$EE BLM Locker Code Query

[NomakeWan]

So I noticed while working on my car today that when I loaded the BIN I'd made on my desktop onto the laptop I use for flashing, the copy of TunerPro I have on the laptop said the patch was indeterminate. On my desktop I checked again, and it was patched. So I dug into the XDFs I was using on each computer, and found that the routine they use to lock BLMs are in fact different! While I can identify what's being changed just fine (thanks to EagleMark for those disassemblies!), I can't tell which of the methods is more 'correct'. In reality they might both be, but I figured I would ask here since a cursory Google as well as a search of this forum didn't have the answer to this question. Maybe it helps some other curious folks.

In the XDF I primarily use for tuning (kur4o's fork of EEXtra), the operation changes the "Branch if Minus" on the L and R BLMs (addresses 5ACC and 5B21) to NOPs.

In the XDF I had loaded on my flashing Laptop (EEXTRA v0.003), it changes those same addresses to 27 "Branch if Equal to Zero" but rather than branching to 5AD0/5B25 it has the next byte as 00. So...branch if equal to zero, to itself? Am I reading that correctly?

In any event, I'm total trash when it comes to assembly language, but my completely uninformed guess is that kur4o's NOP version is the correct way of doing things. I guess I'm more curious about setting it to "27 00" and what exactly that does more than anything.

Thanks!

[steveo]

So...branch if equal to zero, to itself? Am I reading that correctly?

the original code is 2B 02. this is a relative address branch, and moves two bytes ahead if status register is minus.

the next two bytes, which is what it's conditionally jumping over, are 86 80 which means LDAA 0x80 (0x80 is dec 128 which i'm sure you recognize). the blm locker simply removes that conditional branch and always LDAA 0x80.

27 00 is functionally equivalent to NOP NOP because the relative address 00 is 0 bytes ahead of itself. it doesn't do anything. it's like saying 'if something do nothing. else do nothing'.

although it may seem more "correct" to use NOP instructions, the original GM branching code and the 27 00 instruction both use 3 cycles, whereas two NOOP instructions use 4. so technically the old version it is more efficient and uses the same amount of cycles as the original program, which, if you do not fully understand what you're patching, probably isn't a bad idea, because execution time dependent deterministic are a thing with ECM code.

[NomakeWan]

Oh wow, awesome! Thank you for the detailed response! Good to know the command was doing what I thought it was; I just had no idea about the amount of cycles required. I'll go ahead and use the 27 00 going forward for consistency's sake.