PATCH Solution

LENGTH RECEIPT

PATCH length gate patch

In-game screenshot of LENGTH RECEIPT
In-game view
FamilyPATCH Graph0.153 DifficultyEasy Ring01 IDzp3_length

Prerequisites

DUTY

Unlocks

Mirror Image

Patch choices gate=5
Accepted keysTRACE Editable slots1 Rulenonzero

Walkthrough

The receipt checker has the right byte tests but the wrong length gate. Only the marked immediate can move. Set the gate to the real key length.

Read the byte checks after the length guard. The program asks for five positions, so a four-byte length gate turns away the real receipt before the content check can run.

Valid Patch Combos

  • gate=5

Reject Battery

  • TRAC
  • TRACEX
  • TRICE
  • SPACE

Editable Slot Options

  • gate: 4, 5, 6
Broken Listing 
; LENGTH RECEIPT: PATCH job. The length gate is one byte short.
; Only the marked length immediate is editable.
;
; The real key is TRACE. The shipped gate checks for length 4, so the check never
; reaches a valid five-byte receipt.

        len   r2
gate:   cmp   r2, 4
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x54
        jnz   bad
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x41
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x43
        jnz   bad
        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x45
        jnz   bad

        mov   r0, 1
        ret
bad:    mov   r0, 0
        ret