update holle patcher [fixes Sherwood Forest]

[fixes Kittens, Kids, and a Frog]

Makefile

@@ -17,36 +17,35 @@ ACME=acme
 CADIUS=cadius
 # https://bitbucket.org/magli143/exomizer/wiki/Home
 # requires Exomizer 3.0 or later
-EXOMIZER=exomizer raw -q -P23
+EXOMIZER=exomizer
 
 BUILDDISK=build/passport
 
 asm:
 	mkdir -p build
 	cd src/mods && $(ACME) universalrwts.a
-	$(EXOMIZER) build/universalrwts.bin -o build/universalrwts.tmp
-	printf "\xB8\x00" | cat - build/universalrwts.tmp > build/universalrwts.pak
+	$(EXOMIZER) mem -lnone -q -P23 -f build/universalrwts.bin@0xb800 -o build/universalrwts.pak
 	cd src/mods && $(ACME) -r ../../build/t00only.lst t00only.a
-	$(EXOMIZER) build/t00only.bin -o build/t00only.tmp
-	printf "\x20\x00" | cat - build/t00only.tmp > build/t00only.pak
+	$(EXOMIZER) mem -lnone -q -P23 -f build/t00only.bin@0x2000 -o build/t00only.pak
+	echo > build/vars.a
 	cd src && $(ACME) -r ../build/passport.lst -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/relbase.log
-	cd src && $(ACME) -DRELBASE=`cat ../build/relbase.log | grep "RELBASE =" | cut -d"=" -f2 | cut -d"(" -f2 | cut -d")" -f1` -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/vars.log
-	grep "ThisSlot=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PrintByID=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "WaitForKey=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CleanExit=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "OpenFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "ReadFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CloseFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "GetVolumeName=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "GetVolumeInfo=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PREFSVER=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "PREFSFILE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "SLOT=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "DRIVE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "MainMenu=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	grep "CheckCache=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
-	$(EXOMIZER) -b build/passport.tmp -o build/passport.pak
+	cd src && $(ACME) -r ../build/passport.lst -DRELBASE=`cat ../build/relbase.log | grep "RELBASE =" | cut -d"=" -f2 | cut -d"(" -f2 | cut -d")" -f1` -DFORWARD_DECRUNCHING=1 passport.a 2> ../build/vars.log
+	grep -m1 "ThisSlot=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PrintByID=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "WaitForKey=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CleanExit=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "OpenFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "ReadFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CloseFile=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "GetVolumeName=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "GetVolumeInfo=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PREFSVER=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "PREFSFILE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "SLOT=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "DRIVE=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "MainMenu=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	grep -m1 "CheckCache=" build/vars.log | cut -d":" -f3 | cut -d"(" -f1 >> build/vars.a
+	$(EXOMIZER) raw -q -P23 -b build/passport.tmp -o build/passport.pak
 	cd src && $(ACME) -DFORWARD_DECRUNCHING=0 wrapper.a
 	cp res/work.po "$(BUILDDISK)".po
 	cp res/_FileInformation.txt build/

README.md

@@ -40,8 +40,8 @@ Using Passport is simple. After running
 the program, put an original disk in
 slot 6, drive 1 and a blank formatted
 disk in any other drive. If necessary,
-press "S" to cycle through your drives.
-Then press "C" to start the cracking.
+press `S` to cycle through your drives.
+Then press `C` to start the cracking.
 
 If all goes well, Passport will read
 your original disk and write a copy in
@@ -55,6 +55,23 @@ copy program.
 If all does not go well, Passport will
 tell you where it all went wrong.
 
+During the process, you can press any
+key to cancel immediately.
+
+If you have a two-sided disk where only
+one side is bootable, after the first
+side completes, you can press `2` to
+reuse the captured RWTS on the second
+side.
+
+If Passport stops because of read errors
+but you suspect the errors are due to
+physical damage (as opposed to just copy
+protection), you can retry the process
+ignoring errors by pressing `Ctrl-R`.
+The resulting copy may or may not be
+usable.
+
 In any case, Passport will NEVER write
 to or alter your original disk in any
 way. And neither should you! Don't
@@ -70,7 +87,10 @@ companies. These types of protection
 were common in educational software.
 
 - Abracadata
-  e.g. Design Your Own Home
+  e.g. Design Your Own Home series
+
+- Allyn and Bacon
+  e.g. CAAT Skill Tester series
 
 - American Guidance Service
   e.g. SocMate Analogies Games
@@ -81,7 +101,7 @@ were common in educational software.
 - ArtSci
   e.g. AceCalc, Magicalc
 
-- Blue Chip
+- Blue Chip Software
   e.g. Squire, Baron, Tycoon
 
 - BrainBank
@@ -101,6 +121,10 @@ were common in educational software.
   e.g. Curious George in Outer Space,
   Alien Addition
 
+- Didatech Software
+  e.g. Crosscountry USA, Crosscountry
+  Canada
+
 - Edu-Ware
   e.g. Decimals, Algebra 2
 
@@ -115,11 +139,15 @@ were common in educational software.
   e.g. Problem Solving in Algebra,
   Math Skills: Elementary Level
 
+- Enlightenment
+  e.g. Paul Whitehead Teaches Chess,
+  Living Chess Library
+
 - Focus Media
   e.g. The Time Tunnel (series),
   Travels with Za-Zoom
 
-- Gamco
+- Gamco Publishing
   e.g. Math Leap Frog, Math Football
 
 - Grolier Publishing
@@ -129,7 +157,7 @@ were common in educational software.
   e.g. Chariots, Cougars, and Kings;
   Tim and the Cat and the Big Red Hat
 
-- Hayden
+- Hayden Software
   e.g. SAT Score Improvement System,
   Microscopic Journey
 
@@ -150,7 +178,7 @@ were common in educational software.
   e.g. Building Reading Skills,
   Explorations in Science
 
-- Krell
+- Krell Software
   e.g. Time Traveler, College Boards
 
 - Laureate Learning Systems
@@ -183,7 +211,7 @@ were common in educational software.
 - Methods & Solutions
   e.g. Fantasy Land, Behind The Wheel
 
-- Micrograms
+- Micrograms Publishing
   e.g. Wild West Math, Granny
   Applebee's Cookie Factory
 
@@ -205,6 +233,10 @@ were common in educational software.
 - National Geographic Society
   e.g. The Botanist's Apprentice
 
+- Neosoft
+  e.g. Comparison Kitchen, Animal Photo
+  Fun
+
 - Optimum Resource
   e.g. Stickybear Math, Car Builder
 
@@ -242,9 +274,19 @@ were common in educational software.
 - Science Research Associates
   e.g. Computer Drill and Instruction
 
+- Scott, Foresman and Company
+  e.g. Addition and Subtraction 4,
+  Decimals 3, Dinosaurs and Squids
+
+- Silicon Valley Systems
+  e.g. Rapid Reader, E-Z Learner
+
 - Softsmith
   e.g. Astro Attack, Dinner on a Disk
 
+- Software Publishing Corporation
+  e.g. PFS File, PFS Graph, PFS Write
+
 - Spinnaker Software
   e.g. Snooper Troops, KidWriter
 
@@ -275,6 +317,9 @@ variation and "one-off" protection in
 games than in educational software, so
 your mileage may vary.
 
+- Accolade
+  e.g. Hardball, Law of the West
+
 - Activision (patcher by TRex)
   e.g. Hacker, Rampage
 
@@ -284,6 +329,9 @@ your mileage may vary.
 - Atari
   e.g. Defender, Gremlins
 
+- Baudville
+  e.g. Blazing Paddles, Take 1
+
 - Border
   e.g. Arena, Early Bird
 
@@ -372,7 +420,7 @@ Passport is open source and is
 distributed under the MIT license.
 
 Passport
-Copyright (c) 2016-2021 by 4am
+Copyright (c) 2016-2023 by 4am
 
 Permission is hereby granted, free of
 charge, to any person obtaining a copy
@@ -408,6 +456,93 @@ IN THE SOFTWARE.
 
 ## History
 
+Unreleased
+- NEW: patchers/t00_jmp600.a
+  (fixes Wizard of Words, Alphabet Zoo,
+  Broadsides)
+- NEW: patchers/e7everywhere.encrypted.a
+  (fixes Language Carnival 1 & 2)
+- IMPROVED: patchers/t00_earthware.a
+  (fixes Black Belt rev. 2)
+- IMPROVED: patchers/d5d5f7.a
+  (fixes Picture Perfect 1987)
+- IMPROVED: patchers/t00_rps.a
+  (fixes Evelyn Dynamic Reader)
+- IMPROVED: patchers/advint.a
+  (fixes War, Questprobe/Spider-Man)
+
+2023-07-28
+- NEW: patchers/didatech.a (fixes
+  Crosscountry USA, Crosscountry
+  Canada, Crosscountry California)
+- NEW: patchers/microlearn.a (fixes
+  US Constitution Tutor, SAT English 1)
+- NEW: patchers/probs5.a (fixes
+  Decimals Analyzer, Whole Numbers
+  Analyzer)
+- NEW: patchers/t00_neosoft.a (fixes
+  Comparison Kitchen, Animal Photo Fun)
+- NEW: patchers/t00_scottforesman.a
+  (fixes Addition and Subtraction 4,
+  Decimals 3, Dinosaurs and Squids)
+- NEW: patchers/t00_scottforesman_
+  dos33.a (fixes Addition and
+  Subtraction 3, Decimals 2)
+- NEW: unexpected 5&3 track detection
+  (fixes Real Math, Mathosaurus)
+- IMPROVED: patchers/d5d5f7.a (fixes
+  Les Sports)
+- IMPROVED: patchers/gamco.a (fixes
+  Percent)
+- IMPROVED: patchers/sierra.a (fixes
+  secondary anti-tamper check in
+  The General Manager)
+- IMPROVED: patchers/sigcheck.a (fixes
+  Water Pollution)
+- IMPROVED: patchers/t00_rwtslog.a
+  (ATILA variant of LSR $6A detection
+  fixes The Treasure of Forest Isle,
+  TAY/BIT detection fixes Rapid
+  Reader and E-Z Learner)
+- Matching updates to the
+  [Passport test suite](https://github.com/a2-4am/passport-test-suite)
+
+2022-07-12
+- NEW: patchers/mak.a (fixes "Kittens,
+  Kids, and a Frog")
+- NEW: patchers/t00_baudville.a (fixes
+  Blazing Paddles, Take 1)
+- NEW: patchers/t00_sigcheck.a (fixes
+  Hardball, Law of the West)
+- NEW: patchers/pfs.pascal.a (fixes
+  pfs:* Pascal titles)
+- NEW: patchers/pfs.prodos.a (fixes
+  pfs:* ProDOS titles)
+- NEW: patchers/enlightenment.a (fixes
+  Paul Whitehead Teaches Chess)
+- IMPROVED: id/555.a (fixes Fax,
+  Funbunch College Prep)
+- IMPROVED: patchers/ea.a (fixes
+  Boulder Dash II) (by qkumba)
+- IMPROVED: patchers/holle.a (fixes
+  Sherwood Forest)
+- IMPROVED: patchers/jmpbb03.a (fixes
+  Pacific 231)
+- IMPROVED: patchers/jmpb400.a (fixes
+  Rebus Writer, Writer's Helper)
+- IMPROVED: patchers/jmpb4bb.a (fixes
+  Half Time)
+- IMPROVED: patchers/sierra.a (fixes
+  Ultima II)
+- IMPROVED: patchers/sigcheck.a (fixes
+  Inca, Holy Grail)
+- IMPROVED: RW18 sector verification
+  (fixes Toy Shop)
+- Detect extra wide tracks anywhere,
+  not just on track 6
+- Matching updates to the
+  [Passport test suite](https://github.com/a2-4am/passport-test-suite)
+
 2021-09-04
 - IMPROVED: patchers/universale7.a
   cracks now work on //c and IIgs

src/adstyle.a

@@ -180,7 +180,7 @@ ADStyle
 ;
 +
 b4bbcompare
-         lda   #$FD                  ; modified at runtime (in Inspect1)
+         lda   #$FD                  ; SMC
          ldx   #$00
          ldy   #$20
          jsr   CompareMemory
@@ -236,10 +236,10 @@ x0       lda   $FFC2                 ; high byte modified at runtime (above)
          sta   gPossibleB4BBBasic
          lda   #$BB
 b4bbmodify
-         sta   $FFFF                 ; modified at runtime (high byte in Inspect1, low byte above)
+         sta   $FFFF                 ; SMC
          lda   #$DE
 b4bbmodify2
-         sta   $FFFF                 ; modified at runtime (high byte in Inspect1, low byte above)
+         sta   $FFFF                 ; SMC
          lda   gIsDOS32
          bne   _b4bbexit
          lda   #kSectorCustomDOS32B4BB

src/apicode.a

@@ -37,6 +37,8 @@
          jmp   modify2
 ;jmodify3
          jmp   modify3
+;jmultimodify
+         jmp   multimodify
 ;jcompare
          jmp   compare
 ;jcompare1
@@ -79,11 +81,26 @@
                           ; set in IDBootFailure() after reading T00
 
 FIRSTFILTER
+;gIsJMP600
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in IDBootloader() after reading T00,S00
+;gIsDidatech
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in TraceDOS33c() after tracing DOS 3.3-shaped RWTS
+;gIsEnlightenment
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in IDBootloader() after reading T00,S00
+;gIsBaudville
+         !byte FALSE      ; 0=true, 1=false
+                          ; reset before each operation
+                          ; set in IDBootloader() after reading T00,S00
 ;gIsLowDOS
          !byte FALSE      ; 0=true, 1=false
                           ; reset before each operation
                           ; set in IDVolumeName() after identifying ProDOS bootloader
-
 ;gPossibleB4BBBasic
          !byte FALSE      ; 0=true, 1=false
                           ; reset before each operation
@@ -181,10 +198,6 @@ FIRSTFILTER
          !byte FALSE      ; 0=true, 1=false
                           ; reset before each operation
                           ; set in IDBootloader() after reading T00,S00
-;gPossibleD5D5F7
-         !byte FALSE      ; 0=true, 1=false
-                          ; reset before each operation
-                          ; set in IDBootloader() after reading T00,S00
 ;gIsOptimum
          !byte FALSE      ; 0=true, 1=false
                           ; reset before each operation

src/apidefs.a

@@ -158,8 +158,7 @@ gIsDavidDOS                   = gIsProtDOS-$01                        ; byte
 gIsEA                         = gIsDavidDOS-$01                       ; byte
 gPossibleGamco                = gIsEA-$01                             ; byte
 gIsOptimum                    = gPossibleGamco-$01                    ; byte
-gPossibleD5D5F7               = gIsOptimum-$01                        ; byte
-gIs8b3                        = gPossibleD5D5F7-$01                   ; byte
+gIs8b3                        = gIsOptimum-$01                        ; byte
 gIsMilliken1                  = gIs8b3-$01                            ; byte
 gAdventureInternational       = gIsMilliken1-$01                      ; byte
 gIsLaureate                   = gAdventureInternational-$01           ; byte
@@ -183,9 +182,13 @@ gPossibleMECCSwapper          = gIsTSR-$01                            ; byte
 gPossibleWoodbury             = gPossibleMECCSwapper-$01              ; byte
 gPossibleB4BBBasic            = gPossibleWoodbury-$01                 ; byte
 gIsLowDOS                     = gPossibleB4BBBasic-$01                ; byte
+gIsBaudville                  = gIsLowDOS-$01                         ; byte
+gIsEnlightenment              = gIsBaudville-$01                      ; byte
+gIsDidatech                   = gIsEnlightenment-$01                  ; byte
+gIsJMP600                     = gIsDidatech-$01                       ; byte
 ;LASTFILTER ; add new gIs* above this line
 ;gIsInfocom18 is a special case whose ID is not in the regular inspection path
-gIsInfocom18                  = gIsLowDOS-$01                         ; byte
+gIsInfocom18                  = gIsJMP600-$01                         ; byte
 ;gIs13Sector is a special case whose ID is not in the regular inspection path
 gIs13Sector                   = gIsInfocom18-$01                      ; byte
 ;gMECCFastloadType is a special case integer whose default value cannot be #FALSE
@@ -201,7 +204,8 @@ jcompare3                     = gDisplayBytes-$03                     ; 3-byte
 jcompare2                     = jcompare3-$03                         ; 3-byte
 jcompare1                     = jcompare2-$03                         ; 3-byte
 jcompare                      = jcompare1-$03                         ; 3-byte
-jmodify3                      = jcompare-$03                          ; 3-byte
+jmultimodify                  = jcompare-$03                          ; 3-byte
+jmodify3                      = jmultimodify-$03                      ; 3-byte
 jmodify2                      = jmodify3-$03                          ; 3-byte
 jmodify1                      = jmodify2-$03                          ; 3-byte
 jmodify                       = jmodify1-$03                          ; 3-byte
@@ -224,6 +228,7 @@ modify                    = jmodify
 modify1                   = jmodify1
 modify2                   = jmodify2
 modify3                   = jmodify3
+multimodify               = jmultimodify
 PrintByID                 = jPrintByID
 SearchTrack               = jSearchTrack
 CallRWTS                  = jCallRWTS
@@ -269,7 +274,6 @@ ConstructStandardDelivery = jConstructStandardDelivery
 !warn "gPossibleGamco=",gPossibleGamco
 !warn "gIsOptimum=",gIsOptimum
 !warn "gMECCFastloadType=",gMECCFastloadType
-!warn "gPossibleD5D5F7=",gPossibleD5D5F7
 !warn "gIs8b3=",gIs8b3
 !warn "gIsMilliken1=",gIsMilliken1
 !warn "gAdventureInternational=",gAdventureInternational
@@ -301,6 +305,7 @@ ConstructStandardDelivery = jConstructStandardDelivery
 !warn "gDisplayBytes=",gDisplayBytes
 !warn "jcompare=",jcompare
 !warn "jmodify=",jmodify
+!warn "jmultimodify=",jmultimodify
 !warn "jPrintByID=",jPrintByID
 !warn "jSearchTrack=",jSearchTrack
 !warn "jCallRWTS=",jCallRWTS

src/crackme.a

@@ -15,6 +15,11 @@
 ;        exits via TheEnd
 ;-------------------------------
 ReadWithRWTS
+         ldx   #0
+         ldy   #0
+         dec   gCommand
+         jsr   ReadSectorXY                     ; clear DOS error
+         inc   gCommand
          jsr   IncProgress
          lda   #$22
          jsr   ChangeTrackNW
@@ -38,6 +43,9 @@ ReadWithRWTS
          lda   gIsInfocom18
          and   gIsRW18
          bne   checksector
+         dec   gCommand
+         jsr   ReadSector                       ; seek
+         inc   gCommand
          jsr   VerifyInfocom18
          bcc   .passtrack
          jmp   FatalError

src/exodecrunch.s

@@ -66,7 +66,7 @@ EXTRA_TABLE_ENTRY_FOR_LENGTH_THREE = 1
 ; -------------------------------------------------------------------
 ; optional progress UI
 !IFNDEF SHOW_PROGRESS_DURING_DECRUNCH {
-        SHOW_PROGRESS_DURING_DECRUNCH = 0
+  !set SHOW_PROGRESS_DURING_DECRUNCH = 0
 }
 ; -------------------------------------------------------------------
 ; zero page addresses used
@@ -160,23 +160,18 @@ gb_get_hi:
 decrunch:
 
 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-        lda $FBB3
-        cmp #$EA
-        bne +
-        lda #$A1 ; use ! instead of | for initial spinner animation
-        sta progress_char+1
-        sta progress_char+5
-+
-; -------------------------------------------------------------------
-; show initial on-screen progress UI
-;
-        ldy #7
-init_progress_loop:
-        lda progress_char,y
-        jsr show_one_progress_char
-        dey
-        bpl init_progress_loop
-done_init_progress_loop:
+kExoProgressWidth = 23               ; depends on total size, max 38
+         ldx   #(kExoProgressWidth+2)
+         lda   #$DF
+-        sta   $0528+(20-(kExoProgressWidth/2))-1, x
+         sta   $05A8+(20-(kExoProgressWidth/2))-1, x
+         dex
+         bpl   -
+         lda   #$20
+         sta   $05A8+(20-(kExoProgressWidth/2))-1
+         sta   $05A8+(20-(kExoProgressWidth/2))+kExoProgressWidth+1
+         lda   #$A8+(20-(kExoProgressWidth/2))
+         sta   ExoProgressPtr+1
 }
 ; -------------------------------------------------------------------
 ; init zeropage, x and y regs. (12 bytes)
@@ -259,25 +254,15 @@ no_hi_decr:
         sta (zp_dest_lo),y
 
 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-; periodically update on-screen progress UI
-        dec progress_counter
-        bne dont_update_progress_ui
-        tya
-        pha
-        ldy progress_index
-        lda progress_char,y
-        jsr show_one_progress_char
-        inc progress_index
-        lda progress_index
-        and #$07
-        sta progress_index
-        tay
-        lda #$20
-        jsr show_one_progress_char
-        pla
-        tay
-dont_update_progress_ui:
+         dec   ExoProgressCounter
+         bne   +
+         lda   #$20
+ExoProgressPtr
+         sta   $0500                 ; SMC lo byte
+         inc   ExoProgressPtr+1
++
 }
+
 } else {
 literal_start1:
         jsr get_crunched_byte
@@ -473,28 +458,8 @@ tabl_bit:
         !BYTE $8c, $e2
 }
 !IF SHOW_PROGRESS_DURING_DECRUNCH = 1 {
-progress_index:
-        !BYTE $00
-progress_counter:
-        !BYTE $00
-progress_char:
-        !BYTE $DC, $FC, $AF, $AD, $DC, $FC, $AF, $AD
-progress_address_lo:
-        !BYTE $BB, $BC, $BD, $3D, $BD, $BC, $BB, $3B
-progress_address_hi:
-        !BYTE $05, $05, $05, $06, $06, $06, $06, $06
-show_one_progress_char:
-; in: A=ASCII char to show
-;     y=0..7 index into progress_address_lo/hi array
-        pha
-        lda progress_address_lo,y
-        sta progress_STA+1
-        lda progress_address_hi,y
-        sta progress_STA+2
-        pla
-progress_STA:
-        sta $FFFF
-        rts
+ExoProgressCounter
+         !byte $00
 }
 ; -------------------------------------------------------------------
 ; end of decruncher

src/id/baudville.a

@@ -0,0 +1,39 @@
+;-------------------------------
+; IDBaudville
+; identify Baudville bootloader
+;
+; in:    track buffer contains T00,S00
+; out:   C clear if Baudville bootloader found
+;        C set otherwise
+;        all other registers & flags clobbered
+;-------------------------------
+!macro IDBaudville {
+; variation 1
+; - Blazing Paddles rev. 0
+; - Blazing Paddles v04421
+; - Blazing Paddles v04431
+; - Pixit v01331
+         lda   #$00
+         ldx   #$15
+         jsr   compare3
+         !byte $18,$AD,$4A
+         bcc   +                     ; passport-test-suite/Blazing Paddles rev. 0.woz [C=0] matches
+; variation 2
+; - Guitar Wizard v11601
+; - Prince v15521
+; - Prince v15531
+; - Rainy Day Games v13501
+; - Ski Crazed v28701
+; - Take 1 v06431
+; - Take 1 v06451
+; - Video Vegas v12501
+; - Video Vegas v12511
+         lda   #BASEPAGE
+         ldy   #$05
+         jsr   SearchSector
+         !byte $48
+         !byte $AD,$01,$E0
+         !byte $48
+                                     ; passport-test-suite/Take 1 v06431.woz [C=0] matches
++
+}

src/id/bootfailure.a

@@ -63,6 +63,7 @@ VerifyInfocom18
          beq   .setcount  ; passport-test-suite/Trinity - Side B.woz [Z=1] here
          lda   #$02       ; passport-test-suite/Time Lord.woz [Z=0] here
                           ; only two sectors when in ID mode
+
 .setcount
          sta   tmp        ; sector counter
 
@@ -155,7 +156,12 @@ VerifyInfocom18
 .verifyrw18
          ldx   #$06       ; six sectors, three times the usual size
          stx   tmp        ; sector counter
-         bne   +
+         stx   $40
+         stx   $41
+         stx   $42
+         stx   $43
+         stx   $44
+         stx   $45
 
 .retryrw18
          jsr   ReadNib
@@ -166,7 +172,11 @@ VerifyInfocom18
          bne   --
          jsr   .rw18pro
          bne   .badrw18
-+        ldy   #4
+         ldx   $2D
+         cmp   $40,x
+         beq   .badrw18
+         sta   $40,x
+         ldy   #4
 -        dey
          beq   .badrw18
 .x4
@@ -309,6 +319,11 @@ VerifyInfocom18
          eor   #$AA
 +        rts
 
+seekread13
+         dec   gCommand
+         jsr   $BD00       ; seek
+         inc   gCommand
+
 read13
          lda   $C0E9
          lda   #$1C        ; retry count
@@ -408,3 +423,7 @@ read13
          lda   $C0E8
          rts
 }
+
+; this prevents branches in this file from crossing a page
+; (adjust as necessary)
+filler   !fill 9

src/id/d5d5f7.a

@@ -1,33 +0,0 @@
-;-------------------------------
-; IDD5D5F7
-; Identify specific version of DOS 3.3 bootloader
-; shared by all disks that use the D5D5F7 check.
-; Note: this detection pattern makes no logical
-; sense; it just happens to be a useful filter for
-; the D5D5F7 patcher to use later. It filters out
-; about 2/3 of disks on which I've never seen a
-; D5D5F7 protection check, so we can save time by
-; not doing full-track searches on those disks.
-;
-; in:    $0800..$08FF contains T00,S00
-;        IDDOS33 returned success
-;        A = 0
-; out:   A = 0
-;        Y preserved
-;        all other flags and registers clobbered
-;-------------------------------
-!macro IDD5D5F7 {
-         ldx   #$08
-         cpx   $08F2
-         beq   @d5yes     ; passport-test-suite/Trivia Fever (BB03 variant 3).woz [Z=1] matches
-         cpx   $084C
-         bne   @d5no
-         ldx   $08B0
-         cpx   #$B6
-         bne   @d5no
-         ldx   $08D0
-         cpx   #$20
-         bne   @d5no
-@d5yes   sta   gPossibleD5D5F7 ; passport-test-suite/RoboMath.woz [Z=1] matches
-@d5no
-}

src/id/enlightenment.a

@@ -0,0 +1,18 @@
+;-------------------------------
+; IDEnlightenment
+; identify Enlightenment bootloader
+;
+; in:    $800..$8FF contains T00,S00
+; out:   C clear if Enlightenment bootloader found
+;        C set otherwise
+;        all other registers & flags clobbered
+;-------------------------------
+!macro IDEnlightenment {
+         lda   #$08
+         ldx   #$01
+         ldy   #$04
+         jsr   CompareMemory
+         !byte $A9,$B7
+         !byte $85,$27
+                                     ; passport-test-suite/Paul Whitehead Teaches Chess.woz [C=0] matches
+}

src/id/inspect0.a

@@ -57,6 +57,7 @@ IDBootloader
 .sanity
 ;
 ; Quick sanity check -- only recognized values for $0800 are
+; $00 = some Enlightenment disks
 ; $01 = most disks
 ; $02 = Special Delivery (DOS 3.3P)
 ; $05 = some EA disks
@@ -67,7 +68,19 @@ IDBootloader
          bcc   .sane
          cmp   #$05
          beq   .sane
-+        jmp   UseUniversal
+-        jmp   UseUniversal
++
+;
+; Try to identify Enlightenment bootloader.
+; (in none; out none)
+;
+         +IDEnlightenment
+         bcs   -
+         lda   #TRUE
+         sta   gIsEnlightenment
+         jsr   PrintByID
+         !byte s_enlightenmentb0
+         bvc   -                     ; always branches
 
 .sane
 ;
@@ -86,12 +99,6 @@ IDBootloader
          bcs   .notdos33
          sta   gIsBoot0              ; A = 0 (TRUE)
 ;
-; Try to identify specific DOS 3.3-shaped bootloader
-; that may imply a D5D5F7 whole-track protection.
-; (in A=0; out A=0)
-;
-         +IDD5D5F7
-;
 ; Try to identify Diversi-DOS
 ; (in A=0; out A=0)
 ;
@@ -141,6 +148,19 @@ IDBootloader
          jmp   Trace8B3
 .not8b3
 ;
+; Try to identify a bootloader that loads several sectors
+; into the text page before loading a non-standard RWTS in
+; higher memory.
+; Exit via custom trace function if found.
+;
+         +IDJMP600
+         bcs   .notjmp600
+         jsr   PrintByID
+         !byte s_jmp600
+         sta   gIsJMP600             ; A = 0 (TRUE)
+         jmp   FoundJMP600
+.notjmp600
+;
 ; Try to identify all the different MECC fastloader variants.
 ; Exit via custom trace function if found.
 ; (in A=0,X=0; out A=0,X=0)
@@ -339,6 +359,17 @@ IDBootloader
          jmp   foundadvent
 .notInterplay
 ;
+; Try to identify Baudville bootloader.
+; (in none; out none)
+;
+         +IDBaudville
+         bcs   .notBaudville
+         jsr   PrintByID
+         !byte s_baudville
+         lda   #TRUE
+         sta   gIsBaudville
+.notBaudville
+;
 ; Try to detect whether there is code in the boot sector
 ; that loads 4-and-4-encoded data. This is an early escape
 ; hatch for disks that will fail later anyway.

src/id/jmp600.a

@@ -0,0 +1,47 @@
+;------------------------------------------------------------------------------
+; IDJMP600
+; identify JMP600 bootloader
+; custom boot sector uses its own RWTS to load one or more sectors into the
+; text page and eventually jumps to $600 which uses a second RWTS to load
+; and jump to a third RWTS at $B700
+;
+; in:    track buffer contains T00,S00
+;        A = 0
+;        X = 0
+; out:   C clear if JMP600 bootloader was found
+;        C set if not found
+;        A = 0
+;        X = 0
+;        all other registers & flags clobbered
+;-------------------------------
+!macro IDJMP600 {
+         ldy   #$11
+         jsr   compare
+         !byte $01,$A2,$00,$BD,$00,$08,$9D,$00
+         !byte $02,$E8,$D0,$F7,$4C,$0F,$02,$A9
+         !byte $A0
+                          ; passport-test-suite/Competition Karate.woz [C=0] matches
+}
+
+FoundJMP600
+;
+; We found a JMP600 bootloader. Now we create
+; an RWTS that can read the rest of the disk.
+; Starting with our built-in RWTS, we modify address
+; and data prologues based on the parameters of the
+; original disk.
+;
+         lda   $84A
+         lsr
+         sta   UNIV_A1
+         lda   $853
+         sta   UNIV_A2
+         lda   $85D
+         sta   UNIV_A3
+         lda   $888
+         sta   UNIV_D1
+         lda   $891
+         sta   UNIV_D2
+         lda   $89B
+         sta   UNIV_D3
+         jmp   ADStyle

src/id/pascal.a

@@ -13,18 +13,20 @@
 !macro IDPascal {
 ;
 ; Apple Pascal signature (version < 1.3)
-; The wildcard in 7th position catches alternate jump
+; 7th position not included, to catch alternate jump
 ; addresses (e.g. Wizardry I, Sundog Frozen Legacy)
+; 8th position not included, to catch PFS
 ;
          lda   #$00
          tax
-         ldy   #$08
+         ldy   #$06
          jsr   compare    ; if T00,S00,$00 ==
          !byte $01
          !byte $E0,$60
          !byte $F0,$03
-         !byte $4C,WILDCARD,$08
+         !byte $4C
          bcc   @notPascal ; passport-test-suite/Wizplus.woz [C=0] matches
+                          ; passport-test-suite/PFS A02.woz [C=0] matches
 ;
 ; Apple Pascal 1.3 signature [thanks Marco V.]
 ;
@@ -33,7 +35,6 @@
          !byte $01
          !byte $E0,$70
          !byte $B0,$04
-         !byte $E0,$40
-         !byte $B0
+         !byte $E0
 @notPascal                ; passport-test-suite/Triangles Through Octagons.woz [C=0] matches
 }

src/id/trace32.a

@@ -41,7 +41,7 @@ TraceDOS32LO
 .TraceDOS32c
          lda   #$03
          ldx   #$0D
-         ldy   #$39
+         ldy   #$36
          jsr   CompareMemory
          !byte $A6,$2B
          !byte $A9,$09
@@ -70,7 +70,6 @@ TraceDOS32LO
          !byte $AD,$CC,$03
          !byte $85,$3F
          !byte $E6,$3F
-         !byte $6C,$3E,$00
          bcs   .tryChoplifter
          lda   $03CC
          cmp   #$B2                  ; RDOS
@@ -100,6 +99,18 @@ TraceDOS32LO
          lda   #$00
          sta   jCallRWTS+1
 
+         ;don't let The Game Show print
+
+         lda   $343
+         eor   #$4C
+         bne   +
+         sta   $345
+         lda   #$6C
+         sta   $343
+         lda   #$3E
+         sta   $344
++
+
 ; set up final trace
 
          lda   #$4C
@@ -298,10 +309,20 @@ FFer
 
 ;standard 13-sector prologue on T00
 ;because we can't decode the 16-sector version
+         lda   $BC76
+         pha
+         lda   $BC8B
+         pha
          lda   #$D5
          sta   $BC76
          lda   #$B5
          sta   $BC8B
+         jsr   +
+         pla
+         sta   $BC8B
+         pla
+         sta   $BC76
+         rts
 
 +        lda   gAddress
          sta   $BAF7

src/id/trace33.a

@@ -204,6 +204,29 @@ TraceDOS33c               ; 2nd-level trace callback is here
          sta   T02S05
 .notMilliken
 ;
+; Check for Didatech decryption routine
+; (affects readable/ignoreable sector map, so must ID now)
+;
+         lda   MaybeBC
+         ldx   #$E1
+         ldy   #$0A
+         jsr   CompareMemory
+         !byte $A2,$04
+         !byte $A0,$05
+         !byte $A9,$96
+         !byte $59,$00,$08
+         !byte $99
+         bcs   .notDidatech ; passport-test-suite/Crosscountry Canada.woz [C=0] matches
+         lda   #$07
+         sta   gDisplayBytes
+         jsr   PrintByID
+         !byte s_didatech
+         lda   #kSectorOptional
+         sta   T02S07
+         lda   #TRUE
+         sta   gIsDidatech
+.notDidatech
+;
 ; Try to initialize the 'current track' variable like the bootloader would --
 ; required for some disks that use a strange location for this variable
 ; e.g. Super Taxman II
@@ -334,6 +357,37 @@ TraceDOS33c               ; 2nd-level trace callback is here
          jsr   $BC61
 .notFun
 ;
+; Check for Micro Learn RWTS
+; (uses per-disk zero page values within RWTS)
+;
+         lda   MaybeB7
+         cmp   #$B7
+         bne   .notLearn
+         ldx   #$38
+         ldy   #$08
+         jsr   CompareMemory
+         !byte $A9,WILDCARD
+         !byte $85,$31
+         !byte $A9,WILDCARD
+         !byte $85,$D6
+         bcs   .notLearn  ; passport-test-suite/U.S. Constitution Tutor.woz [C=0] matches
+         lda   #$C9
+         sta   $B8E6
+         sta   $B8F0
+         sta   $B934
+         sta   $B954
+         sta   $B95E
+         sta   $B990
+         lda   $B739
+         sta   $B8F1
+         sta   $B955
+         sta   $B991
+         lda   $B73D
+         sta   $B8E7
+         sta   $B935
+         sta   $B95F
+.notLearn
+;
 ; Check for alternate RWTS entry point (e.g. Swordthrust)
 ;
          lda   MaybeB7
@@ -375,9 +429,21 @@ TraceDOS33c               ; 2nd-level trace callback is here
          !byte $D0,$13
          !byte WILDCARD,WILDCARD
          !byte $9D,$8D,$C0
-         bcs   .notEarthware ; passport-test-suite/Zoo Master.woz [C=0] matches
+         bcc   .yesEarthware ; passport-test-suite/Zoo Master.woz [C=0] matches
+         ldx   #$8C
+         jsr   CompareMemory
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$AD
+         !byte $D0,$F4
+         !byte $A9,$F8
+         !byte $3D,$8C,$C0
+         bcs   .notEarthware ; passport-test-suite/Zoo Master rev. 2.woz [C=0] matches
+.yesEarthware
          lda   #$BD
          sta   $B8F6
+         lda   $B8F7
+         sta   EarthwareSwapperLo+1
          lda   #$8C
          sta   $B8F7
          lda   #$C0

src/modify.a

@@ -90,3 +90,45 @@ mod_tmp_y=*+1
          ldy   #$FD                  ; SMC
          clv
          rts
+
+multimodify
+; in:    (A/Y) -> sector+offsets+values block
+;        X = number of values (must also be equal number of sectors and offsets)
+; out:   all registers/flags clobbered
+         sta   @getsector+1
+         sty   @getsector+2
+         stx   @loop+1
+         clc
+         adc   @loop+1
+         bcc   +
+         iny
++        sta   @getoffset+1
+         sty   @getoffset+2
+         clc
+         adc   @loop+1
+         bcc   +
+         iny
++        sta   @getvalue+1
+         sty   @getvalue+2
+         jmp   @next
+@loop
+         ldy   #$FD                  ; SMC
+@getvalue
+         lda   $FDFD, y              ; SMC
+         sta   @cmpvalue
+         sta   @modvalue
+@getsector
+         lda   $FDFD, y              ; SMC
+@getoffset
+         ldx   $FDFD, y              ; SMC
+         jsr   compare1
+@cmpvalue
+         !byte $FD                   ; SMC
+         bcc   @next
+         jsr   modify1
+@modvalue
+         !byte $FD                   ; SMC
+@next
+         dec   @loop+1
+         bpl   @loop
+         rts

src/mods/t00only.a

@@ -62,6 +62,7 @@ AnalyzeT00
          !source "../patchers/t00_methods.a"
          !source "../patchers/t00_microfun.a"
          !source "../patchers/t00_microfun2.a"
+         !source "../patchers/t00_microlearn.a"
          !source "../patchers/t00_milliken.a"
          !source "../patchers/t00_muserwts.a"
          !source "../patchers/t00_panglosdos.a"
@@ -72,6 +73,8 @@ AnalyzeT00
          !source "../patchers/t00_sunburst.a"
          !source "../patchers/t00_sve.a"
          !source "../patchers/t00_swordthrust.a"
+         !source "../patchers/t00_scottforesman_dos33.a"
+         !source "../patchers/t00_neosoft.a"
          ; ----- add new DOS 3.3 patchers above this line -----
          !source "../patchers/t00_nibtable.a"   ; clobbers $2000..$2095 (AnalyzeT00 is decompressed into $2000)
          !source "../patchers/t00_rwts.a"       ; must run after all other patchers that might modify RWTS code
@@ -94,6 +97,11 @@ T00_IsNotRWTS
          !source "../patchers/t00_pascalrwts.a"
          !source "../patchers/t00_rdos13.a"
          !source "../patchers/t00_rol1e.a"
+         !source "../patchers/t00_sigcheck.a"
+         !source "../patchers/t00_baudville.a"
+         !source "../patchers/t00_enlightenment.a"
+         !source "../patchers/t00_scottforesman.a"
+         !source "../patchers/t00_jmp600.a"
          rts
 
 !if * > $3200 {

src/mods/universalrwts.a

@@ -9,7 +9,7 @@
 ; - address prologue $D4 $AA $96 or $D5 $AA $96
 ; - verifies address field checksum
 ; - any address epilogue
-; - data prologue $D5 $AA $AD
+; - data prologue $D5 $AA * (anything > $96)
 ; - verifies data field checksum
 ; - any data epilogue
 ; - waits longer than a normal RWTS to find an address prologue (long enough
@@ -37,7 +37,7 @@ universalrwts
          !byte $C0,$60,$A0,$00,$A2,$56,$CA,$30,$FB,$B9,$00,$BB,$5E,$00,$BC,$2A
          !byte $5E,$00,$BC,$2A,$91,$3E,$C8,$C4,$26,$D0,$EB,$60,$A0,$20,$88,$F0
          !byte $61,$BD,$8C,$C0,$10,$FB,$49,$D5,$D0,$F4,$EA,$BD,$8C,$C0,$10,$FB
-         !byte $C9,$AA,$D0,$F2,$A0,$56,$BD,$8C,$C0,$10,$FB,$C9,$AD,$D0,$E7,$A9
+         !byte $C9,$AA,$D0,$F2,$A0,$56,$BD,$8C,$C0,$10,$FB,$C9,$97,$90,$E7,$A9
          !byte $00,$88,$84,$26,$BC,$8C,$C0,$10,$FB,$59,$00,$BA,$A4,$26,$99,$00
          !byte $BC,$D0,$EE,$84,$26,$BC,$8C,$C0,$10,$FB,$59,$00,$BA,$A4,$26,$99
          !byte $00,$BB,$C8,$D0,$EE,$BC,$8C,$C0,$10,$FB,$D9,$00,$BA,$D0,$13,$BD

src/passport.a

@@ -1,7 +1,7 @@
 ;-------------------------------
 ; Passport
 ; a 4am hack
-; (c) 2016-2021 by 4am
+; (c) 2016-2022 by 4am
 ;
 ; Permission is hereby granted, free of charge, to any
 ; person obtaining a copy of this software and associated
@@ -37,7 +37,7 @@
 VERBOSE  = $00       ; set to $01 to display API label addresses
 }
 
-!to "../build/PASSPORT.TMP",plain
+!to "../build/passport.tmp",plain
 !ct "lcase.ct"
 
 Relocatable
@@ -65,16 +65,18 @@ NonRelocatable
          !source "id/quickdos.a"
          !source "id/diversidos.a"
          !source "id/prontodos.a"
-         !source "id/d5d5f7.a"
          !source "id/laureate.a"
          !source "id/micrograms.a"
          !source "id/volumename.a"
          !source "id/dinkeydos.a"
          !source "id/advent.a"
+         !source "id/baudville.a"
+         !source "id/enlightenment.a"
          !source "id/panglosdos.a"
          !source "id/davidson.a"
          !source "id/holle.a"
          !source "id/phoenix.a"
+         !source "id/jmp600.a"
          !source "id/555.a"
          !source "id/trace32.a"
          !source "id/trace8b3.a"
@@ -332,7 +334,7 @@ AnalyzeTrack
          ; only run these modules in crack mode
          !source "patchers/universale7.a"
          !source "patchers/c9ff.a"
-         !source "patchers/d5d5f7.a"            ; gIsPascal || (gIsBoot0 && gPossibleD5D5F7) only
+         !source "patchers/d5d5f7.a"            ; gIsPascal || gIsBoot0 only
          !source "patchers/rwtsswapmecc.a"      ; gMECCFastloadType || gPossibleMECCSwapper only
          !source "patchers/meccdqc.a"           ; gMECCFastloadType==1 && gT07 only
          !source "patchers/rwtsswappenguin.a"   ; T01 only
@@ -365,7 +367,9 @@ AnalyzeTrack
          !source "patchers/tsr.a"               ; T04 && gIsTSR only
          !source "patchers/woodbury.a"          ; gPossibleWoodbury only
          !source "patchers/b4bbbasic.a"         ; gPossibleB4BBBasic only
+         !source "patchers/sigcheck.a"          ; gPossibleSigCheck only
          !source "patchers/errord51.a"          ; gIsLowDOS only
+         !source "patchers/enlightenment.a"     ; gIsEnlightenment && T02 only
          ;
          ; DOS 3.3-specific patchers
          ;
@@ -375,10 +379,14 @@ AnalyzeTrack
 +
          !source "patchers/hallabs.a"           ; gIsBoot0 && T01 only
          !source "patchers/harvey.a"            ; gIsBoot0 && T01 only
+         !source "patchers/microlearn.a"        ; gIsBoot0 && T01 only
          !source "patchers/jmpb400.a"           ; gIsBoot0 && T02 only
          !source "patchers/jmpb412.a"           ; gIsBoot0 && T02 only
+         !source "patchers/mak.a"               ; gIsBoot0 && T02 only
          !source "patchers/jsr8635.a"           ; gIsBoot0 only
          !source "patchers/sierra.a"            ; gIsBoot0 only
+         !source "patchers/probs5.a"            ; gIsBoot0 only
+         !source "patchers/didatech.a"          ; gIsBoot0 && gIsDidatech only
 _endDOS33Patchers
          ;
          ; Diversi-DOS-specific patchers
@@ -386,7 +394,6 @@ _endDOS33Patchers
          lda   gIsDiversi
          bne   _endDiversiPatchers
          !source "patchers/pdi.a"               ; gIsDiversi only
-         !source "patchers/sigcheck.a"          ; gIsDiversi only
 _endDiversiPatchers
          ;
          ; ProDOS-specific patchers
@@ -397,6 +404,8 @@ _endDiversiPatchers
 +
          !source "patchers/bbf9.a"              ; gIsProDOS only
          !source "patchers/fbffencrypted.a"     ; gIsProDOS only
+         !source "patchers/e7everywhere.encrypted.a" ; gIsProDOS only
+         !source "patchers/pfs.prodos.a"        ; gIsProDOS && T05 only
          !source "patchers/leisure.a"           ; gIsProDOS && T22 only
          !source "patchers/memory.config.a"     ; gIsProDOS only
          !source "patchers/origin.a"            ; gIsProDOS only
@@ -415,6 +424,7 @@ _endProDOSPatchers
          !source "patchers/a5count.a"           ; gIsPascal only
          !source "patchers/a6bc95.a"            ; gIsPascal only
          !source "patchers/fbffpascal.a"        ; gIsPascal only
+         !source "patchers/pfs.pascal.a"        ; gIsPascal only
 _endPascalPatchers
          ; /!\ execution falls through here because why not
 
@@ -457,6 +467,8 @@ _byte_skip_hi:
          rts
 
          !source "id/bootfailure.a"
+         nop
+         nop
          !source "wholetrack.a"
          !source "apicode.a"                    ; /!\ must be last
 

src/patchers/555.a

@@ -21,6 +21,7 @@
 ; - Disk Director
 ; - Drinks On a Disk
 ; - Friends or Lovers
+; - Funbunch College Prep
 ; - Game of the U.S.
 ; - Gertrude's Puzzles v1.0
 ; - Gertrude's Secrets v1.0
@@ -30,6 +31,7 @@
 ; - Keyboard Golf
 ; - L.A. Land Monopoly
 ; - Lazersilk
+; - Logic Builders
 ; - Microzine 3
 ; - Microzine 4
 ; - Microzine 5
@@ -156,8 +158,9 @@ Do555
 	 !byte $20,WILDCARD,WILDCARD ; JSR $xxxx
 	 !byte $88                   ; DEY
          !byte $D0,$FA               ; BNE *-4
-         bcc   .nohalf
-         jsr   CompareMemory
+         bcs   +
+         jmp   .nohalf
++        jsr   CompareMemory
 	 !byte $99,$02,$08 ; STA $802,y
 	 !byte $88         ; DEY
          !byte $D0,$FA     ; BNE *-4
@@ -192,10 +195,38 @@ Do555
          ;so we can count calls to whole-track seek
          ; static boot tracer!
 
+.skip2jsr
          ldy   $801,x
          lda   $800,y
          cmp   #$A9       ; LDA
-         beq   .nohalf
+         bne   .maybehalf
+         lda   $803,y
+         cmp   #$0B       ; [JMP] $xx0B
+         beq   .incx3
+         cmp   #$20       ; JSR $xxxx
+         bne   .nohalf
+         lda   $808,x
+         eor   .patch+1
+         bne   .nohalf
+         lda   $806,x
+         cmp   #$20       ; JSR $xxxx
+         bne   .nohalf
+         lda   $808,x
+         eor   .patch+1
+         bne   .nohalf
+         txa
+         adc   #5         ; try the next JSR instead
+         tax
+         bcc   +
+.incx3
+         inx
+         inx
+         inx              ; try the next JSR instead
++        inc   .curtrk+1
+         inc   .curtrk+1
+         bne   .skip2jsr  ; always taken
+
+.maybehalf
          lda   $801,y
          tay
          lda   $800,y
@@ -224,6 +255,12 @@ Do555
          lda   #0
          sta   .hookseek+1
          ldx   #$94
+         lda   $801,x
+         cmp   #$B7
+         bne   .not_e7
+         ldx   #$A2
+
+.not_e7
          jmp   .foundpart
 
 .foundseek2
@@ -508,7 +545,7 @@ Do555
          !byte $4C,$85,$04 ; JMP $0485
 
 .writesectors
-         jsr   WriteTrackNA
+         jsr   WriteTrack
          jsr   IncProgress
          lda   KEY
          bmi   .cancel
@@ -558,12 +595,12 @@ Do555
          ldy   #$37
          lda   ($3E),y
          cmp   #$41       ; [INC] $41
-         beq   .notpatch1
+         beq   .jnotpatch1
          ldy   $3A
          iny
          lda   ($3E),y
          cmp   #$4C
-         beq   .notpatch1
+         beq   .jnotpatch1
          tya
          clc
          adc   #$0D
@@ -613,6 +650,7 @@ Do555
          sta   ($3C),y
          lda   #0
          sta   $3E
+.jnotpatch1
          beq   .notpatch1
 
 .skipnohalf
@@ -812,6 +850,8 @@ Do555
          sta   $BDF2
          lda   #$B9
          sta   $BE2B
+         lda   #$50
+         sta   $47E       ; blow away track number to force full recalibration
          rts
 
 .exit

src/patchers/advint.a

@@ -1,30 +1,66 @@
 ;-------------------------------
 ; #ADVINT
-; encrypted protection check on
-; Adventure International disks
+; protection check on Adventure International disks
+; usually encrypted but not always
 ;
 ; tested on
 ; - Curse of Crowley Manor
 ; - Earthquake San Francisco 1906
 ; - QuestProbe featuring The Hulk
+; - QuestProbe featuring Spider-Man vB-258
+; - QuestProbe featuring Spider-Man vF-261
 ; - SAGA1 - Adventureland v2.0-416
 ; - SAGA1 - Adventureland v2.1-416
 ; - SAGA2 - Pirate Adventure v2.1-408
-; - SAGA3 - Mission Impossible v2.1/306
-; - SAGA4 - Voodoo Castle v2.1/119
+; - SAGA3 - Mission Impossible v2.1-306
+; - SAGA4 - Voodoo Castle v2.1-119
 ; - SAGA5 - The Count v2.1-115
 ; - SAGA6 - Strange Odyssey v2.1-119
 ;-------------------------------
 !zone {
          lda   gAdventureInternational
          bne   .exit
+         ; variant 0 - very old, possibly first generation
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $C9,$9C
+         !byte $B0,$04
+         !byte $BD,$88,$C0
+         !byte $60
+         !byte $4C
+         bcs   .variant1             ; passport-test-suite/War.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_advint
+         jsr   inx8
+         jsr   modify3
+         !byte $18                   ;CLC
+         !byte $90,$F9               ;BCC -$F9
+         bvc   .exit                 ; always branches
+;-----
+.variant1
+         ; variant 1 - unencrypted
+         ldy   #$08
+         jsr   SearchTrack
+         !byte $4C,WILDCARD,WILDCARD ;JMP $****
+         !byte $BD,$8C,$C0           ;LDA $C08C,X
+         !byte $10,$FB               ;BPL -$FB
+         bcs   .variant2             ; passport-test-suite/Spiderman B.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_advint
+         jsr   modify3
+         !byte $18                   ;CLC
+         !byte $90,$6E               ;BCC +$6E
+         bvc   .exit                 ; always branches
+;-----
+.variant2
+         ; variant 2 - bytes are XOR'd with #$C9 on disk
+         ; comments show decrypted code
          ldy   #$08
          jsr   SearchTrack
-         ; bytes are XORd with #$C9 on disk -- comments show decrypted code
          !byte $85,WILDCARD,WILDCARD ;JMP $****
          !byte $74,$45,$09           ;LDA $C08C,X
          !byte $D9,$32               ;BPL -$FB
-         bcs   .exit      ; passport-test-suite/S.A.G.A. 6.woz [C=0] matches
+         bcs   .exit                 ; passport-test-suite/S.A.G.A. 6.woz [C=0] matches
          jsr   PrintByID
          !byte s_advint
          jsr   modify3

src/patchers/corrupter.a

@@ -42,6 +42,7 @@
          !byte $85,$04    ; STA $04
          !byte $20,$28,$40; JSR $4028
          bcs   .exit      ; passport-test-suite/Squire.woz [C=0] matches
+         sta   gDisplayBytes
          jsr   PrintByID
          !byte s_corrupter
          jsr   modify1

src/patchers/d5d5f7.a

@@ -3,29 +3,24 @@
 ; nibble count with weird bitstream
 ; involving $D5 and $F7 as delimiters
 ;
-; Ace Detective
-; Cat 'n Mouse
-; Cotton Tales
-; Dyno-Quest
-; Easy Street
-; Fraction-oids
-; Math Magic
-; RoboMath
+; Ace Detective (Mindplay)
+; Cat 'n Mouse (Mindplay)
+; Cotton Tales (Mindplay)
+; Dyno-Quest (Mindplay)
+; Easy Street (Mindplay)
+; Fraction-oids (Mindplay)
+; Math Magic (Mindplay)
+; RoboMath (Mindplay)
 ; NoteCard Maker (Pascal variant)
+; Les Sports (DC Heath) - variant wrapped by PHA/PLAs
+; Picture Perfect (1987) (Mindplay)
 ;-------------------------------
 !zone {
 ;
-; always run on Pascal disks
+; only run on Pascal disks and DOS 3.3 disks
 ;
          lda   gIsPascal
-;
-; if DOS 3.3-shaped bootloader, only run if we found
-; specific markers on T00,S00 earlier that are shared
-; by all the samples I have that use this protection.
-; (This filter is subject to revision if we find
-; additional samples.)
-;
-         and   gPossibleD5D5F7
+         and   gIsBoot0
          bne   .exit
          ldy   #$20
          jsr   SearchTrack
@@ -46,11 +41,12 @@
          !byte $C8        ; INY
          !byte $18        ; CLC
          !byte $6D        ; ADC
-         bcs   .exit      ; passport-test-suite/RoboMath.woz [C=0] matches
+         bcs   .exit      ; passport-test-suite/Cotton Tales.woz [C=0] matches
                           ; passport-test-suite/Notecard Maker.woz [C=0] matches
          jsr   PrintByID
          !byte s_d5d5f7
-         jsr   modify1
-         !byte $60        ; RTS
+         jsr   modify3
+         !byte $18        ; CLC
+         !byte $90,$62    ; BCC +$62
 .exit
 }

src/patchers/didatech.a

@@ -0,0 +1,25 @@
+;-------------------------------
+; #DIDATECH
+; nibble check of malformed T02,S07
+;
+; tested on
+; - Crosscountry Canada
+; - Crosscountry USA
+; - Crosscountry California
+;-------------------------------
+         lda   gIsDidatech
+         bne   +
+
+         ldy   #$09
+         jsr   SearchTrack; code is XOR #$96 but not tamper-checked
+         !byte $06,$59    ; BCC -$CF
+         !byte $8E        ; CLC
+         !byte $36,$68    ; LDY #$FE
+         !byte $06,$97    ; BCC +$01
+         !byte $5E        ; INY
+         !byte $1A        ; STY ....
+         bcs   +          ; passport-test-suite/Crosscountry Canada.woz [C=0] matches
+         jsr   inx7
+         jsr   modify1
+         !byte $7C        ; NOP instead of INY
++

src/patchers/e7everywhere.a

@@ -3,8 +3,9 @@
 ; E7 bitstream in the track seam of every track
 ;
 ; We can't attack the bitstream itself (like #UNIVERSALE7) because it's not
-; within any sector data, so we search for the code instead. AFAIK the code
-; is never encrypted.
+; within any sector data, so we search for the code instead. Encrypted
+; variant is handled elsewhere.
+;
 ; This does a full-track search on every track, which is unfortunate. I've
 ; only seen this protection on DOS and ProDOS disks, so we filter on that
 ; to optimize performance a little bit.

src/patchers/e7everywhere.encrypted.a

@@ -0,0 +1,30 @@
+;------------------------------------------------------------------------------
+; #E7EVERYWHERE.ENCRYPTED
+; E7 bitstream in the track seam of every track
+;
+; We can't attack the bitstream itself (like #UNIVERSALE7) because it's not
+; within any sector data, so we search for the code instead.
+;
+; tested on
+; - Language Carnival 1 & 2 (DLM)
+;------------------------------------------------------------------------------
+         ; gIsProDOS is TRUE here
+         lda   #$0F
+         sta   .sector+1
+.sector  lda   #$FF                  ; modified at runtime
+         ldx   #$0C
+         ldy   #$0A
+         jsr   compare
+         !byte $F5
+         !byte $20,$00,$20
+         !byte $90,$04
+         !byte $20,$B0,$FE
+         !byte $60
+         bcs   .nextsector           ; passport-test-suite/Language Carnival.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_e7everywhere
+         jsr   modify1               ; change branch target to success path
+         !byte $09
+.nextsector
+         dec   .sector+1
+         bpl   .sector

src/patchers/ea.a

@@ -330,7 +330,7 @@
 +        ldy   #16
          jsr   SearchTrack
          !byte $49,$4E     ;EOR #$4E
-         !byte $09,$2B     ;ORA #$2B
+         !byte $09,WILDCARD ;ORA #$xx
          !byte $48         ;PHA
          !byte $A9,$04     ;LDA #$04
          !byte $48         ;PHA

src/patchers/enlightenment.a

@@ -0,0 +1,48 @@
+;-------------------------------
+; #ENLIGHTENMENT
+; anti-tamper checks on the changes
+; we're about to make on track 0
+; to disable the RWTS swapper and
+; protection check
+;-------------------------------
+!zone {
+         lda   gIsEnlightenment
+         bne   .exit
+         lda   gTrack
+         cmp   #$02
+         bne   .exit
+
+         lda   #$01
+         ldx   #$AE
+         jsr   compare1
+         !byte $48
+         bcs   +
+
+         jsr   PrintByID
+         !byte s_tamper
+         jsr   modify1
+         !byte $EA
++
+         lda   #$01
+         ldx   #$D5
+         jsr   compare1
+         !byte $48
+         bcs   +
+
+         jsr   modify1
+         !byte $EA
++
+         lda   #$09
+         ldx   #$8A
+         jsr   compare3
+         !byte $A9,$00
+         !byte $48
+         bcs   +
+         inx
+         jsr   PrintByID
+         !byte s_tamper
+         jsr   modify1
+         !byte $52
++
+.exit
+}

src/patchers/gamco.a

@@ -16,12 +16,26 @@
          !byte $33,$32,$01,$30,$03,$31,$39,$31
          !byte $03,$31,$32,$38,$02,$31,$31,$02
          !byte $39,$36
-         bcs   .exit      ; passport-test-suite/Essential Grammar.woz [C=0] matches
+         bcs   .var2      ; passport-test-suite/Essential Grammar.woz [C=0] matches
          jsr   PrintByID
          !byte s_poke
          jsr   modify
          !byte $34,$34,$01,$30,$02,$31,$30,$03
          !byte $32,$33,$34,$03,$31,$36,$39,$02
          !byte $33,$39
+         bvc   .exit
+.var2
+         ldy   #$12
+         jsr   SearchTrack
+         !byte $32,$01,$30,$03,$31,$39,$31,$03
+         !byte $31,$32,$38,$03,$32,$35,$30,$02
+         !byte $33,$31
+         bcs   .exit      ; passport-test-suite/Percent (Gamco).woz [C=0] matches
+         jsr   PrintByID
+         !byte s_poke
+         jsr   modify
+         !byte $36,$01,$30,$03,$31,$36,$39,$03
+         !byte $31,$32,$38,$03,$31,$36,$39,$02
+         !byte $33,$39
 .exit
 }

src/patchers/holle.a

@@ -68,9 +68,44 @@
          dec   .sector+1
          bpl   .sector
 
+         ; look for secondary RWTS that enforces elongated timing after data prologue
+         ; e.g. Sherwood Forest
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $49,$AD               ; EOR #$AD
+         !byte $D0,$E7               ; BNE -
+         !byte $08                   ; PHP
+         !byte $20,WILDCARD,WILDCARD ; JSR xxxx
+         !byte $28                   ; PLP
+         bcs   +
+         jsr   inx4
+         jsr   modify2
+         !byte $F0,$03               ; BEQ +3
+
+         ; look for secondary disk volume number check
+         ; e.g. Sherwood Forest
++        ldy   #$03
+         jsr   SearchTrack
+         !byte $A4,$1A               ; LDY $1A
+         !byte $8C                   ; STY
+         bcs   +
+         jsr   modify2
+         !byte $A0,$00               ; LDY #$00
+
+         ; look for save game disk volume number check
+         ; e.g. Sherwood Forest
++        ldy   #$05
+         jsr   SearchTrack
+         !byte $AD,$16,$98           ; LDA $9816
+         !byte $F0,$0F               ; BEQ +0F
+         bcs   +
+         jsr   inx4
+         jsr   modify1
+         !byte $00
+
          ; look for secondary disk volume number check
          ; e.g. Crime Wave
-         ldy   #$04
++        ldy   #$04
          jsr   SearchTrack
          LDA   $2F
          ORA   $2E

src/patchers/jmpb400.a

@@ -3,7 +3,7 @@
 ; Boot1 jumps to $B400 for a
 ; self-decrypting nibble check
 ; that seeks to track $23
-; and exits via $9D84 if successful
+; and exits via $9D84 or $9B00 if successful
 ;
 ; tested on
 ; Binomal Multiplication (1984, Mindscape)
@@ -12,6 +12,7 @@
 ; First Degree Linear Equations (1984, Mindscape)
 ; PathWords (1984, Thunder Mountain)
 ; Success With Math - Multiplying and Dividing Fractions (1984, Mindscape)
+; Rebus Writer (1987, Mindscape)
 ;-------------------------------
 !zone {
          ; gIsBoot0 is TRUE here
@@ -31,11 +32,11 @@
          bcs   .exit
 
          ldx   #$D5
-         ldy   #$16
+         ldy   #$14
          jsr   compare    ; and T02,S03,$D5 ==
          !byte $F1,$C2,$8C,$F1,$C0,$8C,$5C,$B7  ; encrypted code --
          !byte $85,$99,$9C,$BF,$8C,$11,$9C,$82  ; decrypted listing follows
-         !byte $F1,$C4,$8C,$00,$C8,$D1
+         !byte $F1,$C4,$8C,$00
                           ; LDA   $C08E,X
                           ; LDA   $C08C,X
                           ; BPL   $00D8
@@ -44,8 +45,9 @@
                           ; CPY   #$5D
                           ; BNE   $00B3
                           ; LDA   $C088,X
-                          ; JMP   $9D84
+                          ; JMP
          bcs   .exit      ; passport-test-suite/Binomial Multiplication.woz [C=0] matches
+                          ; passport-test-suite/Rebus Writer.woz [C=0] matches
 
          ldx   #$B4
          stx   gDisplayBytes+1       ; address (hi)
@@ -54,7 +56,18 @@
          jsr   PrintByID
          !byte s_beforedos
 
+         pha
+         lda   $13E9
+         eor   #$4C
+         sta   @jmplo
+         lda   $13EA
+         eor   #$4C
+         sta   @jmphi
+         pla
+
          jsr   modify3    ; then set T02,S03,$00 =
-         !byte $4C,$84,$9D
+         !byte $4C
+@jmplo   !byte $84        ; SMC
+@jmphi   !byte $9D        ; SMC
 .exit
 }

src/patchers/jmpb4bb.a

@@ -71,5 +71,17 @@
          inx
          jsr   modify3    ; then set offset+1 to
          !byte $4C,$84,$9D
+
+         ldx   #$19
+         ldy   #$05
+         jsr   compare    ; if T02,S0x,$19 ==
+         !byte $AE,$07,$B7; LDX $B707
+         !byte $8E,$55    ; STX $xx55
+         bcs   .exit      ; passport-test-suite/Half Time.woz [C=0] matches
+         inx
+         inx
+         inx
+         jsr   modify1    ; disable optional RWTS swapper
+         !byte $2C
 .exit
 }

src/patchers/mak.a

@@ -0,0 +1,41 @@
+;-------------------------------
+; #MAK
+; Boot1 jumps to $B3BB to read
+; two sectors on track $23
+;
+; so named because it prints the
+; initials 'MAK' on screen before
+; executing the protection check
+;
+; Kittens, Kids, and a Frog 03.12.86 (Hartley)
+; Who What Where When Why 02.05.86 (Hartley)
+;-------------------------------
+!zone {
+         ; gIsBoot0 is TRUE here
+
+         lda   gTrack
+         cmp   #$02
+         bne   .exit
+
+         lda   #$02
+         ldx   #$BB
+         ldy   #$0A
+         jsr   compare    ; if T02,S02,$BB ==
+         !byte $20,$58,$FC; JSR $FC58
+         !byte $A9,$CD    ; LDA #$CD
+         !byte $20,$ED,$FD; JSR $FDED
+         !byte $A9,$C1    ; LDA #$C1
+         bcs   .exit      ; passport-test-suite/Kittens, Kids, and a Frog.woz [C=0] matches
+
+         ldy   #$B3
+         sty   gDisplayBytes+1       ; address (hi)
+         ldy   #$BB
+         sty   gDisplayBytes+2       ; address (lo)
+         jsr   PrintByID
+         !byte s_beforedos
+
+         ldx   #$BB
+         jsr   modify3    ; then set T02,S02,$BB =
+         !byte $4C,$84,$9D
+.exit
+}

src/patchers/microlearn.a

@@ -0,0 +1,30 @@
+;-------------------------------
+; #MICROLEARN
+; protection check that writes
+; its own protection track on
+; first boot
+;
+;-------------------------------
+!zone {
+         lda   gTrack
+         cmp   #$01
+         bne   .exit
+
+         lda   #$00
+         ldx   #$84
+         jsr   compare3
+         !byte $4C,$8E,$AE
+         bcs   .exit
+
+         sta   gDisplayBytes
+         ldy   #$AE
+         sty   gDisplayBytes+1       ; address (hi)
+         ldy   #$8E
+         sty   gDisplayBytes+2       ; address (lo)
+         jsr   PrintByID
+         !byte s_beforedos
+
+         jsr   modify3
+         !byte $AD,$E9,$B7
+.exit
+}

src/patchers/pfs.pascal.a

@@ -0,0 +1,91 @@
+;-------------------------------
+; #PFSPASCAL
+; a variant of Activision's Timing Bit Detection
+; linked as an Apple Pascal module
+; (soft switches are hard-coded to slot 6)
+;
+; tested on
+; - pfs: file (Pascal version)
+; - pfs: graph (Pascal version)
+; - pfs: report (Pascal version)
+;-------------------------------
+         ; gIsPascal is TRUE here
+
+@variation1
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $F0,$27    ; BEQ +
+         !byte $AD,$EC,$C0; LDA $C0EC
+         !byte $10,$FB    ; BPL -
+         !byte $C9,$93    ; CMP #$93
+         bcs   @variation2; passport-test-suite/PFS Graph.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_pfs
+         inx
+         jsr   modify1
+         !byte $25        ; unconditional jump to success path
+         bvc   @variation1; always branches (may find additional protection checks on same track)
+
+@variation2
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $F0,$31    ; BEQ +
+         !byte $AD,$EC,$C0; LDA $C0EC
+         !byte $10,$FB    ; BPL -
+         !byte $C9,$AD    ; CMP #$AD
+         bcs   @writeCheck; passport-test-suite/PFS Write 1984-11-01.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_pfs
+         inx
+         jsr   modify1
+         !byte $2F        ; unconditional jump to success path
+         bvc   @variation2; always branches (may find additional protection checks on same track)
+
+@writeCheck
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $9E,$06
+         !byte $9E,$22
+         !byte $00
+         !byte $C3,$A1
+         !byte $02,$B9
+         bcc   @foundWriteCheck
+
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $9E,$06
+         !byte $9E,$22
+         !byte $00
+         !byte $C3,$A1
+         !byte $2E,$C7
+         bcc   @foundWriteCheck
+
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $9E,$06
+         !byte $9E,$22
+         !byte $00
+         !byte $C3,$AB
+         !byte $05,$A9
+         bcc   @foundWriteCheck      ; passport-test-suite/PFS Graph 1983-01-12.woz [C=0] here
+
+         ldy   #$09
+         jsr   SearchTrack
+         !byte $9E,$06
+         !byte $9E,$22
+         !byte $00
+         !byte $C3,$A1
+         !byte $5D,$CD
+         bcs   @exit                 ; passport-test-suite/PFS Write 1984-09-27.woz [C=0] here
+
+@foundWriteCheck
+         jsr   PrintByID
+         !byte s_corrupter
+         inx
+         jsr   modify1
+         !byte $05        ; UREAD command instead of UWRITE
+         jsr   inx4
+         jsr   modify1
+         !byte $CB        ; NEQI instead of EQUI because we expect the UREAD to succeed
+         bvc   @writeCheck; always branches (may find additional write checks on same track)
+@exit

src/patchers/pfs.prodos.a

@@ -0,0 +1,28 @@
+;-------------------------------
+; #PFSPRODOS
+; a variant of Activision's Timing Bit Detection
+; used by PFS ProDOS titles
+; (soft switches are munged and corrected at runtime)
+;
+; tested on
+; - pfs: file (ProDOS version)
+; - pfs: report (ProDOS version)
+; - pfs: write (ProDOS version)
+;-------------------------------
+         ; gIsProDOS is TRUE here
+
+         ldy   gTrack
+         cpy   #$05
+         bne   +
+         lda   #$00
+         ldx   #$5E
+         jsr   compare    ; if T05,S00,$5E ==
+         !byte $FF
+         !byte $CD,$88,$C0
+         !byte $60
+         bcs   +          ; passport-test-suite/PFS Write.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_fbff
+         jsr   modify1
+         !byte $00
++

src/patchers/probs5.a

@@ -0,0 +1,35 @@
+;-------------------------------
+; #PROBS5
+; sector check of track $23
+; usually found in PROBS5 file
+;
+; tested on
+; - Addition and Subtraction of Fractions Analyzer
+; - Addition and Subtraction of Fractions Worksheet
+; - Decimals Analyzer
+; - Decimals Worksheet
+; - Multiplication and Division of Fractions Analyzer
+; - Multiplication and Division of Fractions Worksheet
+; - Whole Numbers Analyzer
+; - Whole Numbers Worksheet
+;-------------------------------
+!zone {
+         lda   #$0F
+         sta   .sector+1
+.sector  lda   #$FF       ; modified at runtime
+         ldx   #$00
+         ldy   #$08
+         jsr   compare
+         !byte $00,$20, $FF,$0F ; DOS 3.3 file header
+         !byte $A9,$23    ; LDA #$23
+         !byte $8D,$EC    ; STA $..EC
+         bcs   +          ; passport-test-suite/Addition and Subtraction of Fractions Analyzer.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_probs5
+         ldx   #$04
+         jsr   modify1
+         !byte $60        ; RTS
++        dec   .sector+1
+         bpl   .sector
+.exit
+}

src/patchers/sierra.a

@@ -28,6 +28,8 @@
 ; - The Dark Crystal
 ; - Mixed Up Mother Goose
 ; - The Artist
+; - Ultima II
+; - The General Manager
 ;
 ; module by qkumba
 ;-------------------------------
@@ -44,6 +46,30 @@
          jsr   modify1
          !byte $2C
 
+         pha
+         txa
+         sec
+         sbc   #10
+         tax
+         pla
+         ldy   #8
+         jsr   compare
+         !byte $AD,WILDCARD,$63 ;LDA $63xx
+         !byte $C9,$20          ;CMP #$20
+         !byte $F0,$03          ;BEQ *+5
+         !byte $4C              ;JMP $xxxx
+         bcs   +
+         pha
+         jsr   PrintByID
+         !byte s_tamper
+         txa
+         clc
+         adc   #4
+         tax
+         pla
+         jsr   modify1
+         !byte $2C ;don't run protection check
+
          ;there are two of these on the same track
 
 +        ldy   #3
@@ -120,7 +146,7 @@
          bcs   +
          pha
          tay
-         jsr   inx5
+         jsr   inx4
          txa
          pha
          tya
@@ -355,19 +381,18 @@
          jsr   modify1
          !byte $2C ;don't call protection check
 
++
 .jmpexit
          jmp   .exit
 
 .dosearch
          ; gIsBoot0 is TRUE here
 
-         ldy   #15
+         ldy   #9
          jsr   SearchTrack
-         !byte $CE,WILDCARD,WILDCARD ;DEC $xxxx
-         !byte $EF,WILDCARD,WILDCARD ;mod->INC $xxxx
          !byte $AD,WILDCARD,WILDCARD ;LDA $xxxx
          !byte $49,WILDCARD          ;EOR #$xx
-         !byte $D0,01                ;BNE *+3
+         !byte $D0,$01               ;BNE *+3
          !byte $20                   ;dummy
          !byte $8D                   ;STA $xxxx
          bcc   +
@@ -387,7 +412,7 @@
          sta   .page10+2
          stx   .adj+1
          txa
-         adc   #17
+         adc   #11
          tax
 .page1
          lda   $D100,x
@@ -531,6 +556,7 @@
          bcs   .exit
 .page8
          lda   $D109,x
+         sta   .tryalt2+1
          pha
 .adj
          adc   #$D1
@@ -548,6 +574,15 @@
          bcc   .yes
          pha
 .tryalt
+         ldx   #$D1
+         ldy   #3
+         jsr   compare
+         !byte $A9,$1C ;LDA #$1C
+         !byte $8D     ;STA $xxxx
+         pla
+         bcc   .yes
+         pha
+.tryalt2
          ldx   #$D1
          ldy   #3
          jsr   compare

src/patchers/sigcheck.a

@@ -3,24 +3,49 @@
 ; productized extra wide track protection check
 ;
 ; tested on
-; - Advanced Electricity
-; - Complex Circuits
-; - Projectile and Circular Motion
+; - Advanced Electricity (EME)
+; - Complex Circuits (EME)
+; - Projectile and Circular Motion (EME)
+; - Inca (Hayden)
+; - Holy Grail (Hayden)
+; - The Dam Busters (Accolade)
+; - Conjecture (Robert Scott)
 ;-------------------------------
-!zone {
-         ; gIsDiversi is TRUE here
-         ; (only ever seen this protection on Diversi-DOS disks)
-
-         ldy   #$0A
+         lda   gIsBoot0
+         bne   @exit
+         ldy   #$05
          jsr   SearchTrack
-         !byte $4C,$42,$61
-         !byte $A9,$00
-         !byte $F0,$02
-         !byte $A9,$FF
-         !byte $48
-         bcs   .exit      ; passport-test-suite/Advanced Electricity.woz [C=0] matches
-         jsr   inx8
+         !byte $BD,$80,$C0; LDA $C080,X
+         !byte $18        ; CLC
+         !byte $68        ; PLA
+         bcs   @exit      ; passport-test-suite/Advanced Electricity.woz [C=0] matches
+         inx
+         inx
          jsr   modify1
-         !byte $00
-.exit
-}
+         !byte $D0        ; change indexed softswitch address so it does nothing
+                          ; now search for non-standard RWTS parameters
+                          ; conveniently listed at beginning of SIGCHECK routine
+         ldy   #$0C
+         jsr   SearchTrack
+         !byte $D5,$AA,$96
+         !byte WILDCARD,WILDCARD
+         !byte $D5,$AA,$AD
+         !byte WILDCARD,WILDCARD
+         !byte $18,$B0
+         bcs   @exit
+         jsr   +
+         jmp   @exit
++        jsr   ++
+         inx
+         inx
+++       inx
+         inx
+         inx
+         jsr   compare2
+         !byte $DE,$AA
+         bcc   +++
+                          ; passport-test-suite/Water Pollution.woz reaches here
+         jsr   modify2
+         !byte $DE,$AA
++++      rts
+@exit

src/patchers/t00_baudville.a

@@ -0,0 +1,75 @@
+;-------------------------------
+; #BAUDVILLE
+; track sync and hidden sector checks
+;
+; tested on
+; - Blazing Paddles rev. 0
+; - Blazing Paddles v04421
+; - Blazing Paddles v04431
+; - Guitar Wizard v11601
+; - Pixit v01331
+; - Prince v15521
+; - Prince v15531
+; - Rainy Day Games v13501
+; - Ski Crazed v28701
+; - Take 1 v06431
+; - Take 1 v06451
+; - Video Vegas v12501
+; - Video Vegas v12511
+;-------------------------------
+!zone {
+         lda   gIsBaudville
+         bne   .exit
+
+;.variation1
+         ldy   #$03
+         jsr   SearchTrack
+         !byte $4C,$00,$BB
+         bcs   .variation2           ; passport-test-suite/Blazing Paddles rev. 0.woz [C=0] matches
+         tay                         ; only continue if we found it in sector 0
+         bne   .variation2
+         inx
+         inx
+         jsr   modify1
+         !byte $B1                   ; JMP $BB00 -> JMP $B100
+         bvc   .secondary            ; always branches
+
+.variation2
+         lda   #$06
+         ldx   #$00
+         jsr   compare2
+         !byte $E0,$02
+         bcs   .secondary            ; passport-test-suite/Take 1 v06431.woz [C=0] matches
+
+         ldy   #$04
+         jsr   SearchTrack
+         !byte $A5,$2B
+         !byte $8D,$D0
+         bcs   .secondary            ; passport-test-suite/Take 1 v06431.woz [C=0] matches
+         cmp   #$06                  ; only continue if we found it in sector 6
+         bne   .secondary
+         dex
+         stx   @offset               ; passport-test-suite/Prince v15531.woz [X=3C] here
+         ldx   #$01
+         jsr   modify1               ; change entry point to first instruction after protection
+@offset  !byte $FD                   ; SMC
+         ; /!\ execution falls through here
+
+.secondary
+         lda   #$0F
+         ldx   #$04
+         ldy   #$06
+         jsr   compare
+         !byte $A5,$2D
+         !byte $C9,$FF
+         !byte $D0,$F7
+         bcs   .exit                 ; passport-test-suite/Take 1 v06431.woz [C=0] matches
+         inx
+         inx
+         inx
+         inx
+         inx
+         jsr   modify1
+         !byte $00                   ; branch back -> branch to next instruction (i.e. ignore)
+.exit
+}

src/patchers/t00_bb03.a

@@ -15,17 +15,22 @@
 ; - Mrs. Wigglesworth's Secret
 ; - Mystery of the Witch's Shoes
 ;
-; variant 3 (JMP $BB03)
+; variant 3a (JMP $BB03)
 ; - Alice in Wonderland (some versions)
 ; - Sum Ducks
 ; - Trivia Fever
+;
+; variant 3b (JMP $BB03 but no whole track count)
+; - Pacific 231
 ;-------------------------------
 !zone {
          lda   #$07       ; sector to check for David-DOS variant
          ldy   gIsDavidDOS
          beq   .check
          ldy   gIsBoot0   ; if DOS 3.3 boot0 loader
-         bne   .exit
+         beq   +
+         jmp   .exit
++
          lda   #$05       ; sector to check for DOS 3.3 variant
 .check   ldx   #$03
          jsr   compare3   ; if T00,S0(5|7),$03 ==
@@ -52,8 +57,22 @@
          jsr   compare    ; and T00,S05,$6B ==
          !byte $06,$26,$7D; encrypted, decrypts to 'LDA $C08C,X / BPL -'
          !byte $39,$41
+         bcc   .variant3a
+         ldx   #$65
+         jsr   compare    ; or T00,S05,$65 ==
+         !byte $A3,$BC
+         !byte $BD,$30,$99; encrypted, decrypts to 'LDY #$05 / LDA $C08C,X'
          bcs   .exit
-;variant3
+.variant3b
+         inx
+         jsr   modify3    ; then set T00,S05,$66 =
+         !byte $B9,$F0,$85; encrypted, decrypts to '#$00 / BEQ +$39'
+                          ; which will set Y to 0 (required) and branch to $BBA2
+                          ; to finish setting side effects and continue on success path
+                          ; passport-test-suite/Pacific 231.woz [V=0] reaches here
+         bvc   .exit      ; always branches
+
+.variant3a
          jsr   modify2    ; then set T00,S05,$6B =
          !byte $6B,$F6    ; encrypted, decrypts to 'BNE +$5C' which will unconditionally branch to success path at $BBC9
          lda   #$06

src/patchers/t00_earthware.a

@@ -10,14 +10,16 @@
 ;
 ; tested on
 ; - Black Belt (Earthware Computer Services)
+; - Black Belt rev. 2 (Earthware Computer Services)
 ; - Zoo Master (Earthware Computer Services)
+; - Zoo Master rev. 2 (Earthware Computer Services)
 ; - Star Search (Earthware Computer Services)
 ;-------------------------------
 EARTHWARE
          lda   #$02
          ldx   #$F6
          jsr   compare3
-         !byte $4C,$89,$B6
+         !byte $4C,WILDCARD,$B6
          bcs   @exit                 ; passport-test-suite/Zoo Master.woz [C=0] here
          jsr   PrintByID
          !byte s_bytrack

src/patchers/t00_enlightenment.a

@@ -0,0 +1,41 @@
+;-------------------------------
+; #T00_ENLIGHTENMENT
+; RWTS third data prologue varies,
+; also an insane flux-level timing
+; protection
+;
+; tested on
+; - Paul Whitehead Teaches Chess
+; - King's Indian Defense
+; - Living Chess Library - 50 Classic Games
+;-------------------------------
+!zone {
+         lda   gIsEnlightenment
+         bne   .exit
+
+         lda   #$0A
+         ldx   #$26
+         jsr   compare2
+         !byte $85,$3D
+         bcs   +
+
+         jsr   PrintByID
+         !byte s_enlightenment
+         jsr   modify2
+         !byte $18
+         !byte $60
++
+         lda   #$0C
+         ldx   #$94
+         jsr   compare3
+         !byte $BD,$00,$BF
+         bcs   +
+
+         jsr   PrintByID
+         !byte s_bytrack
+         jsr   modify3
+         !byte $EA
+         !byte $A9,$AD
++
+.exit
+}

src/patchers/t00_jmp600.a

@@ -0,0 +1,144 @@
+;------------------------------------------------------------------------------
+; #JMP600
+; custom boot sector uses its own RWTS to load one or more sectors into the
+; text page and eventually jumps to $600 which uses a second RWTS to load
+; and jump to a third RWTS at $B700
+;
+; tested on
+; - Dinosaurs v1.0 (Advanced Ideas)
+; - Wizard of Words v1.0 (Advanced Ideas)
+;------------------------------------------------------------------------------
+;
+; common to all variants:
+;
+; T00,S00,$4A:  -> D5
+; T00,S00,$53:  -> AA
+; T00,S00,$5D:  -> 96
+;
+; T00,S00,$88:  -> D5
+; T00,S00,$91:  -> AA
+; T00,S00,$9B:  -> AD
+;
+; T00,S03,$1A:  -> D5
+; T00,S03,$23:  -> AA
+; T00,S03,$2D:  -> 96
+;
+; T00,S03,$57:  -> D5
+; T00,S03,$60:  -> AA
+; T00,S03,$6A:  -> AD
+;
+; That's all that's required for the 'basic' version (e.g. Wizard of Words v1.0).
+; Its final RWTS loaded into $B700+ is custom but seamlessly supports both
+; reading and reading of both protected and unprotected disks. However, there
+; are several variants in use. Some variants require additional patches because
+; - they don't support reading from unprotected disks (e.g. In Search of the Most Amazing Thing), or
+; - they don't support writing to unprotected disks, or
+; - they support writing to disks but in some other protected format that is
+;   different than the program disk (e.g. Competition Karate, Amazon)
+
+; e.g. Competition Karate / Amazon variant:
+;
+; T00,S06,$53:  -> D5
+; T00,S06,$58:  -> AA
+; T00,S06,$5D:  -> AD
+; T00,S06,$9E:  -> DE
+; T00,S06,$A3:  -> AA
+; T00,S06,$A8:  -> EB
+;
+; T00,S07,$46:  -> D5
+; T00,S07,$4B:  -> AA
+; T00,S07,$50:  -> 96
+; T00,S07,$7A:  -> DE
+; T00,S07,$7F:  -> AA
+; T00,S07,$84:  -> EB
+;
+; T00,S08,$74:  -> D5
+; T00,S08,$82:  -> AA
+; T00,S08,$91:  -> 96
+;
+; TODO need to test on real hardware and see if these are sufficient:
+; T00,S06,$49:  -> 04 to restore standard timing
+; T00,S07,$D2:  -> 2C to burn fewer cycles
+; T00,S08,$6C:  -> 2C to burn fewer cycles
+;
+;.competitionkaratemulti ; length=21 dec
+;         !byte $08,$08,$08,$08,$07,$07,$07,$07,$07,$07,$07,$07,$07,$07,$06,$06,$06,$06,$06,$06,$06
+;         !byte $91,$82,$74,$6C,$F7,$E8,$DA,$D2,$84,$7F,$7A,$50,$4B,$46,$A8,$A3,$9E,$5D,$58,$53,$49
+;         !byte $96,$AA,$D5,$2C,$AD,$AA,$D5,$2C,$EB,$AA,$DE,$96,$AA,$D5,$EB,$AA,$DE,$AD,$AA,$D5,$04
+
+!zone {
+         ; gTrack = 0
+         lda   gIsJMP600
+         beq   .start
+         jmp   .exit
+
+.jmp600multi ; length=12 dec
+;sectors
+         !byte $03,$03,$03,$03,$03,$03,$00,$00,$00,$00,$00,$00
+;offsets
+         !byte $6A,$60,$57,$2D,$23,$1A,$9B,$91,$88,$5D,$53,$4A
+;values
+         !byte $AD,$AA,$D5,$96,$AA,$D5,$AD,$AA,$D5,$96,$AA,$D5
+
+.bc56multi ; length=12 dec
+;sectors
+         !byte $0C,$0C,$0C,$0C,$0C,$09,$09,$09,$09,$09,$09,$09
+;offsets
+         !byte $C4,$87,$78,$6A,$66,$B1,$F4,$F3,$F2,$A2,$94,$90
+;values
+         !byte $AA,$96,$AA,$D5,$2C,$AD,$0B,$F0,$DE,$AA,$D5,$2C
+
+.start
+         ; patches common to all known variants
+         lda   #<.jmp600multi
+         ldy   #>.jmp600multi
+         ldx   #12
+         jsr   multimodify
+
+         ; some variants have a secondary RWTS with an address
+         ; prologue entry point at $BC56 instead of $B944
+         ; note: these patches only affect the read routines
+         ; and thus will only work if the disk either supports
+         ; writes to unprotected disks or never writes anything
+         lda   #$0C
+         ldx   #$61
+         ldy   #$09
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $20,$C8,$BC
+         !byte $C9
+         bcs   .notbc56
+
+         lda   #<.bc56multi
+         ldy   #>.bc56multi
+         ldx   #12
+         jsr   multimodify
+
+.notbc56
+         ; variant seen on some versions of Broadsides
+         ; that uses LSR6A+CMP08 protection with an
+         ; explicit epilogue check
+         lda   #$0C
+         ldx   #$AC
+         ldy   #$09
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$AF
+         !byte $D0,$14
+         bcs   .notcmpaf
+
+         jsr   PrintByID
+         !byte s_lsr6a
+
+         jsr   PrintByID
+         !byte s_bcs08
+
+         ldx   #$C9
+         jsr   modify1
+         !byte $18
+
+.notcmpaf
+.exit
+}

src/patchers/t00_laureate.a

@@ -6,31 +6,21 @@
 !zone {
          lda   gIsLaureate
          bne   .exit
-         beq   +          ; passport-test-suite/Sound Ideas- Word Attack - Disk 1 - Ending Consonants.woz [Z=1] reaches here
+         beq   .start     ; passport-test-suite/Sound Ideas- Word Attack - Disk 1 - Ending Consonants.woz [Z=1] reaches here
 
-.sectors
+.laureatemulti
+;sectors
          !byte $04,$04,$04,$04,$04,$04,$04,$04,$04,$05,$05,$05,$05,$05,$05,$05,$06,$06,$06
-.offsets
+;offsets
          !byte $53,$58,$5D,$9E,$A3,$A8,$E7,$F1,$FC,$35,$3F,$55,$5F,$6A,$91,$9B,$49,$D5,$D6
-.values
+;values
          !byte $D5,$AA,$AD,$DE,$AA,$EB,$D5,$AA,$AD,$DE,$AA,$D5,$AA,$96,$DE,$AA,$D6,$D5,$20
 
-+        lda   #$12
-         sta   .loop+1
-
-.loop    ldy   #$d1
-         lda   .values,y
-         sta   .valuea
-         sta   .valueb
-         lda   .sectors,y
-         ldx   .offsets,y
-         jsr   compare1
-.valuea  !byte $d1
-         bcc   +
-         jsr   modify1
-.valueb  !byte $d1
-+        dec   .loop+1
-         bpl   .loop
+.start
+         lda   #<.laureatemulti
+         ldy   #>.laureatemulti
+         ldx   #19
+         jsr   multimodify
 
          lda   #$0A
          ldx   #$12

src/patchers/t00_microlearn.a

@@ -0,0 +1,41 @@
+;-------------------------------
+; #MICROLEARN
+; RWTS uses per-disk values in
+; zero page
+;
+; tested on
+; - U.S. Constitution Tutor
+; - SAT English 1
+;-------------------------------
+!zone {
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$02
+         ldx   #$E6
+         jsr   compare2
+         !byte $C5,$D6
+         bcs   +
+         jsr   modify2
+         !byte $C9,$D5
++        ldx   #$F0
+         jsr   compare2
+         !byte $C5,$31
+         bcs   +
+         jsr   modify2
+         !byte $C9,$AA
++        lda   #$03
+         ldx   #$54
+         jsr   compare2
+         !byte $C5,$31
+         bcs   +
+         jsr   modify2
+         !byte $C9,$D5
++        ldx   #$5E
+         jsr   compare2
+         !byte $C5,$D6
+         bcs   +
+         jsr   modify2
+         !byte $C9,$AA
++
+}

src/patchers/t00_neosoft.a

@@ -0,0 +1,43 @@
+;-------------------------------
+; #T00NEOSOFT
+; nibble count during early boot
+;
+; tested on
+; - Comparison Kitchen (Neosoft/DLM)
+; - Animal Photo Fun (Neosoft/DLM)
+;-------------------------------
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$01
+         ldx   #$38
+         jsr   compare3   ; if T00,S01,$38 ==
+         !byte $20,$90,$B7
+         bcs   +
+
+         ldx   #$90
+         jsr   compare3   ; and T00,S01,$90 ==
+         !byte $20,$00,$BB
+         bcs   +
+
+         lda   #$05
+         ldx   #$DA
+         jsr   compare3   ; and T00,S05,$DA ==
+         !byte $F8,$55,$E2; XOR #$55 of $AD $00 $B7 (LDA $B700)
+         bcs   +
+
+         ldx   #$6C
+         jsr   compare2   ; and T00,S05,$6C ==
+         !byte $D0,$55    ; XOR #$55 of $85 $00 (STA $00)
+         bcs   +          ; passport-test-suite/Animal Photo Fun.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_neosoft
+
+         jsr   modify2    ; then set T00,S05,$6C ==
+         !byte $A5,$39    ; XOR #$55 of $F0 $6C (BEQ +6C)
+
+         ldx   #$DA
+         jsr   modify1
+         !byte $D8        ; XOR #$55 of $8D (STA)
++

src/patchers/t00_rps.a

@@ -70,7 +70,7 @@
          ldx   #$92
          jsr   modify1    ; and set T00,S01,$92 =
          !byte $F1        ; change branch to unconditionally jump to success path
-         bvc   .exit      ; always branches
+         bvc   .rwtsswap  ; always branches
 
 .variant2
          inx
@@ -84,5 +84,17 @@
          ldx   #$92
          jsr   modify1    ; and set T00,S01,$92 =
          !byte $F2        ; change branch to unconditionally jump to success path
+
+.rwtsswap
+         lda   #$0C
+         ldx   #$40
+         ldy   #$04
+         jsr   compare
+         !byte $32,$A2    ; MON and NOMON commands at $A233 and $A247
+         !byte $46,$A2    ; are used to toggle protected/normal RWTS
+         bcs   .exit
+         jsr   modify
+         !byte $57,$FF    ; point them both to $FF58 (does nothing)
+         !byte $57,$FF
 .exit
 }

src/patchers/t00_rwtslog.a

@@ -14,13 +14,27 @@ _rwtslog_start
 ; to reduce duplicated code
 ;
 @compare_lsr6a
-         ldy   #$0A
+         ldy   #$09
          jsr   compare
          !byte $BD,$8C,$C0
          !byte $10,$FB
          !byte $4A
          !byte WILDCARD,$6A
-         !byte $D0,$EF
+         !byte $D0
+         rts
+
+@compare_cmp08
+         ldy   #$11
+         jsr   compare
+         !byte $BD,$8C,$C0
+         !byte $10,$FB
+         !byte $C9,$DE
+         !byte $F0,$0A
+         !byte $48
+         !byte $68
+         !byte $BD,$8C,$C0
+         !byte $C9,$08
+         !byte $B0
          rts
 
 @compare_bne0
@@ -49,9 +63,15 @@ _rwtslog_start
          jsr   @compare_lsr6a
          bcc   @print_lsr6a          ; passport-test-suite/Roadwar 2000.woz [C=0] matches
 
+; ATILA variant
+         lda   #$04                  ; or T00,S04,$A5 ==
+         ldx   #$A5
+         jsr   @compare_lsr6a
+         bcc   @print_lsr6a          ; passport-test-suite/The Treasure of Forest Isle.woz [C=0] matches
+
 ; Pascal variant
          lda   #$0D
-         ldx   #$05                  ; oro T00,S0D,$05 ==
+         ldx   #$05                  ; or T00,S0D,$05 ==
          jsr   @compare_lsr6a
          bcs   @lsr6a_end            ; passport-test-suite/GATO v1.3.woz [C=0] matches
 
@@ -67,22 +87,9 @@ _rwtslog_start
 ; for the first address epilogue nibble
 ;-------------------------------
 ; DOS 3.3 variant
-         lda   #$03
+         lda   #$03                  ; if T00,S03,$8B ==
          ldx   #$8B
-         ldy   #$15
-         jsr   compare               ; if T00,S03,$8B ==
-         !byte $BD,$8C,$C0
-         !byte $10,$FB
-         !byte $C9,$DE
-         !byte $F0,$0A
-         !byte $48
-         !byte $68
-         !byte $BD,$8C,$C0
-         !byte $C9,$08
-         !byte $B0,$A5
-         !byte $EA
-         !byte $18
-         !byte $60
+         jsr   @compare_cmp08
          bcc   @print_bcs08          ; passport-test-suite/The Seasons.woz [C=0] matches
 
 ; RDOS variant
@@ -98,7 +105,13 @@ _rwtslog_start
          !byte $BD,$8C,$C0
          !byte $C9,$80
          !byte $B0
-         bcs   @bcs08_end            ; passport-test-suite/Roadwar 2000.woz [C=0] matches
+         bcc   @print_bcs08          ; passport-test-suite/Roadwar 2000.woz [C=0] matches
+
+; ATILA variant
+         lda   #$04
+         ldx   #$E6                  ; or T00,S04,$E6 ==
+         jsr   @compare_cmp08
+         bcs   @bcs08_end            ; passport-test-suite/The Treasure of Forest Isle.woz [C=0] matches
 
 @print_bcs08
          jsr   PrintByID
@@ -141,9 +154,26 @@ _rwtslog_start
          !byte $10,$FB
          !byte $C9,$AA
          !byte $EA,$EA
-         bcs   _rwtslog_end          ; passport-test-suite/La Guillotine.woz [C=0] matches
+         bcs   @cmpnopnop_end        ; passport-test-suite/La Guillotine.woz [C=0] matches
          jsr   PrintByID
          !byte s_cmpnopnop
          inc   gPatchCount
+@cmpnopnop_end
+
+;-------------------------------
+; RWTS "TAY / BIT" identification
+; disk allows any value for
+; for address field checksum
+;-------------------------------
+         lda   #$03
+         ldx   #$88
+         ldy   #$03
+         jsr   compare               ; if T00,S03,$88 ==
+         !byte $A8
+         !byte $24,$B7
+         bcs   _rwtslog_end          ; passport-test-suite/E-Z Learner.woz [C=0] matches
+         jsr   PrintByID
+         !byte s_anychecksum
+         inc   gPatchCount
 
 _rwtslog_end

src/patchers/t00_scottforesman.a

@@ -0,0 +1,53 @@
+;-------------------------------
+; #T00SCOTTFORESMAN
+; nibble count during early boot
+;
+; tested on
+; - Addition and Subtraction 4 (Scott, Foresman and Company)
+; - Decimals 3 (Scott, Foresman and Company)
+; - Dinosaurs and Squids (Scott, Foresman and Company)
+; - Division 2 (Scott, Foresman and Company)
+; - Division 3 (Scott, Foresman and Company)
+; - Fractions 3 (Scott, Foresman and Company)
+; - Fractions 5 (Scott, Foresman and Company)
+; - Multiplication 3 (Scott, Foresman and Company)
+; - Percent 2 (Scott, Foresman and Company)
+;-------------------------------
+         ; gTrack = 0
+         lda   #$00
+         ldx   #$33
+         ldy   #$08
+         jsr   compare    ; if T00,S00,$33 ==
+         !byte $A9,$79
+         !byte $85,$3C
+         !byte $A9,$08
+         !byte $85,$3D
+         bcs   +
+
+         lda   #$06
+         ldx   #$02
+         tay
+         jsr   compare    ; and T00,S06,$02 ==
+         !byte $48
+         !byte $20,WILDCARD,WILDCARD
+         !byte $68
+         !byte $D0
+         bcs   +
+
+         lda   #$0E
+         ldx   #$FF
+         jsr   compare1   ; and T00,S0E,$FF ==
+         !byte $20
+         bcs   +          ; passport-test-suite/Addition and Subtraction 4.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_sfc
+
+         jsr   modify1    ; then set T00,S0E,$FF ==
+         !byte $EA
+
+         lda   #$06
+         ldx   #$00
+         jsr   modify2    ; and set T00,S06,$00 ==
+         !byte $A9,$00
++

src/patchers/t00_scottforesman_dos33.a

@@ -0,0 +1,32 @@
+;-------------------------------
+; #T00SCOTTFORESMANDOS33
+; nibble count during early boot
+;
+; tested on
+; - Addition and Subtraction 3 (Scott, Foresman and Company)
+; - Decimals 2 (Scott, Foresman and Company)
+; - Fractions 1 (Scott, Foresman and Company)
+; - Fractions 2 (Scott, Foresman and Company)
+; - Multiplication 2 (Scott, Foresman and Company)
+; - Percent 1 (Scott, Foresman and Company)
+;-------------------------------
+         ; gTrack = 0
+         ; Caller found DOS 3.3 RWTS
+
+         lda   #$0B
+         ldx   #$15
+         ldy   #$06
+         jsr   compare    ; if T00,S0B,$15 ==
+         !byte $EE,$F3,$03
+         !byte $20,$00,$87
+         bcs   +          ; passport-test-suite/Addition and Subtraction 3.woz [C=0] matches
+
+         jsr   PrintByID
+         !byte s_sfc
+
+         inx
+         inx
+         inx
+         jsr   modify1    ; then set T00,S0B,$18 ==
+         !byte $2C
++

src/patchers/t00_sigcheck.a

@@ -0,0 +1,21 @@
+;-------------------------------
+; #T00SIGCHECK
+; productized extra wide track protection check
+;
+; tested on
+; - Hardball (Accolade)
+; - Law of the West (Accolade)
+;-------------------------------
+         ; gTrack = 0
+
+         ldy   #$05
+         jsr   SearchTrack
+         !byte $BD,$80,$C0; LDA $C080,X
+         !byte $18        ; CLC
+         !byte $68        ; PLA
+         bcs   +          ; passport-test-suite/Hardball.woz [C=0] matches
+         inx
+         inx
+         jsr   modify1
+         !byte $D0        ; change indexed softswitch address so it does nothing
++

src/patchers/universale7.a

@@ -24,7 +24,8 @@ universale7
          bne   .eor
 
          lda   .sector+2  ; passport-test-suite/Rocky's Boots.woz [C=1] reaches here
-         and   #$0F
+         sec
+         sbc   #BASEPAGE
          sta   gDisplayBytes
          jsr   PrintByID
          !byte s_e7

src/print.a

@@ -83,10 +83,8 @@ PrintByID
          bcc   @nosub
          cmp   #":"
          bcs   @nosub
-         sec
-         sbc   #"0"
          tax
-         lda   gDisplayBytes, x
+         lda   gDisplayBytes-$B0, x
 @printbyte
          jsr   PrintByte
          bvc   @next      ; unconditional branch

src/rwts.a

@@ -113,6 +113,7 @@ PreReadSector
 @earthware
          ldx   #$4C
          stx   $B8F6
+EarthwareSwapperLo
          ldx   #$89
          stx   $B8F7
          ldx   #$B6

src/sectormap.a

@@ -75,6 +75,7 @@ T01S0F    = T01 + $0F
 T02       = T01 + $10
 T02S04    = T02 + $04
 T02S05    = T02 + $05
+T02S07    = T02 + $07
 T02S0A    = T02 + $0A
 T02S0C    = T02 + $0C
 T02S0F    = T02 + $0F

src/strings/en.a

@@ -132,7 +132,7 @@ StringTableLow            ; must be kept in sync with constants in enid.a
          !byte <.restart
          !byte <.corrupter
          !byte <.eaboot0
-         !byte <.eatrk6
+         !byte <.widetrack
          !byte <.protectioncheck
          !byte <.poke
          !byte <.bootcounter
@@ -211,6 +211,17 @@ StringTableLow            ; must be kept in sync with constants in enid.a
          !byte <.erasingserialnumber
          !byte <.lockitupserial
          !byte <.protection
+         !byte <.baudville
+         !byte <.pfs
+         !byte <.enlightenmentb0
+         !byte <.enlightenment
+         !byte <.sfc
+         !byte <.neosoft
+         !byte <.probs5
+         !byte <.didatech
+         !byte <.anychecksum
+         !byte <.unexpected5and3
+         !byte <.jmp600
 
 StringTableHigh           ; must be kept in sync with constants in enid.a
          !byte >.header
@@ -282,7 +293,7 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
          !byte >.restart
          !byte >.corrupter
          !byte >.eaboot0
-         !byte >.eatrk6
+         !byte >.widetrack
          !byte >.protectioncheck
          !byte >.poke
          !byte >.bootcounter
@@ -361,11 +372,22 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
          !byte >.erasingserialnumber
          !byte >.lockitupserial
          !byte >.protection
+         !byte >.baudville
+         !byte >.pfs
+         !byte >.enlightenmentb0
+         !byte >.enlightenment
+         !byte >.sfc
+         !byte >.neosoft
+         !byte >.probs5
+         !byte >.didatech
+         !byte >.anychecksum
+         !byte >.unexpected5and3
+         !byte >.jmp600
 
 .passport
          !text "Passport ",$00
 .header
-         !text "@",s_passport,"by 4am@",s_space7,"@",s_space7," 2021-09-04",$00
+         !text "@",s_passport,"by 4am@",s_space7,"@",s_space7," 2024-05-14",$00
 .bar9
          !text "_________",$00
 .bar18
@@ -629,11 +651,11 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
 .restart
          !text "Restarting scan",$8D,$00
 .corrupter
-         !text "T13,S0E Protection check intentionally",$8D
+         !text "T%t,S%0 Protection check intentionally",$8D
          !text "destroys unauthorized copies",$8D,$00
 .eaboot0
          !text "@",s_tfound,"Electronic Arts @",s_bootloader,$8D,$00
-.eatrk6
+.widetrack
          !text "@",s_tfound,"extra wide @",s_protectiontrack,$8D,$00
 .poke
          !text "T%t,S%0 BASIC program POKEs @",s_protection,$8D
@@ -748,3 +770,27 @@ StringTableHigh           ; must be kept in sync with constants in enid.a
          !text "@",s_found,"RW18-sector format",$8D,$00
 .x555
          !text "@",s_found,"5-5-5 spiral @",s_bootloader,$8D,$00
+.baudville
+         !text "@",s_found,"Baudville @",s_bootloader,$8D,$00
+.pfs
+         !text "@",s_found,"PFS @",s_protectioncheck,$8D,$00
+.enlightenmentb0
+         !text "@",s_found,"Enlightenment @",s_bootloader,$8D,$00
+.enlightenment
+         !text "@",s_found,"flux timing @",s_protection,$8D,$00
+.sfc
+         !text "@",s_found,"SFC @",s_protectioncheck,$8D,$00
+.neosoft
+         !text "@",s_found,"Neosoft @",s_protectioncheck,$8D,$00
+.probs5
+         !text "@",s_found,"PROBS5 @",s_protectioncheck,$8D,$00
+.didatech
+         !text "@",s_found,"Didatech disk",$8D
+         !text "T02,S07 @",s_maybeunreadable,$8D,$00
+.anychecksum
+         !text "@",s_rwts,"@",s_acceptsany,$8D
+         !text "address field checksum",$8D,$00
+.unexpected5and3
+         !text "@",s_tfound,"5-and-3 @",s_protectiontrack,$8D,$00
+.jmp600
+         !text "@",s_found,"JMP $0600 @",s_bootloader,$8D,$00

src/strings/enid.a

@@ -70,7 +70,7 @@ s_a5count =    $41
 s_restart =    $42
 s_corrupter=   $43
 s_eab0    =    $44
-s_eatrk6  =    $45
+s_widetrack =  $45
 s_protectioncheck = $46
 s_poke   =     $47
 s_bootcounter =$48
@@ -149,3 +149,14 @@ s_555        = $90
 s_erasingserialnumber = $91
 s_lockitupserial = $92
 s_protection = $93
+s_baudville  = $94
+s_pfs        = $95
+s_enlightenmentb0 = $96
+s_enlightenment = $97
+s_sfc        = $98
+s_neosoft    = $99
+s_probs5     = $9A
+s_didatech   = $9B
+s_anychecksum = $9C
+s_unexpected5and3 = $9D
+s_jmp600     = $9E

src/universalstyle.a

@@ -22,9 +22,11 @@ UseUniversal
 ;
          lda   gIs13Sector
          bne   @not13Sector
-         lda   #<read13
+         lda   #0
+         sta   $47E                  ; restore track number replaced by DOS
+         lda   #<seekread13
          sta   jCallRWTS+1
-         lda   #>read13
+         lda   #>seekread13
          sta   jCallRWTS+2
          bne   @doneUnivPatching     ; always branches
 @not13Sector

src/wholetrack.a

@@ -29,8 +29,8 @@ SkipTrack
 ;
 ; Electronic Arts protection track?
 ;
-         jsr   IsEATrack6
-         lda   #s_eatrk6
+         jsr   IsWideTrack
+         lda   #s_widetrack
          bcc   @print
 ;
 ; Nibble count track?
@@ -39,6 +39,13 @@ SkipTrack
          lda   #s_sync
          bcc   @print
 ;
+; Unexepcted 13-sector track on a 16-sector disk?
+; (Micrograms likes to do this)
+;
+         jsr   Unexpected5And3InBaggingArea
+         lda   #s_unexpected5and3
+         bcc   @print
+;
 ; RW18-format track?
 ;
          jsr   VerifyInfocom18
@@ -80,6 +87,8 @@ SkipTrack
          cmp   #$22
          clc
          bne   @donotskip
+         lda   #TRUE
+         sta   gAdventureInternational
          lda   gIsProDOS
          bne   @donotskip
          sta   gPossibleGamco
@@ -213,9 +222,6 @@ JustTheSameDamnThingOverAndOver
 ;     C set if track is formatted
 ;-------------------------------
 IsUnformatted
-         lda   #$FD
-         sta   gNIBTableFF
-
          lda   $C0E9      ; turn on drive motor, but we assume it's already spun up from previous reads so no waiting
          lda   #$00
          sta   unform
@@ -244,29 +250,28 @@ IsUnformatted
          sec
 @unformatted
          lda   $C0E8
-
-         lda   #$3F
-         sta   gNIBTableFF
          rts
 
 ;-------------------------------
-; IsEATrack6
-; check if track 6 even exists
+; IsWideTrack
+; check if this track claims to be the previous track
 ; in the case of EA, track 6 reads as track 5
+; in the case of Accolade, track $22 reads as track $21
 ;
 ; in  slot 6, drive 1 is on track to test
-; out C clear if read track does not match expected track
-;     C set otherwise
+; out C clear if found wide track
+;     C set if not found
 ;-------------------------------
-IsEATrack6
-         lda   gTrack
-         cmp   #6
+IsWideTrack
+         lda   $2E
+         clc
+         adc   #1
+         cmp   gTrack
+         beq   +
          sec
-         bne   +
-         lda   $2E ;DOS read track number
-         sbc   #5
-         cmp   #1
-+        rts
+         rts
++        clc
+         rts
 
 ;-------------------------------
 ; ReadNib
@@ -316,3 +321,52 @@ Read4x4
   }
          and   tmp
          rts
+
+;-------------------------------
+; Unexpected5And3InBaggingArea
+; check if track is unexpectedly full of
+; 5-and-3-encoded sectors on a disk where
+; we expected 6-and-2 encoded sectors
+;
+; used by e.g. Micrograms as a weak form
+; of copy protection to foil COPYA-style
+; copying
+;
+; in  slot 6, drive 1 is on track to test
+; out C clear if unexpected track found
+;     C set if not found
+;-------------------------------
+Unexpected5And3InBaggingArea
+         lda   gIs13Sector
+         beq   @no                   ; if ID'd as a 13 sector disk, then this is not unexpected
+         lda   $C0E9
+         lda   #$19
+         sta   nibcount
+         ldx   #$0C
+         ldy   #$00
+@restart
+         dey
+         bne   +
+         dec   nibcount
+         beq   @no
++
+-        lda   $C0EC
+         bpl   -
+@maybeD5
+         cmp   #$D5
+         bne   @restart
+-        lda   $C0EC
+         bpl   -
+         cmp   #$AA
+         bne   @maybeD5
+-        lda   $C0EC
+         bpl   -
+         cmp   #$B5
+         bne   @maybeD5
+         dex
+         bne   @restart
+         clc                         ; passport-test-suite/Real Math.woz [C=0] matches
+         !byte $A9
+@no      sec
+         lda   $C0E8
+         rts