passport/src/patchers/t00_rps.a

101 lines
3.5 KiB
Plaintext
Executable File

;-------------------------------
; #RPS
; boot1 jumps to $B3C1 to change RWTS,
; epilogue checker jumps to $B6B3 to
; check timing bits, late DOS routes
; through nibble check at $B74B
;
; so named because the disk volume string is
; C1984 RPS A#
;
; variant 0
; - Math Skills: Elementary Level (Encyclopaedia Britannica)
; - Math Skills: Junior High Level (Encyclopaedia Britannica)
; variant 1
; - Dig Dug (Thunder Mountain)
; - Pac-Man (Thunder Mountain)
; - Galaxian (Thunder Mountain)
;
; variant 2
; - Problem Solving in Algebra (Encyclopaedia Britannica)
;-------------------------------
!zone {
; gTrack = 0
; Caller found DOS 3.3 RWTS
lda #$01
ldx #$48
jsr compare2 ; if T00,S01,$48 ==
!byte $C1,$B3
bcs .exit ; primary pattern not found, bail
lda #$03
ldx #$3E
ldy #$04
jsr compare ; if T00,S03,$3E ==
!byte $4C,$B3,$B6
!byte $EA
bcs .variant0 ; passport-test-suite/Math Skills Elementary Level.woz [C=1] here
jsr modify ; then set T00,S03,$3E =
!byte $C9,$AA
!byte $F0,$5C
lda #$01 ; presence of JMP $B6B3 also indicates code at
ldx #$48 ; $B41F that copies the real DOS code back to $B6B3
; so we modify $B747 to jump to that (it exits via $9D84)
jsr modify2 ; and set T00,S01,$48 =
!byte $1F,$B4
bvc .variant1 ; always branches
.variant0
lda #$01 ; lack of JMP $B6B3 indicates an earlier variant
ldx #$48 ; which has no useful code at $B3C1, so we
; modify $B747 to jump directly to $9D84
jsr modify2
!byte $84,$9D
; /!\ execution falls through here
.variant1
;A=#$01 here regardless of how we got here
;Y=#$02 here regardless of how we got here
ldx #$87
jsr compare3 ; if T00,S01,$87 ==
!byte $6C,$58,$9D
bcs .variant2 ; passport-test-suite/Pac-Man (Thunder Mountain).woz [C=0] here
ldx #$8E
jsr modify1 ; then set T00,S01,$8E =
!byte $F8 ; change branch to unconditionally jump to success path
ldx #$92
jsr modify1 ; and set T00,S01,$92 =
!byte $F1 ; change branch to unconditionally jump to success path
bvc .rwtsswap ; always branches
.variant2
inx
jsr compare3 ; if T00,S01,$88 ==
!byte $6C,$58,$9D
bcs .exit ; passport/test-suite/Problem Solving in Algebra.woz [C=0] here
; if we didn't find indirect jump in either location, bail
ldx #$8E ; variant #2 is similar to variant #1 but branch offsets differ by 1 byte
jsr modify1 ; then set T00,S01,$8E =
!byte $F9 ; change branch to unconditionally jump to success path
ldx #$92
jsr modify1 ; and set T00,S01,$92 =
!byte $F2 ; change branch to unconditionally jump to success path
.rwtsswap
lda #$0C
ldx #$40
ldy #$04
jsr compare
!byte $32,$A2 ; MON and NOMON commands at $A233 and $A247
!byte $46,$A2 ; are used to toggle protected/normal RWTS
bcs .exit
jsr modify
!byte $57,$FF ; point them both to $FF58 (does nothing)
!byte $57,$FF
.exit
}