PATCH Solution

CROSSWIRE

PATCH register mix-up

In-game screenshot of CROSSWIRE
In-game view
FamilyPATCH Graph0.482 DifficultyHard Ring03 IDzp42_crosswire

Prerequisites

PEAK HOLD

Unlocks

CLOCK AND LEVEL

Patch choices wire1=r0 wire2=r0
Accepted keysWIRED Editable slots2 Rulenonzero

Walkthrough

Two byte checks load into a register the compare never reads, so they grade a leftover value instead of the real byte. Only the two marked loader destinations can move. Route both loaders into the register the compares actually consume, then TEST.

Trace which register each cmp reads, then look at the loader feeding it. A load that drops the byte into a scratch register leaves the compare grading whatever the previous position left behind.

Valid Patch Combos

  • wire1=r0 wire2=r0

Reject Battery

  • WIRES
  • WARED
  • XIRED
  • WIRE
  • WIREDD

Editable Slot Options

  • wire1: r3, r0, r1, r2
  • wire2: r4, r0, r1, r2
Broken Listing 
; CROSSWIRE: a PATCH job. Each byte check is supposed to load the input byte into
; r0 and compare r0 against the target. Two of the loaders are crosswired: they
; drop their byte into a scratch register the compare never reads, so those two
; positions compare a STALE r0 left over from the byte before. Only the two marked
; loader destinations (labels "wire1" and "wire2") are yours to edit; every cmp,
; every target, and the verdict are frozen.
;
; The real key is WIRED. Positions 1 and 3 load into the wrong register, so route
; both loaders back into the register the compare actually consumes.
;
; r0 = 1 on accept; rule: nonzero. SHIPPED loaders write r3 and r4, which the
; following compares ignore, so the real key is bounced.

        len   r2
        cmp   r2, 5
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x57      ; 'W'
        jnz   bad

        mov   r7, 1
wire1:  ldb   r3, [r7]      ; SHIPPED BROKEN: lands in r3, cmp below reads r0
        cmp   r0, 0x49      ; 'I'
        jnz   bad

        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x52      ; 'R'
        jnz   bad

        mov   r7, 3
wire2:  ldb   r4, [r7]      ; SHIPPED BROKEN: lands in r4, cmp below reads r0
        cmp   r0, 0x45      ; 'E'
        jnz   bad

        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x44      ; 'D'
        jnz   bad

        mov   r0, 1
        ret
bad:    mov   r0, 0
        ret