Firmware Fn getIso2CountryCode

getIso2CountryCode — CfcAspectISO2CountryCodeChangedEvent::getIso2CountryCode

Part of Firmware Reversing.

• File offset: 0x58a974 (VA 0xf6e18668)
• Status: 🟡* Partially traced — one of only 4 functions in the whole "gold standard" set (real name + confirmed real caller) that is ALSO an exact, clean strict-prologue match with no boundary ambiguity — the highest-confidence category this project has. Fully bounded: real frame size 0x110 (272 bytes) confirmed matching exactly at both ends (stwu/epilogue), size 0x534 (1,332) bytes. Ends in the 9th confirmed instance of the central "no locally-visible blr" anomaly documented on Firmware Reversing — now confirmed even in this highest-confidence category, not limited to lower-confidence finds.
• Full mangled name: getIso2CountryCode__36CfcAspectISO2CountryCodeChangedEvent

Real, confirmed structure

A substantial function (5 floating-point register saves f27-f31 alongside 14 GPRs, a 272-byte frame) doing real coordinate/array-bounds validation: compares loop-index bounds (lwz/cmpw against array start/end fields read from an input struct), checks an input parameter against both 3 and 0xa (10) as range limits, and branches to an early-exit path if any check fails — consistent with validating inputs before a real country-code lookup proceeds (array-bounds-checked indexing into some country/region table, matching the function's own name and class — a "country code changed" event naturally needs to look up the real ISO2 code for a location).

Callees

• compare__C32... (name incomplete in the symbol table itself — truncated at 12 characters, not a parsing artifact of this session's own tooling as far as could be determined) — a real comparison function, plausibly used in a binary-search-style lookup against a sorted country/region table.

Net read

A real, substantial, validated-gold function: bounds-checks its inputs thoroughly before what is presumably a real country-code table lookup (the actual lookup/compare call site and what follows wasn't traced further this session). Valuable primarily as further, high- confidence confirmation of the pervasive "no locally-visible blr" anomaly — this function has no ambiguity in its own boundary (unlike most other examples on this wiki) and still shows it, reinforcing that this is a genuine, systemic property of the compiled output itself, not an artifact of uncertain function boundaries.

UPDATE: real Hex-Rays decompilation reveals the actual algorithm —

bounding-box/polygon interpolation geometry, not a simple table lookup

With whole-file function recovery in place (see Firmware Reversing, ".frame_info"-aware recovery section), this function now decompiles, and the real logic is much more specific than "bounds-check then look up a table." After the already-documented range checks (comparing a count parameter against 3 and 10), it:

• Computes a small bounding box from 4 input fields (each padded by ±3, suggesting a tolerance/margin in the same fixed-point coordinate units used elsewhere in this codebase).
• Loops over a small set (bounded by the 3-10 range check) of input coordinate pairs, converting each raw fixed-point value to a real float/double using the same int-to-double bit-trick idiom documented on registerBlocking (XOR with 0x80000000, combine with the 0x43300000... magic double constant).
• For each point, computes a ratio against the bounding-box span and derives both an interpolated float value and a sign flag (-1/0/ 1) stored per-point into a small output array.

This is the real shape of a point-against-boundary / polygon-edge interpolation routine — consistent with determining which side of a country/region boundary a given coordinate falls on (directly matching the class name, CfcAspectISO2CountryCodeChangedEvent), not a generic sorted-table binary search as the compare__C32... callee name alone suggested. The compare callee itself still wasn't reached in this pass (real control flow escapes via JUMPOUT before getting there), so it may still be a real part of the picture — but the bulk of this function's own logic is geometric, not a simple comparison-driven lookup.