.nolist
#include "ti73.inc"
.list
jumpBackup      equ     appBackUpScreen     ;2
unlockLocation  equ     jumpBackup+2        ;?
jumpTable       equ     unlockLocation+512  ;50
spBackup        equ     jumpTable+50        ;2
oldStack        equ     spBackup+2          ;50
.org asm_exec_ram

        call UnlockFlash
        ld hl,sDump
        rst 20h
        bcall(_chkFindSym)
        ret nc
        ld hl,4000h
        bcall(_createAppVar)
        ret c
        inc de
        inc de
        ld a,1Eh
        ld hl,4000h
        ld bc,4000h
        bcall(_FlashToRam2)
        bcall(_clrLCDFull)
        ld hl,0
        ld (curRow),hl
        ld hl,sDone
        bcall(_PutS)
        bcall(_newLine)
        ret
sDump:  .db AppVarObj,"CERTIMG",0
sDone:  .db "CERTIMG created",0

UnlockFlash:
;Unlocks Flash protection.
;Destroys appBackUpScreen, iMathPtr4, iMathPtr5,
;  and probably other stuff.
        ld ix,searchPattern
        ld de,4000h
        ld a,1Ch
        call FindPattern
        jr nc,patternFound
        ld ix,searchPattern
        ld de,4000h
        ld a,1Dh
        call FindPattern
        ret c
patternFound:
        ld ix,(appBackUpScreen)
        ld hl,unlockStart
        ld de,unlockLocation
        ld bc,unlockEnd-unlockStart
        ldir
        jp unlockLocation
unlockStart:
        ld hl,(8080h)
        push hl
        ld hl,(8082h)
        push hl
        ld hl,8080h
        ld (hl),0C3h
        inc hl
        ld de,returnPoint-unlockStart+unlockLocation
        ld (hl),e
        inc hl
        ld (hl),d
        in a,(6)
        push af
        ld hl,jumpTable
        ld (hl),80h
        ld de,jumpTable+1
        ld bc,49
        ldir
        ld (spBackup),sp
        ld hl,(spBackup)
        ld de,oldStack
        ld bc,50
        ldir
        ld a,1Ch
        out (6),a
        ld hl,(spBackup)
        ld de,-8
        add hl,de
        ld de,jumpTable
        ex de,hl
        ld bc,50
        jp (ix)
returnPoint:
        ld sp,(spBackup)
        ld de,(spBackup)
        ld hl,oldStack
        ld bc,50
        ldir
        pop af
        out (6),a
        pop hl
        ld (8082h),hl
        pop hl
        ld (8080h),hl
        xor a
        ret
unlockEnd:        

FindPattern:
;Pattern in IX, Flash page in A, starting address in DE
;Returns NZ if pattern not found
;(appBackUpScreen) contains the address of match found
;Search pattern: terminated by 0FEh
;                0FFh is ? (one-character wildcard)
        ld (iMathPtr4),a
        in a,(6)
        push af
        ld hl,findPatternRet
        push hl
        ld a,(iMathPtr4)
        out (6),a
        dec de
searchLoopRestart:
        inc de
        ld (appBackUpScreen),de
        push ix
        pop hl
searchLoop:
        ld b,(hl)
        ld a,0FEh
        cp b
        ld a,b
        ret z
        inc de
        inc a
        jr z,matchSoFar
        dec de
        ld a,(de)
        inc de
        bit 7,d
        ret nz
        cp b
        jr z,matchSoFar
        ld de,(appBackUpScreen)
        jr searchLoopRestart
matchSoFar:
        inc hl
        jr searchLoop
findPatternRet:
        pop bc
        ld a,b
        out (6),a
        ret
searchPattern:
        .db 0F5h,3Eh,01h,00h,0F3h,00h,00h
        .db 0EDh,56h,0F3h,0D3h,14h,0F3h,0CDh,0FFh
        .db 0FFh,0F1h,0EFh,54h,80h,0FEh
.end
end