8000B0BC 27BDFFE8 addiu sp,-$18 // create stack frame, clean entry 8000B0C0 AFBA0010 sw k0,$10(sp) // preserve k0 8000B0C4 AFBB0014 sw k1,$14(sp) // preserve k1 8000B0C8 00000000 sll 0,$0 // nop (pipeline safety) 8000B0CC 3C1AA000 lui k0,$A000 // k0 = A0000000 (uncached KSEG1) 8000B0D0 375A0040 ori k0,$40 // k0 = A0000040 (uncached exception vector) 8000B0D4 3C1B0800 lui k1,$800 // k1 = 08000000 8000B0D8 377B2C58 ori k1,$2C58 // k1 = 08002C58 (your custom handler) 8000B0DC AF5B0000 sw k1,$0(k0) // overwrite uncached exception vector // Spyro never checks this mirror 8000B0E0 00000000 sll 0,$0 // nop 8000B0E4 277BFFEA addiu k1,-$16 // adjust DCIC value 8000B0E8 AF5B0040 sw k1,$40(k0) // write debug control helper value 8000B0EC AF400044 sw 0,$44(k0) // clear leftover state 8000B0F0 00000000 sll 0,$0 // nop 8000B0F4 8FBA0010 lw k0,$10(sp) // restore k0 8000B0F8 8FBB0014 lw k1,$14(sp) // restore k1 8000B0FC 27BD0018 addiu sp,$18 // restore stack 8000B100 08016537 j $800594DC // return to game boot flow 8000B104 00000000 sll 0,$0 // delay slot // ---------------- DEBUG HARDWARE ARMING ---------------- 8000B108 3C1AFFFF lui k0,$FFFF 8000B10C 375AFFFF ori k0,$FFFF 8000B110 409A5800 mtc0 k0,cop0_bpcm // allow all PC bits for breakpoint masking // retail games assume this is inert 8000B114 00000000 sll 0,$0 8000B118 00000000 sll 0,$0 8000B11C 00000000 sll 0,$0 8000B120 3C1A8004 lui k0,$8004 8000B124 375ACA98 ori k0,$CA98 // breakpoint #1 address 8000B128 409A1800 mtc0 k0,cop0_bpc // set PC breakpoint // no code modified, pure hardware trap 8000B12C 00000000 sll 0,$0 8000B130 00000000 sll 0,$0 8000B134 00000000 sll 0,$0 8000B138 3C1AE180 lui k0,$E180 8000B13C 375A0000 ori k0,$0 8000B140 409A3800 mtc0 k0,cop0_dcic // enable debug exception logic // this is what Spyro never audits 8000B144 00000000 sll 0,$0 8000B148 00000000 sll 0,$0 8000B14C 00000000 sll 0,$0 8000B150 3C1A0000 lui k0,$0 8000B154 375A0C80 ori k0,$C80 8000B158 03400008 jr k0 // jump to debug handler entry 8000B15C 00000000 sll 0,$0 // ---------------- SECOND BREAKPOINT SETUP ---------------- 8000B160 40803800 mtc0 0,cop0_dcic // temporarily disable debug 8000B164 00000000 sll 0,$0 8000B168 00000000 sll 0,$0 8000B16C 00000000 sll 0,$0 8000B170 3C1AFFFF lui k0,$FFFF 8000B174 375AFFFF ori k0,$FFFF 8000B178 409A5800 mtc0 k0,cop0_bpcm // re-arm mask 8000B17C 00000000 sll 0,$0 8000B180 00000000 sll 0,$0 8000B184 00000000 sll 0,$0 8000B188 3C1A8004 lui k0,$8004 8000B18C 375ACB30 ori k0,$CB30 // breakpoint #2 address 8000B190 409A1800 mtc0 k0,cop0_bpc 8000B194 00000000 sll 0,$0 8000B198 00000000 sll 0,$0 8000B19C 00000000 sll 0,$0 8000B1A0 3C1AE180 lui k0,$E180 8000B1A4 375A0000 ori k0,$0 8000B1A8 409A3800 mtc0 k0,cop0_dcic // debug re-enabled // ---------------- EXCEPTION HANDLER LOGIC ---------------- 8000B1B8 401A7000 mfc0 k0,cop0_epc // read trapped PC 8000B1BC 00000000 sll 0,$0 8000B1C0 3C1B8004 lui k1,$8004 8000B1C4 377BCA98 ori k1,$CA98 8000B1C8 137A000A beq k1,k0,$8000B1F4 // check which breakpoint fired // prevents false triggers 8000B1CC 00000000 sll 0,$0 8000B1D0 3C1A8005 lui k0,$8005 8000B1D4 8F5ACB34 lw k0,-$34CC(k0) // read game state safely 8000B1D8 00000000 sll 0,$0 8000B1DC 3C1BA000 lui k1,$A000 8000B1E0 377BB1EC ori k1,$B1EC 8000B1E4 AF7A0000 sw k0,$0(k1) // store intercepted value // no game memory altered 8000B1E8 00000000 sll 0,$0 8000B1EC 00021043 sra v0,$1 // side-effect logic 8000B1F0 00000000 sll 0,$0 // ---------------- EPC REDIRECTION (THE KILL MOVE) ---------------- 8000B1F4 401A7000 mfc0 k0,cop0_epc // reload EPC 8000B1F8 00000000 sll 0,$0 8000B1FC 275A0008 addiu k0,$8 // skip protected instruction 8000B200 409A7000 mtc0 k0,cop0_epc // write back modified EPC // execution altered, code untouched 8000B204 00000000 sll 0,$0 8000B208 00000000 sll 0,$0 8000B20C 00000000 sll 0,$0 8000B210 03400008 jr k0 // resume normal execution 8000B214 42000010 rfe // return from exception // Spyro thinks it ran cleanly