How would you resolve a branch from 0x02040000 (gba rom 0x08000000) to 0x03000000 (gba rom 0x08FC0000, but also iwram) then? You can't know if it was a relative branch or not. And normally code that goes to 0x03000000 or 0x02000000 or others will run in there, same for static code within these areas. And the prefetch abort will raise the exception if any inmediate, rd or branch with link.Īs long as you keep these two offsets, and identify when LDR pc,=NxNNNNNNNN and branches within the GBA ROM map take place, code should be patched to run within a code cave.

Then if a new code cave is reloaded, both the global and the code cave size - current code cave offset should be added and used to relocate the upcoming code cave.Īnd third, the offsets are hardcoded in the GBA ROM, and these point to 0x08000000 onwards. That one should be added to the new relocated code within the new code cave. So for code caves you need to keep both (above) offsets, and for the prefetch exception, keep the current offset from the current code cave - the global offset.

Second, the prefetch abort will raise exceptions if the memory resolved in the prefetcher unit is not mapped. So you need to keep track of the current relative offset from within the code cave, and the global offset (the gba map it's supposed to). First of all, the address can be read from the inmediate value bits, from a register or if branch with link, from two half word bytes.

How to play rom hacks on 3ds 2017