PATCH Solution

MASK WRONG

PATCH xor mask patch

In-game screenshot of MASK WRONG
In-game view
FamilyPATCH Graph0.169 DifficultyEasy Ring01 IDzp2_mask

Prerequisites

RAMP

Unlocks

Const GateOne Compare

Patch choices mask=0x22
Accepted keysNODE Editable slots1 Rulenonzero

Walkthrough

The first-byte decoder uses the wrong xor mask. Only the marked immediate can move. Recover the mask that lets the real key through without opening the decoys.

Work backward from the compare target. The byte in the key, xor the mask, must equal the stored target. A mask that makes a decoy pass will fail the battery.

Valid Patch Combos

  • mask=0x22

Reject Battery

  • }ODE
  • _ODE
  • (ODE
  • NOPE
  • NOD
  • NODEX

Editable Slot Options

  • mask: 0x11, 0x22, 0x33, 0x44
Broken Listing 
; MASK WRONG: PATCH job. The first byte is decoded with the wrong xor mask.
; Only the marked immediate is editable. The verdict block is frozen, so the fix
; is to recover the mask that lets NODE pass without letting the decoys through.
;
; The real key is NODE. The first byte check stores the encoded target 0x6C,
; which is 'N' xor 0x22. The shipped mask 0x11 accepts a different first byte.

        len   r2
        cmp   r2, 4
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
mask:   xor   r0, 0x11
        cmp   r0, 0x6C
        jnz   bad

        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x44
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x45
        jnz   bad

        mov   r0, 1
        ret
bad:    mov   r0, 0
        ret