Re: PokéWTrainer freeze
Posted by: ISSOtm
Date: 2016-11-21 10:36:48
Also, that it not a chain of rst 38's. It's just that there is this :
ROM0:0038 rst 38 FFROM0:0000 FF rst 38
ROM0:0001 00 nop
ROM0:0002 00 nop
ROM0:0003 00 nop
ROM0:0004 00 nop
ROM0:0005 00 nop
ROM0:0006 00 nop
ROM0:0007 00 nop
ROM0:0008 FF rst 38
ROM0:0009 00 nop
ROM0:000A 00 nop
ROM0:000B 00 nop
ROM0:000C 00 nop
ROM0:000D 00 nop
ROM0:000E 00 nop
ROM0:000F 00 nop
ROM0:0010 FF rst 38
ROM0:0011 00 nop
ROM0:0012 00 nop
ROM0:0013 00 nop
ROM0:0014 00 nop
ROM0:0015 00 nop
ROM0:0016 00 nop
ROM0:0017 00 nop
ROM0:0018 FF rst 38
ROM0:0019 00 nop
ROM0:001A 00 nop
ROM0:001B 00 nop
ROM0:001C 00 nop
ROM0:001D 00 nop
ROM0:001E 00 nop
ROM0:001F 00 nop
ROM0:0020 FF rst 38
ROM0:0021 00 nop
ROM0:0022 00 nop
ROM0:0023 00 nop
ROM0:0024 00 nop
ROM0:0025 00 nop
ROM0:0026 00 nop
ROM0:0027 00 nop
ROM0:0028 FF rst 38
ROM0:0029 00 nop
ROM0:002A 00 nop
ROM0:002B 00 nop
ROM0:002C 00 nop
ROM0:002D 00 nop
ROM0:002E 00 nop
ROM0:002F 00 nop
ROM0:0030 FF rst 38
ROM0:0031 00 nop
ROM0:0032 00 nop
ROM0:0033 00 nop
ROM0:0034 00 nop
ROM0:0035 00 nop
ROM0:0036 00 nop
ROM0:0037 00 nop
ROM0:0038 FF rst 38
ROM0:0039 00 nop
ROM0:003A 00 nop
ROM0:003B 00 nop
ROM0:003C 00 nop
ROM0:003D 00 nop
ROM0:003E 00 nop
ROM0:003F 00 nop
Not that any of the others MATTER, it's just I like to be accurate :P
Also, just a C9 doesn't do jack, as, like you said,Now, all writable memory is conquered. And read-only memory has been reduced to silence, since the 0039s have infinite powers and have the CPU all for themselves.
Nah, you didn't understand me. Imagine all of these rst 38h actually ARE one-byte call $0038. Okay ? So there's no chain of them, because none of them return x). I'm going to translate this into Python, since you seem unfamiliar with asm :
def func_0000():
func_0038()
# NOP sled into func_0008, but that doesn't matter since func_0038 NEVER returns.
# Assume code execution slides while ignoring "def" lines until it finds a return, instead of implicitly reading a "return" at the end of the func.
def func_0008():
func_0038():
def func_0010():
func_0038():
def func_0018():
func_0038()
def func_0020():
func_0038()
def func_0028():
func_0038()
def func_0030():
func_0038():
def func_0038():
func_0038()
calling either of these functions will result in a RecursionError ; this is pretty much what happens here, but instead of triggering an error, the stack overwrites all writable memory (as I described).
What I suggested was to replace all these 6 "call 0038" into 6 "ret" (basically making a ROM hack, y'see ?), therefore neutering all these infinite loops. In "Python" :
def func_0000():
return
def func_0008():
return
def func_0010():
return
def func_0018():
return
def func_0020():
return
def func_0028():
return
def func_0030():
return
def func_0038():
return
Basically making all rst's some (longer) NOPs, taking I'd say roughly the time 4 NOPs take to execute.