passport/src/patchers/protecteddos.a

;-------------------------------
; #PROTECTEDDOS
; patcher for "Protected.DOS",
; an insane full-DOS makeover with a self-
; decrypting bootloader, RWTS swappers,
; embedded serial numbers, and more
; e.g. Bingo Bugglebee Presents series
; (Home Alone / Outdoor Safety / Famous People),
; Math Blaster, Moebius
;-------------------------------
!zone {
         lda   gIsProtDOS
         beq   +
.jmpexit
         jmp   .exit
+
;
; Find secondary/tertiary RWTS swappers on any track
; e.g. Moebius
;
         ldy   #$0C
         jsr   SearchTrack
         !byte $A9,$B5
         !byte $85,$4E
         !byte $8D,$5D,$BD
         !byte $A9,$D5
         !byte $8D,$2C,$BF
         bcs   .specific  ; passport-test-suite/Moebius.woz [C=0] matches
         sta   .swapper2+1
         inx
         stx   .swapper1+1
         jsr   modify1    ; offset $01. $B5 -> $AD
         !byte $AD
.swapper1
         lda   #$FF       ; modified at runtime
         clc
         adc   #$07
         tax
.swapper2
         lda   #$FF       ; modified at runtime
         jsr   modify1    ; offset $08. $D5 -> 9B
         !byte $9B

.specific
         lda   gTrack
         cmp   #$02
         bcc   .strip
         jmp   .exit
.strip
;
; strip 6-digit numeric serial number
; (appears on both track 0 and 1, but
; in different sectors)
;
         cmp   #$01
         beq   +
         lda   #BASEPAGE
         clc
         adc   #$0B
         tax
         lda   #$0B
         bne   ++
+
         ldx   #BASEPAGE
         inx
         inx
         lda   #$02
++
         stx   .serial+2
         stx   .serialb+2
         sta   gDisplayBytes
         lda   #$C5
         sta   .serial+1
         sta   .serialb+1
         ldy   #$00
.serialloop
         jsr   .serial
         tax
         jsr   .serial
         jsr   .XA2byte
         sta   gDisplayBytes+1,y
         iny
         cpy   #$03
         bne   .serialloop
         jsr   PrintByID
         !byte s_protserial
         lda   gTrack
         beq   .track0

;
; disable RWTS swapper (technically make the
; "protected disk" mode the same as the
; "standard disk" mode)
;
         lda   #$02
         ldx   #$AF
         ldy   #$0C
         jsr   compare    ; if T01,S02,$AF ==
         !byte $A2,$B5
         !byte $86,$4E
         !byte $8E,$5D,$BD
         !byte $A2,$D5
         !byte $8E,$2C,$BF
         bcs   .exitt1
         inx
         jsr   modify1    ; then set T01,S02,$B0 =
         !byte $AD
         ldx   #$B7
         jsr   modify1    ; and set T01,S02,$B7 =
         !byte $9B

.exitt1
         jmp   .exit

.track0
;
; decrypt RWTS in track buffer
;
         bit   gMode
         bpl   +
         jsr   PrintByID
         !byte s_decryptrwts
+        ldx   #BASEPAGE
         inx
         stx   .a+2
         stx   .b+2
         stx   .c+2
.a       lda   $FF06      ; modified at runtime
         sta   .key+1
         ldx   #$09
         ldy   #$1A
.b       lda   $FF00,Y    ; modified at runtime
.key     eor   #$FF       ; modified at runtime
.c       sta   $FF00,Y    ; modified at runtime
         iny
         bne   .b
         inc   .b+2
         inc   .c+2
         dex
         bne   .b

;
; disable decryption loop
;
         lda   #$01
         ldx   #$07
         jsr   modify1    ; set T00,S01,$07 =
         !byte $2C

;
; bypass check for duplicate T00,S00
;
         ldx   #$93
         jsr   compare3   ; if T00,S01,$93 ==
         !byte $4C,$00,$B8
         bcs   .skipcheck ; passport-test-suite/Ultima IV.woz [C=0] matches
         jsr   modify3    ; then set T00,S01,$93 =
         !byte $AC,$E5,$B7
.skipcheck

;
; fake "found disk volume" in RWTS parameter table
; so it's always 0 (many Davidson disks have
; multiple secondary checks for this)
;
         lda   #$05
         ldx   #$15
         jsr   compare2   ; if T00,S05,$15 ==
         !byte $A5,$2F
         bcs   .exit      ; passport-test-suite/Math Blaster v080584.woz [C=0] matches
         jsr   modify2    ; then set T00,S05,$15 =
         !byte $A9,$00

;
; re-enable write mode if it was disabled
;
         lda   #$07
         ldx   #$4C
         jsr   compare1   ; if T00,S07,$4C ==
         !byte $A0
         bcs   +          ; passport-test-suite/Bingo Bugglebee Presents Outdoor Safety.woz [C=0] matches
         jsr   modify1    ; then set T00,S07,$4C =
         !byte $20
+
         jmp   .exit

; subroutines for getting (and erasing) the embedded
; 6-digit serial number and converting them to bytes
; for printing
.serial
         lda   $FFFF      ; modified at runtime
         pha
         lda   #$B0
.serialb
         sta   $FFFF      ; modified at runtime
         pla
         inc   .serial+1
         inc   .serialb+1
         inc   gPatchCount
         rts

.XA2byte
         and   #$0F
         sta   tmp
         txa
         asl
         asl
         asl
         asl
         ora   tmp
         rts

.exit
}