Light Node Pointer SRM Brief Notes (Torches)

Light Node Pointer SRM Brief Notes (Torches)


Light Node Pointer (LNP) is 4 bytes stored at Torch + 0x1E0. The value of LNP is initially 801Fxxxx.

We can use Pot + 0x32 (Movement Angle) to write to Torch + 0x1E2, which allows us to edit the last 2 bytes of LNP.

Pot + 0x32 = Torch + 0x1E2
Pot = Torch + 0x1B0

Edit the value of LNP to be 801FXXXX. Call this address LN (Light Node; i.e. LN = 801FXXXX).

LN + 4 = Ptr1		(LN.prev)
LN + 8 = Ptr2		(LN.next)

Ptr1 has value Addrees1
Ptr2 has value Address2

When you deallocate the torch you SRM'd, the following happens...

- The 4 bytes stored at Address1 + 8 are overwritten by the value Address2
- The 4 bytes stored at Address2 + 4 are overwritten by the value Address1