F2-F4 (Insert ASM with 16bit XOR Check)[Clay10]

The basic use of the F2 codetype is to make a check-sum before an ASM code replaces instructions. If the check-sum is correct, it will replace the ASM at the address with the new ASM. If not, it will not replace any instructions.

According to the codetypes doc, the F2 code will xor YY 16-bit values before or after the address. If the resulting number is equal to ZZZZ, the code will execute NN lines of ASM.


For this tutorial, I will be using a code by DeathAndBack,


Infinite Ammo [DeathAndBack/Various Creators]

F259964C 04048C02

380003E7 94050008

60000000 00000000

--

First, open up gecko.net and head to memory viewer. There, go to your ASM address. In this case I will use 0x8059964C.

The instruction at 0x8059964C is lwzu r0,8(r5), which stands for "load word zero updated". This is not what we will be focusing on, though. In DeathAndBack's infinite ammo code, it states that 0x04 16-bit values after 0x8059964C are xor'd together, and if the result equals 0x048C, 0x02 lines of ASM are inserted into the address 0x8059964C. There are four 16-bit values after 0x8059964C xor'd together. Now, there are two 16-bit values in each address. All you have to do is open up windows calculator, and use the xor function. (in windows 7, switch the view to "programmer". Note, remember to switch to hex mode.)


In DeathAndBack's code, he specifies that 0x04 16-bit values after 0x8059964C are xor'd together.

Highlighted in blue is our address, and in the red boxes are the values we will xor together.

Here I am xoring 0x9086 and 0x4 in windows calculator. The result is 0x9082. Now, that's only two 16-bit values after our address. Next, we xor our result from the first two 16-bits with our 3rd 16-bit, 0x9406. The result is 0x0484. Three down, one 16-bit value to go. We xor our last result with our last 16-bit value, 0x8. Our final value is 0x048C, which also equals the ZZZZ in our original code.

The rest functions exactly as a C2 code. NN = number of lines of ASM. But we're not done yet. What is the F4 codetype? The exact same thing as the F2 codetype, but it will use a pointer offset. That pretty much covers the F2/F4 codetypes!