Refactor E and S

WEEK06/WEEK06-04.md

@@ -1,13 +1,13 @@
-# Embedded Systems Reverse Engineering
+# Embedded Systems Reverse Engineering
 [Repository](https://github.com/mytechnotalent/Embedded-Hacking)
 
 ## Week 6
 Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics
 
-### Exercise 4: Invert the Button Logic with XOR
+### Non-Credit Practice Exercise 4: Invert the Button Logic with XOR
 
 #### Objective
-Find the `eor.w r3, r3, #1` instruction that implements the ternary operator's button inversion, patch it to `eor.w r3, r3, #0` using a hex editor to reverse the LED behavior, and verify that the LED is now ON when the button is pressed and OFF when released — the opposite of the original behavior.
+Find the `eor.w r3, r3, #1` instruction that implements the ternary operator's button inversion, patch it to `eor.w r3, r3, #0` using a hex editor to reverse the LED behavior, and verify that the LED is now ON when the button is pressed and OFF when released — the opposite of the original behavior.
 
 #### Prerequisites
 - Completed Week 6 tutorial (all GDB and hex editor sections)
@@ -61,7 +61,7 @@ Look for this sequence:
 0x10000274:    mov.w r1, #0xd0000000   ; SIO base address
 0x10000280:    ldr   r3, [r1, #4]      ; Read GPIO input register
 0x10000282:    ubfx  r3, r3, #15, #1   ; Extract bit 15 (button state)
-0x10000286:    eor.w r3, r3, #1        ; XOR with 1 — INVERT ← OUR TARGET
+0x10000286:    eor.w r3, r3, #1        ; XOR with 1 — INVERT ? OUR TARGET
 0x1000028a:    mcrr  0, 4, r2, r3, cr0 ; Write to GPIO output
 ```
 
@@ -93,8 +93,8 @@ When it hits, check what value is about to be XORed:
 (gdb) info registers r3
 ```
 
-- If button is **released**: `r3 = 1` → after EOR: `r3 = 0`
-- If button is **pressed**: `r3 = 0` → after EOR: `r3 = 1`
+- If button is **released**: `r3 = 1` ? after EOR: `r3 = 0`
+- If button is **pressed**: `r3 = 0` ? after EOR: `r3 = 1`
 
 ##### Step 5: Test the Patch in GDB
 
@@ -118,9 +118,9 @@ Look at the raw bytes:
 ```
 
 The `eor.w` instruction is a 32-bit Thumb-2 encoding. The 4 bytes break down as:
-- `0x83 0xF0` — opcode + source register (r3)
-- `0x01` — **the immediate value (`#1`)** ← this is what we change
-- `0x03` — destination register (r3)
+- `0x83 0xF0` — opcode + source register (r3)
+- `0x01` — **the immediate value (`#1`)** ? this is what we change
+- `0x03` — destination register (r3)
 
 ##### Step 7: Patch with the Hex Editor
 
@@ -128,11 +128,11 @@ The `eor.w` instruction is a 32-bit Thumb-2 encoding. The 4 bytes break down as:
 2. The instruction starts at file offset: `0x10000286 - 0x10000000 = 0x286`
 3. The immediate byte is the 3rd byte: offset `0x286 + 2 = 0x288`
 4. Press **Ctrl+G** and enter offset: `288`
-5. You should see `01` — change it to `00`
+5. You should see `01` — change it to `00`
 6. Verify the surrounding bytes (`83 F0` before and `03` after) are unchanged
-7. Click **File** → **Save As** → `0x0014_static-variables-h.bin` (in the same `build` directory)
+7. Click **File** ? **Save As** ? `0x0014_static-variables-h.bin` (in the same `build` directory)
 
-> 🔍 **Why offset `0x288`?** The 4-byte instruction starts at `0x286`, but the immediate value `#1` is in the **third byte** (index 2), so it's at `0x286 + 2 = 0x288`.
+> ?? **Why offset `0x288`?** The 4-byte instruction starts at `0x286`, but the immediate value `#1` is in the **third byte** (index 2), so it's at `0x286 + 2 = 0x288`.
 
 ##### Step 8: Predict the New Behavior
 
@@ -183,9 +183,9 @@ After completing this exercise, you should be able to:
 
 #### Tips and Hints
 - `eor.w r3, r3, #1` is a 32-bit Thumb-2 instruction (4 bytes), not a 16-bit Thumb instruction
-- A Thumb NOP is `00 bf` (2 bytes) — you would need two NOPs to replace a 4-byte instruction
+- A Thumb NOP is `00 bf` (2 bytes) — you would need two NOPs to replace a 4-byte instruction
 - Use GDB `x/1tw` to view a word in binary format, making bit manipulation easier to see
-- The SIO base address `0xd0000000` provides single-cycle access to GPIO — it's separate from the IO_BANK0 registers at `0x40028000`
+- The SIO base address `0xd0000000` provides single-cycle access to GPIO — it's separate from the IO_BANK0 registers at `0x40028000`
 
 #### Next Steps
 - Review all four exercises and verify you can patch any part of the binary: data values, arithmetic operations, and logic operations