Problem writing to a memory location.

[field3d]

Hello. I want ask about something is strange in program:

*I have the memory position 35000 that the program stores there a flag 01 or 00. By default is 01 and if not touched the program will never start. if Is 00 the program will start perfectly. Sounds easy to make the change to that memory position to 01 always and done yes that is the theory but there is a high complexity that is not allowing me to change that.

*The main thing is: That memory position is not loaded at the beginning it will appears after 3 internal loads of the program after many features of the game. Ok this problem is solved as I detected where is the routine that exactly decompress that routine.

*Now the main problem is that the 35000 memory position appears after the the a routine and exactly before these lines:

starts in a2488:

move.l d1,d0
movem.l (a7)+,d2-d7/a2-a6
rts

Meaning that before that lines are executed I can see the 35000 totally decompressed. Sounds like a good place to shot.

Now, The problems here are:

**First problem if I put my routine and I change my 35000 to 01 after the rts simply will be ignored nothing happens. After the ‘movem.l (a7)+,d2-d7/a2-a6” the changes to 35000 are not detected simply like that.

***Second problem, is clear that my routine for a change to the 35000 must be done before that move.l d1,d0 or at least before ‘movem.l (a7)+,d2-d7/a2-a6’ as after that lines the changes have no effect are not considered by the program. Then, I tried to put a jsr ($200) there in the place of that lines to become in this:

memory a2488 becomes:

jsr ($200)
rts

now in the memory $200 I have:

move.w #$0001,$35000
move.l d1,d0
movem.l (a7)+,d2-d7/a2-a6
rts

I simply sent to memory $200 the lines and I execute before my change but not work it crash. As if it detects I jump to other location or simply crash and program exits.

What can I do here? I need to execute my “move.w #$0001,$35000” exactly before ‘movem.l (a7)+,d2-d7/a2-a6’ not after. But also as can be seen if I try to jump outside a2488 it crash, also I can’t extend the a2488 to add more lines before the ‘movem.l (a7)+,d2-d7/a2-a6’ because it becomes in the third problem:

**third problem if I want to make large de a2488 I can’t because that routine of in a2488 is used endlessly during all sections of the program, and I can’t modify permanently. Anyway I used a test in that moment in the memory a2488:

move.w #$0001,$35000
move.l d1,d0
movem.l (a7)+,d2-d7/a2-a6
rts

Simply test and is not recognized my $35000 01 then the program never starts. Is clear that $35000 is used to a sore the protection scheme with that 0 or 1. Simply it will work if I have in A2488 like this:

move.l d1,d0
movem.l (a7)+,d2-d7/a2-a6
rts

and will work only if I put a break point in A2488 then manually I modify the memory 35000 by myself typing the keyboard the 01 there .

I can’t modify anything to A2488 as is not recognized.

How can be solved this?

An exactly what it does this:

movem.l (a7)+,d2-d7/a2-a6

Thank you

[Samurai_Crow]

Try pre-decrementing A7 reads to avoid overwriting the return address and other data stored there.

If the contents of the stack is misaligned, the return address could also be lost that way.

[field3d]

Oh I see but now I lost the rts value trying to pre-decrement?I did this to the position A2488:

movem.l d2-d7/a2-a6, -(a7) - pre decrement?

move.l a2,d2 -Backup a2 in d2. a2 is a reference to know where is the $35000
adda.l #$2ca,a2 - I add to a2 the number $2ca to make a2 the $35000
move.l #$0,(a2) - I write to $35000 the 0 to a2 yes .l is ok
move.l d2,a2 - I return the backed up a2 from d2
moveq #0,d2 - As d2 is always 0 I return to 0 to leave untouched

movem.l (a7)+,d2-d7/a2-a6 - normal command they use
rts - return to normal program

But the line

‘ movem.l d2-d7/a2-a6, -(a7)’

together with

‘movem.l (a7)+,d2-d7/a2-a6’

makes this combination that the rts return address is lost because it goes to ffffffffe and previously it was to 21e1e if I don’t use ‘ movem.l d2-d7/a2-a6, -(a7)’

It was correct my preor why was lost the rts?

[paraj]

When a JSR is executed the return address (address of the following instruction) is pushed onto the stack, so you change the stack layout (like Samurai_Crow mentions). It'll be off by 4 compared to what movem.l expects.

Instead of JSR, just JMP to $200 (since you don't care about returning to the code around a2488). If it's whdload stuff, you can just PL_P $a2488,func (assuming patching from address 0, otherwise adjust) since there is room for the 6 byte patch

func:
    move.w #$0001,$35000
    move.l d1,d0
    movem.l (a7)+,d2-d7/a2-a6
    rts

[field3d]

@SAMURAI and @paraj thank you for the help. Yes I solved the problem. I ended moving the bytes as you mention @paraj. All is running now. Thank you again