Originally back in the day, I had the idea of just rigging up some sort of hardware switch to swap in a changed OS (or just OS 0.1) just before hitting BREAK.
Seeing as though the gauntlet was thrown, I brought a copy of the Wizadore tape off ebay to have a stab at that protection...
Heres the bit after the timer decoding/checksumming done
E00 20 0C 0E .. JSR &0E0C .
E03 9D 0C 0E ... STA &0E0C,X .
E06 CA . DEX .
E07 D0 FA .. BNE &0E03 .
E09 4C 00 00 L.. JMP &0000 .
E0C A9 00 .. LDA #&00 (0) .
E0E A2 0F .. LDX #&0F (15) .
E10 9D A1 02 ... STA &02A1,X .paged ROM 0 type number
E13 CA . DEX .
E14 10 FA .. BPL &0E10 (>= signed) .
E16 E8 . INX .
E17 BD 39 0E .9. LDA &0E39,X .
E1A 95 00 .. STA &00,X .
E1C E8 . INX .
E1D E0 84 .. CPX #&84 (132=-124) .
E1F D0 F6 .. BNE &0E17 .
E21 A2 41 .A LDX #&41 (65) .
E23 BD BD 0E ... LDA &0EBD,X .
E26 9D 20 01 . . STA &0120,X .
E29 CA . DEX .
E2A 10 F7 .. BPL &0E23 (>= signed) .
E2C A9 CD .. LDA #&CD (205=-51) .
E2E 8D 04 02 ... STA &0204 .IRQ1V vector lo address
E31 A9 D9 .. LDA #&D9 (217=-39) .
E33 8D 05 02 ... STA &0205 .IRQ2V vector hi address
E36 85 FC .. STA &FC .interrupt Acc save register
E38 60 ` RTS .
E39 A9 03 .. LDA #&03 (3) .
E3B 85 F8 .. STA &F8 .
E3D 8D 08 FE ... STA &FE08 .6850 ACIA control register (write) status register (read)
E40 A9 05 .. LDA #&05 (5) .
E42 8D 10 FE ... STA &FE10 .serial ULA control register
E45 A2 FF .. LDX #&FF (255=-1) .
E47 CA . DEX .
E48 D0 FD .. BNE &0E47 .
E4A A9 85 .. LDA #&85 (133=-123) .
E4C 8D 10 FE ... STA &FE10 .serial ULA control register
E4F A9 D5 .. LDA #&D5 (213=-43) .
E51 8D 08 FE ... STA &FE08 .6850 ACIA control register (write) status register (read)
E54 AD 08 FE ... LDA &FE08 .6850 ACIA control register (write) status register (read)
E57 10 FB .. BPL &0E54 (>= signed) .
E59 A8 . TAY .
E5A 29 01 ). AND #&01 (1) .
E5C F0 F6 .. BEQ &0E54 .
E5E 98 . TYA .
E5F 29 70 )p AND #&70 (112) .
E61 F0 07 .. BEQ &0E6A .
E63 24 F8 $. BIT &F8 .
E65 10 ED .. BPL &0E54 (>= signed) .
E67 4C 20 01 L . JMP &0120 .
E6A AD 09 FE ... LDA &FE09 .6850 ACIA transmit/receive data register
E6D 49 B5 I. EOR #&B5 (181=-75) .
E6F 24 F8 $. BIT &F8 .
E71 30 08 0. BMI &0E7B (< signed) .(RTS)
E73 C9 CD .. CMP #&CD (205=-51) .
E75 D0 DD .. BNE &0E54 .
E77 85 F8 .. STA &F8 .
E79 F0 01 .. BEQ &0E7C .
E7B 60 ` RTS .
E7C A2 00 .. LDX #&00 (0) .
E7E 20 1B 00 .. JSR &001B .
E81 38 8 SEC .
E82 F5 7E .~ SBC &7E,X .
E84 55 78 Ux EOR &78,X .
E86 95 72 .r STA &72,X .
E88 E8 . INX .
E89 E0 06 .. CPX #&06 (6) .
E8B D0 F1 .. BNE &0E7E .
E8D A2 00 .. LDX #&00 (0) .
E8F 20 1B 00 .. JSR &001B .
E92 81 72 .r STA (&72,X) .
E94 E6 72 .r INC &72 .
E96 D0 02 .. BNE &0E9A .
E98 E6 73 .s INC &73 .
E9A A5 74 .t LDA &74 .
E9C D0 02 .. BNE &0EA0 .
E9E C6 75 .u DEC &75 .
EA0 C6 74 .t DEC &74 .
EA2 D0 EB .. BNE &0E8F .
EA4 A5 75 .u LDA &75 .
EA6 D0 E7 .. BNE &0E8F .
EA8 6C 76 00 lv. JMP (&0076) .
0EA0 ** ** ** ** ** ** ** ** ** ** ** 00 00 00 00 00 .....
0EB0 00 2D 9B 63 7A 46 67 6E F2 39 CD B3 ** ** ** ** .-.czFgn.9..
EBD A2 00 .. LDX #&00 (0) .
EBF 9D 00 04 ... STA &0400,X .
EC2 E8 . INX .
EC3 D0 FA .. BNE &0EBF .
EC5 EE 24 01 .$. INC &0124 .
EC8 10 F5 .. BPL &0EBF (>= signed) .
ECA 95 00 .. STA &00,X .
ECC E8 . INX .
ECD D0 FB .. BNE &0ECA .
ECF A9 3F .? LDA #&3F (63) .
ED1 8D 88 02 ... STA &0288 .OSBYTE &f8 value BREAK intercept code (address lsb)
ED4 A9 01 .. LDA #&01 (1) .
ED6 8D 89 02 ... STA &0289 .OSBYTE &f9 value BREAK intercept code (address msb)
ED9 6C FC FF l.. JMP (&FFFC) .6502 RESET entry lo
EDC 90 10 .. BCC &0EEE .(RTS)
EDE A2 00 .. LDX #&00 (0) .
EE0 8E 87 02 ... STX &0287 .OSBYTE &f7 value BREAK intercept code (opcode JMP usually)
EE3 BD 52 01 .R. LDA &0152,X .
EE6 F0 06 .. BEQ &0EEE .(RTS)
EE8 20 EE FF .. JSR &FFEE .OSWRCH output a character to the VDU stream
EEB E8 . INX .
EEC D0 F5 .. BNE &0EE3 .
EEE 60 ` RTS .
0EE0 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** 07 .
0EF0 4C 6F 61 64 20 45 72 72 6F 72 0D 0A 0A 00 F9 23 Load Error.....#