PATCH Solution

DUAL RELAY

PATCH ARC policy/backdoor battery

FamilyPATCH Graph0.940 DifficultyHard Ring05 IDzp31_dual_relay

Prerequisites

BREATHE PHASE BURST

Unlocks

TWO PHASE WAIT

Patch choices

lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jnz | lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jg | lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jl | lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jnz | lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jg | lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jl

Accepted keysRELAY42, RELAYS7 Editable slots5 Rulenonzero

Walkthrough

The policy accepts two legitimate licenses, but a retired maintenance key still reaches the verdict and the secondary lane is damaged. Patch both paths without collapsing the policy to one key.

Preserve both legitimate routes. A patch that only makes the first sample pass can still fail because the battery also asks for the second real license and the old backdoor.

Valid Patch Combos

lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jnz
lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jg
lenfix=7 masterfix=nop bbytefix=0x41 bloadfix=r0 bguardfix=jl
lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jnz
lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jg
lenfix=7 masterfix=jnz bbytefix=0x41 bloadfix=r0 bguardfix=jl

Reject Battery

ROOT999
RELAY4
RELAY42X
AELAY42
RELAYS
RELAYS7X
AELAYS7

Editable Slot Options

lenfix: 6, 7, 8
masterfix: jz, nop, jmp, jnz
bbytefix: 0x52, 0x41, 0x54
bloadfix: r1, r0, r2
bguardfix: jz, jnz, jg, jl

Broken Listing

; DUAL RELAY: PATCH job. Two real licenses should survive, but an old
; maintenance path and a damaged secondary-key lane are both still in the
; image. The battery checks both real keys and the retired backdoor.

        len   r2
lenfix: cmp   r2, 6
        jnz   bad

; retired maintenance key path
        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   legit
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   legit
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   legit
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x54
        jnz   legit
        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x39
        jnz   legit
        mov   r7, 5
        ldb   r0, [r7]
        cmp   r0, 0x39
        jnz   legit
        mov   r7, 6
        ldb   r0, [r7]
        cmp   r0, 0x39
masterfix: jz    good

legit:
        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   tryb
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x45
        jnz   tryb
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x4C
        jnz   tryb
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x41
        jnz   tryb
        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x59
        jnz   tryb
        mov   r7, 5
        ldb   r0, [r7]
        cmp   r0, 0x34
        jnz   tryb
        mov   r7, 6
        ldb   r0, [r7]
        cmp   r0, 0x32
        jnz   tryb
        jmp   good

tryb:
        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   bad
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x45
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x4C
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
bbytefix: cmp   r0, 0x52
        jnz   bad
        mov   r7, 4
bloadfix: ldb   r1, [r7]
        cmp   r0, 0x59
        jnz   bad
        mov   r7, 5
        ldb   r0, [r7]
        cmp   r0, 0x53
        jnz   bad
        mov   r7, 6
        ldb   r0, [r7]
        cmp   r0, 0x37
bguardfix: jz    bad
        jmp   good

good:   mov   r0, 1
        ret
bad:    mov   r0, 0
        ret