stairway to hell forum: Originally back in the day, I had the idea of just rigging up some sort of hardware switch to swap in a changed OS (or just OS 0.1) just before hitting BREAK. Seeing as though the gauntlet was thrown, I brought a copy of the Wizadore tape off ebay to have a stab at that protection... Heres the bit after the timer decoding/checksumming done Smile E00 20 0C 0E .. JSR &0E0C E03 9D 0C 0E ... STA &0E0C,X E06 CA . DEX E07 D0 FA .. BNE &0E03 E09 4C 00 00 L.. JMP &0000 E0C A9 00 .. LDA #&00 (0) E0E A2 0F .. LDX #&0F (15) E10 9D A1 02 ... STA &02A1,X ; paged ROM 0 type number E13 CA . DEX E14 10 FA .. BPL &0E10 ; (>= signed) E16 E8 . INX E17 BD 39 0E .9. LDA &0E39,X E1A 95 00 .. STA &00,X E1C E8 . INX E1D E0 84 .. CPX #&84 ; (132=-124) E1F D0 F6 .. BNE &0E17 E21 A2 41 .A LDX #&41 ; (65) E23 BD BD 0E ... LDA &0EBD,X E26 9D 20 01 . . STA &0120,X E29 CA . DEX E2A 10 F7 .. BPL &0E23 ; (>= signed) E2C A9 CD .. LDA #&CD ; (205=-51) E2E 8D 04 02 ... STA &0204 ; IRQ1V vector lo address E31 A9 D9 .. LDA #&D9 ; (217=-39) E33 8D 05 02 ... STA &0205 ; IRQ2V vector hi address E36 85 FC .. STA &FC ; interrupt Acc save register E38 60 ` RTS E39 A9 03 .. LDA #&03 ; (3) E3B 85 F8 .. STA &F8 E3D 8D 08 FE ... STA &FE08 ; 6850 ACIA control register (write) status register (read) E40 A9 05 .. LDA #&05 ; (5) E42 8D 10 FE ... STA &FE10 ; serial ULA control register E45 A2 FF .. LDX #&FF ; (255=-1) E47 CA . DEX E48 D0 FD .. BNE &0E47 E4A A9 85 .. LDA #&85 ; (133=-123) E4C 8D 10 FE ... STA &FE10 ; serial ULA control register E4F A9 D5 .. LDA #&D5 ; (213=-43) E51 8D 08 FE ... STA &FE08 ; 6850 ACIA control register (write) status register (read) E54 AD 08 FE ... LDA &FE08 ; 6850 ACIA control register (write) status register (read) E57 10 FB .. BPL &0E54 ; (>= signed) E59 A8 . TAY E5A 29 01 ). AND #&01 ; (1) E5C F0 F6 .. BEQ &0E54 E5E 98 . TYA E5F 29 70 )p AND #&70 ; (112) E61 F0 07 .. BEQ &0E6A E63 24 F8 $. BIT &F8 E65 10 ED .. BPL &0E54 ; (>= signed) E67 4C 20 01 L . JMP &0120 E6A AD 09 FE ... LDA &FE09 ; 6850 ACIA transmit/receive data register E6D 49 B5 I. EOR #&B5 ; (181=-75) E6F 24 F8 $. BIT &F8 E71 30 08 0. BMI &0E7B ; (< signed) .(RTS) E73 C9 CD .. CMP #&CD ; (205=-51) E75 D0 DD .. BNE &0E54 E77 85 F8 .. STA &F8 E79 F0 01 .. BEQ &0E7C E7B 60 ` RTS E7C A2 00 .. LDX #&00 ; (0) E7E 20 1B 00 .. JSR &001B E81 38 8 SEC E82 F5 7E .~ SBC &7E,X E84 55 78 Ux EOR &78,X E86 95 72 .r STA &72,X E88 E8 . INX E89 E0 06 .. CPX #&06 ; (6) E8B D0 F1 .. BNE &0E7E E8D A2 00 .. LDX #&00 ; (0) E8F 20 1B 00 .. JSR &001B E92 81 72 .r STA (&72,X) E94 E6 72 .r INC &72 E96 D0 02 .. BNE &0E9A E98 E6 73 .s INC &73 E9A A5 74 .t LDA &74 E9C D0 02 .. BNE &0EA0 E9E C6 75 .u DEC &75 EA0 C6 74 .t DEC &74 EA2 D0 EB .. BNE &0E8F EA4 A5 75 .u LDA &75 EA6 D0 E7 .. BNE &0E8F EA8 6C 76 00 lv. JMP (&0076) 0EA0 ** ** ** ** ** ** ** ** ** ** ** 00 00 00 00 00 ..... 0EB0 00 2D 9B 63 7A 46 67 6E F2 39 CD B3 ** ** ** ** .-.czFgn.9.. EBD A2 00 .. LDX #&00 ; (0) EBF 9D 00 04 ... STA &0400,X EC2 E8 . INX EC3 D0 FA .. BNE &0EBF EC5 EE 24 01 .$. INC &0124 EC8 10 F5 .. BPL &0EBF ; (>= signed) ECA 95 00 .. STA &00,X ECC E8 . INX ECD D0 FB .. BNE &0ECA ECF A9 3F .? LDA #&3F ; (63) ED1 8D 88 02 ... STA &0288 ; OSBYTE &f8 value BREAK intercept code (address lsb) ED4 A9 01 .. LDA #&01 ; (1) ED6 8D 89 02 ... STA &0289 ; OSBYTE &f9 value BREAK intercept code (address msb) ED9 6C FC FF l.. JMP (&FFFC) ; 6502 RESET entry lo EDC 90 10 .. BCC &0EEE ; (RTS) EDE A2 00 .. LDX #&00 ; (0) EE0 8E 87 02 ... STX &0287 ; OSBYTE &f7 value BREAK intercept code (opcode JMP usually) EE3 BD 52 01 .R. LDA &0152,X EE6 F0 06 .. BEQ &0EEE ; (RTS) EE8 20 EE FF .. JSR &FFEE ; OSWRCH output a character to the VDU stream EEB E8 . INX EEC D0 F5 .. BNE &0EE3 EEE 60 ` RTS 0EE0 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** 07 . 0EF0 4C 6F 61 64 20 45 72 72 6F 72 0D 0A 0A 00 F9 23 Load Error.....#