diff --git a/src/SendCommands.cc b/src/SendCommands.cc
index ddf9c658..b96fe47a 100644
--- a/src/SendCommands.cc
+++ b/src/SendCommands.cc
@@ -846,10 +846,9 @@ static std::shared_ptr<AsyncPromise<C_ExecuteCodeResult_B3>> send_brutal_peeps_h
 
     constexpr uint32_t scan_start = 0x16760000;
     constexpr uint32_t scan_end = 0x16A90000;
-    constexpr uint32_t signature_offset = 0x00002800;
-    constexpr uint32_t signature_size = 0x80;
+    constexpr uint32_t signature_size = 64;
 
-    if (bp_entry->size < (signature_offset + signature_size)) {
+    if (bp_entry->size < signature_size) {
       c->log.warning_f("Skipping Brutal Peeps HP client patch: BattleParamEntry_on.dat too small for signature");
       return nullptr;
     }
@@ -864,10 +863,9 @@ static std::shared_ptr<AsyncPromise<C_ExecuteCodeResult_B3>> send_brutal_peeps_h
     std::string suffix;
     append_u32l(suffix, scan_start);
     append_u32l(suffix, scan_end);
-    append_u32l(suffix, signature_offset);
     append_u32l(suffix, signature_size);
     append_u32l(suffix, 0); // patched below after diff generation
-    suffix.append(vanilla_data + signature_offset, signature_size);
+    suffix.append(vanilla_data, signature_size);
 
     uint32_t patch_entry_count = 0;
     for (uint32_t offset = 0; offset < target_data.size(); offset++) {
@@ -882,10 +880,10 @@ static std::shared_ptr<AsyncPromise<C_ExecuteCodeResult_B3>> send_brutal_peeps_h
       patch_entry_count++;
     }
 
-    suffix[16] = static_cast<char>(patch_entry_count & 0xFF);
-    suffix[17] = static_cast<char>((patch_entry_count >> 8) & 0xFF);
-    suffix[18] = static_cast<char>((patch_entry_count >> 16) & 0xFF);
-    suffix[19] = static_cast<char>((patch_entry_count >> 24) & 0xFF);
+    suffix[12] = static_cast<char>(patch_entry_count & 0xFF);
+    suffix[13] = static_cast<char>((patch_entry_count >> 8) & 0xFF);
+    suffix[14] = static_cast<char>((patch_entry_count >> 16) & 0xFF);
+    suffix[15] = static_cast<char>((patch_entry_count >> 24) & 0xFF);
 
     auto fn = s->client_functions->get("PsoPeepsBrutalPeepsHP", c->specific_version);
 
@@ -902,8 +900,8 @@ static std::shared_ptr<AsyncPromise<C_ExecuteCodeResult_B3>> send_brutal_peeps_h
 
     c->enabled_flags |= fn->client_flag;
 
-    c->log.info_f("Brutal Peeps HP client patch sent: tier={} mult={:g} patch_entries={} signature_offset={:05X} scan={:08X}-{:08X}",
-        tier, mult, patch_entry_count, signature_offset, scan_start, scan_end);
+    c->log.info_f("Brutal Peeps HP client patch sent: tier={} mult={:g} patch_entries={} scan={:08X}-{:08X}",
+        tier, mult, patch_entry_count, scan_start, scan_end);
 
     return promise;
 
diff --git a/system/client-functions/PsoPeepsBrutalPeepsHPBB.s b/system/client-functions/PsoPeepsBrutalPeepsHPBB.s
index fb40fc2c..13d3b1aa 100644
--- a/system/client-functions/PsoPeepsBrutalPeepsHPBB.s
+++ b/system/client-functions/PsoPeepsBrutalPeepsHPBB.s
@@ -20,21 +20,21 @@ start:
 get_data_ptr_ret:
   pop    ebx                                  # ebx = suffix payload
 
-  mov    esi, [ebx]                           # scan_start, scans for signature address, not table base
+  mov    esi, [ebx]                           # scan_start
+  mov    edx, [ebx + 4]                       # scan_end
+  mov    ecx, [ebx + 8]                       # signature_size
+  sub    edx, ecx                             # scan limit = end - sig_size
+  lea    edi, [ebx + 16]                      # signature ptr
 
 scan_again:
-  mov    edx, [ebx + 4]                       # scan_end
-  mov    ecx, [ebx + 12]                      # signature_size
-  sub    edx, ecx                             # scan limit = end - sig_size
   cmp    esi, edx
   ja     not_found
 
   xor    ebp, ebp
-  lea    edi, [ebx + 20]                      # signature ptr
 
 compare_again:
   cmp    ebp, ecx
-  jae    found_signature
+  jae    found_table
 
   mov    al, [esi + ebp]
   cmp    al, [edi + ebp]
@@ -47,14 +47,11 @@ next_candidate:
   inc    esi
   jmp    scan_again
 
-found_signature:
-  # esi = signature address; table base = esi - signature_offset
-  mov    ebp, esi
-  sub    ebp, [ebx + 8]                       # ebp = BattleParam table base
-
-  mov    ecx, [ebx + 16]                      # patch entry count
-  mov    edi, [ebx + 12]                      # signature_size
-  lea    edi, [ebx + edi + 20]                # patch entries after header+signature
+found_table:
+  # esi = BattleParamEntry_on.dat base
+  mov    ecx, [ebx + 12]                      # patch entry count
+  mov    edi, [ebx + 8]                       # signature_size
+  lea    edi, [ebx + edi + 16]                # patch entries after header+signature
 
 patch_again:
   test   ecx, ecx
@@ -62,14 +59,14 @@ patch_again:
 
   mov    edx, [edi]                           # offset from table base
   mov    al, [edi + 4]                        # byte value
-  mov    [ebp + edx], al
+  mov    [esi + edx], al
 
   add    edi, 5
   dec    ecx
   jmp    patch_again
 
 done:
-  mov    eax, ebp                             # return found table base
+  mov    eax, esi                             # return found table base
   jmp    return
 
 not_found:
@@ -88,10 +85,9 @@ get_data_ptr:
 # Server suffix starts here:
 #   uint32_t scan_start
 #   uint32_t scan_end
-#   uint32_t signature_offset
 #   uint32_t signature_size
 #   uint32_t patch_entry_count
-#   signature bytes from table+signature_offset
+#   signature bytes from table start
 #   repeated patch entries:
 #     uint32_t offset
 #     uint8_t value