----Stickybear Reading Comprehension---
A 4am crack                  2016-02-23
---------------------------------------

Name: Stickybear Reading Comprehension
Genre: educational
Year: unknown (no year listed on disk
  labael on displayed on boot; can't
  find an authoritative source online)
Publisher: Optimum Resource, Inc.
Media: single-sided 5.25-inch floppy
OS: custom with DOS 3.3 bootloader
Previous cracks: none of 5.25" version
Similar cracks:
  #611 Stickybear Reading
  #610 Stickybear Word Problems
  #609 Stickybear Math 2
  #586 Stickybear Parts of Speech
  #585 Map Skills
  #336 Car Builder

                   ~

               Chapter 0
 In Which Various Automated Tools Fail
          In Interesting Ways


COPYA
  read error on first pass

Locksmith Fast Disk Backup
  fails to read T01,S0F; copy displays
  title page then hangs

EDD 4 bit copy (no sync, no count)
  no read errors, but copy displays
  title page then hangs

Disk Fixer
  unable to read T01,S0F by any obvious
  combination of parameters

Why didn't COPYA work?
  intentionally bad sector on track $01

Why didn't Locksmith FDB work?
  probably a nibble check during boot
  that centers around the bad sector

Why didn't my EDD copy work?
  ditto

Next steps:

  1. Trace the boot
  2. Find the nibble check and skip it
  3. There is no step 3 (I hope)

                   ~

               Chapter 1
  Hello, I'd Like To Have An Argument
         On The Stack, Please


[S6,D1=original disk]
[S5,D1=my work disk]

]PR#5
...
CAPTURING BOOT0
...reboots slot 6...
...reboots slot 5...
SAVING BOOT0
CAPTURING BOOT1
...reboots slot 6...
...reboots slot 5...
SAVING BOOT1
SAVING RWTS

]BLOAD BOOT1,A$2600
]CALL -151

*B600<2600.2EFFM ; move RWTS into place
                 ; (but don't overwrite
                 ; Diversi-DOS @ $BF00)
*B700L

; clear hi-res graphics screen 1
B700-   A9 00       LDA   #$00
B702-   A8          TAY
B703-   85 10       STA   $10
B705-   A2 20       LDX   #$20
B707-   86 11       STX   $11
B709-   91 10       STA   ($10),Y
B70B-   C8          INY
B70C-   D0 FB       BNE   $B709
B70E-   E6 11       INC   $11
B710-   CA          DEX
B711-   D0 F6       BNE   $B709

; hmm, a JSR followed by garbage code
B713-   20 5D B6    JSR   $B65D
B716-   01 0E       ORA   ($0E,X)
B718-   00          BRK
B719-   08          PHP
B71A-   18          CLC

*B65DL

; Ah! This subroutine uses the stack to
; pass in multiple arguments and store
; them in zero page
B65D-   68          PLA
B65E-   85 F0       STA   $F0
B660-   68          PLA
B661-   85 F1       STA   $F1
B663-   A0 01       LDY   #$01
B665-   B1 F0       LDA   ($F0),Y
B667-   85 54       STA   $54
B669-   C8          INY
B66A-   B1 F0       LDA   ($F0),Y
B66C-   85 55       STA   $55
B66E-   C8          INY
B66F-   B1 F0       LDA   ($F0),Y
B671-   85 58       STA   $58
B673-   C8          INY
B674-   B1 F0       LDA   ($F0),Y
B676-   85 59       STA   $59
B678-   C8          INY
B679-   B1 F0       LDA   ($F0),Y
B67B-   85 67       STA   $67
B67D-   18          CLC
B67E-   A5 F0       LDA   $F0
B680-   69 05       ADC   #$05
B682-   A8          TAY
B683-   A5 F1       LDA   $F1
B685-   69 00       ADC   #$00

; then munges the stack pointer to
; "return" to the next real instruction
; after the parameters
B687-   48          PHA
B688-   98          TYA
B689-   48          PHA

B68A-   A9 00       LDA   #$00
B68C-   85 5A       STA   $5A
B68E-   85 5B       STA   $5B
B690-   85 5E       STA   $5E
B692-   85 53       STA   $53
B694-   A9 01       LDA   #$01
B696-   85 50       STA   $50
B698-   85 52       STA   $52
B69A-   85 60       STA   $60
B69C-   85 62       STA   $62
B69E-   A9 60       LDA   #$60
B6A0-   85 51       STA   $51
B6A2-   85 5F       STA   $5F
B6A4-   A9 00       LDA   #$00
B6A6-   85 57       STA   $57
B6A8-   A9 61       LDA   #$61
B6AA-   85 56       STA   $56
B6AC-   A9 EF       LDA   #$EF
B6AE-   85 63       STA   $63
B6B0-   A9 D8       LDA   #$D8
B6B2-   85 64       STA   $64
B6B4-   A5 67       LDA   $67
B6B6-   D0 01       BNE   $B6B9
B6B8-   60          RTS
B6B9-   A9 01       LDA   #$01
B6BB-   85 5C       STA   $5C
B6BD-   A9 00       LDA   #$00
B6BF-   A0 50       LDY   #$50
B6C1-   20 B5 B7    JSR   $B7B5
B6C4-   E6 59       INC   $59
B6C6-   C6 67       DEC   $67
B6C8-   C6 55       DEC   $55
B6CA-   10 E8       BPL   $B6B4
B6CC-   A9 0F       LDA   #$0F
B6CE-   85 55       STA   $55
B6D0-   E6 54       INC   $54
B6D2-   D0 E0       BNE   $B6B4

This is a multi-sector read loop. It
calls the regular $B7B5 entry point to
read sectors (at $B6C1). Interestingly,
the RWTS parameter table is actually on
zero page, starting at $50. That would
mean that the parameters passed in (on
the stack, after the JSR $B65D) are

  1. start track ($54)
  2. start sector ($55)
  3. start address - low ($58)
  4. start address - high ($59)
  5. sector count ($67)

It uses logical sectors (via the RWTS).
Sectors count down from $0F to $00, and
tracks are decremented once the sector
wraps around to $0F. The target address
is incremented monotonically, and the
sector count is decremented until it
hits 0.

Revisiting the caller with this new
understanding...

; read $18 sectors into $0800 starting
; from T01,S0E
B713-   20 5D B6    JSR   $B65D
B716-  [01 0E 00 08 18]

; continue in the code we just read
B71B-   4C 00 08    JMP   $0800

That's where I'll interrupt the boot.

                   ~

               Chapter 2
          Bootus Interruptus


*9600<C600.C6FFM

; set up callback #1 after boot0 loads
; boot1
96F8-   A9 4C       LDA   #$4C
96FA-   8D 4A 08    STA   $084A
96FD-   A9 0A       LDA   #$0A
96FF-   8D 4B 08    STA   $084B
9702-   A9 97       LDA   #$97
9704-   8D 4C 08    STA   $084C

; start the boot
9707-   4C 01 08    JMP   $0801

; (callback #1) set up callback #2 once
; we load the code into $0800
970A-   A9 4C       LDA   #$4C
970C-   8D 1B B7    STA   $B71B
970F-   A9 1C       LDA   #$1C
9711-   8D 1C B7    STA   $B71C
9714-   A9 97       LDA   #$97
9716-   8D 1D B7    STA   $B71D

; continue the boot
9719-   4C 00 B7    JMP   $B700

; (callback #2) copy newly loaded
; code to higher memory so it doesn't
; get overwritten by the HELLO program
; on my work disk
971C-   A2 18       LDX   #$18
971E-   A0 00       LDY   #$00
9720-   B9 00 08    LDA   $0800,Y
9723-   99 00 28    STA   $2800,Y
9726-   C8          INY
9727-   D0 F7       BNE   $9720
9729-   EE 22 97    INC   $9722
972C-   EE 25 97    INC   $9725
972F-   CA          DEX
9730-   D0 EE       BNE   $9720

; reboot to my work disk
9732-   4C 00 C5    JMP   $C500

*BSAVE TRACE,A$9600,L$135

*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT2 0800,A$2800,L$1800
]CALL -151

*800<2800.3FFFM
*800L

; slow to 1 MHz (IIgs)
0800-   AD 36 C0    LDA   $C036
0803-   29 7F       AND   #$7F
0805-   8D 36 C0    STA   $C036

; black border (IIgs)
0808-   AD 34 C0    LDA   $C034
080B-   29 F0       AND   #$F0
080D-   8D 34 C0    STA   $C034

; reset memory switches and stuff
0810-   8D 02 C0    STA   $C002
0813-   8D 0C C0    STA   $C00C
0816-   8D 04 C0    STA   $C004

; checks machine ID for //e or later
; (not shown)
0819-   20 3E 0F    JSR   $0F3E

081C-   4C 13 0A    JMP   $0A13

*A13L

0A13-   A9 01       LDA   #$01
0A15-   85 BE       STA   $BE
0A17-   A9 0D       LDA   #$0D
0A19-   8D 00 C0    STA   $C000
0A1C-   8D 50 C0    STA   $C050
0A1F-   8D 57 C0    STA   $C057
0A22-   8D 52 C0    STA   $C052
0A25-   8D 10 C0    STA   $C010

; munge reset vector
0A28-   A9 00       LDA   #$00
0A2A-   8D F4 03    STA   $03F4

; A quick investigation reveals that
; this is also a multi-sector read loop
; that takes parameters on the stack,
; just like the one at $B65D. So this
; reads $20 sectors into $2000 starting
; at T03,S0F. (This is the title screen
; I saw, even on my non-working copy.)
0A2D-   20 2B 16    JSR   $162B
0A30-  [03 0F 00 20 20]

; show it
0A35-   8D 54 C0    STA   $C054
0A38-   20 B4 17    JSR   $17B4

*17B4L

; hmm
17B4-   A9 20       LDA   #$20
17B6-   8D FE 17    STA   $17FE
17B9-   A9 02       LDA   #$02
17BB-   8D 00 18    STA   $1800
17BE-   A9 D8       LDA   #$D8
17C0-   8D FF 17    STA   $17FF
17C3-   A9 60       LDA   #$60
17C5-   8D 01 18    STA   $1801

; wipe $46 bytes of memory at $1E00
17C8-   A9 00       LDA   #$00
17CA-   85 50       STA   $50
17CC-   A9 1E       LDA   #$1E
17CE-   85 51       STA   $51
17D0-   A0 46       LDY   #$46
17D2-   A9 00       LDA   #$00
17D4-   91 50       STA   ($50),Y
17D6-   88          DEY
17D7-   D0 FB       BNE   $17D4

; call the following line, then fall
; through to call it again (?!?)
17D9-   20 DC 17    JSR   $17DC

; read 2 sectors into $42D8, starting
; at T17,S0F
17DC-   20 2B 16    JSR   $162B
17DF-  [17 0F D8 42 02]

; copy them (well, most of them) into
; lower memory, starting at $02D8
17E4-   A0 00       LDY   #$00
17E6-   B9 D8 42    LDA   $42D8,Y
17E9-   99 D8 02    STA   $02D8,Y
17EC-   C8          INY
17ED-   D0 F7       BNE   $17E6
17EF-   A0 90       LDY   #$90
17F1-   B9 D6 43    LDA   $43D6,Y
17F4-   99 D6 03    STA   $03D6,Y
17F7-   88          DEY
17F8-   D0 F7       BNE   $17F1
17FA-   20 FE 17    JSR   $17FE
17FD-   60          RTS

; and... crash?
17FE-   00          BRK
17FF-   00          BRK
1800-   00          BRK
1801-   00          BRK

Ah! But all is not as it seems. Recall
that we literally *just* modified the
memory at $17FE..$1801 (at $17B4). This
is the code that ends up there:

*17FE:20 D8 02 60

*17FEL

17FE-   20 D8 02    JSR   $02D8
1801-   60          RTS

...which is the code we just moved,
that we read from T17,S0F.

Highly suspect.

Let's interrupt at $17FA and see what
sneaky code ends up in the input buffer
($02D8), the page 3 vectors ($03D6),
and overflowing onto the text page.

                   ~

               Chapter 3
  Why Build One When You Can Have Two
          At Twice The Price?


*9600<C600.C6FFM

; set up callback #1 and start the boot
96F8-   A9 4C       LDA   #$4C
96FA-   8D 4A 08    STA   $084A
96FD-   A9 0A       LDA   #$0A
96FF-   8D 4B 08    STA   $084B
9702-   A9 97       LDA   #$97
9704-   8D 4C 08    STA   $084C
9707-   4C 01 08    JMP   $0801

; (callback #1) set up callback #2 and
; continue the boot
970A-   A9 4C       LDA   #$4C
970C-   8D 1B B7    STA   $B71B
970F-   A9 1C       LDA   #$1C
9711-   8D 1C B7    STA   $B71C
9714-   A9 97       LDA   #$97
9716-   8D 1D B7    STA   $B71D
9719-   4C 00 B7    JMP   $B700

; (callback #2) set up callback #3 and
; continue the boot
971C-   A9 4C       LDA   #$4C
971E-   8D FA 17    STA   $17FA
9721-   A9 2E       LDA   #$2E
9723-   8D FB 17    STA   $17FB
9726-   A9 97       LDA   #$97
9728-   8D FC 17    STA   $17FC
972B-   4C 00 08    JMP   $0800

; (callback #3) copy the code we copied
; into the input buffer and text page
; to higher memory so it survives a
; reboot
972E-   A0 00       LDY   #$00
9730-   B9 D8 02    LDA   $02D8,Y
9733-   99 D8 22    STA   $22D8,Y
9736-   B9 D8 03    LDA   $03D8,Y
9739-   99 D8 23    STA   $23D8,Y
973C-   C8          INY
973D-   D0 F1       BNE   $9730

; and reboot to my work disk
973F-   4C 00 C5    JMP   $C500

*BSAVE TRACE2,A$9600,L$142
*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT2 02D8,A$22D8,L$200
]CALL -151

Since part of this ends up on the text
page, I'm going to leave it at $22D8.
Relative branches will look correct,
but absolute addresses will be off by
$2000.

]CALL -151

*22D8L

; whatever this is doing, it's going to
; keep doing it until it works (note
; the infinite loop if the carry bit
; is set)
22D8-   A0 3C       LDY   #$3C
22DA-   A9 04       LDA   #$04
22DC-   20 E2 02    JSR   $02E2
22DF-   B0 F7       BCS   $22D8
22E1-   60          RTS

; save registers
22E2-   48          PHA
22E3-   8A          TXA
22E4-   48          PHA
22E5-   98          TYA
22E6-   48          PHA

; do something
22E7-   20 F8 02    JSR   $02F8

; restore registers
22EA-   68          PLA
22EB-   A8          TAY
22EC-   68          PLA
22ED-   AA          TAX
22EE-   68          PLA

; read a sector via RWTS
22EF-   20 B5 B7    JSR   $B7B5

; do the same thing again (but save and
; restore the processor flags)
22F2-   08          PHP
22F3-   20 F8 02    JSR   $02F8
22F6-   28          PLP

; and return to caller with the flags
; from the RWTS call
22F7-   60          RTS

OK, this is a bit convoluted, but it's
not intentionally obfuscated. It's just
cautious. The heart of it is a standard
RWTS call (at $02EF) which absolutely
has to work, otherwise $02DF will keep
branching back to $02D8 to try again.
The RWTS parameter table is at $043C
(passed in A and Y, set at $02D8).
Before and after the RWTS call, we call
a routine at $02F8. The RWTS parameter
table is never modified, so it's just
whatever was read from disk.

*243C.2450

243C- 01 60 01 00
2440- 01 0F 4D 04 00 1E 00 00
      ^^ ^^       ^^^^^
   track sector  address

2448- 01 00 00 60 01 00 01 EF
2450- D8

That's reading from slot 6, drive 1,
track $01, sector $0F (aha! that's the
unreadable sector), into $1E00.

*22F8L

; take two bytes from a data structure
; starting at $0321 and store them in
; zero page $02/$03
22F8-   A2 00       LDX   #$00
22FA-   A0 00       LDY   #$00
22FC-   BD 21 03    LDA   $0321,X
22FF-   E8          INX
2300-   85 02       STA   $02
2302-   BD 21 03    LDA   $0321,X
2305-   E8          INX
2306-   85 03       STA   $03
2308-   C5 02       CMP   $02
230A-   D0 05       BNE   $2311
230C-   C9 00       CMP   #$00
230E-   D0 01       BNE   $2311
2310-   60          RTS

; swap the byte at ($02),Y with the
; byte at $0321,X
2311-   BD 21 03    LDA   $0321,X
2314-   48          PHA
2315-   B1 02       LDA   ($02),Y
2317-   9D 21 03    STA   $0321,X
231A-   E8          INX
231B-   68          PLA
231C-   91 02       STA   ($02),Y

; and loop back (will exit if the BNEs
; at $030A and $030E fail)
231E-   4C FC 02    JMP   $02FC

So we're swapping some bytes in memory,
then (since we call the same routine
again) swapping them back after the
RWTS call at $02EF. This is driven by
a data structure (starting at $0321)
that contains an array of triples
(two byte address + one byte value)
followed by two null bytes.

Here is the data structure:

*2321.2334

2321- C2 B8 4C
      C3 B8 8E
      C4 B8 03
      DC B8 4C
      DD B8 35
      DE B8 03
      00 00

So we're swapping three bytes at $B8C2
(4C 8E 03) and three bytes at $B8DC
(4C 35 03). That... is right in the
middle of RWTS code. $B8C2 is the
POSTNIBBLE routine that converts the
342 nibbles on disk into 256 bytes in
memory. $B8DC is the READ routine. And
we're completely replacing (well,
redirecting) both of them to custom
routines that we just read from disk,
in order to read the unreadable sector
on track $01.

Let's see what's at $038E and $0335.

*238EL

; new POSTNIBBLE routine
238E-   A0 87       LDY   #$87
2390-   20 AB 03    JSR   $03AB
2393-   88          DEY
2394-   20 AB 03    JSR   $03AB
2397-   0A          ASL
2398-   0A          ASL
2399-   0A          ASL
239A-   0A          ASL
239B-   85 00       STA   $00
239D-   20 AB 03    JSR   $03AB
23A0-   05 00       ORA   $00
23A2-   91 3E       STA   ($3E),Y
23A4-   98          TYA
23A5-   88          DEY
23A6-   C9 00       CMP   #$00
23A8-   D0 EA       BNE   $2394
23AA-   60          RTS
23AB-   98          TYA
23AC-   48          PHA
23AD-   C9 87       CMP   #$87
23AF-   D0 19       BNE   $23CA
23B1-   A0 55       LDY   #$55
23B3-   AD C0 FB    LDA   $FBC0
23B6-   F0 0C       BEQ   $23C4
23B8-   AE 8D 03    LDX   $038D
23BB-   BD 8D C0    LDA   $C08D,X
23BE-   BD 8E C0    LDA   $C08E,X
23C1-   10 01       BPL   $23C4
23C3-   88          DEY
23C4-   84 02       STY   $02
23C6-   A2 00       LDX   #$00
23C8-   86 01       STX   $01
23CA-   A4 02       LDY   $02
23CC-   A6 01       LDX   $01
23CE-   30 0C       BMI   $23DC
23D0-   BE FF BB    LDX   $BBFF,Y
23D3-   88          DEY
23D4-   D0 0A       BNE   $23E0
23D6-   A9 FF       LDA   #$FF
23D8-   85 01       STA   $01
23DA-   D0 04       BNE   $23E0
23DC-   BE 00 BB    LDX   $BB00,Y
23DF-   C8          INY
23E0-   84 02       STY   $02
23E2-   68          PLA
23E3-   A8          TAY
23E4-   BD 3C 03    LDA   $033C,X
23E7-   60          RTS

*2335L

; new READ routine
2335-   A0 20       LDY   #$20
2337-   8E 8D 03    STX   $038D
233A-   88          DEY
233B-   F0 4E       BEQ   $238B
233D-   BD 8C C0    LDA   $C08C,X
2340-   10 FB       BPL   $233D
2342-   49 D5       EOR   #$D5
2344-   D0 F4       BNE   $233A
2346-   EA          NOP
2347-   BD 8C C0    LDA   $C08C,X
234A-   10 FB       BPL   $2347
234C-   C9 AA       CMP   #$AA
234E-   D0 F2       BNE   $2342
2350-   A0 56       LDY   #$56
2352-   BD 8C C0    LDA   $C08C,X
2355-   10 FB       BPL   $2352
2357-   EA          NOP
2358-   EA          NOP
2359-   9D 8D C0    STA   $C08D,X
235C-   88          DEY
235D-   84 26       STY   $26
235F-   BD 8C C0    LDA   $C08C,X
2362-   10 FB       BPL   $235F
2364-   BC 00 BA    LDY   $BA00,X
2367-   A4 26       LDY   $26
2369-   99 00 BC    STA   $BC00,Y
236C-   D0 EE       BNE   $235C
236E-   84 26       STY   $26
2370-   BD 8C C0    LDA   $C08C,X
2373-   10 FB       BPL   $2370
2375-   BC 00 BA    LDY   $BA00,X
2378-   A4 26       LDY   $26
237A-   99 00 BB    STA   $BB00,Y
237D-   C8          INY
237E-   D0 EE       BNE   $236E
2380-   AD 52 BC    LDA   $BC52
2383-   29 F0       AND   #$F0
2385-   C9 90       CMP   #$90
2387-   F0 02       BEQ   $238B
2389-   18          CLC
238A-   60          RTS
238B-   38          SEC
238C-   60          RTS
238D-   00          BRK

And that's how we're going to read the
unreadable sector: we're going to let
this code do it for us.

                   ~

               Chapter 4
 On A Clear Day You Can Trace Forever


*9600<C600.C6FFM
.
. set up callbacks 1, 2, and 3 (same
. as previous trace)
.
; (callback #3) set up callback #4 once
; it reads the unreadable sector with
; the modified RWTS
972E-   A9 4C       LDA   #$4C
9730-   8D DF 02    STA   $02DF
9733-   A9 40       LDA   #$40
9735-   8D E0 02    STA   $02E0
9738-   A9 97       LDA   #$97
973A-   8D E1 02    STA   $02E1

; continue the boot and capture the
; unreadable sector
973D-   4C D8 02    JMP   $02D8

; (callback #4) copy it to the graphics
; page so it survives a reboot (I'm not
; sure if my HELLO program would
; overwrite it, but it would be close)
9740-   A0 00       LDY   #$00
9742-   B9 00 1E    LDA   $1E00,Y
9745-   99 00 2E    STA   $2E00,Y
9748-   C8          INY
9749-   D0 F7       BNE   $9742

; and reboot to my work disk
974B-   4C 00 C5    JMP   $C500

*BSAVE TRACE3,A$9600,L$14E
*9600G
...reboots slot 6...
...reboots slot 5...

]BSAVE BOOT2 1E00,A$1E00,L$100
]CALL -151

*1E00<2E00.2EFFM
*1E00L
.
. (some data structure)
.
1E83-   A9 75       LDA   #$75
1E85-   85 93       STA   $93
1E87-   A9 AB       LDA   #$AB
1E89-   85 94       STA   $94
1E8B-   A0 01       LDY   #$01
1E8D-   20 A0 17    JSR   $17A0
1E90-   A9 75       LDA   #$75
1E92-   85 93       STA   $93
1E94-   A9 AB       LDA   #$AB
1E96-   85 94       STA   $94
1E98-   A9 60       LDA   #$60
1E9A-   85 98       STA   $98
1E9C-   A9 09       LDA   #$09
1E9E-   85 99       STA   $99
1EA0-   A9 01       LDA   #$01
1EA2-   85 9A       STA   $9A
1EA4-   20 B6 18    JSR   $18B6
1EA7-   B0 DA       BCS   $1E83
1EA9-   AD 60 09    LDA   $0960
1EAC-   8D 10 C0    STA   $C010

Well, I'm not sure what this is, but it
is most decidedly something. This was
not just a check to ensure that the
unreadable sector was there. The data
(and code) on that sector matters.

OK, no problem. I have the data now. I
can write it back to T01,S0F on my non-
working copy. Then, if I disable the
RWTS swapper at $02F8, the program will
just read T01,S0F with a standard RWTS.

08C0-   A9 08       LDA   #$08
08C2-   A0 E8       LDY   #$E8
08C4-   4C D9 03    JMP   $03D9

08E8- 01 60 01 FE 01 0F FB 08
                  ^^ ^^
               track sector

08F0- 00 1E 00 00 02 00 FE 60
      ^^^^^       ^^
     address    write

08F8- 01 00 00 00 01 EF D8 00

*BSAVE WRITE T01S0F,A$8C0,L$40
*BLOAD BOOT2 1E00,A$1E00

[S6,D1=non-working copy]

*8C0G
...write write write...

$02D8 was read from T17,S0F (at $17DC).
I want to put an "RTS" at $02F8 to
disable the RWTS swapper, so that's at
offset $20. I shouldn't need to change
anything else.

T17,S0F,$20 change "A2" to "60"

]PR#6
...works...

Quod erat liberandum.

---------------------------------------
A 4am crack                     No. 613
------------------EOF------------------