.nolist
#include "ti83plus.inc"
.list
.org userMem-2
        .db 0BBh,6Dh

        call UnlockFlash
        bcall(_MarkOSValid)
        bcall(_GetBaseVer)
        ld (newOSHeaderMajor),a
        ld a,b
        ld (newOSHeaderMinor),a
        bcall(_FindSwapSector)
        push af
        ld hl,4000h
        bcall(_LoadAIndPaged)
        ld b,0FEh
        cp b
        ex de,hl
        pop hl
        jr z,swapSectorFound
        ld a,h
        bcall(_WriteAByte)
swapSectorFound:
        ;Back up all of sector except for header at 1A:4000h
        bcall(_FindSwapSector)
        ld (savesscreen),a
        bcall(_EraseFlashPage)
        ld hl,4000h+100h
        ld bc,4000h-100h
copyLoop:
        push bc
        ld a,1Ah
        push hl
        bcall(_LoadAIndPaged)
        push hl
        pop de
        ld b,a
        ld a,(savesscreen)
        inc a
        inc a
        bcall(_WriteAByte)
        pop hl
        pop bc
        inc hl
        dec bc
        ld a,b
        or c
        jr nz,copyLoop
        ld a,(savesscreen)
        ld b,a
        ld a,18h
        push af
        push bc
        bcall(_copyFlashPage)
        pop bc
        pop af
        inc a
        inc b
        push bc
        bcall(_copyFlashPage)
        pop bc
        inc b
        inc b
        ld a,1Bh
        bcall(_copyFlashPage)
        ;Erase old sector
;==================================
;=== BCALLless code starts here ===
        ld hl,bcallStart
        ld de,appBackUpScreen
        ld bc,bcallEnd-bcallStart
        ldir
        ld a,18h
        ld ix,_EraseFlashPage-4000h
        call appBackUpScreen
        ld a,(savesscreen)
        ld b,18h
        ld c,4
        call copyPages
;=== BCALLless code ends here =====
;==================================
        ;Write new OS header to 1A:4000h
        ld hl,appData
        ld bc,100h
        bcall(_MemClear)
        ld hl,newOSHeader
        ld de,appData
        ld bc,newOSHeaderEnd-newOSHeader
        ldir
        ld a,1Ah
        ld hl,appData
        ld de,4000h
        ld bc,100h
        bcall(_WriteFlash)
        ;Erase swap sector
        ld a,(savesscreen)
        push af
        bcall(_EraseFlashPage)
        pop af
        ld b,0FEh
        ld de,4000h
        bcall(_WriteAByte)
        ;Reset execution permissions
        ;This should probably dynamically be checking for
        ;  an empty spot to place this code, but eh.
        ld bc,resetExecPermissionsEnd-resetExecPermissions
        ld hl,7FFFh
        or a
        sbc hl,bc
        ld a,1Ch
        ld de,appData
        push bc
        push hl
        bcall(_FlashToRam)
        pop de
        pop bc
        push bc
        ld hl,appData
        call VerifyEmptyData
        pop bc
        ld a,1Ch
        jr z,writePermissionsCode
        ld a,1Dh
writePermissionsCode:
        ld hl,resetExecPermissions
        push af
        push de
        bcall(_WriteFlash)
        pop hl
        pop bc
        ;Now call the code
        in a,(6)
        push af
        ld a,b
        out (6),a
        ld ix,permissionsRet
        push ix
        jp (hl)
permissionsRet:
        pop af
        out (6),a
        ;Maybe forge new certificate?
        ret
resetExecPermissions:
        xor a
        out (5),a
        nop
        nop
        im 1
        di
        out (16h),a
        ld a,1
        out (5),a
        dec a
        nop
        nop
        im 1
        di
        out (16h),a
        ret
resetExecPermissionsEnd:
VerifyEmptyData:
        ld a,(hl)
        inc a
        ret nz
        inc hl
        dec bc
        ld a,b
        or c
        jr nz,VerifyEmptyData
        ret

newOSHeader:
        .db 80h,0Fh,00h,00h,00h,00h
        .db 80h,11h,04h
        .db 80h,21h
newOSHeaderMajor:
        .db 01
        .db 80h,31h
newOSHeaderMinor:
        .db 19
        .db 80h,0A1h,00h
        .db 80h,81h,14
        .db 80h,7Fh
newOSHeaderEnd:

bcallStart:
        ld (9C87h),a
        in a,(6)
        push af
        ld a,1Fh
        push hl
        out (6),a
        ld l,(ix+0)
        ld h,(ix+1)
        push hl
        pop ix
        pop hl
        ld a,(9C87h)
        call jpIX
        ld (9C87h),a
        pop af
        out (6),a
        ld a,(9C87h)
        ret
jpIX:   jp (ix)
bcallEnd:

copyPages:
;Copy C pages from A to B
        push af
        push bc
        ld hl,4000h
        ld d,h
        ld e,l
        ld (asm_ram),bc
        ld (asm_ram),a
copyPage:
;Copy page A to B
        bit 7,h
        jr nz,copyPageDone
        push hl
        push de
        ld a,(asm_ram)
        ld ix,_LoadAIndPaged-4000h
        call appBackUpScreen
        pop de
        push de
        ld b,a
        ld a,(asm_ram+1)
        ld ix,_WriteAByte-4000h
        call appBackUpScreen
        pop de
        pop hl
        inc hl
        inc de
        jr copyPage
copyPageDone:
        pop bc
        pop af
        inc a
        inc b
        dec c
        jr nz,copyPages
        ret

UnlockFlash:
;Unlocks Flash protection.
;Destroys: appBackUpScreen
;          pagedCount
;          pagedGetPtr
;          arcInfo
;          iMathPtr5
;          pagedBuf
;          ramCode
        in a,(6)
        push af
        ld a,7Bh
        call translatePage
        out (6),a
        ld hl,5092h
        ld e,(hl)
        inc hl
        ld d,(hl)
        inc hl
        ld a,(hl)
        call translatePage
        out (6),a
        ex de,hl
        ld a,0CCh
        ld bc,0FFFFh
        cpir
        ld e,(hl)
        inc hl
        ld d,(hl)
        push de
        pop ix
        ld hl,9898h
        ld (hl),0C3h
        inc hl
        ld (hl),returnPoint & 11111111b
        inc hl
        ld (hl),returnPoint >> 8
        ld hl,pagedBuf
        ld (hl),98h
        ld de,pagedBuf+1
        ld bc,49
        ldir
        ld (iMathPtr5),sp
        ld hl,(iMathPtr5)
        ld de,9A00h
        ld bc,50
        ldir   
        ld de,(iMathPtr5)
        ld hl,-16
        add hl,de
        ld (iMathPtr5),hl
        ld iy,0056h-25h
        ld a,50
        ld (pagedCount),a
        ld a,8
        ld (arcInfo),a
        jp (ix)
translatePage:
        ld b,a
        in a,(2)
        and 80h
        jr z,_is83P
        in a,(21h)
        and 3
        ld a,b
        ret nz
        and 3Fh
        ret
_is83P: ld a,b
        and 1Fh
        ret
returnPoint:
        ld iy,flags
        ld hl,(iMathPtr5)
        ld de,16
        add hl,de
        ld sp,hl
        ex de,hl
        ld hl,9A00h
        ld bc,50
        ldir
        pop af
        out (6),a
        ret
.end
end