update holle patcher [fixes Sherwood Forest]

update changelog
add support for encrypted E7Everywhere [fixes Language Carnival]
2024-05-28 21:41:27 +00:00 · 2024-05-15 11:57:44 -04:00 · 2024-04-29 12:17:24 -04:00 · 2024-04-29 12:10:05 -04:00 · 2024-04-29 12:09:25 -04:00 · 2024-04-28 02:09:21 -04:00
43 changed files with 1114 additions and 225 deletions
--- a/45
+++ b/45
@ -17,36 +17,35 @@ ACME=acme
 CADIUS=cadius
 # https://bitbucket.org/magli143/exomizer/wiki/Home
 # requires Exomizer 3.0 or later
-EXOMIZER=exomizer raw -q -P23
+EXOMIZER=exomizer

 BUILDDISK=build/passport

 asm:
 	mkdir -p build
 	cd src/mods && $(ACME) universalrwts.a
-	$(EXOMIZER) build/universalrwts.bin -o build/universalrwts.tmp
-	printf "\xB8\x00" | cat - build/universalrwts.tmp > build/universalrwts.pak
+	$(EXOMIZER) mem -lnone -q -P23 -f build/universalrwts.bin@0xb800 -o build/universalrwts.pak
 	cd src/mods && $(ACME) -r ../../build/t00only.lst t00only.a
-	$(EXOMIZER) build/t00only.bin -o build/t00only.tmp
-	printf "\x20\x00" | cat - build/t00only.tmp > build/t00only.pak
-	cd src && $(ACME) -r ../build/passport.lst -o ../build/passport.tmp -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/relbase.log
-	cd src && $(ACME) -DRELBASE=`cat ../build/relbase.log | grep "RELBASE =" | cut -d"=" -f2 | cut -d"(" -f2 | cut -d")" -f1` -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/vars.log
-	grep "ThisSlot=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PrintByID=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "WaitForKey=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CleanExit=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "OpenFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "ReadFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CloseFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "GetVolumeName=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "GetVolumeInfo=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PREFSVER=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PREFSFILE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "SLOT=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "DRIVE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "MainMenu=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CheckCache=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	$(EXOMIZER) -b build/passport.tmp -o build/passport.pak
+	$(EXOMIZER) mem -lnone -q -P23 -f build/t00only.bin@0x2000 -o build/t00only.pak
+	echo > build/vars.a
+	cd src && $(ACME) -r ../build/passport.lst -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/relbase.log
+	cd src && $(ACME) -r ../build/passport.lst -DRELBASE=`cat ../build/relbase.log | grep "RELBASE =" | cut -d"=" -f2 | cut -d"(" -f2 | cut -d")" -f1` -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/vars.log
+	grep -m1 "ThisSlot=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PrintByID=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "WaitForKey=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CleanExit=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "OpenFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "ReadFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CloseFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "GetVolumeName=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "GetVolumeInfo=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PREFSVER=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PREFSFILE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "SLOT=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "DRIVE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "MainMenu=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CheckCache=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	$(EXOMIZER) raw -q -P23 -b build/passport.tmp -o build/passport.pak
 	cd src && $(ACME) -DFORWARD_DECRUNCHING=0 wrapper.a
 	cp res/work.po "$(BUILDDISK)".po
 	cp res/_FileInformation.txt build/
--- a/README.md
+++ b/README.md
@ -40,8 +40,8 @@ Using Passport is simple. After running
 the program, put an original disk in
 slot 6, drive 1 and a blank formatted
 disk in any other drive. If necessary,
-press "S" to cycle through your drives.
-Then press "C" to start the cracking.
+press `S` to cycle through your drives.
+Then press `C` to start the cracking.

 If all goes well, Passport will read
 your original disk and write a copy in
@ -55,6 +55,23 @@ copy program.
 If all does not go well, Passport will
 tell you where it all went wrong.

+During the process, you can press any
+key to cancel immediately.
+
+If you have a two-sided disk where only
+one side is bootable, after the first
+side completes, you can press `2` to
+reuse the captured RWTS on the second
+side.
+
+If Passport stops because of read errors
+but you suspect the errors are due to
+physical damage (as opposed to just copy
+protection), you can retry the process
+ignoring errors by pressing `Ctrl-R`.
+The resulting copy may or may not be
+usable.
+
 In any case, Passport will NEVER write
 to or alter your original disk in any
 way. And neither should you! Don't
@ -70,7 +87,10 @@ companies. These types of protection
 were common in educational software.

 - Abracadata
-  e.g. Design Your Own Home
+  e.g. Design Your Own Home series
+
+- Allyn and Bacon
+  e.g. CAAT Skill Tester series

 - American Guidance Service
  e.g. SocMate Analogies Games
@ -81,7 +101,7 @@ were common in educational software.
 - ArtSci
  e.g. AceCalc, Magicalc

- Blue Chip
+- Blue Chip Software
  e.g. Squire, Baron, Tycoon

 - BrainBank
@ -101,6 +121,10 @@ were common in educational software.
  e.g. Curious George in Outer Space,
  Alien Addition

+- Didatech Software
+  e.g. Crosscountry USA, Crosscountry
+  Canada
+
 - Edu-Ware
  e.g. Decimals, Algebra 2

@ -123,7 +147,7 @@ were common in educational software.
  e.g. The Time Tunnel (series),
  Travels with Za-Zoom

- Gamco
+- Gamco Publishing
  e.g. Math Leap Frog, Math Football

 - Grolier Publishing
@ -133,7 +157,7 @@ were common in educational software.
  e.g. Chariots, Cougars, and Kings;
  Tim and the Cat and the Big Red Hat

- Hayden
+- Hayden Software
  e.g. SAT Score Improvement System,
  Microscopic Journey

@ -154,7 +178,7 @@ were common in educational software.
  e.g. Building Reading Skills,
  Explorations in Science

- Krell
+- Krell Software
  e.g. Time Traveler, College Boards

 - Laureate Learning Systems
@ -187,7 +211,7 @@ were common in educational software.
 - Methods & Solutions
  e.g. Fantasy Land, Behind The Wheel

- Micrograms
+- Micrograms Publishing
  e.g. Wild West Math, Granny
  Applebee's Cookie Factory

@ -209,6 +233,10 @@ were common in educational software.
 - National Geographic Society
  e.g. The Botanist's Apprentice

+- Neosoft
+  e.g. Comparison Kitchen, Animal Photo
+  Fun
+
 - Optimum Resource
  e.g. Stickybear Math, Car Builder

@ -246,6 +274,13 @@ were common in educational software.
 - Science Research Associates
  e.g. Computer Drill and Instruction

+- Scott, Foresman and Company
+  e.g. Addition and Subtraction 4,
+  Decimals 3, Dinosaurs and Squids
+
+- Silicon Valley Systems
+  e.g. Rapid Reader, E-Z Learner
+
 - Softsmith
  e.g. Astro Attack, Dinner on a Disk

@ -385,7 +420,7 @@ Passport is open source and is
 distributed under the MIT license.

 Passport
-Copyright (c) 2016-2022 by 4am
+Copyright (c) 2016-2023 by 4am

 Permission is hereby granted, free of
 charge, to any person obtaining a copy
@ -421,6 +456,57 @@ IN THE SOFTWARE.

 ## History

+Unreleased
+- NEW: patchers/t00_jmp600.a
+  (fixes Wizard of Words, Alphabet Zoo,
+  Broadsides)
+- NEW: patchers/e7everywhere.encrypted.a
+  (fixes Language Carnival 1 & 2)
+- IMPROVED: patchers/t00_earthware.a
+  (fixes Black Belt rev. 2)
+- IMPROVED: patchers/d5d5f7.a
+  (fixes Picture Perfect 1987)
+- IMPROVED: patchers/t00_rps.a
+  (fixes Evelyn Dynamic Reader)
+- IMPROVED: patchers/advint.a
+  (fixes War, Questprobe/Spider-Man)
+
+2023-07-28
+- NEW: patchers/didatech.a (fixes
+  Crosscountry USA, Crosscountry
+  Canada, Crosscountry California)
+- NEW: patchers/microlearn.a (fixes
+  US Constitution Tutor, SAT English 1)
+- NEW: patchers/probs5.a (fixes
+  Decimals Analyzer, Whole Numbers
+  Analyzer)
+- NEW: patchers/t00_neosoft.a (fixes
+  Comparison Kitchen, Animal Photo Fun)
+- NEW: patchers/t00_scottforesman.a
+  (fixes Addition and Subtraction 4,
+  Decimals 3, Dinosaurs and Squids)
+- NEW: patchers/t00_scottforesman_
+  dos33.a (fixes Addition and
+  Subtraction 3, Decimals 2)
+- NEW: unexpected 5&3 track detection
+  (fixes Real Math, Mathosaurus)
+- IMPROVED: patchers/d5d5f7.a (fixes
+  Les Sports)
+- IMPROVED: patchers/gamco.a (fixes
+  Percent)
+- IMPROVED: patchers/sierra.a (fixes
+  secondary anti-tamper check in
+  The General Manager)
+- IMPROVED: patchers/sigcheck.a (fixes
+  Water Pollution)
+- IMPROVED: patchers/t00_rwtslog.a
+  (ATILA variant of LSR $6A detection
+  fixes The Treasure of Forest Isle,
+  TAY/BIT detection fixes Rapid
+  Reader and E-Z Learner)
+- Matching updates to the
+  [Passport test suite](https://github.com/a2-4am/passport-test-suite)
+
 2022-07-12
 - NEW: patchers/mak.a (fixes "Kittens,
  Kids, and a Frog")
--- a/res/work.po
+++ b/res/work.po
--- a/src/adstyle.a
+++ b/src/adstyle.a
@ -180,7 +180,7 @@ ADStyle
 ;
 +
 b4bbcompare
-         lda   #$FD                  ; modified at runtime (in Inspect1)
+         lda   #$FD                  ; SMC
         ldx   #$00
         ldy   #$20
         jsr   CompareMemory
@ -236,10 +236,10 @@ x0       lda   $FFC2                 ; high byte modified at runtime (above)
         sta   gPossibleB4BBBasic
         lda   #$BB
 b4bbmodify
-         sta   $FFFF                 ; modified at runtime (high byte in Inspect1, low byte above)
+         sta   $FFFF                 ; SMC
         lda   #$DE
 b4bbmodify2
-         sta   $FFFF                 ; modified at runtime (high byte in Inspect1, low byte above)
+         sta   $FFFF                 ; SMC
         lda   gIsDOS32
         bne   _b4bbexit
         lda   #kSectorCustomDOS32B4BB
--- a/src/apicode.a
+++ b/src/apicode.a
@ -37,6 +37,8 @@
         jmp   modify2
 ;jmodify3
         jmp   modify3
+;jmultimodify
+         jmp   multimodify
 ;jcompare
         jmp   compare
 ;jcompare1
@ -79,6 +81,14 @@
                          ; set in IDBootFailure() after reading T00

 FIRSTFILTER
+;gIsJMP600
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in IDBootloader() after reading T00,S00
+;gIsDidatech
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in TraceDOS33c() after tracing DOS 3.3-shaped RWTS
 ;gIsEnlightenment
         !byte FALSE      ; 0=true, 1=false
                          ; reset before each operation
@ -188,10 +198,6 @@ FIRSTFILTER
         !byte FALSE      ; 0=true, 1=false
                          ; reset before each operation
                          ; set in IDBootloader() after reading T00,S00
-;gPossibleD5D5F7
-         !byte FALSE      ; 0=true, 1=false
-                          ; reset before each operation
-                          ; set in IDBootloader() after reading T00,S00
 ;gIsOptimum
         !byte FALSE      ; 0=true, 1=false
                          ; reset before each operation
--- a/src/apidefs.a
+++ b/src/apidefs.a
@ -158,8 +158,7 @@ gIsDavidDOS                   = gIsProtDOS-$01                        ; byte
 gIsEA                         = gIsDavidDOS-$01                       ; byte
 gPossibleGamco                = gIsEA-$01                             ; byte
 gIsOptimum                    = gPossibleGamco-$01                    ; byte
-gPossibleD5D5F7               = gIsOptimum-$01                        ; byte
-gIs8b3                        = gPossibleD5D5F7-$01                   ; byte
+gIs8b3                        = gIsOptimum-$01                        ; byte
 gIsMilliken1                  = gIs8b3-$01                            ; byte
 gAdventureInternational       = gIsMilliken1-$01                      ; byte
 gIsLaureate                   = gAdventureInternational-$01           ; byte
@ -185,9 +184,11 @@ gPossibleB4BBBasic            = gPossibleWoodbury-$01                 ; byte
 gIsLowDOS                     = gPossibleB4BBBasic-$01                ; byte
 gIsBaudville                  = gIsLowDOS-$01                         ; byte
 gIsEnlightenment              = gIsBaudville-$01                      ; byte
+gIsDidatech                   = gIsEnlightenment-$01                  ; byte
+gIsJMP600                     = gIsDidatech-$01                       ; byte
 ;LASTFILTER ; add new gIs* above this line
 ;gIsInfocom18 is a special case whose ID is not in the regular inspection path
-gIsInfocom18                  = gIsEnlightenment-$01                  ; byte
+gIsInfocom18                  = gIsJMP600-$01                         ; byte
 ;gIs13Sector is a special case whose ID is not in the regular inspection path
 gIs13Sector                   = gIsInfocom18-$01                      ; byte
 ;gMECCFastloadType is a special case integer whose default value cannot be #FALSE
@ -203,7 +204,8 @@ jcompare3                     = gDisplayBytes-$03                     ; 3-byte
 jcompare2                     = jcompare3-$03                         ; 3-byte
 jcompare1                     = jcompare2-$03                         ; 3-byte
 jcompare                      = jcompare1-$03                         ; 3-byte
-jmodify3                      = jcompare-$03                          ; 3-byte
+jmultimodify                  = jcompare-$03                          ; 3-byte
+jmodify3                      = jmultimodify-$03                      ; 3-byte
 jmodify2                      = jmodify3-$03                          ; 3-byte
 jmodify1                      = jmodify2-$03                          ; 3-byte
 jmodify                       = jmodify1-$03                          ; 3-byte
@ -226,6 +228,7 @@ modify                    = jmodify
 modify1                   = jmodify1
 modify2                   = jmodify2
 modify3                   = jmodify3
+multimodify               = jmultimodify
 PrintByID                 = jPrintByID
 SearchTrack               = jSearchTrack
 CallRWTS                  = jCallRWTS
@ -271,7 +274,6 @@ ConstructStandardDelivery = jConstructStandardDelivery
 !warn "gPossibleGamco=",gPossibleGamco
 !warn "gIsOptimum=",gIsOptimum
 !warn "gMECCFastloadType=",gMECCFastloadType
-!warn "gPossibleD5D5F7=",gPossibleD5D5F7
 !warn "gIs8b3=",gIs8b3
 !warn "gIsMilliken1=",gIsMilliken1
 !warn "gAdventureInternational=",gAdventureInternational
@ -303,6 +305,7 @@ ConstructStandardDelivery = jConstructStandardDelivery
 !warn "gDisplayBytes=",gDisplayBytes
 !warn "jcompare=",jcompare
 !warn "jmodify=",jmodify
+!warn "jmultimodify=",jmultimodify
 !warn "jPrintByID=",jPrintByID
 !warn "jSearchTrack=",jSearchTrack
 !warn "jCallRWTS=",jCallRWTS
--- a/src/exodecrunch.s
+++ b/src/exodecrunch.s
@ -66,7 +66,7 @@ EXTRA_TABLE_ENTRY_FOR_LENGTH_THREE = 1
 ; -------------------------------------------------------------------
 ; optional progress UI
 !IFNDEF SHOW_PROGRESS_DURING_DECRUNCH {
-        SHOW_PROGRESS_DURING_DECRUNCH = 0
+  !set SHOW_PROGRESS_DURING_DECRUNCH = 0
 }
 ; -------------------------------------------------------------------
 ; zero page addresses used
@ -160,23 +160,18 @@ gb_get_hi:
 decrunch:

 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-        lda $FBB3
-        cmp #$EA
-        bne +
-        lda #$A1 ; use ! instead of | for initial spinner animation
-        sta progress_char+1
-        sta progress_char+5
-+
-; -------------------------------------------------------------------
-; show initial on-screen progress UI
-;
-        ldy #7
-init_progress_loop:
-        lda progress_char,y
-        jsr show_one_progress_char
-        dey
-        bpl init_progress_loop
-done_init_progress_loop:
+kExoProgressWidth = 23               ; depends on total size, max 38
+         ldx   #(kExoProgressWidth+2)
+         lda   #$DF
+-        sta   $0528+(20-(kExoProgressWidth/2))-1, x
+         sta   $05A8+(20-(kExoProgressWidth/2))-1, x
+         dex
+         bpl   -
+         lda   #$20
+         sta   $05A8+(20-(kExoProgressWidth/2))-1
+         sta   $05A8+(20-(kExoProgressWidth/2))+kExoProgressWidth+1
+         lda   #$A8+(20-(kExoProgressWidth/2))
+         sta   ExoProgressPtr+1
 }
 ; -------------------------------------------------------------------
 ; init zeropage, x and y regs. (12 bytes)
@ -259,25 +254,15 @@ no_hi_decr:
        sta (zp_dest_lo),y

 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-; periodically update on-screen progress UI
-        dec progress_counter
-        bne dont_update_progress_ui
-        tya
-        pha
-        ldy progress_index
-        lda progress_char,y
-        jsr show_one_progress_char
-        inc progress_index
-        lda progress_index
-        and #$07
-        sta progress_index
-        tay
-        lda #$20
-        jsr show_one_progress_char
-        pla
-        tay
-dont_update_progress_ui:
+         dec   ExoProgressCounter
+         bne   +
+         lda   #$20
+ExoProgressPtr
+         sta   $0500                 ; SMC lo byte
+         inc   ExoProgressPtr+1
+
 }
+
 } else {
 literal_start1:
        jsr get_crunched_byte
@ -473,28 +458,8 @@ tabl_bit:
        !BYTE $8c, $e2
 }
 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-progress_index:
-        !BYTE $00
-progress_counter:
-        !BYTE $00
-progress_char:
-        !BYTE $DC, $FC, $AF, $AD, $DC, $FC, $AF, $AD
-progress_address_lo:
-        !BYTE $BB, $BC, $BD, $3D, $BD, $BC, $BB, $3B
-progress_address_hi:
-        !BYTE $05, $05, $05, $06, $06, $06, $06, $06
-show_one_progress_char:
-; in: A=ASCII char to show
-;     y=0..7 index into progress_address_lo/hi array
-        pha
-        lda progress_address_lo,y
-        sta progress_STA+1
-        lda progress_address_hi,y
-        sta progress_STA+2
-        pla
-progress_STA:
-        sta $FFFF
-        rts
+ExoProgressCounter
+         !byte $00
 }
 ; -------------------------------------------------------------------
 ; end of decruncher
--- a/src/id/bootfailure.a
+++ b/src/id/bootfailure.a
@ -63,6 +63,7 @@ VerifyInfocom18
         beq   .setcount  ; passport-test-suite/Trinity - Side B.woz [Z=1] here
         lda   #$02       ; passport-test-suite/Time Lord.woz [Z=0] here
                          ; only two sectors when in ID mode
+
 .setcount
         sta   tmp        ; sector counter

@ -161,7 +162,6 @@ VerifyInfocom18
         stx   $43
         stx   $44
         stx   $45
-         bne   +

 .retryrw18
         jsr   ReadNib
@ -172,7 +172,7 @@ VerifyInfocom18
         bne   --
         jsr   .rw18pro
         bne   .badrw18
-+        ldx   $2D
+         ldx   $2D
         cmp   $40,x
         beq   .badrw18
         sta   $40,x
@ -423,3 +423,7 @@ read13
         lda   $C0E8
         rts
 }
+
+; this prevents branches in this file from crossing a page
+; (adjust as necessary)
+filler   !fill 9
--- a/src/id/d5d5f7.a
+++ b/src/id/d5d5f7.a
@ -1,33 +0,0 @@
-;-------------------------------
-; IDD5D5F7
-; Identify specific version of DOS 3.3 bootloader
-; shared by all disks that use the D5D5F7 check.
-; Note: this detection pattern makes no logical
-; sense; it just happens to be a useful filter for
-; the D5D5F7 patcher to use later. It filters out
-; about 2/3 of disks on which I've never seen a
-; D5D5F7 protection check, so we can save time by
-; not doing full-track searches on those disks.
-;
-; in:    $0800..$08FF contains T00,S00
-;        IDDOS33 returned success
-;        A = 0
-; out:   A = 0
-;        Y preserved
-;        all other flags and registers clobbered
-;-------------------------------
-!macro IDD5D5F7 {
-         ldx   #$08
-         cpx   $08F2
-         beq   @d5yes     ; passport-test-suite/Trivia Fever (BB03 variant 3).woz [Z=1] matches
-         cpx   $084C
-         bne   @d5no
-         ldx   $08B0
-         cpx   #$B6
-         bne   @d5no
-         ldx   $08D0
-         cpx   #$20
-         bne   @d5no
-@d5yes   sta   gPossibleD5D5F7 ; passport-test-suite/RoboMath.woz [Z=1] matches
-@d5no
-}
--- a/src/id/inspect0.a
+++ b/src/id/inspect0.a
@ -99,12 +99,6 @@ IDBootloader
         bcs   .notdos33
         sta   gIsBoot0              ; A = 0 (TRUE)
 ;
-; Try to identify specific DOS 3.3-shaped bootloader
-; that may imply a D5D5F7 whole-track protection.
-; (in A=0; out A=0)
-;
-         +IDD5D5F7
-;
 ; Try to identify Diversi-DOS
 ; (in A=0; out A=0)
 ;
@ -154,6 +148,19 @@ IDBootloader
         jmp   Trace8B3
 .not8b3
 ;
+; Try to identify a bootloader that loads several sectors
+; into the text page before loading a non-standard RWTS in
+; higher memory.
+; Exit via custom trace function if found.
+;
+         +IDJMP600
+         bcs   .notjmp600
+         jsr   PrintByID
+         !byte s_jmp600
+         sta   gIsJMP600             ; A = 0 (TRUE)
+         jmp   FoundJMP600
+.notjmp600
+;
 ; Try to identify all the different MECC fastloader variants.
 ; Exit via custom trace function if found.
 ; (in A=0,X=0; out A=0,X=0)
--- a/src/id/jmp600.a
+++ b/src/id/jmp600.a
@ -0,0 +1,47 @@
+;------------------------------------------------------------------------------
+; IDJMP600
+; identify JMP600 bootloader
+; custom boot sector uses its own RWTS to load one or more sectors into the
+; text page and eventually jumps to $600 which uses a second RWTS to load
+; and jump to a third RWTS at $B700
+;
+; in:    track buffer contains T00,S00
+;        A = 0
+;        X = 0
+; out:   C clear if JMP600 bootloader was found
+;        C set if not found
+;        A = 0
+;        X = 0
+;        all other registers & flags clobbered
+;-------------------------------
+!macro IDJMP600 {
+         ldy   #$11
+         jsr   compare
+         !byte $01,$A2,$00,$BD,$00,$08,$9D,$00
+         !byte $02,$E8,$D0,$F7,$4C,$0F,$02,$A9
+         !byte $A0
+                          ; passport-test-suite/Competition Karate.woz [C=0] matches
+}
+
+FoundJMP600
+;
+; We found a JMP600 bootloader. Now we create
+; an RWTS that can read the rest of the disk.
+; Starting with our built-in RWTS, we modify address
+; and data prologues based on the parameters of the
+; original disk.
+;
+         lda   $84A
+         lsr
+         sta   UNIV_A1
+         lda   $853
+         sta   UNIV_A2
+         lda   $85D
+         sta   UNIV_A3
+         lda   $888
+         sta   UNIV_D1
+         lda   $891
+         sta   UNIV_D2
+         lda   $89B
+         sta   UNIV_D3
+         jmp   ADStyle
--- a/src/id/trace32.a
+++ b/src/id/trace32.a
@ -41,7 +41,7 @@ TraceDOS32LO
 .TraceDOS32c
         lda   #$03
         ldx   #$0D
-         ldy   #$39
+         ldy   #$36
         jsr   CompareMemory
         !byte $A6,$2B
         !byte $A9,$09
@ -70,7 +70,6 @@ TraceDOS32LO
         !byte $AD,$CC,$03
         !byte $85,$3F
         !byte $E6,$3F
-         !byte $6C,$3E,$00
         bcs   .tryChoplifter
         lda   $03CC
         cmp   #$B2                  ; RDOS
@ -100,6 +99,18 @@ TraceDOS32LO
         lda   #$00
         sta   jCallRWTS+1

+         ;don't let The Game Show print
+
+         lda   $343
+         eor   #$4C
+         bne   +
+         sta   $345
+         lda   #$6C
+         sta   $343
+         lda   #$3E
+         sta   $344
+
+
 ; set up final trace

         lda   #$4C
--- a/src/id/trace33.a
+++ b/src/id/trace33.a
@ -204,6 +204,29 @@ TraceDOS33c               ; 2nd-level trace callback is here
         sta   T02S05
 .notMilliken
 ;
+; Check for Didatech decryption routine
+; (affects readable/ignoreable sector map, so must ID now)
+;
+         lda   MaybeBC
+         ldx   #$E1
+         ldy   #$0A
+         jsr   CompareMemory
+         !byte $A2,$04
+         !byte $A0,$05
+         !byte $A9,$96
+         !byte $59,$00,$08
+         !byte $99
+         bcs   .notDidatech ; passport-test-suite/Crosscountry Canada.woz [C=0] matches
+         lda   #$07
+         sta   gDisplayBytes
+         jsr   PrintByID
+         !byte s_didatech
+         lda   #kSectorOptional
+         sta   T02S07
+         lda   #TRUE
+         sta   gIsDidatech
+.notDidatech
+;
 ; Try to initialize the 'current track' variable like the bootloader would --
 ; required for some disks that use a strange location for this variable
 ; e.g. Super Taxman II
@ -334,6 +357,37 @@ TraceDOS33c               ; 2nd-level trace callback is here
         jsr   $BC61
 .notFun
 ;
+; Check for Micro Learn RWTS
+; (uses per-disk zero page values within RWTS)
+;
+         lda   MaybeB7
+         cmp   #$B7
+         bne   .notLearn
+         ldx   #$38
+         ldy   #$08
+         jsr   CompareMemory
+         !byte $A9,WILDCARD
+         !byte $85,$31
+         !byte $A9,WILDCARD
+         !byte $85,$D6
+         bcs   .notLearn  ; passport-test-suite/U.S. Constitution Tutor.woz [C=0] matches
+         lda   #$C9
+         sta   $B8E6
+         sta   $B8F0
+         sta   $B934
+         sta   $B954
+         sta   $B95E
+         sta   $B990
+         lda   $B739
+         sta   $B8F1
+         sta   $B955
+         sta   $B991
+         lda   $B73D
+         sta   $B8E7
+         sta   $B935
+         sta   $B95F
+.notLearn
+;
 ; Check for alternate RWTS entry point (e.g. Swordthrust)
 ;
         lda   MaybeB7
@ -375,9 +429,21 @@ TraceDOS33c               ; 2nd-level trace callback is here
         !byte $D0,$13
         !byte WILDCARD,WILDCARD
         !byte $9D,$8D,$C0
-         bcs   .notEarthware ; passport-test-suite/Zoo Master.woz [C=0] matches
+         bcc   .yesEarthware ; passport-test-suite/Zoo Master.woz [C=0] matches
+         ldx   #$8C
+         jsr   CompareMemory
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$AD
+         !byte $D0,$F4
+         !byte $A9,$F8
+         !byte $3D,$8C,$C0
+         bcs   .notEarthware ; passport-test-suite/Zoo Master rev. 2.woz [C=0] matches
+.yesEarthware
         lda   #$BD
         sta   $B8F6
+         lda   $B8F7
+         sta   EarthwareSwapperLo+1
         lda   #$8C
         sta   $B8F7
         lda   #$C0
--- a/src/modify.a
+++ b/src/modify.a
@ -90,3 +90,45 @@ mod_tmp_y=*+1
         ldy   #$FD                  ; SMC
         clv
         rts
+
+multimodify
+; in:    (A/Y) -> sector+offsets+values block
+;        X = number of values (must also be equal number of sectors and offsets)
+; out:   all registers/flags clobbered
+         sta   @getsector+1
+         sty   @getsector+2
+         stx   @loop+1
+         clc
+         adc   @loop+1
+         bcc   +
+         iny
+        sta   @getoffset+1
+         sty   @getoffset+2
+         clc
+         adc   @loop+1
+         bcc   +
+         iny
+        sta   @getvalue+1
+         sty   @getvalue+2
+         jmp   @next
+@loop
+         ldy   #$FD                  ; SMC
+@getvalue
+         lda   $FDFD, y              ; SMC
+         sta   @cmpvalue
+         sta   @modvalue
+@getsector
+         lda   $FDFD, y              ; SMC
+@getoffset
+         ldx   $FDFD, y              ; SMC
+         jsr   compare1
+@cmpvalue
+         !byte $FD                   ; SMC
+         bcc   @next
+         jsr   modify1
+@modvalue
+         !byte $FD                   ; SMC
+@next
+         dec   @loop+1
+         bpl   @loop
+         rts
--- a/src/mods/t00only.a
+++ b/src/mods/t00only.a
@ -62,6 +62,7 @@ AnalyzeT00
         !source "../patchers/t00_methods.a"
         !source "../patchers/t00_microfun.a"
         !source "../patchers/t00_microfun2.a"
+         !source "../patchers/t00_microlearn.a"
         !source "../patchers/t00_milliken.a"
         !source "../patchers/t00_muserwts.a"
         !source "../patchers/t00_panglosdos.a"
@ -72,6 +73,8 @@ AnalyzeT00
         !source "../patchers/t00_sunburst.a"
         !source "../patchers/t00_sve.a"
         !source "../patchers/t00_swordthrust.a"
+         !source "../patchers/t00_scottforesman_dos33.a"
+         !source "../patchers/t00_neosoft.a"
         ; ----- add new DOS 3.3 patchers above this line -----
         !source "../patchers/t00_nibtable.a"   ; clobbers $2000..$2095 (AnalyzeT00 is decompressed into $2000)
         !source "../patchers/t00_rwts.a"       ; must run after all other patchers that might modify RWTS code
@ -97,6 +100,8 @@ T00_IsNotRWTS
         !source "../patchers/t00_sigcheck.a"
         !source "../patchers/t00_baudville.a"
         !source "../patchers/t00_enlightenment.a"
+         !source "../patchers/t00_scottforesman.a"
+         !source "../patchers/t00_jmp600.a"
         rts

 !if * > $3200 {
--- a/src/passport.a
+++ b/src/passport.a
@ -37,7 +37,7 @@
 VERBOSE  = $00       ; set to $01 to display API label addresses
 }

-!to "../build/PASSPORT.TMP",plain
+!to "../build/passport.tmp",plain
 !ct "lcase.ct"

 Relocatable
@ -65,7 +65,6 @@ NonRelocatable
         !source "id/quickdos.a"
         !source "id/diversidos.a"
         !source "id/prontodos.a"
-         !source "id/d5d5f7.a"
         !source "id/laureate.a"
         !source "id/micrograms.a"
         !source "id/volumename.a"
@ -77,6 +76,7 @@ NonRelocatable
         !source "id/davidson.a"
         !source "id/holle.a"
         !source "id/phoenix.a"
+         !source "id/jmp600.a"
         !source "id/555.a"
         !source "id/trace32.a"
         !source "id/trace8b3.a"
@ -334,7 +334,7 @@ AnalyzeTrack
         ; only run these modules in crack mode
         !source "patchers/universale7.a"
         !source "patchers/c9ff.a"
-         !source "patchers/d5d5f7.a"            ; gIsPascal || (gIsBoot0 && gPossibleD5D5F7) only
+         !source "patchers/d5d5f7.a"            ; gIsPascal || gIsBoot0 only
         !source "patchers/rwtsswapmecc.a"      ; gMECCFastloadType || gPossibleMECCSwapper only
         !source "patchers/meccdqc.a"           ; gMECCFastloadType==1 && gT07 only
         !source "patchers/rwtsswappenguin.a"   ; T01 only
@ -379,11 +379,14 @@ AnalyzeTrack
 +
         !source "patchers/hallabs.a"           ; gIsBoot0 && T01 only
         !source "patchers/harvey.a"            ; gIsBoot0 && T01 only
+         !source "patchers/microlearn.a"        ; gIsBoot0 && T01 only
         !source "patchers/jmpb400.a"           ; gIsBoot0 && T02 only
         !source "patchers/jmpb412.a"           ; gIsBoot0 && T02 only
         !source "patchers/mak.a"               ; gIsBoot0 && T02 only
         !source "patchers/jsr8635.a"           ; gIsBoot0 only
         !source "patchers/sierra.a"            ; gIsBoot0 only
+         !source "patchers/probs5.a"            ; gIsBoot0 only
+         !source "patchers/didatech.a"          ; gIsBoot0 && gIsDidatech only
 _endDOS33Patchers
         ;
         ; Diversi-DOS-specific patchers
@ -401,6 +404,7 @@ _endDiversiPatchers
 +
         !source "patchers/bbf9.a"              ; gIsProDOS only
         !source "patchers/fbffencrypted.a"     ; gIsProDOS only
+         !source "patchers/e7everywhere.encrypted.a" ; gIsProDOS only
         !source "patchers/pfs.prodos.a"        ; gIsProDOS && T05 only
         !source "patchers/leisure.a"           ; gIsProDOS && T22 only
         !source "patchers/memory.config.a"     ; gIsProDOS only
@ -463,6 +467,8 @@ _byte_skip_hi:
         rts

         !source "id/bootfailure.a"
+         nop
+         nop
         !source "wholetrack.a"
         !source "apicode.a"                    ; /!\ must be last

--- a/src/patchers/555.a
+++ b/src/patchers/555.a
@ -850,6 +850,8 @@ Do555
         sta   $BDF2
         lda   #$B9
         sta   $BE2B
+         lda   #$50
+         sta   $47E       ; blow away track number to force full recalibration
         rts

 .exit
--- a/src/patchers/advint.a
+++ b/src/patchers/advint.a
@ -1,30 +1,66 @@
 ;-------------------------------
 ; #ADVINT
-; encrypted protection check on
-; Adventure International disks
+; protection check on Adventure International disks
+; usually encrypted but not always
 ;
 ; tested on
 ; - Curse of Crowley Manor
 ; - Earthquake San Francisco 1906
 ; - QuestProbe featuring The Hulk
+; - QuestProbe featuring Spider-Man vB-258
+; - QuestProbe featuring Spider-Man vF-261
 ; - SAGA1 - Adventureland v2.0-416
 ; - SAGA1 - Adventureland v2.1-416
 ; - SAGA2 - Pirate Adventure v2.1-408
-; - SAGA3 - Mission Impossible v2.1/306
-; - SAGA4 - Voodoo Castle v2.1/119
+; - SAGA3 - Mission Impossible v2.1-306
+; - SAGA4 - Voodoo Castle v2.1-119
 ; - SAGA5 - The Count v2.1-115
 ; - SAGA6 - Strange Odyssey v2.1-119
 ;-------------------------------
 !zone {
         lda   gAdventureInternational
         bne   .exit
+         ; variant 0 - very old, possibly first generation
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $C9,$9C
+         !byte $B0,$04
+         !byte $BD,$88,$C0
+         !byte $60
+         !byte $4C
+         bcs   .variant1             ; passport-test-suite/War.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_advint
+         jsr   inx8
+         jsr   modify3
+         !byte $18                   ;CLC
+         !byte $90,$F9               ;BCC -$F9
+         bvc   .exit                 ; always branches
+;-----
+.variant1
+         ; variant 1 - unencrypted
+         ldy   #$08
+         jsr   SearchTrack
+         !byte $4C,WILDCARD,WILDCARD ;JMP $****
+         !byte $BD,$8C,$C0           ;LDA $C08C,X
+         !byte $10,$FB               ;BPL -$FB
+         bcs   .variant2             ; passport-test-suite/Spiderman B.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_advint
+         jsr   modify3
+         !byte $18                   ;CLC
+         !byte $90,$6E               ;BCC +$6E
+         bvc   .exit                 ; always branches
+;-----
+.variant2
+         ; variant 2 - bytes are XOR'd with #$C9 on disk
+         ; comments show decrypted code
         ldy   #$08
         jsr   SearchTrack
-         ; bytes are XORd with #$C9 on disk -- comments show decrypted code
         !byte $85,WILDCARD,WILDCARD ;JMP $****
         !byte $74,$45,$09           ;LDA $C08C,X
         !byte $D9,$32               ;BPL -$FB
-         bcs   .exit      ; passport-test-suite/S.A.G.A. 6.woz [C=0] matches
+         bcs   .exit                 ; passport-test-suite/S.A.G.A. 6.woz [C=0] matches
         jsr   PrintByID
         !byte s_advint
         jsr   modify3
--- a/src/patchers/d5d5f7.a
+++ b/src/patchers/d5d5f7.a
@ -3,29 +3,24 @@
 ; nibble count with weird bitstream
 ; involving $D5 and $F7 as delimiters
 ;
-; Ace Detective
-; Cat 'n Mouse
-; Cotton Tales
-; Dyno-Quest
-; Easy Street
-; Fraction-oids
-; Math Magic
-; RoboMath
+; Ace Detective (Mindplay)
+; Cat 'n Mouse (Mindplay)
+; Cotton Tales (Mindplay)
+; Dyno-Quest (Mindplay)
+; Easy Street (Mindplay)
+; Fraction-oids (Mindplay)
+; Math Magic (Mindplay)
+; RoboMath (Mindplay)
 ; NoteCard Maker (Pascal variant)
+; Les Sports (DC Heath) - variant wrapped by PHA/PLAs
+; Picture Perfect (1987) (Mindplay)
 ;-------------------------------
 !zone {
 ;
-; always run on Pascal disks
+; only run on Pascal disks and DOS 3.3 disks
 ;
         lda   gIsPascal
-;
-; if DOS 3.3-shaped bootloader, only run if we found
-; specific markers on T00,S00 earlier that are shared
-; by all the samples I have that use this protection.
-; (This filter is subject to revision if we find
-; additional samples.)
-;
-         and   gPossibleD5D5F7
+         and   gIsBoot0
         bne   .exit
         ldy   #$20
         jsr   SearchTrack
@ -46,11 +41,12 @@
         !byte $C8        ; INY
         !byte $18        ; CLC
         !byte $6D        ; ADC
-         bcs   .exit      ; passport-test-suite/RoboMath.woz [C=0] matches
+         bcs   .exit      ; passport-test-suite/Cotton Tales.woz [C=0] matches
                          ; passport-test-suite/Notecard Maker.woz [C=0] matches
         jsr   PrintByID
         !byte s_d5d5f7
-         jsr   modify1
-         !byte $60        ; RTS
+         jsr   modify3
+         !byte $18        ; CLC
+         !byte $90,$62    ; BCC +$62
 .exit
 }
--- a/src/patchers/didatech.a
+++ b/src/patchers/didatech.a
@ -0,0 +1,25 @@
+;-------------------------------
+; #DIDATECH
+; nibble check of malformed T02,S07
+;
+; tested on
+; - Crosscountry Canada
+; - Crosscountry USA
+; - Crosscountry California
+;-------------------------------
+         lda   gIsDidatech
+         bne   +
+
+         ldy   #$09
+         jsr   SearchTrack; code is XOR #$96 but not tamper-checked
+         !byte $06,$59    ; BCC -$CF
+         !byte $8E        ; CLC
+         !byte $36,$68    ; LDY #$FE
+         !byte $06,$97    ; BCC +$01
+         !byte $5E        ; INY
+         !byte $1A        ; STY ....
+         bcs   +          ; passport-test-suite/Crosscountry Canada.woz [C=0] matches
+         jsr   inx7
+         jsr   modify1
+         !byte $7C        ; NOP instead of INY
+
--- a/src/patchers/e7everywhere.a
+++ b/src/patchers/e7everywhere.a
@ -3,8 +3,9 @@
 ; E7 bitstream in the track seam of every track
 ;
 ; We can't attack the bitstream itself (like #UNIVERSALE7) because it's not
-; within any sector data, so we search for the code instead. AFAIK the code
-; is never encrypted.
+; within any sector data, so we search for the code instead. Encrypted
+; variant is handled elsewhere.
+;
 ; This does a full-track search on every track, which is unfortunate. I've
 ; only seen this protection on DOS and ProDOS disks, so we filter on that
 ; to optimize performance a little bit.
--- a/src/patchers/e7everywhere.encrypted.a
+++ b/src/patchers/e7everywhere.encrypted.a
@ -0,0 +1,30 @@
+;------------------------------------------------------------------------------
+; #E7EVERYWHERE.ENCRYPTED
+; E7 bitstream in the track seam of every track
+;
+; We can't attack the bitstream itself (like #UNIVERSALE7) because it's not
+; within any sector data, so we search for the code instead.
+;
+; tested on
+; - Language Carnival 1 & 2 (DLM)
+;------------------------------------------------------------------------------
+         ; gIsProDOS is TRUE here
+         lda   #$0F
+         sta   .sector+1
+.sector  lda   #$FF                  ; modified at runtime
+         ldx   #$0C
+         ldy   #$0A
+         jsr   compare
+         !byte $F5
+         !byte $20,$00,$20
+         !byte $90,$04
+         !byte $20,$B0,$FE
+         !byte $60
+         bcs   .nextsector           ; passport-test-suite/Language Carnival.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_e7everywhere
+         jsr   modify1               ; change branch target to success path
+         !byte $09
+.nextsector
+         dec   .sector+1
+         bpl   .sector
--- a/src/patchers/gamco.a
+++ b/src/patchers/gamco.a
@ -16,12 +16,26 @@
         !byte $33,$32,$01,$30,$03,$31,$39,$31
         !byte $03,$31,$32,$38,$02,$31,$31,$02
         !byte $39,$36
-         bcs   .exit      ; passport-test-suite/Essential Grammar.woz [C=0] matches
+         bcs   .var2      ; passport-test-suite/Essential Grammar.woz [C=0] matches
         jsr   PrintByID
         !byte s_poke
         jsr   modify
         !byte $34,$34,$01,$30,$02,$31,$30,$03
         !byte $32,$33,$34,$03,$31,$36,$39,$02
         !byte $33,$39
+         bvc   .exit
+.var2
+         ldy   #$12
+         jsr   SearchTrack
+         !byte $32,$01,$30,$03,$31,$39,$31,$03
+         !byte $31,$32,$38,$03,$32,$35,$30,$02
+         !byte $33,$31
+         bcs   .exit      ; passport-test-suite/Percent (Gamco).woz [C=0] matches
+         jsr   PrintByID
+         !byte s_poke
+         jsr   modify
+         !byte $36,$01,$30,$03,$31,$36,$39,$03
+         !byte $31,$32,$38,$03,$31,$36,$39,$02
+         !byte $33,$39
 .exit
 }
--- a/src/patchers/holle.a
+++ b/src/patchers/holle.a
@ -92,6 +92,17 @@
         jsr   modify2
         !byte $A0,$00               ; LDY #$00

+         ; look for save game disk volume number check
+         ; e.g. Sherwood Forest
+        ldy   #$05
+         jsr   SearchTrack
+         !byte $AD,$16,$98           ; LDA $9816
+         !byte $F0,$0F               ; BEQ +0F
+         bcs   +
+         jsr   inx4
+         jsr   modify1
+         !byte $00
+
         ; look for secondary disk volume number check
         ; e.g. Crime Wave
 +        ldy   #$04
--- a/src/patchers/microlearn.a
+++ b/src/patchers/microlearn.a
@ -0,0 +1,30 @@
+;-------------------------------
+; #MICROLEARN
+; protection check that writes
+; its own protection track on
+; first boot
+;
+;-------------------------------
+!zone {
+         lda   gTrack
+         cmp   #$01
+         bne   .exit
+
+         lda   #$00
+         ldx   #$84
+         jsr   compare3
+         !byte $4C,$8E,$AE
+         bcs   .exit
+
+         sta   gDisplayBytes
+         ldy   #$AE
+         sty   gDisplayBytes+1       ; address (hi)
+         ldy   #$8E
+         sty   gDisplayBytes+2       ; address (lo)
+         jsr   PrintByID
+         !byte s_beforedos
+
+         jsr   modify3
+         !byte $AD,$E9,$B7
+.exit
+}
--- a/src/patchers/probs5.a
+++ b/src/patchers/probs5.a
@ -0,0 +1,35 @@
+;-------------------------------
+; #PROBS5
+; sector check of track $23
+; usually found in PROBS5 file
+;
+; tested on
+; - Addition and Subtraction of Fractions Analyzer
+; - Addition and Subtraction of Fractions Worksheet
+; - Decimals Analyzer
+; - Decimals Worksheet
+; - Multiplication and Division of Fractions Analyzer
+; - Multiplication and Division of Fractions Worksheet
+; - Whole Numbers Analyzer
+; - Whole Numbers Worksheet
+;-------------------------------
+!zone {
+         lda   #$0F
+         sta   .sector+1
+.sector  lda   #$FF       ; modified at runtime
+         ldx   #$00
+         ldy   #$08
+         jsr   compare
+         !byte $00,$20, $FF,$0F ; DOS 3.3 file header
+         !byte $A9,$23    ; LDA #$23
+         !byte $8D,$EC    ; STA $..EC
+         bcs   +          ; passport-test-suite/Addition and Subtraction of Fractions Analyzer.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_probs5
+         ldx   #$04
+         jsr   modify1
+         !byte $60        ; RTS
+        dec   .sector+1
+         bpl   .sector
+.exit
+}
--- a/src/patchers/sierra.a
+++ b/src/patchers/sierra.a
@ -29,6 +29,7 @@
 ; - Mixed Up Mother Goose
 ; - The Artist
 ; - Ultima II
+; - The General Manager
 ;
 ; module by qkumba
 ;-------------------------------
@ -45,6 +46,30 @@
         jsr   modify1
         !byte $2C

+         pha
+         txa
+         sec
+         sbc   #10
+         tax
+         pla
+         ldy   #8
+         jsr   compare
+         !byte $AD,WILDCARD,$63 ;LDA $63xx
+         !byte $C9,$20          ;CMP #$20
+         !byte $F0,$03          ;BEQ *+5
+         !byte $4C              ;JMP $xxxx
+         bcs   +
+         pha
+         jsr   PrintByID
+         !byte s_tamper
+         txa
+         clc
+         adc   #4
+         tax
+         pla
+         jsr   modify1
+         !byte $2C ;don't run protection check
+
         ;there are two of these on the same track

 +        ldy   #3
--- a/src/patchers/sigcheck.a
+++ b/src/patchers/sigcheck.a
@ -12,15 +12,40 @@
 ; - Conjecture (Robert Scott)
 ;-------------------------------
         lda   gIsBoot0
-         bne   +
+         bne   @exit
         ldy   #$05
         jsr   SearchTrack
         !byte $BD,$80,$C0; LDA $C080,X
         !byte $18        ; CLC
         !byte $68        ; PLA
-         bcs   +          ; passport-test-suite/Advanced Electricity.woz [C=0] matches
+         bcs   @exit      ; passport-test-suite/Advanced Electricity.woz [C=0] matches
         inx
         inx
         jsr   modify1
         !byte $D0        ; change indexed softswitch address so it does nothing
-+
+                          ; now search for non-standard RWTS parameters
+                          ; conveniently listed at beginning of SIGCHECK routine
+         ldy   #$0C
+         jsr   SearchTrack
+         !byte $D5,$AA,$96
+         !byte WILDCARD,WILDCARD
+         !byte $D5,$AA,$AD
+         !byte WILDCARD,WILDCARD
+         !byte $18,$B0
+         bcs   @exit
+         jsr   +
+         jmp   @exit
+        jsr   ++
+         inx
+         inx
++       inx
+         inx
+         inx
+         jsr   compare2
+         !byte $DE,$AA
+         bcc   +++
+                          ; passport-test-suite/Water Pollution.woz reaches here
+         jsr   modify2
+         !byte $DE,$AA
+++      rts
+@exit
--- a/src/patchers/t00_earthware.a
+++ b/src/patchers/t00_earthware.a
@ -10,14 +10,16 @@
 ;
 ; tested on
 ; - Black Belt (Earthware Computer Services)
+; - Black Belt rev. 2 (Earthware Computer Services)
 ; - Zoo Master (Earthware Computer Services)
+; - Zoo Master rev. 2 (Earthware Computer Services)
 ; - Star Search (Earthware Computer Services)
 ;-------------------------------
 EARTHWARE
         lda   #$02
         ldx   #$F6
         jsr   compare3
-         !byte $4C,$89,$B6
+         !byte $4C,WILDCARD,$B6
         bcs   @exit                 ; passport-test-suite/Zoo Master.woz [C=0] here
         jsr   PrintByID
         !byte s_bytrack
--- a/src/patchers/t00_jmp600.a
+++ b/src/patchers/t00_jmp600.a
@ -0,0 +1,144 @@
+;------------------------------------------------------------------------------
+; #JMP600
+; custom boot sector uses its own RWTS to load one or more sectors into the
+; text page and eventually jumps to $600 which uses a second RWTS to load
+; and jump to a third RWTS at $B700
+;
+; tested on
+; - Dinosaurs v1.0 (Advanced Ideas)
+; - Wizard of Words v1.0 (Advanced Ideas)
+;------------------------------------------------------------------------------
+;
+; common to all variants:
+;
+; T00,S00,$4A:  -> D5
+; T00,S00,$53:  -> AA
+; T00,S00,$5D:  -> 96
+;
+; T00,S00,$88:  -> D5
+; T00,S00,$91:  -> AA
+; T00,S00,$9B:  -> AD
+;
+; T00,S03,$1A:  -> D5
+; T00,S03,$23:  -> AA
+; T00,S03,$2D:  -> 96
+;
+; T00,S03,$57:  -> D5
+; T00,S03,$60:  -> AA
+; T00,S03,$6A:  -> AD
+;
+; That's all that's required for the 'basic' version (e.g. Wizard of Words v1.0).
+; Its final RWTS loaded into $B700+ is custom but seamlessly supports both
+; reading and reading of both protected and unprotected disks. However, there
+; are several variants in use. Some variants require additional patches because
+; - they don't support reading from unprotected disks (e.g. In Search of the Most Amazing Thing), or
+; - they don't support writing to unprotected disks, or
+; - they support writing to disks but in some other protected format that is
+;   different than the program disk (e.g. Competition Karate, Amazon)
+
+; e.g. Competition Karate / Amazon variant:
+;
+; T00,S06,$53:  -> D5
+; T00,S06,$58:  -> AA
+; T00,S06,$5D:  -> AD
+; T00,S06,$9E:  -> DE
+; T00,S06,$A3:  -> AA
+; T00,S06,$A8:  -> EB
+;
+; T00,S07,$46:  -> D5
+; T00,S07,$4B:  -> AA
+; T00,S07,$50:  -> 96
+; T00,S07,$7A:  -> DE
+; T00,S07,$7F:  -> AA
+; T00,S07,$84:  -> EB
+;
+; T00,S08,$74:  -> D5
+; T00,S08,$82:  -> AA
+; T00,S08,$91:  -> 96
+;
+; TODO need to test on real hardware and see if these are sufficient:
+; T00,S06,$49:  -> 04 to restore standard timing
+; T00,S07,$D2:  -> 2C to burn fewer cycles
+; T00,S08,$6C:  -> 2C to burn fewer cycles
+;
+;.competitionkaratemulti ; length=21 dec
+;         !byte $08,$08,$08,$08,$07,$07,$07,$07,$07,$07,$07,$07,$07,$07,$06,$06,$06,$06,$06,$06,$06
+;         !byte $91,$82,$74,$6C,$F7,$E8,$DA,$D2,$84,$7F,$7A,$50,$4B,$46,$A8,$A3,$9E,$5D,$58,$53,$49
+;         !byte $96,$AA,$D5,$2C,$AD,$AA,$D5,$2C,$EB,$AA,$DE,$96,$AA,$D5,$EB,$AA,$DE,$AD,$AA,$D5,$04
+
+!zone {
+         ; gTrack = 0
+         lda   gIsJMP600
+         beq   .start
+         jmp   .exit
+
+.jmp600multi ; length=12 dec
+;sectors
+         !byte $03,$03,$03,$03,$03,$03,$00,$00,$00,$00,$00,$00
+;offsets
+         !byte $6A,$60,$57,$2D,$23,$1A,$9B,$91,$88,$5D,$53,$4A
+;values
+         !byte $AD,$AA,$D5,$96,$AA,$D5,$AD,$AA,$D5,$96,$AA,$D5
+
+.bc56multi ; length=12 dec
+;sectors
+         !byte $0C,$0C,$0C,$0C,$0C,$09,$09,$09,$09,$09,$09,$09
+;offsets
+         !byte $C4,$87,$78,$6A,$66,$B1,$F4,$F3,$F2,$A2,$94,$90
+;values
+         !byte $AA,$96,$AA,$D5,$2C,$AD,$0B,$F0,$DE,$AA,$D5,$2C
+
+.start
+         ; patches common to all known variants
+         lda   #<.jmp600multi
+         ldy   #>.jmp600multi
+         ldx   #12
+         jsr   multimodify
+
+         ; some variants have a secondary RWTS with an address
+         ; prologue entry point at $BC56 instead of $B944
+         ; note: these patches only affect the read routines
+         ; and thus will only work if the disk either supports
+         ; writes to unprotected disks or never writes anything
+         lda   #$0C
+         ldx   #$61
+         ldy   #$09
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $20,$C8,$BC
+         !byte $C9
+         bcs   .notbc56
+
+         lda   #<.bc56multi
+         ldy   #>.bc56multi
+         ldx   #12
+         jsr   multimodify
+
+.notbc56
+         ; variant seen on some versions of Broadsides
+         ; that uses LSR6A+CMP08 protection with an
+         ; explicit epilogue check
+         lda   #$0C
+         ldx   #$AC
+         ldy   #$09
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$AF
+         !byte $D0,$14
+         bcs   .notcmpaf
+
+         jsr   PrintByID
+         !byte s_lsr6a
+
+         jsr   PrintByID
+         !byte s_bcs08
+
+         ldx   #$C9
+         jsr   modify1
+         !byte $18
+
+.notcmpaf
+.exit
+}
--- a/src/patchers/t00_laureate.a
+++ b/src/patchers/t00_laureate.a
@ -6,31 +6,21 @@
 !zone {
         lda   gIsLaureate
         bne   .exit
-         beq   +          ; passport-test-suite/Sound Ideas- Word Attack - Disk 1 - Ending Consonants.woz [Z=1] reaches here
+         beq   .start     ; passport-test-suite/Sound Ideas- Word Attack - Disk 1 - Ending Consonants.woz [Z=1] reaches here

-.sectors
+.laureatemulti
+;sectors
         !byte $04,$04,$04,$04,$04,$04,$04,$04,$04,$05,$05,$05,$05,$05,$05,$05,$06,$06,$06
-.offsets
+;offsets
         !byte $53,$58,$5D,$9E,$A3,$A8,$E7,$F1,$FC,$35,$3F,$55,$5F,$6A,$91,$9B,$49,$D5,$D6
-.values
+;values
         !byte $D5,$AA,$AD,$DE,$AA,$EB,$D5,$AA,$AD,$DE,$AA,$D5,$AA,$96,$DE,$AA,$D6,$D5,$20

-+        lda   #$12
-         sta   .loop+1
-
-.loop    ldy   #$d1
-         lda   .values,y
-         sta   .valuea
-         sta   .valueb
-         lda   .sectors,y
-         ldx   .offsets,y
-         jsr   compare1
-.valuea  !byte $d1
-         bcc   +
-         jsr   modify1
-.valueb  !byte $d1
-+        dec   .loop+1
-         bpl   .loop
+.start
+         lda   #<.laureatemulti
+         ldy   #>.laureatemulti
+         ldx   #19
+         jsr   multimodify

         lda   #$0A
         ldx   #$12
--- a/src/patchers/t00_microlearn.a
+++ b/src/patchers/t00_microlearn.a
@ -0,0 +1,41 @@
+;-------------------------------
+; #MICROLEARN
+; RWTS uses per-disk values in
+; zero page
+;
+; tested on
+; - U.S. Constitution Tutor
+; - SAT English 1
+;-------------------------------
+!zone {
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$02
+         ldx   #$E6
+         jsr   compare2
+         !byte $C5,$D6
+         bcs   +
+         jsr   modify2
+         !byte $C9,$D5
+        ldx   #$F0
+         jsr   compare2
+         !byte $C5,$31
+         bcs   +
+         jsr   modify2
+         !byte $C9,$AA
+        lda   #$03
+         ldx   #$54
+         jsr   compare2
+         !byte $C5,$31
+         bcs   +
+         jsr   modify2
+         !byte $C9,$D5
+        ldx   #$5E
+         jsr   compare2
+         !byte $C5,$D6
+         bcs   +
+         jsr   modify2
+         !byte $C9,$AA
+
+}
--- a/src/patchers/t00_neosoft.a
+++ b/src/patchers/t00_neosoft.a
@ -0,0 +1,43 @@
+;-------------------------------
+; #T00NEOSOFT
+; nibble count during early boot
+;
+; tested on
+; - Comparison Kitchen (Neosoft/DLM)
+; - Animal Photo Fun (Neosoft/DLM)
+;-------------------------------
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$01
+         ldx   #$38
+         jsr   compare3   ; if T00,S01,$38 ==
+         !byte $20,$90,$B7
+         bcs   +
+
+         ldx   #$90
+         jsr   compare3   ; and T00,S01,$90 ==
+         !byte $20,$00,$BB
+         bcs   +
+
+         lda   #$05
+         ldx   #$DA
+         jsr   compare3   ; and T00,S05,$DA ==
+         !byte $F8,$55,$E2; XOR #$55 of $AD $00 $B7 (LDA $B700)
+         bcs   +
+
+         ldx   #$6C
+         jsr   compare2   ; and T00,S05,$6C ==
+         !byte $D0,$55    ; XOR #$55 of $85 $00 (STA $00)
+         bcs   +          ; passport-test-suite/Animal Photo Fun.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_neosoft
+
+         jsr   modify2    ; then set T00,S05,$6C ==
+         !byte $A5,$39    ; XOR #$55 of $F0 $6C (BEQ +6C)
+
+         ldx   #$DA
+         jsr   modify1
+         !byte $D8        ; XOR #$55 of $8D (STA)
+
--- a/src/patchers/t00_rps.a
+++ b/src/patchers/t00_rps.a
@ -70,7 +70,7 @@
         ldx   #$92
         jsr   modify1    ; and set T00,S01,$92 =
         !byte $F1        ; change branch to unconditionally jump to success path
-         bvc   .exit      ; always branches
+         bvc   .rwtsswap  ; always branches

 .variant2
         inx
@ -84,5 +84,17 @@
         ldx   #$92
         jsr   modify1    ; and set T00,S01,$92 =
         !byte $F2        ; change branch to unconditionally jump to success path
+
+.rwtsswap
+         lda   #$0C
+         ldx   #$40
+         ldy   #$04
+         jsr   compare
+         !byte $32,$A2    ; MON and NOMON commands at $A233 and $A247
+         !byte $46,$A2    ; are used to toggle protected/normal RWTS
+         bcs   .exit
+         jsr   modify
+         !byte $57,$FF    ; point them both to $FF58 (does nothing)
+         !byte $57,$FF
 .exit
 }
--- a/src/patchers/t00_rwtslog.a
+++ b/src/patchers/t00_rwtslog.a
@ -14,13 +14,27 @@ _rwtslog_start
 ; to reduce duplicated code
 ;
@compare_lsr6a
-         ldy   #$0A
+         ldy   #$09
         jsr   compare
         !byte $BD,$8C,$C0
         !byte $10,$FB
         !byte $4A
         !byte WILDCARD,$6A
-         !byte $D0,$EF
+         !byte $D0
+         rts
+
+@compare_cmp08
+         ldy   #$11
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$DE
+         !byte $F0,$0A
+         !byte $48
+         !byte $68
+         !byte $BD,$8C,$C0
+         !byte $C9,$08
+         !byte $B0
         rts

@compare_bne0
@ -49,9 +63,15 @@ _rwtslog_start
         jsr   @compare_lsr6a
         bcc   @print_lsr6a          ; passport-test-suite/Roadwar 2000.woz [C=0] matches

+; ATILA variant
+         lda   #$04                  ; or T00,S04,$A5 ==
+         ldx   #$A5
+         jsr   @compare_lsr6a
+         bcc   @print_lsr6a          ; passport-test-suite/The Treasure of Forest Isle.woz [C=0] matches
+
 ; Pascal variant
         lda   #$0D
-         ldx   #$05                  ; oro T00,S0D,$05 ==
+         ldx   #$05                  ; or T00,S0D,$05 ==
         jsr   @compare_lsr6a
         bcs   @lsr6a_end            ; passport-test-suite/GATO v1.3.woz [C=0] matches

@ -67,22 +87,9 @@ _rwtslog_start
 ; for the first address epilogue nibble
 ;-------------------------------
 ; DOS 3.3 variant
-         lda   #$03
+         lda   #$03                  ; if T00,S03,$8B ==
         ldx   #$8B
-         ldy   #$15
-         jsr   compare               ; if T00,S03,$8B ==
-         !byte $BD,$8C,$C0
-         !byte $10,$FB
-         !byte $C9,$DE
-         !byte $F0,$0A
-         !byte $48
-         !byte $68
-         !byte $BD,$8C,$C0
-         !byte $C9,$08
-         !byte $B0,$A5
-         !byte $EA
-         !byte $18
-         !byte $60
+         jsr   @compare_cmp08
         bcc   @print_bcs08          ; passport-test-suite/The Seasons.woz [C=0] matches

 ; RDOS variant
@ -98,7 +105,13 @@ _rwtslog_start
         !byte $BD,$8C,$C0
         !byte $C9,$80
         !byte $B0
-         bcs   @bcs08_end            ; passport-test-suite/Roadwar 2000.woz [C=0] matches
+         bcc   @print_bcs08          ; passport-test-suite/Roadwar 2000.woz [C=0] matches
+
+; ATILA variant
+         lda   #$04
+         ldx   #$E6                  ; or T00,S04,$E6 ==
+         jsr   @compare_cmp08
+         bcs   @bcs08_end            ; passport-test-suite/The Treasure of Forest Isle.woz [C=0] matches

@print_bcs08
         jsr   PrintByID
@ -141,9 +154,26 @@ _rwtslog_start
         !byte $10,$FB
         !byte $C9,$AA
         !byte $EA,$EA
-         bcs   _rwtslog_end          ; passport-test-suite/La Guillotine.woz [C=0] matches
+         bcs   @cmpnopnop_end        ; passport-test-suite/La Guillotine.woz [C=0] matches
         jsr   PrintByID
         !byte s_cmpnopnop
         inc   gPatchCount
+@cmpnopnop_end
+
+;-------------------------------
+; RWTS "TAY / BIT" identification
+; disk allows any value for
+; for address field checksum
+;-------------------------------
+         lda   #$03
+         ldx   #$88
+         ldy   #$03
+         jsr   compare               ; if T00,S03,$88 ==
+         !byte $A8
+         !byte $24,$B7
+         bcs   _rwtslog_end          ; passport-test-suite/E-Z Learner.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_anychecksum
+         inc   gPatchCount

 _rwtslog_end
--- a/src/patchers/t00_scottforesman.a
+++ b/src/patchers/t00_scottforesman.a
@ -0,0 +1,53 @@
+;-------------------------------
+; #T00SCOTTFORESMAN
+; nibble count during early boot
+;
+; tested on
+; - Addition and Subtraction 4 (Scott, Foresman and Company)
+; - Decimals 3 (Scott, Foresman and Company)
+; - Dinosaurs and Squids (Scott, Foresman and Company)
+; - Division 2 (Scott, Foresman and Company)
+; - Division 3 (Scott, Foresman and Company)
+; - Fractions 3 (Scott, Foresman and Company)
+; - Fractions 5 (Scott, Foresman and Company)
+; - Multiplication 3 (Scott, Foresman and Company)
+; - Percent 2 (Scott, Foresman and Company)
+;-------------------------------
+         ; gTrack = 0
+         lda   #$00
+         ldx   #$33
+         ldy   #$08
+         jsr   compare    ; if T00,S00,$33 ==
+         !byte $A9,$79
+         !byte $85,$3C
+         !byte $A9,$08
+         !byte $85,$3D
+         bcs   +
+
+         lda   #$06
+         ldx   #$02
+         tay
+         jsr   compare    ; and T00,S06,$02 ==
+         !byte $48
+         !byte $20,WILDCARD,WILDCARD
+         !byte $68
+         !byte $D0
+         bcs   +
+
+         lda   #$0E
+         ldx   #$FF
+         jsr   compare1   ; and T00,S0E,$FF ==
+         !byte $20
+         bcs   +          ; passport-test-suite/Addition and Subtraction 4.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_sfc
+
+         jsr   modify1    ; then set T00,S0E,$FF ==
+         !byte $EA
+
+         lda   #$06
+         ldx   #$00
+         jsr   modify2    ; and set T00,S06,$00 ==
+         !byte $A9,$00
+
--- a/src/patchers/t00_scottforesman_dos33.a
+++ b/src/patchers/t00_scottforesman_dos33.a
@ -0,0 +1,32 @@
+;-------------------------------
+; #T00SCOTTFORESMANDOS33
+; nibble count during early boot
+;
+; tested on
+; - Addition and Subtraction 3 (Scott, Foresman and Company)
+; - Decimals 2 (Scott, Foresman and Company)
+; - Fractions 1 (Scott, Foresman and Company)
+; - Fractions 2 (Scott, Foresman and Company)
+; - Multiplication 2 (Scott, Foresman and Company)
+; - Percent 1 (Scott, Foresman and Company)
+;-------------------------------
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$0B
+         ldx   #$15
+         ldy   #$06
+         jsr   compare    ; if T00,S0B,$15 ==
+         !byte $EE,$F3,$03
+         !byte $20,$00,$87
+         bcs   +          ; passport-test-suite/Addition and Subtraction 3.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_sfc
+
+         inx
+         inx
+         inx
+         jsr   modify1    ; then set T00,S0B,$18 ==
+         !byte $2C
+
--- a/src/patchers/universale7.a
+++ b/src/patchers/universale7.a
@ -24,7 +24,8 @@ universale7
         bne   .eor

         lda   .sector+2  ; passport-test-suite/Rocky's Boots.woz [C=1] reaches here
-         and   #$0F
+         sec
+         sbc   #BASEPAGE
         sta   gDisplayBytes
         jsr   PrintByID
         !byte s_e7
--- a/src/rwts.a
+++ b/src/rwts.a
@ -113,6 +113,7 @@ PreReadSector
@earthware
         ldx   #$4C
         stx   $B8F6
+EarthwareSwapperLo
         ldx   #$89
         stx   $B8F7
         ldx   #$B6
--- a/src/sectormap.a
+++ b/src/sectormap.a
@ -75,6 +75,7 @@ T01S0F    = T01 + $0F
 T02       = T01 + $10
 T02S04    = T02 + $04
 T02S05    = T02 + $05
+T02S07    = T02 + $07
 T02S0A    = T02 + $0A
 T02S0C    = T02 + $0C
 T02S0F    = T02 + $0F
--- a/src/strings/en.a
+++ b/src/strings/en.a
@ -215,6 +215,13 @@ StringTableLow            ; must be kept in sync with constants in enid.a
         !byte <.pfs
         !byte <.enlightenmentb0
         !byte <.enlightenment
+         !byte <.sfc
+         !byte <.neosoft
+         !byte <.probs5
+         !byte <.didatech
+         !byte <.anychecksum
+         !byte <.unexpected5and3
+         !byte <.jmp600

 StringTableHigh           ; must be kept in sync with constants in enid.a
         !byte >.header
@ -369,11 +376,18 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
         !byte >.pfs
         !byte >.enlightenmentb0
         !byte >.enlightenment
+         !byte >.sfc
+         !byte >.neosoft
+         !byte >.probs5
+         !byte >.didatech
+         !byte >.anychecksum
+         !byte >.unexpected5and3
+         !byte >.jmp600

 .passport
         !text "Passport ",$00
 .header
-         !text "@",s_passport,"by 4am@",s_space7,"@",s_space7," 2022-07-12",$00
+         !text "@",s_passport,"by 4am@",s_space7,"@",s_space7," 2024-05-14",$00
 .bar9
         !text "_________",$00
 .bar18
@ -764,3 +778,19 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
         !text "@",s_found,"Enlightenment @",s_bootloader,$8D,$00
 .enlightenment
         !text "@",s_found,"flux timing @",s_protection,$8D,$00
+.sfc
+         !text "@",s_found,"SFC @",s_protectioncheck,$8D,$00
+.neosoft
+         !text "@",s_found,"Neosoft @",s_protectioncheck,$8D,$00
+.probs5
+         !text "@",s_found,"PROBS5 @",s_protectioncheck,$8D,$00
+.didatech
+         !text "@",s_found,"Didatech disk",$8D
+         !text "T02,S07 @",s_maybeunreadable,$8D,$00
+.anychecksum
+         !text "@",s_rwts,"@",s_acceptsany,$8D
+         !text "address field checksum",$8D,$00
+.unexpected5and3
+         !text "@",s_tfound,"5-and-3 @",s_protectiontrack,$8D,$00
+.jmp600
+         !text "@",s_found,"JMP $0600 @",s_bootloader,$8D,$00
--- a/src/strings/enid.a
+++ b/src/strings/enid.a
@ -153,3 +153,10 @@ s_baudville  = $94
 s_pfs        = $95
 s_enlightenmentb0 = $96
 s_enlightenment = $97
+s_sfc        = $98
+s_neosoft    = $99
+s_probs5     = $9A
+s_didatech   = $9B
+s_anychecksum = $9C
+s_unexpected5and3 = $9D
+s_jmp600     = $9E
--- a/src/wholetrack.a
+++ b/src/wholetrack.a
@ -39,6 +39,13 @@ SkipTrack
         lda   #s_sync
         bcc   @print
 ;
+; Unexepcted 13-sector track on a 16-sector disk?
+; (Micrograms likes to do this)
+;
+         jsr   Unexpected5And3InBaggingArea
+         lda   #s_unexpected5and3
+         bcc   @print
+;
 ; RW18-format track?
 ;
         jsr   VerifyInfocom18
@ -80,6 +87,8 @@ SkipTrack
         cmp   #$22
         clc
         bne   @donotskip
+         lda   #TRUE
+         sta   gAdventureInternational
         lda   gIsProDOS
         bne   @donotskip
         sta   gPossibleGamco
@ -312,3 +321,52 @@ Read4x4
  }
         and   tmp
         rts
+
+;-------------------------------
+; Unexpected5And3InBaggingArea
+; check if track is unexpectedly full of
+; 5-and-3-encoded sectors on a disk where
+; we expected 6-and-2 encoded sectors
+;
+; used by e.g. Micrograms as a weak form
+; of copy protection to foil COPYA-style
+; copying
+;
+; in  slot 6, drive 1 is on track to test
+; out C clear if unexpected track found
+;     C set if not found
+;-------------------------------
+Unexpected5And3InBaggingArea
+         lda   gIs13Sector
+         beq   @no                   ; if ID'd as a 13 sector disk, then this is not unexpected
+         lda   $C0E9
+         lda   #$19
+         sta   nibcount
+         ldx   #$0C
+         ldy   #$00
+@restart
+         dey
+         bne   +
+         dec   nibcount
+         beq   @no
+
+-        lda   $C0EC
+         bpl   -
+@maybeD5
+         cmp   #$D5
+         bne   @restart
+-        lda   $C0EC
+         bpl   -
+         cmp   #$AA
+         bne   @maybeD5
+-        lda   $C0EC
+         bpl   -
+         cmp   #$B5
+         bne   @maybeD5
+         dex
+         bne   @restart
+         clc                         ; passport-test-suite/Real Math.woz [C=0] matches
+         !byte $A9
+@no      sec
+         lda   $C0E8
+         rts
Author	SHA1	Message	Date
4am	a8c6676549	update holle patcher [fixes Sherwood Forest]	2024-05-15 11:57:44 -04:00
4am	61b7818929	update changelog	2024-04-29 12:17:24 -04:00
4am	b2686f485e	add support for encrypted E7Everywhere [fixes Language Carnival]	2024-04-29 12:10:05 -04:00
4am	7829069ff4	fix logic error in calculating display sector (does not affect existing cracks)	2024-04-29 12:09:25 -04:00
4am	43a719aa56	add support for unencrypted AdvInt [fixes Spiderman,War]	2024-04-28 02:09:21 -04:00
4am	cc3a9c4f7e	switch to determinate progress bar during initial decompression, and upgrade to ProDOS 2.4.3	2024-03-27 19:59:52 -04:00
4am	6213b948f8	add support for LSR6A+CMP08 JMP0600 variant [fixes Broadsides rev. 4]	2023-12-07 01:28:27 -05:00
4am	161ff58b8d	add support for JMP0600 secondary RWTS with address parsing at BC56 [fixes Alphabet Zoo, Broadsides]	2023-12-06 00:14:41 -05:00
4am	dec3ce3698	disable RWTS swapper in RPS protection [fixes Evelyn Dynamic Reader]	2023-10-08 01:10:39 -04:00
4am	c9af84fa27	add support for JMP600 bootloader [fixes Wizard of Words v1.0]	2023-10-02 23:42:07 -04:00
4am	6bf634274f	remove gPossibleD5D5F7 flag as it's causing false negatives [fixes Picture Perfect 1987]	2023-09-04 23:34:49 -04:00
4am	11f2ef57d6	add support for Earthware variant [fixes Black Belt rev. 2]	2023-09-03 23:30:13 -04:00
4am	8bd1523939	prep for release	2023-07-28 11:04:10 -04:00
4am	87582b60a4	update comment to match test suite change	2023-07-28 11:03:22 -04:00
Peter Ferrie	8b11ac7320	fix dangling partial-track placement in 5-5-5	2023-07-27 11:38:16 -07:00
4am	39758aaba9	add unexpected 5&3 track detection [fixes Real Math]	2023-06-26 20:39:38 -04:00
4am	3e8f19deb4	update readme	2023-05-28 20:13:17 -04:00
4am	25634996e2	add support for TAY/BIT any-checksum protection [fixes SVS Rapid Reader, E-Z Learner]	2023-05-28 20:02:43 -04:00
4am	d20981ed0e	update README	2023-05-06 18:47:42 -04:00
4am	973c0699e4	modify D5D5F7 patch [fixes Les Sports]	2023-05-04 21:07:39 -04:00
4am	cdb1d28920	fix Didatech output log	2023-04-08 11:44:10 -04:00
4am	84a1713b5b	add support for Didatech [fixes Crosscountry USA, Canada, California]	2023-03-26 15:00:07 -04:00
4am	540c9fb161	add support for PROBS5 protection [fixes Allyn and Bacon titles]	2023-03-26 13:22:46 -04:00
4am	98107fcb62	add support for nonstandard epilogues in SIGCHECK [fixes Water Pollution]	2023-01-27 21:30:55 -05:00
Peter Ferrie	dc7b3d8cd3	support The General Manager anti-tamper	2023-01-18 20:23:34 -08:00
eientei95	b675e8f372	Properly fix building on case-sensitive OSes, make makefile more closer to winmake.bat (#113 )	2022-12-03 18:41:38 -05:00
4am	b250d98d23	add support for Neosoft self-decrypting nibble count at BB29 [fixes Animal Photo Fun, Comparison Kitchen]	2022-11-29 18:32:21 -05:00
4am	c525e8c708	add support for ATILA variants of LSR 6A and CMP 08 RWTS	2022-11-29 13:59:13 -05:00
4am	8a746d084f	some comments	2022-11-29 13:33:10 -05:00
4am	c07ce2713e	add support for another Scott, Foresman and Company nibble count	2022-11-29 13:31:03 -05:00
4am	8733220f7c	add support for Scott, Foresman and Company nibble count	2022-11-29 13:07:40 -05:00
4am	00b9e98b8b	Merge branch 'master' of https://github.com/a2-4am/passport	2022-11-17 01:06:13 -05:00
4am	44a8aceb62	add Gamco variant [fixes Percent]	2022-11-17 01:06:05 -05:00
Peter Ferrie	ebcd3df3dd	don't let The Game Show escape	2022-08-04 19:10:53 -07:00
4am	cd37eaba50	Merge branch 'master' of https://github.com/a2-4am/passport	2022-08-04 21:53:16 -04:00
4am	b5cdad368b	add support for MicroLearn protection [fixes U.S. Constitution Tutor]	2022-08-04 21:53:10 -04:00
4am	4b6b066225	Update README.md	2022-07-18 00:34:55 -04:00
4am	895b4fde82	Update README.md	2022-07-18 00:34:05 -04:00
David Schmidt	424701bfde	Add retry keys to doc (#110 )	2022-07-18 00:26:30 -04:00