于是我便写下了这样一段ASM,并用armips写入:
.gba
.thumb
.create "test.gba",0x8000000
.close
.open "802-Random-v1.0.gba","test.gba",0x8000000
.org 0x08304C08
.func cmp
mov r0,r4
cmp r0,#0xE3
beq mov1
cmp r0,#0xC0
beq mov2
b end
mov1:
mov r0,#0x1
mov2:
mov r0,#0x2
end:
pop {r1,r4}
bx r1
.endfunc
.pool
.func newscript
cmp r0,#0x2
beq yes
ldr r0,=0x082725E0
goto:
push {r4}
ldr r4,=(0x0809C7E4|1)
bx r4
yes:
ldr r0,=0x0826FB18
b goto
.endfunc
.pool
.org 0x08089A6C
push{r4,lr}
lsl r0, r0, #0x18
lsr r0, r0, #0x18
mov r4,r0
ldr r0,=(cmp|1)
bx r0
.word 0x00000000
.pool
.org 0x0809A654
bx r0
.halfword 0x0000
.word (newscript|1)
.pool
.close