Week 4-BN: add Step 22b - load Project 2 into Binary Ninja and save its .bndb

Mirror Steps 7-8 for Project 2 (Open with Options, thumb2/thumb2/0x10000000,
verify the vector words, Save As .bndb) and point at Step 26 for resolving the
Project 2 functions.

WEEK04/WEEK04-BN.md

@@ -1084,11 +1084,38 @@ Part 4 left the Pico running the patched Project 1 image. Put the original Proje
    ```
 
 3. Start the debug server again (Step 10) and wait for `Listening on port 3333`.
-4. Open `0x0008_uninitialized-variables/build/0x0008_uninitialized-variables.bin` with options (`thumb2`, `thumb2`, `0x10000000`) and save a `.bndb`.
+4. Load Project 2 and save its database — see Step 22b.
 5. Connect Binary Ninja again (Step 11): adapter **GDB MI**, IP `127.0.0.1`, port `3333`.
 
 Confirm the Pico prints `age: 0` and blinks the red LED.
 
+### Step 22b: Load Project 2 into Binary Ninja and save the database
+
+Exactly like Steps 7–8, but for Project 2. **Use `File -> Open with Options...`** (not plain `File -> Open`), select `0x0008_uninitialized-variables/build/0x0008_uninitialized-variables.bin`, and set:
+
+- **Architecture:** `thumb2`
+- **Platform:** `thumb2`
+- **Base Address:** `0x10000000`
+
+Click **Open**. Then press `G`, type `0x10000000`, and confirm the first two words:
+
+```
+0x10000000   0x20082000   initial stack pointer
+0x10000004   0x1000015d   reset vector (bit 0 = Thumb)
+```
+
+If you see data at `0x00000000`, close the tab and redo it with `Open with Options`.
+
+Save it with `File -> Save As...` as `0x0008_uninitialized-variables.bndb` (next to the `.bin`). From now on open the `.bndb`, not the `.bin`; save with `Cmd+S` / `Ctrl+S` after every rename or patch.
+
+> **Console equivalent:**
+> ```python
+> load("0x0008_uninitialized-variables/build/0x0008_uninitialized-variables.bin",
+>      options={"loader.imageBase": 0x10000000, "loader.platform": "thumb2"})
+> ```
+
+Then resolve the functions for Project 2 the same way as Project 1 — Step 26.
+
 ### Step 23: Break at `main`
 
 `main` is at `0x10000234` in this project too. The GUI sets breakpoints fine (Step 13); the only caution is not to drive `reset run` from the port while Binary Ninja is attached (it desyncs Binary Ninja's view). Use `BP_ADDR`, which arms `main` before Binary Ninja connects: