; ------------------------------------------------------------------------------
; 游戏: (GBA) 最终幻想 I+II
; 类型: 无限金币
; 说明: 需要本金，有了本金之后可以实现 200% 返利。
; ------------------------------------------------------------------------------
; 作者: Jixun
; 地址: https://jixun.moe/  --  季寻日志
; ------------------------------------------------------------------------------

.gba

.open "FF1+2.gba", "FF1+2_GOLD.gba", 0x08000000

; ------------------------------------------------------------------------------
; 补丁原始指令 (FF1 的扣钱函数)
; ------------------------------------------------------------------------------
.org 0x0807dd9c
.thumb
  FN_FF1_COST_GOLD_ORIG:
    LDR r3, =FN_FF1_COST_GOLD + 1
    BX r3          ; jmp_thumb FN_FF1_COST_GOLD
    .pool

; ------------------------------------------------------------------------------
; 补丁原始指令 (FF2 的扣钱代码部分)
; ------------------------------------------------------------------------------
; 08178f7c  4a13 ldr r2, [$08178fcc] (=$00004bdf)
; 08178f7e  18bb add r3, r7, r2
; 08178f80  781a ldrb r2, [r3, #0x0]        ; r2 = [r7 + $4bdf]
.org 0x08178f82
.thumb
  FN_FF2_COST_GOLD_ORIG:
    push {r2}        ; 备份 r2 值
    LDR r2, =FN_FF2_COST_GOLD + 1
    BX r2             ; jmp_thumb FN_FF2_COST_GOLD
    .pool

.org 0x08178f8E
  FN_FF2_CONTINUE:

; 08178F7C:  4A13       ldr r2, [$08178FCC]   ; $4bdf
; 08178F7E:  18BB       add r3, r7, r2
; 08178F80:  781A       ldrb r2, [r3, #0]

; 从此处开始放置钩子跳到自己的代码
; 08178F82:  4C13       ldr r4, [$08178FD0]   ; $4bdc
; 08178F84:  1938       add r0, r7, r4
; 08178F86:  8800       ldrh r0, [r0, #0]
; 08178F88:  4342       mul r2, r0            ; r2 = [r7 + $4bdc]*[r7 + $4bdf]

; 08178F8A:  6808       ldr r0, [r1, #0]
; 08178F8C:  1A80       sub r0, r0, r2

; 跳回来到这里
; 08178F8E:  6008       str r0, [r1, #0]      ; [r1] = [r1] - r2


; ------------------------------------------------------------------------------
; 随便找的一段空位
; 此处执行真正的代码。
; ------------------------------------------------------------------------------
.org 0x0881a640
; ------------------------------------------------------------------------------
; FF1 的补丁
; ------------------------------------------------------------------------------
.thumb
  FN_FF1_COST_GOLD:
    ; r0: BASE_ADDR
    ; r1: COST
    push {lr}               ; push [ret addr]

    ldr r3, =$0b84          ; r3 = GOLD_OFFSET
    add r2, r0, r3          ; r2 = 02001ec8 + $0b84 = 2002A4C[GOLD]
    ldr r0, [r2, #0x0]
    add r0, r0, r1          ; r0 = [r2] + r1
    ldr r3, =#999999
    cmp r0, r3              ; if r0 > 999999
  ble FF1_SKIP_RESET_MONEY  ;   goto FF1_SKIP_RESET_MONEY
    mov r0, r3              ; r0 = [DAT_SOME_MONEY]
  FF1_SKIP_RESET_MONEY:
    str r0, [r2, $0]        ; [r2] = r0

    pop {r0}
    bx r0                   ; ret
; ------------------------------------------------------------------------------
; FF2 的补丁
; ------------------------------------------------------------------------------
.thumb
  FN_FF2_COST_GOLD:
    pop {r2}                ; 还原 r2 值
; 08178F82:  4C13       ldr r4, [$08178FD0]
; 08178F84:  1938       add r0, r7, r4
; 08178F86:  8800       ldrh r0, [r0, #0]
; 08178F88:  4342       mul r2, r0          ; r2 = [r7 + $4bdf] * [r7 + $0b84]
    ldr r4, =$4bdc
    add r0, r7, r4
    ldrh r0, [r0, #0x0]   ; r2: COST
    mul r2, r0            ; r2 = r2 * [r7 + $4bdc]

; 08178F8A:  6808       ldr r0, [r1, #0]
; 08178F8C:  1A80       sub r0, r0, r2      ; 
; 08178F8E:  6008       str r0, [r1, #0]    ; [r1] = [r1] - r2
    ldr r0, [r1, #0]      ; r0 = [r1]
    add r0, r0, r2        ; r0 += r2

    ; 因为 r2 在之后的代码通过 ldr 赋值了，可以用来随意修改而不必备份
    ldr r2, =#999999      ; 防止数据过大溢出
    cmp r0, r2
  ble FF2_SKIP_RESET_MONEY
    mov r0, r2
  FF2_SKIP_RESET_MONEY:
    ldr r2, =FN_FF2_CONTINUE + 1
    bx r2
.pool
; ------------------------------------------------------------------------------


; ------------------------------------------------------------------------------
.Close
; ------------------------------------------------------------------------------