Why psp is modifying a mips instruction?

[dreambottle]

Ok, I figured this out.

BOOT.BIN is a relocatable ELF file, so jump addresses are modified using the .rel table when it is loaded. And there was a jump instruction at the 0x0881A990 address in the original subroutine.

How to fix this:
1. Find the relocation table offset and size using `readelf -a BOOT.BIN` command in bash terminal.
2. Every table entry consists of 2 uint32's: r_offset and r_info . (spec: sco.com/developers/gabi/latest/ch4.reloc.html#reloc_types )
3. In the table, find the entry for the offset of the relocated instruction. In my case the "problematic" instruction offset is 0x16990 (0x16A30 address in file - 0xA0 section offset in file) and replace the r_info value from 4 to 0.