5op7bX0b*rtzX3i`3$L|Dwuhd%ef8}ve$IgMzFz_9;F92T$Cl|ip-6TK! zf0uX*x;#CbU#dGxbp&gBc%ehcfT+>F+a@p^KA98{m zM%6JZgE)fLOMd-eCZzR&vu^0HoCMB2>yA~xc5K{gS!&LjL>~0I9;(jbZov+-?y|W0 zvUql5Iqr}tjOpni?W? z`ENf$<-n}9Y4XDtKLo+F?w??>rWN^dlq(>XOp#qWX z8v$Ees14Ag$M`hNWBZIxAF1Hy&@;>9#?(p~eIEF_*{fS+wU1=IQ4IB7!Z!tSiFfDo z)G89eKWWG2E>}TUc&Ee^#xZtY9h>`5Z(TN;{7$``!h@$jv1<&Pb``pBofZRgS51+K8?ncMLg+MH9rSSzzr-t(TF_oF;V@bA|je|AhiylgbFYcD^qRE@h}4icp{ z5bde8eI+(n7KhC>=P@?a#?{j#CE5mMy=hksI4x35(h=(^*1eL)R9ScFN5FvLE9383 zrQuToz}1FtC2uQebM1Q#pO2&GCq5+vlnmcpm07G^Yt8l`?oC>1HZxvNG~Qv?arc$Y zo_o08mCbZ|0{!r7vw~U93!!f?@M&!bsSZD81GRjvX zx9`^A`vPz3Y_aih*Rb*MBg26cBruo4>&KOfgCy3iyMGk#NHB4CR|RUEWPH#O=XyT2 zj;OAD`zW*!j6dv@>)xjz;=aK$$_&5L#u_D%05>?t zyL#(n2zZ8bt!KOe|QBXwc=Z2O?09E*WB0Y zNBjctwHkX`UDuNd?bw1}y%=I{g*0>aBy&%YYR=|rt!o!|JZ#N3gSS0S&YhQkqZDsj ze#@EGdU9aQ);Vn9x$jwXKL{7jW6qHOX3o37?5buuh2#;U#80_5>70DeF6vITHN=`QQDgCc4rPITQ`TH!`W>#%;)Q;}?&r0eYn|6Qy|ExvoPqYBfm&;(9eH;1 zw;bcL-cn%U9?l!mqm^~H