diff --git a/src/id/prodos.a b/src/id/prodos.a
index 1f64c7a..cdb4ffe 100644
--- a/src/id/prodos.a
+++ b/src/id/prodos.a
@@ -26,3 +26,20 @@ IDProDOS
          !byte $4C        ; JMP
          rts
 }
+
+!zone {
+PatchUniversalRWTSForOrigin
+         ldy   #$0F
+-        lda   .a, y
+         sta   $b990, y
+         dey
+         bpl   -
+         ldy   #$14
+-        lda   .b, y
+         sta   $b92f, y
+         dey
+         bpl   -
+         rts
+.a       !byte $C9,$AB,$D0,$0A,$EA,$BD,$8C,$C0,$C9,$AB,$F0,$95,$D0,$00,$18,$60
+.b       !byte $18,$60,$38,$A5,$2D,$E9,$11,$85,$2D,$18,$60,$00,$00,$00,$00,$00,$00,$00,$00,$38,$60
+}
diff --git a/src/passport.a b/src/passport.a
index 689c97f..7587ac0 100755
--- a/src/passport.a
+++ b/src/passport.a
@@ -319,6 +319,16 @@ ADStyle
 UseUniversal
          jsr   IncProgress
          jsr   StartWithUniv
+         lda   gIsProDOS
+         bne   ReadWithRWTS
+; On disks with a ProDOS bootloader, we patch the universal RWTS in memory
+; so it can also read protected Origin disks like Ultima V and Times of Lore.
+; These disks use a hybrid RWTS that alters the sector number in the
+; address field based on the address epilogue. Once we normalize the
+; sector numbers, no further patches are required, since the RWTS can also
+; read unprotected disks. A separate patcher finds the actual code that
+; alters the sector number to print it to the log.
+         jsr   PatchUniversalRWTSForOrigin
 
 ; note: execution falls through here
 
@@ -683,6 +693,7 @@ _applyToAll
          !source "patchers/prodosmecc.a"        ; gIsProDOS only
          !source "patchers/bbf9.a"              ; gIsProDOS only
          !source "patchers/memory.config.a"     ; gIsProDOS only
+         !source "patchers/origin.a"            ; gIsProDOS only
          !source "patchers/rwtsswapmecc.a"      ; gIsMECCFastloader only
          !source "patchers/protecteddos.a"      ; gIsProtDOS only
          !source "patchers/fbff.a"
diff --git a/src/patchers/origin.a b/src/patchers/origin.a
new file mode 100644
index 0000000..384d9b5
--- /dev/null
+++ b/src/patchers/origin.a
@@ -0,0 +1,43 @@
+;-------------------------------
+; #ORIGIN
+; disk allows either $DE or $AB + timing bit
+; for the address epilogue -- if it finds the latter,
+; it also munges the sector number from the address field
+; (no patches required, but we want to
+; log it and pretend we patched something
+; so we get a nice CRACK COMPLETE message)
+;
+; tested on
+; - Times of Lore
+; - Ultima V
+;-------------------------------
+!zone {
+         lda   gIsProDOS  ; only if ProDOS
+         bne   .exit
+         lda   #$0F
+         sta   .sector+1
+.sector  lda   #$FF       ; modified at runtime
+         sta   gDisplayBytes
+         ldx   #$81
+         ldy   #$18
+         jsr   compare
+         !byte $BD,$8C,$C0; LDA $C08C,X
+         !byte $10,$FB    ; BPL -
+         !byte $C9,$DE    ; CMP #$DE
+         !byte $F0,$0E    ; BEQ +
+         !byte $EA        ; NOP
+         !byte $BD,$8C,$C0; LDA $C08C,X
+         !byte $C9,$AB    ; CMP #$AB
+         !byte $D0,$0C    ; BNE +
+         !byte $38        ; SEC
+         !byte $A5,$5D    ; LDA $5D
+         !byte $E9,$11    ; SBC #$11
+         !byte $85,$5D    ; STA $5D
+         bcs   +
+         lda   #s_origin
+         jsr   PrintByID
+         inc   gPatchCount
++        dec   .sector+1
+         bpl   .sector
+.exit
+}
diff --git a/src/strings/en.a b/src/strings/en.a
index d90fedd..7e5c1fd 100755
--- a/src/strings/en.a
+++ b/src/strings/en.a
@@ -109,6 +109,7 @@ StringTable
          !word .rdos
          !word .sra
          !word .muse
+         !word .origin
 ;
 ; Text can contain substitution strings, which
 ; are replaced by current values at runtime. Each
@@ -134,7 +135,7 @@ StringTable
 ; can be set directly before calling PrintByID.
 ;
 .header
-         !text "Passport by 4am               2017-11-25",$00
+         !text "Passport by 4am               2017-12-03",$00
 .mainmenu
          !text "________________________________________",$8D,$8D,$8D,$8D,$8D,$8D,$8D
          !text "              "
@@ -418,4 +419,7 @@ StringTable
          !text "T%t,S%0 Found SRA protection check",$8D,$00
 .muse
          !text "T00,S08 RWTS doubles every sector ID",$8D,$00
+.origin
+         !text "T%t,S%0 RWTS alters the sector ID if the"
+         !text "address epilogue contains a timing bit.",$8D,00
 }
diff --git a/src/strings/enid.a b/src/strings/enid.a
index 2d5e718..97cc1ec 100644
--- a/src/strings/enid.a
+++ b/src/strings/enid.a
@@ -97,4 +97,5 @@ s_rwtswrite =  $5B
 s_rdos =       $5C
 s_sra =        $5D
 s_muse =       $5E
-STRINGCOUNT =  $5F
+s_origin =     $5F
+STRINGCOUNT =  $60