25e98c is the address where r27 is actually written
Contains the instruction: 981B0000
Replace that with a jump to code cave, which is outlined below
# r4, r6, and r19 are overwritten soon after, so we can use then as a free local vars
# Clear space for registers (we'll use r6, r4, and r19)
stb r0, 0(r27) [981B0000]
addi r4, 0, 0DE4 [38800DE4] # r4 is the register for the character slot memory pointer, so prepare it
addis r4, r4, 3F [3C84003F]
addi r6, 0, 0E74 [38C00E74] # r6 is the register for the last character slot, so prepare it
addis r6, r6, 3F [3CC6003F]
-> StartLoop
addi r4, r4, 24 [38840024] # 24 between each
lbz r19, 0(r4) [8A640000] # Get the next character slot type
cmpiw cr2,r19, 0x3 [2D130003] # Is in NONE?
beq cr2, 0xD [41AA0034] # If it is, go to normal FOD
cmp cr2, 0, r6, r4 [7D062000] # Check to see if we're at the last character slot
bne- cr2, -5 [40AAFFEC] # If we aren't go back to start loop, otherwise continue and make FoD Lagless!
addis r4, 0, 1C [3C80001C] # Put first have of address here (we'll use immediate offset to get rest)
ori r4, r4, B000 [6084B000] # Put the B in so we don't go negative
addis r19, 0, 6000 [3E606000] # Nop into r19
stw r19, bd4(r4) [92640bd4]
stw r19, f54(r4) [92640f54]
stw r19, f84(r4) [92640f84]
addis r19, 0, 4800 [3E604800] # Next part
addi r19, r19, 28 [3A730028] # Next part 2
stw r19, efc(r4) [92640efc]
b +15 [4800003C]
-> NormalFoD
addis r4, 0, 1C [3C80001C] # Put first have of address here (we'll use immediate offset to get rest)
ori r4, r4, B000 [6084B000] * Put the B in so we don't go negative
addis r19, 0, 4800 [3E604800]
addi r19, r19, 0115 [3A730115]
stw r19, bd4(r4) [92640bd4]
addis r19, 0, 4182 [3E604182]
addi r19, r19, 0028 [3A730028]
stw r19, efc(r4) [92640efc]
addis r19, 0, 4800 [3E604800]
addi r19, r19, 0BC5 [3A730BC5]
stw r19, f54(r4) [92640f54]
addis r19, 0, 4BFF [3E604BFF]
ori r19, r19, D775 [6273D775]
stw r19, f84(r4) [92640f84]
-> End
b 0x25e990 (RAM) [4BE530E4]