forked from FIX94/Nintendont
-
Notifications
You must be signed in to change notification settings - Fork 0
/
codehandler.s
1681 lines (1292 loc) · 40.9 KB
/
codehandler.s
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
.text
.set r0,0; .set r1,1; .set r2,2; .set r3,3; .set r4,4
.set r5,5; .set r6,6; .set r7,7; .set r8,8; .set r9,9
.set r10,10; .set r11,11; .set r12,12; .set r13,13; .set r14,14
.set r15,15; .set r16,16; .set r17,17; .set r18,18; .set r19,19
.set r20,20; .set r21,21; .set r22,22; .set r23,23; .set r24,24
.set r25,25; .set r26,26; .set r27,27; .set r28,28; .set r29,29
.set r30,30; .set r31,31; .set f0,0; .set f2,2; .set f3,3
.globl _start
cheatdata:
.long frozenvalue
.space 39*4
_start:
stwu r1,-168(r1) # stores sp
stw r0,8(r1) # stores r0
mflr r0
stw r0,172(r1) # stores lr
mfcr r0
stw r0,12(r1) # stores cr
mfctr r0
stw r0,16(r1) # stores ctr
mfxer r0
stw r0,20(r1) # stores xer
stmw r3,24(r1) # saves r3-r31
mfmsr r20
ori r26,r20,0x2000 #enable floating point ?
andi. r26,r26,0xF9FF
mtmsr r26
stfd f2,152(r1) # stores f2
stfd f3,160(r1) # stores f3
lis r31,_start@h
lis r3, 0xCC00
lhz r28, 0x4010(r3)
ori r21, r28, 0xFF
sth r21, 0x4010(r3) # disable MP3 memory protection
bl _codehandler
_setvalues:
li r21,0
li r22,0x19
li r23,0xD0
lis r24,0xCD00
ori r18, r31, frozenvalue@l # read buffer just store in lowmem
lwz r0,172(r1) # loads lr
stw r0,4(r18) # stores lr
stw r21, 0x643C(r24) # exi speed up
frozen:
bl exireceivebyte
beq finish # r3 returns 1 or 0, one for byte received ok
checkcommand:
cmpwi r29, 0x04 # checks lf 8/1/32 bits write command
bge _nextcommand
cmpwi r29, 0x01
blt finish
b writedword #write value to address
_nextcommand:
beq readmem
cmpwi r29, 0x06
beq freezegame
cmpwi r29, 0x07
beq unfreezegame
cmpwi r29, 0x08
beq resumegame
cmpwi r29, 0x09
beq breakpoints #ibp
cmpwi r29, 0x10
beq breakpoints #dbp
cmpwi r29, 0x2F
beq upbpdata
cmpwi r29, 0x30
beq getbpdata
cmpwi r29, 0x38
beq cancelbreakpoints
cmpwi r29, 0x40
beq sendcheats
cmpwi r29, 0x41
beq uploadcode
cmpwi r29, 0x44
beq breakpoints #step
cmpwi r29, 0x50
beq pausestatus
cmpwi r29, 0x60
beq executecodes
cmpwi r29, 0x89
beq breakpoints #aligned dbp
cmpwi r29, 0x99
beq versionnumber
b finish
#***************************************************************************
# subroutine: getpausestatus:
# one running, two paused, three on a breakpoint
#***************************************************************************
pausestatus:
lwz r3,0(r18)
bl exisendbyte
b finish
#***************************************************************************
# subroutine: executecodes:
# executes the code handler
#***************************************************************************
executecodes:
bl _codehandler
b finish
#***************************************************************************
# subroutine: freezegame:
# Write a 1 to a memory location to freeze
#***************************************************************************
freezegame:
li r4, 1
stw r4, 0(r18)
b finish
#***************************************************************************
# subroutine: upload bp data:
# receive the dp databuffer from the PC
#***************************************************************************
upbpdata:
bl exisendbyteAA
li r16, 40*4 # 42 "registers rN" * 4
ori r12, r31, regbuffer@l
b upload
#***************************************************************************
# subroutine: getbp data:
# send the dp databuffer to the PC
#***************************************************************************
getbpdata:
li r3, 72*4 # register buffer
ori r12, r31, regbuffer@l
bl exisendbuffer # send it, less than a packet
b finish
#***************************************************************************
# subroutine: breakpoints:
# handles data/instruction address breakpoints
#***************************************************************************
breakpoints:
cmpwi cr6,r29,0x10 # 0x10 = instruction, 0x09/0x89 = data
cmpwi cr5,r29,0x44 # 0x44 = step
ori r4,r31,bphandler@l #used for writebranch (= source address)
lis r3,0x8000
ori r3,r3,0x300 # bprw 0x80000300
bl writebranch
addi r3,r3,0xA00 # trace 0x80000D00
bl writebranch
addi r3,r3,0x600 # bpx 0x80001300
bl writebranch
ori r12, r31, bpbuffer@l # read buffer just store in lowmem
stw r21,0(r12) # clears inst bp
stw r21,4(r12) # clears data bp
stw r21,8(r12) # clears alignement
ori r4, r31, regbuffer@l
lwz r9,0x18(r4)
lwz r3,0(r18)
cmpwi r3,2 # checks lf the gecko is on a breakpoint
bne +12
beq cr5,+12
b bp
li r3,0
stw r3,12(r12) # lf not, clears the previous "broken on" address
bne bp
bne cr5,bp
ori r9,r9,0x400
stw r9,0x18(r4)
b unfreezegame
bp:
rlwinm r9,r9,0,22,20
stw r9,0x18(r4)
beq cr5,finish
beq cr6,+8
addi r12,r12,4 # lf databp r12=r12+4
li r3, 4 # 4 bytes
bl exireceivebuffer
ble cr6,noalignement # lf not aligned data bp (0x89)
addi r12,r12,4
li r3, 4 # 4 bytes
bl exireceivebuffer
noalignement:
ori r4, r31, bpbuffer@l # read buffer just store in lowmem
lwz r3, 0(r4)
lwz r4, 4(r4)
mtspr 1010, r3 # set IABR
mtspr 1013, r4 # set DABR
b finish
#***************************************************************************
# subroutine: bphandler
# Data/Instruction address breakpoint handler, save context and return
#***************************************************************************
bphandler:
mtsprg 2,r1 # sprg2 = r1
mfsrr0 r1 # r1=srr0
mtsprg 3,r3 # sprg3 = r3
mfsrr1 r3
# r3=srr1
rlwinm r3,r3,0,22,20 # clear trace
stw r3,regbuffer@l+0x18(r0) # store srr1 with trace cleared in regbuffer
rlwinm r3,r3,0,24,15
ori r3,r3,0x2000
# rlwinm r3,r3,0,17,15 # clear hw interrupt
mtsrr1 r3 # restore srr1 with hw interrupt & trace cleared
lis r3,break@h
ori r3,r3,break@l
mtsrr0 r3
rfi
break:
lis r3, regbuffer@h
ori r3, r3, regbuffer@l
stw r1,0x14(r3) #stores srr0
mr r1,r3
mfsprg r3,3
stmw r2,0x24(r1) #saves r2-r31
mr r4,r1
b break_get_r1
.long 0 #this is 0x1300, so breakpoint possible
break_get_r1:
mfsprg r1,2
stw r0,0x1C(r4)
stw r1,0x20(r4)
mflr r3
stw r3, 0x9C(r4) # Store LR
mfcr r3
stw r3, 0x0(r4) # Store CR
mfxer r3
stw r3, 0x4(r4) # Store XER
mfctr r3
stw r3, 0x8(r4) # Store CTR
mfdsisr r3
stw r3, 0xC(r4) # Store DSISR
mfdar r3
stw r3, 0x10(r4) # Store DAR
li r9,0
mtspr 1010,r9 # Clear IABR
mtspr 1013,r9 # Clear DABR
lis r5,floatstore@h
ori r5,r5,floatstore@l # Set r5 to instruction address
lis r31,0xD004
ori r31,r31,0x00A0 # Set r31 to 'stfs f0,0xA0(r4)' (==0xD00400A0)
floatloop:
stw r31,0(r5)
dcbst r0,r5
sync
icbi r0,r5
isync
floatstore:
stfs f0,0xA0(r4)
addi r31,r31,4 # Advance instruction offset
addis r31,r31,0x20 # Advance instruction register
rlwinm. r16,r31,0,5,5 # Check for register > 31
beq floatloop
skip_floating_point:
lis r31,_start@h
ori r5,r31,bpbuffer@l
lwz r16,0(r5)
lwz r17,4(r5)
lwz r19,12(r5)
cmpwi r19,0
beq _redobp
cmpwi r19,2
bne +24
lwz r9,0x14(r4)
addi r9,r19,3
stw r9,0(r5)
stw r9,12(r5)
b _executebp
cmpw r16,r19
beq _step
cmpw r17,r19
beq _step
add r9,r16,r17
stw r9,12(r5)
_alignementcheck:
lwz r16,8(r5)
cmpwi r16,0
beq _executebp # no alignement = normal break
lwz r3,0x10(r4)
cmpw r16,r3 # we check lf address = aligned address
bne _step # lf no, we need to set a bp on the next instruction
li r16,0
stw r16,8(r5) # lf we are on the good address we clear the aligned bp check
b _executebp # and we break
_step:
li r17,0
stw r17,12(r5)
lwz r9,0x18(r4)
ori r9,r9,0x400
stw r9,0x18(r4)
b _skipbp #and we don't break right now
_redobp:
mtspr 1010,r16 # we set back the instbp with the original value
mtspr 1013,r17 # we set back the databp with the original value
li r9,1
stw r9,12(r5)
b _skipbp # and we don't break
_executebp:
li r5, 2
ori r4, r31, frozenvalue@l # Freeze once returned to let user know there is a breakpoint hit
stw r5, 0(r4)
li r3, 0x11
bl exisendbyte # tell the PC a bp has happened (send 0x11)
bl _start # bl mainloop, so you can set up a new breakpoint.
_skipbp:
mfmsr r1
rlwinm r1,r1,0,31,29
rlwinm r1,r1,0,17,15
mtmsr r1 # we disable the interrupt so nothing interfers with the restore
ori r1, r31, regbuffer@l
lwz r3,0x0(r1)
mtcr r3 # restores CR
lwz r3,0x14(r1)
mtsrr0 r3 # restores SRR0
lwz r3,0x18(r1)
mtsrr1 r3 # restores SRR1
lwz r3,0x9C(r1)
mtlr r3 # restores LR
lmw r2,0x24(r1) # restores r2-r31
lwz r0,0x1C(r1) # restores r0
lwz r1,0x20(r1) # restores r1
rfi # back to the game
#***************************************************************************
# subroutine: unfreezegame:
# Write a 0 to a memory location to unfreeze
#***************************************************************************
unfreezegame:
stw r21, 0(r18)
b resumegame
#***************************************************************************
# subroutine: write dword:
# Write a long word value to memory sent from PC
#***************************************************************************
writedword:
cmpwi cr5,r29,2
li r3, 8 # 8 bytes (location 4 / Value 4)
ori r12, r31, dwordbuffer@l # buffer
bl exireceivebuffer
lwz r5, 0(r12)
lwz r3, 4(r12) # read the value
stb r3, 0(r5) # write to location
blt cr5,skipp
sth r3, 0(r5) # write to location
beq cr5,skipp
stw r3, 0(r5) # write to location
skipp:
dcbf r0, r5 # data cache block flush
sync
icbi r0, r5
isync
b finish
#***************************************************************************
# subroutine: SendCheats :
# Fill memory with value
#***************************************************************************
sendcheats:
bl exisendbyteAA
li r3, 4 # 4 bytes
ori r12, r31, dwordbuffer@l # buffer
bl exireceivebuffer
lwz r16, 0(r12)
lis r12, codelist@h
ori r12, r12, codelist@l
b upload
#***************************************************************************
# subroutine: Upload :
# Fill memory with value
#***************************************************************************
uploadcode:
bl exisendbyteAA
li r3, 8 # 8 bytes
ori r12, r31, dwordbuffer@l # buffer
bl exireceivebuffer
lwz r16, 4(r12)
lwz r12, 0(r12)
upload:
ori r27, r31, rem@l # Remainder of bytes upload code
li r17,0xF80
bl _packetdivide
beq douploadremainder
nextrecpacket:
mr r3,r17
bl exireceivebuffer # r12 start = start of buffer
uploadwait:
bl exisendbyteAA
beq uploadwait
add r12,r12,r14
subic. r11, r11, 1 # decrease loop counter
bgt nextrecpacket
douploadremainder: # send the remainder bytes
lwz r3, 0(r27) # remainder
cmpwi r3,0
beq finishupload
bl exireceivebuffer
finishupload:
dcbf r0, r12 # data cache block flush
sync
icbi r0, r12 # instruction cache block flush
isync
b finish
#***************************************************************************
# subroutine: exireceivebyte:
# Return 1(r3) lf byte receive, 0(r3) lf no byte
# Command byte is stored at 0x800027ff
#***************************************************************************
exireceivebyte:
mflr r30
lis r3, 0xA000 # EXI read command
bl checkexisend
andis. r3, r16, 0x800
rlwinm r29,r16,16,24,31
mtlr r30
blr
#***************************************************************************
# subroutine: checkexisend:
#
#***************************************************************************
checkexisend:
stw r23, 0x6814(r24) # 32mhz Port B
stw r3, 0x6824(r24)
stw r22, 0x6820(r24) # 0xCC006820 (Channel 1 Control Register)
exicheckreceivewait:
lwz r5, 0x6820(r24)
andi. r5, r5, 1
bne exicheckreceivewait # while((exi_chan1cr)&1);
lwz r16, 0x6824(r24)
stw r5, 0x6814(r24)
blr
#***************************************************************************
# subroutine: exireceivebuffer:
# r3 byte counter, r12 points to buffer, r3 gets copied as gets destroyed
#***************************************************************************
exireceivebuffer:
mflr r10 # save link register
mtctr r3 # counter
li r14,0
bufferloop:
bl exicheckreceive
bl exicheckreceive
bl exireceivebyte
beq bufferloop # r3 returns 1 or 0, one for byte received ok
stbx r29, r14,r12 # store byte into buffer
addi r14, r14, 1 # increase buffer by 1
bdnz bufferloop
mtlr r10 # retore link register
blr # return to command check
#***************************************************************************
# exisendbuffer:
# r3 byte counter, r12 points to buffer, r3 gets copied as gets destroyed
#***************************************************************************
exisendbuffer:
mflr r10 # save link register
mtctr r3 # r3->counter
li r14,0
sendloop:
lbzx r3, r12,r14
bl exisendbyte
beq sendloop
addi r14, r14, 1 # increase buffer
bdnz sendloop
mtlr r10 # restore link register
blr
#***************************************************************************
# exisendbyte:12345678
# r3 byte to send, returns 1 lf sent, 0 lf fail (!!! called by breakpoint)
#***************************************************************************
exisendbyteAA:
li r3,0xAA
exisendbyte: # r3, send value
mflr r30
slwi r3, r3, 20 # (sendbyte<<20);
oris r3, r3, 0xB000 # 0xB0000000 | (OR)
li r22,0x19
li r23,0xD0
lis r24,0xCD00
bl checkexisend
extrwi. r3, r16, 1,5 # returns either 0 or 1, one for byte received ok
mtlr r30
blr
#***************************************************************************
# subroutine: exicheckrecieve:
# Return 1(r3) lf byte receive, 0(r3) lf no byte
#***************************************************************************
exicheckreceive:
mflr r30
exicheckreceive2:
lis r3, 0xD000 # EXI check status command
bl checkexisend
rlwinm. r3,r16,6,31,31 # returns either 0 or 1 for r3
beq exicheckreceive2
mtlr r30
blr
#***************************************************************************
# Readmem: (reads a memory range back to PC)
# r3 byte to send, returns 1 lf sent, 0 lf fail
#***************************************************************************
readmem:
bl exisendbyteAA
li r3, 8 # 8 bytes
ori r12, r31, dwordbuffer@l # buffer
bl exireceivebuffer
lwz r5, 4(r12)
lwz r12, 0(r12)
ori r27, r31, rem@l # place holder for remainder bytes
ori r17, r21, 0xF800 # 64K packet
sub r16, r5, r12 # memrange = (*endlocation - *startlocation)
bl _packetdivide
nextsendpacket:
bgt transfer #compares r11 and 0
lwz r17, 0(r27) # remainder
cmpwi r17,0
beq finish
transfer:
mr r3,r17 # number of bytes
bl exisendbuffer
bytewait1:
bl exicheckreceive
bl exicheckreceive
bl exireceivebyte
beq bytewait1 # r3 returns 1 or 0, one for byte received ok
cmpwi r29, 0xCC # cancel code
beq finish
cmpwi r29, 0xBB # retry code
beq transfer
cmpwi r29, 0xAA
bne bytewait1
add r12,r12,r14
subic. r11, r11, 1 # decrease loop counter
blt finish
b nextsendpacket
#***************************************************************************
# Cancel Breakpoints
# Clears instruction and data and step breakpoints
#***************************************************************************
cancelbreakpoints:
mtspr 1013, r21 # clear the DABR
mtspr 1010, r21 # clear the IABR
ori r4, r31, regbuffer@l
lwz r9,0x18(r4)
rlwinm r9,r9,0,22,20
stw r9,0x18(r4)
b finish
#***************************************************************************
# subroutine: version number
# Sends back the current gecko version number.
#***************************************************************************
versionnumber:
li r3, 0x80 #0x80 = Wii, 0x81 = NGC
bl exisendbyte
#b finish
#***************************************************************************
# Finish
# Check lf the gecko has been paused. lf no return to game
#***************************************************************************
finish:
lwz r4, 0(r18)
cmpwi r4, 0 # check to see lf we have frozen the game
bne frozen # loop around lf we have (changed to return for the bp)
resumegame:
lis r3, 0xCC00
sth r28,0x4010(r3) # restore memory protection value
lfd f2,152(r1) # loads f2
lfd f3,160(r1) # loads f3
mtmsr r20 # restore msr
lwz r0,172(r1)
mtlr r0 # restores lr
lwz r0,12(r1)
mtcr r0 # restores cr
lwz r0,16(r1)
mtctr r0 # restores ctr
lwz r0,20(r1)
mtxer r0 # restores xer
lmw r3,24(r1) # restores r3-r31
lwz r0,8(r1) # loads r0
addi r1,r1,168
isync
blr # return back to game
#***************************************************************************
# Write branch
# r3 - source (our mastercode location)
# r4 - destination (lowmem area 0x80001800 address which will branch to
#***************************************************************************
writebranch:
subf r17, r3, r4 # subtract r3 from r4 and place in r17
lis r5, 0x4800 # 0x48000000
rlwimi r5,r17,0,6,29
stw r5, 0(r3) # result in r3
dcbf r0, r3 # data cache block flush
sync
icbi r0, r3
isync
blr # return
#***************************************************************************
# Packet Divide
# Used by the down/up routines to calculate the number of packet to send
#***************************************************************************
_packetdivide:
divw. r11, r16, r17 # fullpackets = memrange / 0xF80 (r11 is full packets)
mullw r10, r11, r17
subf r10, r10, r16 # r10 holds remainder byte counter
stw r10, 0(r27) # store remainder
blr
#================================================================================
_codehandler:
mflr r29
lis r15, codelist@h
ori r15, r15, codelist@l
ori r7, r31, cheatdata@l # set pointer for storing data (before the codelist)
lis r6,0x8000 # default base address = 0x80000000 (code handler)
mr r16,r6 # default pointer =0x80000000 (code handler)
li r8,0 # code execution status set to true (code handler)
lis r3,0x00D0
ori r3,r3,0xC0DE
lwz r4,0(r15)
cmpw r3,r4
bne- _exitcodehandler
lwz r4,4(r15)
cmpw r3,r4
bne- _exitcodehandler # lf no code list skip code handler
addi r15,r15,8
b _readcodes
_exitcodehandler:
mtlr r29
blr
_readcodes:
lwz r3,0(r15) #load code address
lwz r4,4(r15) #load code value
addi r15,r15,8 #r15 points to next code
andi. r9,r8,1
cmpwi cr7,r9,0 #check code execution status in cr7. eq = true, ne = false
li r9,0 #Clears r9
rlwinm r10,r3,3,29,31 #r10 = extract code type, 3 bits
rlwinm r5,r3,7,29,31 #r5 = extract sub code type 3 bits
andis. r11,r3,0x1000 #test pointer
rlwinm r3,r3,0,7,31 #r3 = extract address in r3 (code type 0/1/2) #0x01FFFFFF
bne +12 #jump lf the pointer is used
rlwinm r12,r6,0,0,6 #lf pointer is not used, address = base address
b +8
mr r12,r16 #lf pointer is used, address = pointer
cmpwi cr4,r5,0 #compares sub code type with 0 in cr4
cmpwi r10,1
blt+ _write #code type 0 : write
beq+ _conditional #code type 1 : conditional
cmpwi r10,3
blt+ _ba_pointer #Code type 2 : base address operation
beq- _repeat_goto #Code type 3 : Repeat & goto
cmpwi r10,5
b _readcodes_1808
#this is 0x1800 here so gameid is expected
gameid: .long 0,0
_readcodes_1808:
blt- _operation_rN #Code type 4 : rN Operation
beq+ _compare16_NM_counter #Code type 5 : compare [rN] with [rM]
cmpwi r10,7
blt+ _hook_execute #Code type 6 : hook, execute code
b _terminator_onoff_ #code type 7 : End of code list
#CT0=============================================================================
#write 8bits (0): 00XXXXXX YYYY00ZZ
#write 16bits (1): 02XXXXXX YYYYZZZZ
#write 32bits (2): 04XXXXXX ZZZZZZZZ
#string code (3): 06XXXXXX YYYYYYYY, d1d1d1d1 d2d2d2d2, d3d3d3d3 ....
#Serial Code (4): 08XXXXXX YYYYYYYY TNNNZZZZ VVVVVVVV
_write:
add r12,r12,r3 #address = (ba/po)+(XXXXXX)
cmpwi r5,3
beq- _write_string #r5 == 3, goto string code
bgt- _write_serial #r5 >= 4, goto serial code
bne- cr7,_readcodes #lf code execution set to false skip code
cmpwi cr4,r5,1 #compares sub code type and 1 in cr4
bgt- cr4,_write32 #lf sub code type == 2, goto write32
#lf sub code type = 0 or 1 (8/16bits)
rlwinm r10,r4,16,16,31 #r10 = extract number of times to write (16bits value)
_write816:
beq cr4,+16 #lf r5 = 1 then 16 bits write
stbx r4,r9,r12 #write byte
addi r9,r9,1
b +12
sthx r4,r9,r12 #write halfword
addi r9,r9,2
subic. r10,r10,1 #number of times to write -1
bge- _write816
b _readcodes
_write32:
rlwinm r12,r12,0,0,29 #32bits align adress
stw r4,0(r12) #write word to address
b _readcodes
_write_string: #endianess ?
mr r9,r4
bne- cr7,_skip_and_align #lf code execution is false, skip string code data
_stb:
subic. r9,r9,1 #r9 -= 1 (and compares r9 with 0)
blt- _skip_and_align #lf r9 < 0 then exit
lbzx r5,r9,r15
stbx r5,r9,r12 #loop until all the data has been written
b _stb
_write_serial:
addi r15,r15,8 #r15 points to the code after the serial code
bne- cr7,_readcodes #lf code execution is false, skip serial code
lwz r5,-8(r15) #load TNNNZZZZ
lwz r11,-4(r15) #r11 = load VVVVVVVV
rlwinm r17,r5,0,16,31 #r17 = ZZZZ
rlwinm r10,r5,16,20,31 #r10 = NNN (# of times to write -1)
rlwinm r5,r5,4,28,31 #r5 = T (0:8bits/1:16bits/2:32bits)
_loop_serial:
cmpwi cr5,r5,1
beq- cr5,+16 #lf 16bits
bgt+ cr5,+20 #lf 32bits
stbx r4,r9,r12 #write serial byte (CT04,T=0)
b +16
sthx r4,r9,r12 #write serial halfword (CT04,T=1)
b +8
stwx r4,r9,r12 #write serial word (CT04,T>=2)
add r4,r4,r11 #value +=VVVVVVVV
add r9,r9,r17 #address +=ZZZZ
subic. r10,r10,1
bge+ _loop_serial #loop until all the data has been written
b _readcodes
#CT1=============================================================================
#32bits conditional (0,1,2,3): 20XXXXXX YYYYYYYY
#16bits conditional (4,5,6,7): 28XXXXXX ZZZZYYYY
#PS : 31 bit of address = endlf.
_conditional:
rlwinm. r9,r3,0,31,31 #r10 = (bit31 & 1) (endlf enabled?)
beq +16 #jump lf endlf is not enabled
rlwinm r8,r8,31,1,31 #Endlf (r8>>1)
andi. r9,r8,1 #r9=code execution status
cmpwi cr7,r9,0 #check code execution status in cr7
cmpwi cr5,r5,4 #compares sub code type and 4 in cr5
cmpwi cr3,r10,5 #compares code type and 5 in cr3
rlwimi r8,r8,1,0,30 #r8<<1 and current execution status = old execution status
bne- cr7,_true_end #lf code execution is set to false -> exit
bgt cr3,_addresscheck2 #lf code type==6 -> address check
add r12,r12,r3 #address = (ba/po)+(XXXXXX)
blt cr3,+12 #jump lf code type <5 (==1)
blt cr5,_condition_sub #compare [rN][rM]
b _conditional16_2 #counter compare
bge cr5,_conditional16 #lf sub code type>=4 -> 16 bits conditional
_conditional32:
rlwinm r12,r12,0,0,29 #32bits align
lwz r11,0(r12)
b _condition_sub
_conditional16:
rlwinm r12,r12,0,0,30 #16bits align
lhz r11,0(r12)
_conditional16_2:
nor r9,r4,r4
rlwinm r9,r9,16,16,31 #r9 = extract mask
and r11,r11,r9 #r11 &= r9
rlwinm r4,r4,0,16,31 #r4 = extract data to check against
_condition_sub:
cmpl cr6,r11,r4 #Unsigned compare. r11=data at address, r4=YYYYYYYY
andi. r9,r5,3
beq _skip_NE #lf sub code (type & 3) == 0
cmpwi r9,2
beq _skip_LE #lf sub code (type & 3) == 2
bgt _skip_GE #lf sub code (type & 3) == 3
_skip_EQ:#1
bne- cr6,_true_end #CT21, CT25, CT29 or CT2D (lf !=)
b _skip
_skip_NE:#0
beq- cr6,_true_end #CT20, CT24, CT28 or CT2C (lf==)
b _skip
_skip_LE:#2
bgt- cr6,_true_end #CT22, CT26, CT2A or CT2E (lf r4>[])
b _skip
_skip_GE:#3
blt- cr6,_true_end #CT23, CT27, CT2B or CT2F (lf r4<r4)
_skip:
ori r8,r8,1 #r8|=1 (execution status set to false)
_true_end:
bne+ cr3,_readcodes #lf code type <> 5
blt cr5,_readcodes
lwz r11,-8(r15) #load counter
bne cr7,_clearcounter #lf previous code execution false clear counter