:: Voir le sujet - Quadrant 6112 (Sensible Software, 1982)


IDENTIFICATION SERVEUR : 10.14.20.4 - CLIENT : 54.85.57.0

FAQ

Rechercher

Liste des Membres

Groupes d'utilisateurs

S'enregistrer

Profil

Se connecter pour vérifier ses messages privés

Connexion

Quadrant 6112 (Sensible Software, 1982)

Index du Forum -> PROTECTION MALEFIQUE

Voir le sujet précédent :: Voir le sujet suivant

Auteur

Message

toinet
Site Admin

Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France

Posté le: Jeu 04 Juil 2019, 22:33 Sujet du message: Quadrant 6112 (Sensible Software, 1982)

#1004 - That is an arcade game. I do not have the instructions, I do not know what you have to do but kill the evil guys on the screen. Disk image by Stephane Racle.

Disk structure
That is a non-standard 16-sec disk. There is data on T0-T10. Others are not formatted. It boots as a 13-sec disk (which is weird as it is a title from 1982).

Protection type
We have a 13-sec track on T0.
We have a 16-sec sector with changed prolog data markers on T1: D5AA96/DEAA - D5ABAD/DEAA instead of D5AAAD/DEAA
We have FF nibbles on T2 (hello, nibble count of track length or nibble check)
We have nibbles that look like 4*4 on T3-T10
Good luck!

The interesting part of the protection
Two 4*4 nibbles on disk contain the RAM pointer where data should be loaded. In general, the pointer is set by the calling program. Here, it is included in the on-disk protection scheme. That is a rare protection trick, the only example I had met was EDD IV. That's cool!

Boot trace
A funny one...

Code:

9600<C600.C6FFM
96F8:4C DA FD
9600G
01

An analysis of the code shows it is relocated at $200. So, let's interrupt it further...

96F8:A9 98 8D 43 08 4C 01 08
9801:4C 59 FF
9600G

We have the weird code at $300 now...

*301L

0301- 29 00 AND #$00
0303- 85 3A STA $3A
0305- 9A TXS
0306- 08 PHP
0307- A5 26 LDA $26
0309- 85 4E STA $4E
030B- E6 2B INC $2B
030D- AD 54 C0 LDA $C054
0310- 8C 00 02 STY $0200
0313- A0 3F LDY #$3F
0315- E6 27 INC $27
0317- 10 08 BPL $0321
0319- FF ???
031A- 00 BRK
031B- 00 BRK
031C- FF ???
031D- FF ???
031E- 00 BRK
031F- A9 02 LDA #$02
0321- B9 00 03 LDA $0300,Y
0324- 49 00 EOR #$00
0326- 4D 00 02 EOR $0200
0329- 99 00 03 STA $0300,Y
032C- C8 INY
032D- C4 26 CPY $26
032F- D0 F0 BNE $0321
0331- A9 F8 LDA #$F8
0333- 25 2B AND $2B
0335- AA TAX
0336- A9 E1 LDA #$E1    E1
0338- 4D 00 02 EOR $0200    EOR #$99
033B- 85 3B STA $3B    = 78
033D- 85 4F STA $4F

As from now, the data is already decoded, see above for the key
The program loads 4*4 nibbles and decode them at $400..$7FF (in the text screen)

033F- BD 8C C0 LDA $C08C,X
0342- 10 FB BPL $033F
0344- C9 DB CMP #$DB
0346- D0 F7 BNE $033F
0348- BD 8C C0 LDA $C08C,X
034B- 10 FB BPL $0348
034D- C9 B7 CMP #$B7
034F- D0 F3 BNE $0344
0351- BD 8C C0 LDA $C08C,X
0354- 10 FB BPL $0351
0356- 91 3A STA ($3A),Y
0358- C8 INY
0359- D0 F6 BNE $0351
035B- E6 3B INC $3B
035D- 10 F2 BPL $0351
035F- C6 3B DEC $3B
0361- C6 3B DEC $3B
0363- 98 TYA
0364- AA TAX
0365- C8 INY
0366- B1 4E LDA ($4E),Y
0368- 88 DEY
0369- 38 SEC
036A- 2A ROL
036B- 31 3A AND ($3A),Y
036D- 4D 00 02 EOR $0200
0370- 81 26 STA ($26,X)
0372- 0A ASL
0373- 91 3A STA ($3A),Y
0375- C8 INY
0376- 0A ASL
0377- 91 4E STA ($4E),Y
0379- C8 INY
037A- D0 14 BNE $0390
037C- E6 4F INC $4F
037E- 30 1A BMI $039A
0380- E6 3B INC $3B
0382- A5 3B LDA $3B
0384- 29 01 AND #$01
0386- D0 08 BNE $0390
0388- C6 3B DEC $3B
038A- C6 3B DEC $3B
038C- C6 3B DEC $3B
038E- C6 3B DEC $3B
0390- E6 26 INC $26
0392- D0 02 BNE $0396
0394- E6 27 INC $27
0396- A5 27 LDA $27
0398- 10 CB BPL $0365
039A- A5 27 LDA $27
039C- 49 03 EOR #$03
039E- E6 26 INC $26
03A0- 85 27 STA $27
03A2- 6C 26 00 JMP ($0026)

We must replace the JMP ($0026) by ours. Knowing that the key is #$99, as we want 4C 59 FF instead, we'll enter the following program to know what to put:
*300:A9 4C 49 00 49 99 20 DA FD A9 59 49 00 49 99 20 DA FD A9 FF 49 00 49 99 4C DA FD
*300G
D5C066

Let's retry...
C600<C600.C6FFM
96F8:A9 98 8D 43 08 4C 01 08
9801:A9 D5 8D A2 03 A9 C0 8D A3 03 A9 66 8D A4 03 A9 02 4C 01 03
4*4 data is loaded at $7800.7FFF
Then made to bytes at $400.7FF

Now move the loaded data to a safe place, at $9A00
What is 4C 00 9A with the key. It is D5 99 03

9600<C600.C6FFM
96F8:A9 98 8D 43 08 4C 01 08
9801:A9 D5 8D A2 03 A9 99 8D A3 03 A9 03 8D A4 03 A9 02 4C 01 03
9A00:A2 00 BD 00 04 9D 00 14
9A08:BD 00 05 9D 00 15 BD 00
9A10:06 9D 00 16 BD 00 07 9D
9A18:00 17 E8 D0 F5 4C 59 FF
9600G

9A00- A2 00 LDX #$00
9A02- BD 00 04 LDA $0400,X
9A05- 9D 00 14 STA $1400,X
9A08- BD 00 05 LDA $0500,X
9A0B- 9D 00 15 STA $1500,X
9A0E- BD 00 06 LDA $0600,X
9A11- 9D 00 16 STA $1600,X
9A14- BD 00 07 LDA $0700,X
9A17- 9D 00 17 STA $1700,X
9A1A- E8 INX
9A1B- D0 E5 BNE $9A02
9A1D- 4C 59 FF JMP $FF59
The next load phase is now at $1400..$17FF instead of $400..$7FF

An analysis of the code at $400 shows that the code checksums the ROM, checks the processor flag status, etc. We must shunt down all of the checks for the game to load and we enter redirect the final at $7F5 to jump to a tiny routine in the stack page. One that turns TEXT mode on and waits for a keypress. As the crack is processed on an emulator, one has to save the emupack to get the entire data.

9600<C600.C6FFM
96F8:A9 98 8D 43 08 4C 01 08
9801:A9 D5 8D A2 03 A9 99 8D A3 03 A9 03 8D A4 03 A9 02 4C 01 03
9A00:A9 00 8D 33 07 8D 3F 07 A9 4C 8D F4 07 A9 80 8D F5 07 A9 01 8D F6 07 A9 60 8D 7A 06 4C 00 04
180:2C 51 C0 AD 00 C0 10 FB
9600G

Entry point of the program is set at ($200) where we find $2007
At $2007, we find two INC to change the second header marker of the data field from AA to AB

2007:EE 58 27 INC $2758 ; AA => AB
200A:EE F1 27 INC $27F1 ; AA => AB
200D:9D 00 B8 STA $B800,X ; put a 20
2010:8A TXA ; save the slot value
2011:0A ASL
2012:0A ASL
2013:0A ASL
2014:0A ASL
2015:8D 01 26 STA $2601 ; in the RWTS
2018:8D 0F 26 STA $260F ; to read score at T1/S0
201B:A2 F5 LDX #$F5 ; hop
201D:9A TXS
201E:A9 26 LDA #$26 ; relocate
2020:A2 30 LDX #$30
2022:A0 06 LDY #$06
2024:20 8C 20 JSR $208C
2027:A9 38 LDA #$38 ; relocate
2029:A2 40 LDX #$40
202B:A0 50 LDY #$50
202D:20 8C 20 JSR $208C
2030:A9 25 LDA #$25 ; relocate
2032:A2 26 LDX #$26
2034:A0 02 LDY #$02

How to normalize
Use the following code to get the entire program in memory

Code:

9600<C600.C6FFM
96F8:A9 98 8D 43 08 4C 01 08
9801:A9 D5 8D A2 03 A9 99 8D A3 03 A9 03 8D A4 03 A9 02 4C 01 03
9A00:A9 00 8D 33 07 8D 3F 07 A9 4C 8D F4 07 A9 80 8D F5 07 A9 01 8D F6 07 A9 60 8D 7A 06 4C 00 04
180:2C 51 C0 AD 00 C0 10 FB
9600G

Then copy $1800..$A7FF to the aux RAM or into another memory bank of your computer.
Then boot my copy disk, launch Mobby Disk II
Write what you saved from $1800..$A7FF onto a freshly formatted DOS 3.3 disk, starting at either T2 or T3. T3 if you want to match the original disk, T2 instead as T2 was used for a nibble check length that is now skipped.

Change the data marker from D5AAAD to D5ABAD to read T1/S0 where the score table is, and write it onto your copy.

Finally, rewrite the T0/S0 to load the entire game into memory, having HGR2 on.

How to make a ProDOS version
Have the binary file at $1800..$A7FF (look, there's plenty of empty space in between), the entry point is $2007 (to bypass the prolog data markers change) with X being the slot, HGR2 being active... JMP $2007
Don't forget to redirect the RWTS calls (read and write) knowing that the RWTS is relocated at $600 ($2600 at boot time)

How to play
Keyboard keys:
- ESC to pause
- S to turn sound off/on
The rest is done with a joystick and the two buttons

The disk image is available at http://www.brutaldeluxe.fr/crack/

Reboot and... enjoy,
LoGo
7/2019

Revenir en haut de page

toinet
Site Admin

Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France

Posté le: Jeu 04 Juil 2019, 22:35 Sujet du message:

The boot 1 code at $0800, relocated at $0200

Code:

*
* Quadrant 6112
*
* (c) 1982, Sensible Software
* (s) 2019, LoGo
*

mx %11
org $0800
lst off

*----------------------------

PRERR EQU $FF2D

*----------------------------

L0800 HEX 01
LDX #$00 ; Move to $0200
L0803 LDA L0800,X
STA $0200,X
INX
BNE L0803
JMP $020F

LDY #$AB ; Construct the denibblize table
L0811 TYA
STA $3C
LSR
ORA $3C
CMP #$FF
BNE L0824
CPY #$D5
BEQ L0824
TXA
STA L0800,Y
INX
L0824 INY
BNE L0811

STY $3D ; And load next sector at $0300
STY $26
LDA #$03
STA $27
LDX $2B
JSR $025D
JSR $02D1
LDA #$A9
STA $031F
LDA #$02
STA $0320
JMP $0301 ; and jump

DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00
DB $00

*----------------------------
* Read a 13-sec (data in 4*4)

L085D CLC
L085E PHP
L085F LDA $C08C,X
BPL L085F
L0864 EOR #$D5
BNE L085F
L0868 LDA $C08C,X
BPL L0868
CMP #$AA
BNE L0864
NOP
L0872 LDA $C08C,X
BPL L0872
CMP #$B5
BEQ L0884
PLP
BCC L085D
EOR #$AD
BEQ L08A1
BNE L085D
L0884 LDY #$03
STY $2A
L0888 LDA $C08C,X
BPL L0888
ROL
STA $3C
L0890 LDA $C08C,X
BPL L0890
AND $3C
DEY
BNE L0888
PLP
CMP $3D
BNE L085D
BCS L085E

L08A1 LDY #$9A
L08A3 STY $3C
L08A5 LDY $C08C,X
BPL L08A5
EOR L0800,Y
LDY $3C
DEY
STA L0800,Y
BNE L08A3
L08B5 STY $3C
L08B7 LDY $C08C,X
BPL L08B7
EOR L0800,Y
LDY $3C
STA ($26),Y
INY
BNE L08B5
L08C6 LDY $C08C,X
BPL L08C6
EOR L0800,Y
BNE L085D
RTS

*--- The std 5*3 routine is NOT used

TAY
L08D2 LDX #$00
L08D4 LDA L0800,Y
LSR
ROL $03CC,X
LSR
ROL $0399,X
STA $3C
LDA ($26),Y
ASL
ASL
ASL
ORA $3C
STA ($26),Y
INY
INX
CPX #$33
BNE L08D4
DEC $2A
BNE L08D2
CPY $0300
BNE L08FC
RTS

DB $00
DB $00
L08FC JMP PRERR

DB $00

Revenir en haut de page

toinet
Site Admin

Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France

Posté le: Jeu 04 Juil 2019, 22:36 Sujet du message:

The coded boot 2 code in T0

Code:

Revenir en haut de page

toinet
Site Admin

Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France

Posté le: Jeu 04 Juil 2019, 22:36 Sujet du message:

The DEcoded boot 2 code

Code:

*
* Quadrant 6112
*
* (c) 1982, Sensible Software
* (s) 2019, LoGo
*

mx %11
org $0300
lst off

*----------------------------

TXTPAGE1 EQU $C054

*----------------------------

L0300 DB $99

AND #$00
STA $3A
TXS
PHP
LDA $26
STA $4E
INC $2B
LDA TXTPAGE1
STY $0200
LDY #$3F
INC $27
BPL L0321
DB $FF
DB $00
DB $00
DB $FF
DB $A0
DB $3F
LDA #$02
L0321 LDA L0300,Y
EOR #$00
EOR $0200 ; #$99
STA L0300,Y
INY
CPY $26 ; #$00
BNE L0321
LDA #$F8
AND $2B
TAX
LDA #$E1
EOR $0200
STA $3B
STA $4F

*--- The decoded data

L033F LDA $C08C,X
BPL L033F
L0344 CMP #$DB
BNE L033F
L0348 LDA $C08C,X
BPL L0348
CMP #$B7
BNE L0344
L0351 LDA $C08C,X
BPL L0351
STA ($3A),Y
INY
BNE L0351
INC $3B
BPL L0351
DEC $3B
DEC $3B
TYA
TAX
L0365 INY
LDA ($4E),Y
DEY
SEC
ROL
AND ($3A),Y
EOR $0200
STA ($26,X)
ASL
STA ($3A),Y
INY
ASL
STA ($4E),Y
INY
BNE L0390
INC $4F
BMI L039A
INC $3B
LDA $3B
AND #$01
BNE L0390
DEC $3B
DEC $3B
DEC $3B
DEC $3B
L0390 INC $26
BNE L0396
INC $27
L0396 LDA $27
BPL L0365
L039A LDA $27
EOR #$03
INC $26
STA $27
JMP ($0026) ; next jump

*----------------------------

HEX 39315A30392820212B393434394A5C57
HEX 4A505B555C394A565F4D4E584B5C3931
HEX 5A30392820212B393434394A5C574A50
HEX 5B555C394A565F4D4E584B5C39315A30
HEX 392820212B393434394A5C574A505B55
HEX 5C394A565F4D4E584B5C8D

Revenir en haut de page

toinet
Site Admin

Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France

Posté le: Jeu 04 Juil 2019, 22:37 Sujet du message:

Last but not least, the boot 3 code at $400..$7FF

Code:

*
* Quadrant 6112
*
* (c) 1982, Sensible Software
* (s) 2019, LoGo
*

mx %11
org $0400
lst off

*----------------------------

SOFTEV EQU $03F2
PWREDUP EQU $03F4
USRADR EQU $03F8
TXTCLR EQU $C050
TXTSET EQU $C051
MIXCLR EQU $C052
TXTPAGE2 EQU $C055
HIRES EQU $C057
SETAN0 EQU $C058
RDBANK2 EQU $C080
ROMIN2 EQU $C081
LCBANK2 EQU $C083
RESETV EQU $FFFC

*----------------------------

L0400 JMP L071F

L0403 DB $7D
L0404 DB $A9
L0405 DB $4F
L0406 DB $04
L0407 DB $D1
L0408 DB $60
L0409 DB $02
L040A DA $C080

*----------------------------
* Clear memory and reboot

L040C PHA
LDA #$00
STA $3A
LDA #$05
STA $3B
PLA
L0416 STA ($3A),Y
INY
BNE L0416
INC $3B
LDX $3B
CPX #$0C
BCC L0416
LDA #$00
CPX #$C0
BCC L0416
LDA ROMIN2
LDA ROMIN2
LDA RESETV
STA RESETV
LDA RESETV+1
STA RESETV+1
LDA TXTSET
L043E JMP $C600

*----------------------------
* Check my FF nibbles on T2

L0441 LDA #$19 ; nb of pages
STA $3B
LDY #$00
STY $40
LDY #$A0
L044B LDA $C08C,X ; want FF
BPL L044B
EOR #$FF
BEQ L0470
INC $40 ; next
BEQ L0479 ; we loop, we failed

L0458 LDA $C08C,X ; nibble
BPL L0458
L045D LDA $C08C,X ; nibble
BPL L045D
L0462 LDA $C08C,X ; nibble
BPL L0462
L0467 LDA $C08C,X ; FF nibble
BPL L0467
EOR #$FF
BNE L0479
L0470 INY    ; 256-160
BNE L044B
DEC $3B
BNE L044B
BEQ L047D
L0479 LDA #$FF
STA $40
L047D LDA $40
CMP L0409 ; 02
BEQ L0487
JMP L040C ; reboot
L0487 RTS

*----------------------------
* Read data

L0488 LDX $2B
LDA #$00 ; where to load my nibbles
STA $38
LDA #$90
STA $39
L0492 LDA $C08C,X
BPL L0492
LDA #$14
STA $40
L049B LDA $C08C,X
BPL L049B
SEC
ROL
STA $42
L04A4 LDA $C08C,X
BPL L04A4
AND $42
STA $37
L04AD LDA $C08C,X
BPL L04AD
SEC
ROL
STA $42
L04B6 LDA $C08C,X
BPL L04B6
AND $42
BEQ L04C3
CMP $37
BCS L0492
L04C3 STA $37
DEC $40
BPL L04AD

L04C9 LDA $C08C,X
BPL L04C9
SEC
ROL
STA $42
L04D2 LDA $C08C,X
BPL L04D2
AND $42
BEQ L04E1
CMP $37
BEQ L0492
BCS L04E6
L04E1 STA $37
JMP L04C9

L04E6 LDY #$07
L04E8 LDA $C08C,X
BPL L04E8
SEC
ROL
STA $42
L04F1 LDA $C08C,X
BPL L04F1
AND $42
CMP $37
BCC L0492
BEQ L0492
STA $37
DEY
BNE L04E8
L0503 LDA $C08C,X
BPL L0503
SEC
ROL
STA $42
L050C LDA $C08C,X
BPL L050C
AND $42
CMP $37
BCC L051A
JMP L0492
L051A STA $36

L051C LDA $C08C,X
BPL L051C
SEC
ROL
STA $42
L0525 LDA $C08C,X
BPL L0525
AND $42
STA $34 ; where to load low
LDA #$08
STA $40
LDA #$90
STA $39
L0536 LDA $C08C,X
BPL L0536
SEC
ROL
STA $42
L053F LDA $C08C,X
BPL L053F
AND $42
STA $35 ; where to load high

LDY #$00 ; load my 4*4 nibbles
L054A LDA $C08C,X
BPL L054A
SEC
ROL
STA $42
L0553 LDA $C08C,X
BPL L0553
AND $42
L055A STA ($38),Y
INY
BNE L054A
INC $39 ; next page

L0561 LDA $C08C,X ;
BPL L0561
SEC
ROL
STA $42
L056A LDA $C08C,X
BPL L056A
AND $42
DEC $40
BNE L055A
STA $0200
L0578 LDA $C08C,X
BPL L0578
SEC
ROL
STA $42
L0581 LDA $C08C,X
BPL L0581
AND $42
STA $0201

L058B LDA $C08C,X ; the checksum now
BPL L058B
SEC
ROL
STA $42
L0594 LDA $C08C,X
BPL L0594
AND $42
EOR $34
EOR $35
EOR $0200
EOR $0201
STA $3F ; Y=0
STY $3C
STY $3A ; 00
LDA #$90 ; 90
STA $3B
L05AF LDA ($3A),Y
EOR $36
LDX #$03
L05B5 LSR
PHP
ROL
PLP
ROR
DEX    ; X=3 (so 4 loops)
BNE L05B5

EOR $36
PHA
EOR $3C
STA $3C
PLA
STA ($34),Y ; save at destination
INY
BNE L05AF

INC $35 ; next pages
INC $3B
LDA $3B ; until end of source buffer
CMP #$98
BCC L05AF
LDA $3C ; are checksums similar?
CMP $3F
BEQ L05DD
JMP L0488 ; read more
L05DD RTS

*----------------------------

L05DE LDA #$00 ; recode page 3
TYA
L05E1 EOR $FF00,Y
STA $0300,Y
INY
BNE L05E1
PHA    ; save result
LDA #$6C ; and set vectors
STA USRADR
LDA #$F8
STA SOFTEV
LDA #$03
STA SOFTEV+1
EOR #$A5
STA PWREDUP
LDA #$4E
STA USRADR+1
LDA #$00
STA USRADR+2
LDA #<L040C>L040C
STA $4F
PLA    ; restore value
RTS

L0613 LDA #$00
STA $37
STA $3C
STA $3D
STA $3E
RTS

L061E LDY #$00
LDA ($3A),Y
PHA
LDX $3B ; $FD82 or $FD83
CPX #$FD
BNE L0633
LDX $3A
CPX #$82
BEQ L064F
CPX #$83
BEQ L064F
L0633 EOR $3E
STA $3E
PLA
TAX
PHA
ASL $37
ROL
ROL $37
ROL
L0640 ROL $37
ROL
EOR $3C
STA $3C
LDA $37
STX $37
EOR $3D
STA $3D
L064F PLA
STA ($3A),Y
RTS

*----------------------------

L0653 LDA RESETV+1 ; $FA62
CMP #$FA
BEQ L067F
CMP #$FF
BNE L067A
LDA RESETV ; $FF59?
CMP #$59
BNE L067A
LDA $3D
CMP L0404 ; A9
BNE L0671
LDA $3C
CMP L0403 ; 7D
L0671 BNE L067A
LDA $3E
CMP L0405 ; 4F
BEQ L069B
L067A LDA #$CD ; PUT A RTS
JMP L040C

L067F LDA RESETV ; $FA62
CMP #$62
BNE L067A
LDA $3D
CMP L0407 ; D1
BNE L0692
LDA $3C
CMP L0406 ; 04
L0692 BNE L067A
LDA $3E
CMP L0408 ; 60
BNE L067A
L069B RTS ; we're good

*----------------------------
* Phase 2 - Check ROM

L069C LDA L040A ; $C080
STA $38
LDA L040A+1
STA $39
LDY #$01
JSR L06B3 ; activate $C081
LDY #$00
JSR L06B3 ; activate $C080
JMP L0751 ; go to phase 3

L06B3 JSR L0613 ; calc checksum
LDA ($38),Y ; $C080
LDA ($38),Y ; $C080
LDA #$00 ; browse ROM
STA $3A
LDA #$F8
STA $3B
L06C2 JSR L06DA
INC $3A
BNE L06CB
INC $3B
L06CB LDA $3B
CMP #$00
BNE L06D5
LDA $3A
CMP #$00
L06D5 BNE L06C2
JMP L06DD ; check vectors
L06DA JMP L061E ; calc checksum
L06DD JMP L0653 ; check vectors

*----------------------------
* Play with arm phases

L06E0 JSR L06EB
LDA #$08
JMP L0713

L06E8 JSR L06E0
L06EB DEC $33
JMP L06FD

L06F0 JSR L06FB
LDA #$08
JMP L0713

L06F8 JSR L06F0

L06FB INC $33
L06FD LDA $33
AND #$03
ASL
ORA $2B
TAX
LDA $C081,X
LDA #$56
JSR L0713
LDA $C080,X
LDX $2B
RTS

L0713 SEC
L0714 PHA
L0715 SBC #$01
BNE L0715
PLA
SBC #$01
BNE L0714
RTS

*----------------------------
* Phase 1 - Entry point

L071F LDA SETAN0 ; want HGR2
LDA TXTCLR
LDA MIXCLR
LDA TXTPAGE2
LDA HIRES
TSX
TXA
EOR #$B2
AND #$7F ; PUT 00
BEQ L073B
L0736 LDA #$D3 ; S
JMP L040C

L073B PLA
CMP #$37
BNE L0736 ; PUT D0 00
LDA $0200 ; %1001_1001
AND #$67 ; %0110_0111
; =0000_0001
EOR $2B ; %0110_0000
TAY    ; =0110_0001 = #$61
TAX
STY $2B
JSR L05DE ; code page 3, set vectors
JMP L069C ; go to phase 2

*----------------------------
* Phase 3

L0751 LDA LCBANK2
LDA LCBANK2
LDA #$F8
STA RESETV
LDA #$03
STA RESETV+1
LDA RDBANK2
JSR L05DE ; code page 3
STA $0202 ; save result

LDX #$00 ; clear HGR2
L076C LDA L077E+2
CMP #$40
BCC L077B
CMP #$60
BCS L077B
LDA #$00
BEQ L077E
L077B LDA $D007,X
L077E STA $0800,X
INX
BNE L076C
INC L077B+2
BNE L078E
LDA #$E0
STA L077B+2
L078E INC L077E+2
LDA L077E+2
CMP #$C0
BCC L076C

DEX
TXS
LDA #$04 ; phase
STA $33
JSR L06E8 ; move
JSR L06E8 ; move
LDA #$00 ; phase 0
STA $33
JSR L06F8 ; move again
JSR L06F8 ; and again
JSR L0441 ; check nibbles
L07B1 JSR L07B9 ; read
BEQ L07B1 ; loop on err
JMP L07CE ; exit

L07B9 JSR L05DE ; recode page 3
EOR $0202 ; compare
BEQ L07C4 ; match
JMP L067A ; reboot M

L07C4 JSR L06F8 ; move
JSR L0488 ; read
LDA $0201 ; must not be 00
RTS

*----------------------------
* Final Phase - Go to next phase

L07CE LDX $2B ; stop motor
LDA $C088,X
LDA #$FF
STA $32
TXA
LSR
LSR
ROL $2B
LSR
LSR
TAX
ORA #$C0
STA L043E+2
LDY #$00 ; clear our load code
L07E6 STA $0441,Y
STA $0541,Y
STA $0641,Y
INY
BNE L07E6
LDA $33
JMP ($0200) ; jump to game

* $0200: 07
* $0201: 20
* $0202: 60
* $33: 20

ASC " (C) 1982"

Revenir en haut de page

Montrer les messages depuis:

	Index du Forum -> PROTECTION MALEFIQUE	Toutes les heures sont au format GMT + 1 Heure
Page 1 sur 1

Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum