PATCH Solution

BYPASS STAGE

PATCH bypass removal

In-game screenshot of BYPASS STAGE
In-game view
FamilyPATCH Graph0.175 DifficultyEasy Ring01 IDzp4_bypass

Prerequisites

Index Offset

Unlocks

SPLITTER

Patch choices stage5=nop
Accepted keysLOCK5 Editable slots1 Rulenonzero

Walkthrough

A late-stage check exists, but a jump skips it. Only the marked opcode can move. Re-enable the stage so the right key passes and nearby keys fail.

The first four bytes are already guarded. The fifth-byte check is below the marked jump. Removing the bypass forces the program to test it.

Valid Patch Combos

  • stage5=nop

Reject Battery

  • LOCK4
  • LOCKX
  • LOCK
  • LOCK55
  • AAAAA

Editable Slot Options

  • stage5: jmp, nop
Broken Listing 
; BYPASS STAGE: PATCH job. The fifth-byte stage is present but skipped.
; Only the marked opcode is editable.
;
; The real key is LOCK5. The shipped jump goes straight to the verdict after
; LOCK, which lets LOCK4 and LOCKX through. Turn the bypass into a real stage.

        len   r2
        cmp   r2, 5
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x4C
        jnz   bad
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x43
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x4B
        jnz   bad

stage5: jmp   good
        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x35
        jnz   bad

good:   mov   r0, 1
        ret
bad:    mov   r0, 0
        ret