Some RAM questions - Page 2 - GSM-Forum

lalo.lerry · 05-02-2005, 03:29

hello Student,
sorry if I cannot answer you in a more detailed way, but really I've no time and to answer properly I should look into CDR patch and asm code, any maybe check some RAM locations.

44e6fc: E6FE2600 DABA77BB
1ABB77: FFFF 8880
1ABB79: FFFFFFFF D7403200 ; extp #32h, #1
1ABB7D: FFFFFFFF F2F81B03 ; mov r8, 31bh ;error1
1ABB81: FFFFFFFF 46F85200 ; cmp r8, #82
1ABB85: FFFF 3D04 ; jmpr cc_NZ, 11
1ABB87: FFFFFFFF E6FC3a00 ; mov r12, #3a
1ABB8B: FFFFFFFF DAC3B600 ; calls 0C3h, loc_C300B6 (play tone)
1ABB8F: FFFFFFFF D7403200 ; extp #32h, #1 ;error2
1ABB93: FFFFFFFF F6F81B03 ; mov 31bh, r8
1ABB97: FFFFFFFF E6FE2600
1ABB9B: FFFF 9880 ;note
1ABB9D: FFFF DB00
What's wrong prof?

1.If you want to compare only a byte, use movb command (andchange to byte all following commands).
oterhwise the answer of your cmp will be always NZ
2.you don't need to store back r8 value to 32:031B
morover, since r8 in call c30086 may be changed (and it's very probably that is changed), if you save r8 to RAM location you change it value.
3.I prefer to end my patch routine and than write back the original datas.
So wrtie that mov r14,#26h AFTER command mov r8, [+r0]

How come we have to use the low byte in the RAM loc above to compare the Postcode data? why cant we use the whole word?
check AAA (own ringtone for each Addressbook contact) and incoming call icon patches to know the answer (but they asm is not so easy to read out, I know)

rizapn · 05-02-2005, 05:11

@charlie:
C166 code (not byte data), must be started in the even address. So, you can not use 0x1ABB77 as your starting point ...

charlielao · 05-02-2005, 05:48

@Master Riza:
Thanks for the info. Do you know the RAM loc for Postcode data of incoming sms sender (like in incoming call -> 000C:326C) because that RAM loc for postcode is used only after you have opened the sms sent, not while it is still incoming.
@Master Riza and Prof Lalo:
This patch works:
23022A: E6FC3500 DAC7DEED ; mov r12, #35h <- sms-sound (from active profile)
27EDDE: FFFF 8820
27EDE0: FFFFFFFF D7403200 ; extp #32h, #1
27EDE4: FFFFFFFF F3F41C03 ; movb rl2, 031Ch
27EDE8: FFFFFFFF 47F48800 ; cmpb rl2, #88h
27EDEC: FFFF 2D04 ; jmpr cc_Z, 11
27EDEE: FFFF 9820
27EDF0: FFFFFFFF E6FC3500
27EDF4: FFFF DB00
27EDF6: FFFF 9820
27EDF8: FFFFFFFF E6FC3700
27EDFC: FFFF DB00
I tested it by using play CB-sound (from active profile) if ram loc (0032:031C) is = to 88. 88 is last 2 digits of incoming sms sender. Now my problem is i dont know how to make it use the last 7 digits of incoming sms sender number, or better yet, use postcode data of sms sender.

charlielao · 05-04-2005, 00:32

@Master Riza:
I got thisfrom one of your files:
<<<<<<<<<<<< ADDRESSBOOK >>>>>>>>>>>>>
checkAddrBook() : 0xA0EC0A
checkAddrBook2() : 0xA0EF0C
checkAddrBookOK() : 0xA0F252
0xA0EF0C : DA A0 0A EC -> DA C7 60 DA
AddressBookEdit?() : 0x341268
AddressBookFileName() : 0xA0E6D6
can i use them for the sms sender number tests? to be able to get the postcode data in the addressbook?

rizapn · 05-04-2005, 06:21

@charlie:
- About the document(s). I don't know. You can test it, but I don't know what is the exact result. Some documents and notes is "very old". All are based on my (some times incomplete and unsuccessfull) experiment ...

charlielao · 05-04-2005, 07:08

Thanks Master Riza. For this data from debugger:
09196262888:<-sender number
0C8300: 01 03 01 07 91 36 19 08 00 30 17 00 14 04 0C 00
0C8310: 00 00 01 14 04 0C 91 36 19 69 62 82 88 00 00 50
is there a way to "get" the number and then compare it to the Addressbook and then the Postcode data? I am trying to "make" a patch to assign sms tone to individual numbers

rizapn · 05-04-2005, 07:33

Sorry, but I have no idea yet ...

charlielao · 05-04-2005, 09:47

@Prof Lalo or Master Riza:
If i extp #32h,#4 and movb rl1=318h rl2=319h rl3=31Ah rl4=31Bh rl5=31Ch from this -> 0C8310: 00 00 01 14 04 0C 91 36 19 69 62 82 88 00 00 50
what command do i use so that i can store rl1 to rl5 in r8? i want to make r8=9196262888

charlielao · 05-07-2005, 03:56

i made this stupid patch:
23022A: E6FC3500 DAC7B0D8
27D8B0: FFFFFFFF DAB87085 ;start
27D8B4: FFFFFFFF 47F48700 ; cmpb rl2, #87h
27D8B8: FFFF 3D09 ; jmpr cc_NZ, 21
27D8BA: FFFFFFFF 47F60900 ; cmpb rl3, #09h
27D8BE: FFFF 3D06 ; jmpr cc_NZ, 15
27D8C0: FFFFFFFF 47F88000 ; cmpb rl4, #80h
27D8C4: FFFF 3D03 ; jmpr cc_NZ, 9
27D8C6: FFFFFFFF 47FA4600 ; cmpb rl5, #46h
27D8CA: FFFF 2D10 ; jmpr cc_Z, 35
27D8CC: FFFFFFFF 47F49000 ; cmpb rl2, #90h
27D8D0: FFFF 3D09
27D8D2: FFFFFFFF 47F66200 ; cmpb rl3, #62h
27D8D6: FFFF 3D06
27D8D8: FFFFFFFF 47F80800 ; cmpb rl4, #08h
27D8DC: FFFF 3D03
27D8DE: FFFFFFFF 47FA7000 ; cmpb rl5, #70h
27D8E2: FFFF 2D04
27D8E4: FFFFFFFF DAE074D2; GO TO TEST FOR 0Ch
27D8E8: FFFFFFFF FAC7B6D6 ;end
27D8EC: FFFFFFFF E6FC3700 ; CB tone
27D8F0: FFFFFFFF FAC7B6D6 ;end
;start
188570: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 8820883088408850D7703200F3F41903
188580: FFFFFFFFFFFFFFFFFFFFFFFFFFFF F3F61A03F3F81B03F3FA1C03DB00
;end
27D6B6: FFFFFFFFFFFFFFFFFFFF 9820983098409850DB00
;TEST for #0Ch, from SMS tone
40D274: FFFFFFFF E6FC3500 ; SMS tone
40D278: FFFF 8860
40D27A: FFFFFFFF D7403200 ; extp #32h, #1
40D27E: FFFFFFFF F3FC0E03 ; movb rl6, 30Eh
40D282: FFFFFFFF 47FC0C00 ; cmpb rl6, #0Ch
40D286: FFFF 2D02 ; jmpr cc_Z, 7
40D288: FFFFFFFF E6FC3900 ; Da Dit 2x tone
40D28C: FFFF 9860
40D28E: FFFF DB00
It makes the sms alert sound same as CB tone for the 2 NUMBERS ONLY(above), and if the sms sender is from network, the sms alert sound is Da Dit (39h). My problem is i want to make some more sms sender numbers with CB sound as sms alert, and the only way i know to do it is to add/change the patch again everytime i add a number (because im stupid

) I want to ask how to use eeprom, just like the mini gps patch of DeadMan, so that if i want to add a sms sender number info, i will just have to use a text file in the MMC, like sms.txt for example, just like ci.txt of DeadMan's mini gps.
Maybe after getting the sms sender number (which is easy), then compare it to a txt file in MMC directly (which is very difficult for me). if the sms sender number is not in the txt file, then normal sms alert sound is used, if it is in the txt file, use CB alert sound or any other sound. It would save a lot of bytes, instead of the patch i made above.

cyperghost · 05-07-2005, 20:23

Quote:

because im stupid

Indeed you're not

Maybe someone else graps your idea ... ask DeadmanS, he made "loadable ringtone patch" and also gets some inspiration in making a "Loadable SMS tone Patch" maybe some of the stuff is on ice

charlielao · 05-09-2005, 00:53

Thanks cyper

Hopefully DeadMan isnt so busy so he can read this thread nad give some ideas. The best way, IMHO, is to make txt file for individual sms tones. Example: sms1.txt would contain group of contacts with Standard#1 tone, sms2.txt for Standard#2 tone, etc. When a there's an incoming sms, SL45 would check these txt files for jumper and play the corresponding sms tones. If the incoming number isnt in one of these txt files, then it would play the normal sms tone.

charlielao · 05-11-2005, 04:50

@Prof Lalo:
i diassembled deadmans' SNC patch and this is what he did:
40D000: 88 E0 : mov [-r0], r14
40D002: 88 D0 : mov [-r0], r13
40D004: 88 C0 : mov [-r0], r12
40D006: 88 B0 : mov [-r0], r11
40D008: 88 70 : mov [-r0], r7
40D00A: 88 60 : mov [-r0], r6
40D00C: E6 FC 08 00 : mov r12, #8 <-x
40D010: E6 FD 07 00 : mov r13, #7 <-y
40D014: E6 FB 04 00 : mov r11, #4 <-width digit picture+distance before
40D018: E6 F7 81 1D : mov r7, #1D81h ( 39D81) <-loc 1st word OpCode
40D01C: D7 40 0E 00 : extp #0Eh, #1
40D020: A9 C7 : movb rl6, [r7]
40D022: E1 0D : movb rh6, #0 <- why?
40D024: 88 60 : mov [-r0], r6
40D026: 67 FC 0F 00 : andb rl6, #0Fh <- ???
40D02A: BB 29 : callr loc_40D07E
40D02C: BB 32 : callr loc_40D092
40D02E: 98 60 : mov r6, [r0+]
40D030: 67 FC F0 00 : andb rl6, #0F0h <- ???
40D034: 3C 46 : ror r6, #4 <- to change r6=15 to r6=51?
40D036: BB 23 : callr loc_40D07E
40D038: BB 2C : callr loc_40D092
40D03A: D7 40 0E 00 : extp #0Eh, #1
40D03E: F4 C7 01 00 : movb rl6, [r7+#1]
40D042: E1 0D : movb rh6, #0
40D044: 67 FC 0F 00 : andb rl6, #0Fh
40D048: BB 1A : callr loc_40D07E
40D04A: BB 23 : callr loc_40D092
40D04C: D7 40 0E 00 : extp #0Eh, #1
40D050: F4 C7 02 00 : movb rl6, [r7+#2]
40D054: E1 0D : movb rh6, #0
40D056: 88 60 : mov [-r0], r6
40D058: 67 FC 0F 00 : andb rl6, #0Fh
40D05C: BB 10 : callr loc_40D07E
40D05E: BB 19 : callr loc_40D092
40D060: 98 60 : mov r6, [r0+]
40D062: 67 FC F0 00 : andb rl6, #0F0h
40D066: 3C 46 : ror r6, #4
40D068: BB 0A : callr loc_40D07E
40D06A: BB 13 : callr loc_40D092
40D06C: 98 60 : mov r6, [r0+]
40D06E: 98 70 : mov r7, [r0+]
40D070: 98 B0 : mov r11, [r0+]
40D072: 98 C0 : mov r12, [r0+]
40D074: 98 D0 : mov r13, [r0+]
40D076: 98 E0 : mov r14, [r0+]
40D078: E0 0C : mov r12, #0
40D07A: E0 0D : mov r13, #0
40D07C: DB 00 : rets
;------------------------------------------------------------
40D07E: 28 66 : loc_40D07E:
40D07E: 28 66 : sub r6, #6 <- ???
40D080: 9D 04 : jmpr cc_NC, loc_40D08A
40D082: 06 F6 31 01(0702) : add r6, #207h
40D086: F0 E6 : mov r14, r6
40D088: CB 00 : ret
;------------------------------------------------------------
40D08A: 06 F6 41 01 : loc_40D08A:
40D08A: 06 F6 41 01(0702) : add r6, #207h
40D08E: F0 E6 : mov r14, r6
40D090: CB 00 : ret
;------------------------------------------------------------
40D092: 88 B0 : loc_40D092:
40D092: 88 B0 : mov [-r0], r11
40D094: 88 C0 : mov [-r0], r12
40D096: 88 D0 : mov [-r0], r13
40D098: DA C1 EC 22 : calls 0C1h, loc_C122EC
40D09C: 98 D0 : mov r13, [r0+]
40D09E: 98 C0 : mov r12, [r0+]
40D0A0: 98 B0 : mov r11, [r0+]
40D0A2: 00 CB : add r12, r11
40D0A4: CB 00 : ret
;------------------------------------------------------------

cyperghost · 05-12-2005, 17:10

Hi charlie,
well my "correction" of the SNC patch ...hmm... I never diassembled the patch. I just searched for some pictures in hexcode that where called by the patch.
The patch description was kinda this
pic 299-304 for digits 0-4
pic 321-324 for digits 5-9

then I searched for 304 and 324 (of course you must change them to hex values

)and changed the bytes to the values that I made in the "corrected patch"

So I think I'm not a great help

lalo.lerry · 05-13-2005, 02:05

Sorry student, but I can't answer you now.
BTW, please post me also (always) the original patch when you dissamble one... don't force me to search the whole SL45 patches thread.
Thanks

charlielao · 05-13-2005, 02:50

@cyper:
No problem

I managed to "borrow" Show Op Code corrected patch of DeadMan and You, to show sms sender number of incoming sms.

@Prof Lalo
don't force me to search the whole SL45 patches thread.
Im sorry Prof. I think im asking too much questions already.

05-04-2005, 09:47	#23 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	@Prof Lalo or Master Riza: If i extp #32h,#4 and movb rl1=318h rl2=319h rl3=31Ah rl4=31Bh rl5=31Ch from this -> 0C8310: 00 00 01 14 04 0C 91 36 19 69 62 82 88 00 00 50 what command do i use so that i can store rl1 to rl5 in r8? i want to make r8=9196262888 Last edited by charlielao; 05-06-2005 at 04:33.

05-07-2005, 03:56	#24 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	i made this stupid patch: 23022A: E6FC3500 DAC7B0D8 27D8B0: FFFFFFFF DAB87085 ;start 27D8B4: FFFFFFFF 47F48700 ; cmpb rl2, #87h 27D8B8: FFFF 3D09 ; jmpr cc_NZ, 21 27D8BA: FFFFFFFF 47F60900 ; cmpb rl3, #09h 27D8BE: FFFF 3D06 ; jmpr cc_NZ, 15 27D8C0: FFFFFFFF 47F88000 ; cmpb rl4, #80h 27D8C4: FFFF 3D03 ; jmpr cc_NZ, 9 27D8C6: FFFFFFFF 47FA4600 ; cmpb rl5, #46h 27D8CA: FFFF 2D10 ; jmpr cc_Z, 35 27D8CC: FFFFFFFF 47F49000 ; cmpb rl2, #90h 27D8D0: FFFF 3D09 27D8D2: FFFFFFFF 47F66200 ; cmpb rl3, #62h 27D8D6: FFFF 3D06 27D8D8: FFFFFFFF 47F80800 ; cmpb rl4, #08h 27D8DC: FFFF 3D03 27D8DE: FFFFFFFF 47FA7000 ; cmpb rl5, #70h 27D8E2: FFFF 2D04 27D8E4: FFFFFFFF DAE074D2; GO TO TEST FOR 0Ch 27D8E8: FFFFFFFF FAC7B6D6 ;end 27D8EC: FFFFFFFF E6FC3700 ; CB tone 27D8F0: FFFFFFFF FAC7B6D6 ;end ;start 188570: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 8820883088408850D7703200F3F41903 188580: FFFFFFFFFFFFFFFFFFFFFFFFFFFF F3F61A03F3F81B03F3FA1C03DB00 ;end 27D6B6: FFFFFFFFFFFFFFFFFFFF 9820983098409850DB00 ;TEST for #0Ch, from SMS tone 40D274: FFFFFFFF E6FC3500 ; SMS tone 40D278: FFFF 8860 40D27A: FFFFFFFF D7403200 ; extp #32h, #1 40D27E: FFFFFFFF F3FC0E03 ; movb rl6, 30Eh 40D282: FFFFFFFF 47FC0C00 ; cmpb rl6, #0Ch 40D286: FFFF 2D02 ; jmpr cc_Z, 7 40D288: FFFFFFFF E6FC3900 ; Da Dit 2x tone 40D28C: FFFF 9860 40D28E: FFFF DB00 It makes the sms alert sound same as CB tone for the 2 NUMBERS ONLY(above), and if the sms sender is from network, the sms alert sound is Da Dit (39h). My problem is i want to make some more sms sender numbers with CB sound as sms alert, and the only way i know to do it is to add/change the patch again everytime i add a number (because im stupid ) I want to ask how to use eeprom, just like the mini gps patch of DeadMan, so that if i want to add a sms sender number info, i will just have to use a text file in the MMC, like sms.txt for example, just like ci.txt of DeadMan's mini gps. Maybe after getting the sms sender number (which is easy), then compare it to a txt file in MMC directly (which is very difficult for me). if the sms sender number is not in the txt file, then normal sms alert sound is used, if it is in the txt file, use CB alert sound or any other sound. It would save a lot of bytes, instead of the patch i made above. Last edited by charlielao; 05-07-2005 at 04:13.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Some newbie questions	mocca	Siemens Hardware Repair Area	7	12-25-2003 03:29
Some Basic Questions	Scallion	Old Ericsson Phones & Sony Phones	1	10-24-2003 23:18
Some cable questions!	concom	Nokia Hardware & Hardware Repair	2	05-19-2003 22:28
Some general questions about the T720i	Interlude	Motorola P2k	2	03-15-2003 22:51
some sagem questions	cemali34	Infineon C16X M51 & ARM7 M52 BASED	1	11-05-2002 14:26

05-02-2005, 03:29	#16 (permalink)
lalo.lerry No Life Poster Join Date: Jan 2004 Location: Italy Age: 49 Posts: 1,018 Member: 50673 Status: Offline Thanks Meter: 2	hello Student, sorry if I cannot answer you in a more detailed way, but really I've no time and to answer properly I should look into CDR patch and asm code, any maybe check some RAM locations. 44e6fc: E6FE2600 DABA77BB 1ABB77: FFFF 8880 1ABB79: FFFFFFFF D7403200 ; extp #32h, #1 1ABB7D: FFFFFFFF F2F81B03 ; mov r8, 31bh ;error1 1ABB81: FFFFFFFF 46F85200 ; cmp r8, #82 1ABB85: FFFF 3D04 ; jmpr cc_NZ, 11 1ABB87: FFFFFFFF E6FC3a00 ; mov r12, #3a 1ABB8B: FFFFFFFF DAC3B600 ; calls 0C3h, loc_C300B6 (play tone) 1ABB8F: FFFFFFFF D7403200 ; extp #32h, #1 ;error2 1ABB93: FFFFFFFF F6F81B03 ; mov 31bh, r8 1ABB97: FFFFFFFF E6FE2600 1ABB9B: FFFF 9880 ;note 1ABB9D: FFFF DB00 What's wrong prof? 1.If you want to compare only a byte, use movb command (andchange to byte all following commands). oterhwise the answer of your cmp will be always NZ 2.you don't need to store back r8 value to 32:031B morover, since r8 in call c30086 may be changed (and it's very probably that is changed), if you save r8 to RAM location you change it value. 3.I prefer to end my patch routine and than write back the original datas. So wrtie that mov r14,#26h AFTER command mov r8, [+r0] How come we have to use the low byte in the RAM loc above to compare the Postcode data? why cant we use the whole word? check AAA (own ringtone for each Addressbook contact) and incoming call icon patches to know the answer (but they asm is not so easy to read out, I know)

05-02-2005, 05:11	#17 (permalink)
rizapn No Life Poster Join Date: Mar 2002 Location: -[r0]- Age: 53 Posts: 834 Member: 9891 Status: Offline Thanks Meter: 2	@charlie: C166 code (not byte data), must be started in the even address. So, you can not use 0x1ABB77 as your starting point ...

05-02-2005, 05:48	#18 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	@Master Riza: Thanks for the info. Do you know the RAM loc for Postcode data of incoming sms sender (like in incoming call -> 000C:326C) because that RAM loc for postcode is used only after you have opened the sms sent, not while it is still incoming. @Master Riza and Prof Lalo: This patch works: 23022A: E6FC3500 DAC7DEED ; mov r12, #35h <- sms-sound (from active profile) 27EDDE: FFFF 8820 27EDE0: FFFFFFFF D7403200 ; extp #32h, #1 27EDE4: FFFFFFFF F3F41C03 ; movb rl2, 031Ch 27EDE8: FFFFFFFF 47F48800 ; cmpb rl2, #88h 27EDEC: FFFF 2D04 ; jmpr cc_Z, 11 27EDEE: FFFF 9820 27EDF0: FFFFFFFF E6FC3500 27EDF4: FFFF DB00 27EDF6: FFFF 9820 27EDF8: FFFFFFFF E6FC3700 27EDFC: FFFF DB00 I tested it by using play CB-sound (from active profile) if ram loc (0032:031C) is = to 88. 88 is last 2 digits of incoming sms sender. Now my problem is i dont know how to make it use the last 7 digits of incoming sms sender number, or better yet, use postcode data of sms sender.

05-04-2005, 00:32	#19 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	@Master Riza: I got thisfrom one of your files: <<<<<<<<<<<< ADDRESSBOOK >>>>>>>>>>>>> checkAddrBook() : 0xA0EC0A checkAddrBook2() : 0xA0EF0C checkAddrBookOK() : 0xA0F252 0xA0EF0C : DA A0 0A EC -> DA C7 60 DA AddressBookEdit?() : 0x341268 AddressBookFileName() : 0xA0E6D6 can i use them for the sms sender number tests? to be able to get the postcode data in the addressbook?

05-04-2005, 06:21	#20 (permalink)
rizapn No Life Poster Join Date: Mar 2002 Location: -[r0]- Age: 53 Posts: 834 Member: 9891 Status: Offline Thanks Meter: 2	@charlie: - About the document(s). I don't know. You can test it, but I don't know what is the exact result. Some documents and notes is "very old". All are based on my (some times incomplete and unsuccessfull) experiment ...

05-04-2005, 07:08	#21 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	Thanks Master Riza. For this data from debugger: 09196262888:<-sender number 0C8300: 01 03 01 07 91 36 19 08 00 30 17 00 14 04 0C 00 0C8310: 00 00 01 14 04 0C 91 36 19 69 62 82 88 00 00 50 is there a way to "get" the number and then compare it to the Addressbook and then the Postcode data? I am trying to "make" a patch to assign sms tone to individual numbers

05-04-2005, 07:33	#22 (permalink)
rizapn No Life Poster Join Date: Mar 2002 Location: -[r0]- Age: 53 Posts: 834 Member: 9891 Status: Offline Thanks Meter: 2	Sorry, but I have no idea yet ...

05-09-2005, 00:53	#26 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	Thanks cyper Hopefully DeadMan isnt so busy so he can read this thread nad give some ideas. The best way, IMHO, is to make txt file for individual sms tones. Example: sms1.txt would contain group of contacts with Standard#1 tone, sms2.txt for Standard#2 tone, etc. When a there's an incoming sms, SL45 would check these txt files for jumper and play the corresponding sms tones. If the incoming number isnt in one of these txt files, then it would play the normal sms tone.

05-11-2005, 04:50	#27 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	@Prof Lalo: i diassembled deadmans' SNC patch and this is what he did: 40D000: 88 E0 : mov [-r0], r14 40D002: 88 D0 : mov [-r0], r13 40D004: 88 C0 : mov [-r0], r12 40D006: 88 B0 : mov [-r0], r11 40D008: 88 70 : mov [-r0], r7 40D00A: 88 60 : mov [-r0], r6 40D00C: E6 FC 08 00 : mov r12, #8 <-x 40D010: E6 FD 07 00 : mov r13, #7 <-y 40D014: E6 FB 04 00 : mov r11, #4 <-width digit picture+distance before 40D018: E6 F7 81 1D : mov r7, #1D81h ( 39D81) <-loc 1st word OpCode 40D01C: D7 40 0E 00 : extp #0Eh, #1 40D020: A9 C7 : movb rl6, [r7] 40D022: E1 0D : movb rh6, #0 <- why? 40D024: 88 60 : mov [-r0], r6 40D026: 67 FC 0F 00 : andb rl6, #0Fh <- ??? 40D02A: BB 29 : callr loc_40D07E 40D02C: BB 32 : callr loc_40D092 40D02E: 98 60 : mov r6, [r0+] 40D030: 67 FC F0 00 : andb rl6, #0F0h <- ??? 40D034: 3C 46 : ror r6, #4 <- to change r6=15 to r6=51? 40D036: BB 23 : callr loc_40D07E 40D038: BB 2C : callr loc_40D092 40D03A: D7 40 0E 00 : extp #0Eh, #1 40D03E: F4 C7 01 00 : movb rl6, [r7+#1] 40D042: E1 0D : movb rh6, #0 40D044: 67 FC 0F 00 : andb rl6, #0Fh 40D048: BB 1A : callr loc_40D07E 40D04A: BB 23 : callr loc_40D092 40D04C: D7 40 0E 00 : extp #0Eh, #1 40D050: F4 C7 02 00 : movb rl6, [r7+#2] 40D054: E1 0D : movb rh6, #0 40D056: 88 60 : mov [-r0], r6 40D058: 67 FC 0F 00 : andb rl6, #0Fh 40D05C: BB 10 : callr loc_40D07E 40D05E: BB 19 : callr loc_40D092 40D060: 98 60 : mov r6, [r0+] 40D062: 67 FC F0 00 : andb rl6, #0F0h 40D066: 3C 46 : ror r6, #4 40D068: BB 0A : callr loc_40D07E 40D06A: BB 13 : callr loc_40D092 40D06C: 98 60 : mov r6, [r0+] 40D06E: 98 70 : mov r7, [r0+] 40D070: 98 B0 : mov r11, [r0+] 40D072: 98 C0 : mov r12, [r0+] 40D074: 98 D0 : mov r13, [r0+] 40D076: 98 E0 : mov r14, [r0+] 40D078: E0 0C : mov r12, #0 40D07A: E0 0D : mov r13, #0 40D07C: DB 00 : rets ;------------------------------------------------------------ 40D07E: 28 66 : loc_40D07E: 40D07E: 28 66 : sub r6, #6 <- ??? 40D080: 9D 04 : jmpr cc_NC, loc_40D08A 40D082: 06 F6 31 01(0702) : add r6, #207h 40D086: F0 E6 : mov r14, r6 40D088: CB 00 : ret ;------------------------------------------------------------ 40D08A: 06 F6 41 01 : loc_40D08A: 40D08A: 06 F6 41 01(0702) : add r6, #207h 40D08E: F0 E6 : mov r14, r6 40D090: CB 00 : ret ;------------------------------------------------------------ 40D092: 88 B0 : loc_40D092: 40D092: 88 B0 : mov [-r0], r11 40D094: 88 C0 : mov [-r0], r12 40D096: 88 D0 : mov [-r0], r13 40D098: DA C1 EC 22 : calls 0C1h, loc_C122EC 40D09C: 98 D0 : mov r13, [r0+] 40D09E: 98 C0 : mov r12, [r0+] 40D0A0: 98 B0 : mov r11, [r0+] 40D0A2: 00 CB : add r12, r11 40D0A4: CB 00 : ret ;------------------------------------------------------------

05-12-2005, 17:10	#28 (permalink)
cyperghost No Life Poster Join Date: Oct 2003 Posts: 705 Member: 42457 Status: Offline Thanks Meter: 1	Hi charlie, well my "correction" of the SNC patch ...hmm... I never diassembled the patch. I just searched for some pictures in hexcode that where called by the patch. The patch description was kinda this pic 299-304 for digits 0-4 pic 321-324 for digits 5-9 then I searched for 304 and 324 (of course you must change them to hex values )and changed the bytes to the values that I made in the "corrected patch" So I think I'm not a great help

05-13-2005, 02:05	#29 (permalink)
lalo.lerry No Life Poster Join Date: Jan 2004 Location: Italy Age: 49 Posts: 1,018 Member: 50673 Status: Offline Thanks Meter: 2	Sorry student, but I can't answer you now. BTW, please post me also (always) the original patch when you dissamble one... don't force me to search the whole SL45 patches thread. Thanks

05-13-2005, 02:50	#30 (permalink)
charlielao No Life Poster Join Date: May 2004 Posts: 501 Member: 66040 Status: Offline Thanks Meter: 14	@cyper: No problem I managed to "borrow" Show Op Code corrected patch of DeadMan and You, to show sms sender number of incoming sms. @Prof Lalo don't force me to search the whole SL45 patches thread. Im sorry Prof. I think im asking too much questions already.