| Technician Ted | Routines |
| Prev: 83C3 | Up: Map |
|
The code from here onwards is the third and final block loaded. It follows immediately after the second block with no extra loading tone.
This code creates a hash from 4000 - 5BFF and 5C92 - FFFF and stores it in HL. This means that if any bytes are changed anywhere en route to loading, the game will not decrypt correctly and will crash. The area from 5C00 - 5C92 is not scanned as this contains system variables set up by BASIC and their values are not predictable.
|
||||
| 8C1C | LD A,$5C | Scan up to 5C00 | ||
| 8C1E | LD HL,$4000 | First pass - start at 4000 | ||
| 8C21 | LD D,H | |||
| 8C22 | LD E,L | |||
| 8C23 | EX DE,HL | Get next value | ||
| 8C24 | LD C,(HL) | |||
| 8C25 | INC HL | |||
| 8C26 | LD B,(HL) | |||
| 8C27 | INC HL | |||
| 8C28 | EX DE,HL | Update it | ||
| 8C29 | ADD HL,BC | |||
| 8C2A | CP D | All done? | ||
| 8C2B | JR NZ,$8C23 | Loop back if more to do | ||
| 8C2D | LD DE,$5C92 | Switch target address to 5C92 | ||
| 8C30 | XOR $5C | Scan up to 0000 | ||
| 8C32 | JR Z,$8C23 | Back to update again | ||
|
At this point, the hash in HL should be 4DBD
|
||||
| 8C34 | PUSH HL | Remember this | ||
| 8C35 | LD HL,$5800 | Clear the screen | ||
| 8C38 | LD DE,$5801 | |||
| 8C3B | LD BC,$02FF | |||
| 8C3E | LD (HL),$00 | |||
| 8C40 | LDIR | |||
| 8C42 | POP HL | Restore HL | ||
|
Now decrypt the game
|
||||
| 8C43 | LD DE,$8C60 | Start of game block | ||
| 8C46 | LD C,$29 | |||
| 8C48 | LD A,H | |||
| 8C49 | LD H,L | Get next hash value | ||
| 8C4A | LD B,A | |||
| 8C4B | ADD HL,BC | |||
| 8C4C | LD A,(DE) | Get byte to decrypt | ||
| 8C4D | XOR L | Invert bits against the first hash byte | ||
| 8C4E | LD (DE),A | Store decrypted byte | ||
| 8C4F | LD L,A | Next iteration | ||
| 8C50 | INC DE | Next address | ||
| 8C51 | LD A,(DE) | Get byte to decrypt | ||
| 8C52 | XOR H | Invert bits against the second hash byte | ||
| 8C53 | LD (DE),A | Store decrypted byte | ||
| 8C54 | INC DE | Next address | ||
| 8C55 | BIT 7,D | Are we still between 8000-FFFF? | ||
| 8C57 | JR NZ,$8C49 | Move back if we are | ||
|
At this point, the game is decrypted and ready to run. HL should be EBF5 and A should be 38
|
||||
| 8C59 | EI | Turn interrupts back on | ||
| 8C5A | LD H,A | Get the game's start address - AA65 | ||
| 8C5B | LD DE,$7170 | |||
| 8C5E | ADD HL,DE | |||
| 8C5F | JP (HL) | Jump to it. Control passes to the main entry point. | ||
| Prev: 83C3 | Up: Map |