wrote:
> I
am trying to port HW2Patch to AMS 2.08/2.09. I figured
> out the I/O
ports I need to change (0x700000 and
> 0x700004, lwords), but I can't
figure out how to disable
> the Protection on HW2 calculators. Can
anybody give me a
> tip to disabling it?
>
> -MrM
From http://tict.ticalc.org/docs/J89hw.txt:
$1C0000-$1FFFFF: "the Protection" enable/disable
Note: Four consecutive accesses to this range crashes a HW1 calc!
READ: Enable the Protection
WRITE: Disable the Protection
Note: No access to this range will have any effect unless the access is
"authorized," see below.
$200000-$20FFFF,
$212000-$217FFF,
$21A000-$21FFFF: "the Protection" access authorization
HW1:
In order to alter the state of the Protection, THREE consecutive read
accesses must occur from any of the three ranges above immediately prior
to the access to the Protection enable/disable range.
HW2:
(Note: This is somewhat complicated and I don't know exactly how it works.
The procedure listed below is probably too strict. Anyway, this is what
AMS and the boot sector does.)
In order to alter the state of the Protection, (at least) SEVEN supervisor
instruction fetches must occur from any of the three ranges above prior to
the access to the Protection enable/disable range. The choice of
instructions is not arbitrary, it must be one of the following sequences:
* To DISABLE the Protection: $4E71, , $4E71, $4E71, $46FC, $2700, $3080, . The very next access must be the WRITE to the Protection enable/
disable range.
* To ENABLE the Protection: $4E71, , $4E71, $4E71, $46FC, $2700, $3010, . The very next access must be the READ from the Protection
enable/disable range.
($4E71="nop", $46FC="move #imm16,sr", $3080="move.w d0,(a0)",
$3010="move.w (a0),d0")
Laine
Do you Yahoo!?
The New
Yahoo! Search - Faster. Easier. Bingo.