A while ago when I was making my boot code 1.03 exploit, I was looking through the app security code when I found absolutely horrendous code. The whole system of app trials appears to be written by someone who has been programming z80 for less than a week. The worst part though is that this person was assigned to write code that protects paid apps and is run on a privileged page. But of all the app trials code, this one routine just sticks out as the worst TI code I've ever seen.

Here it is in it's entirety:
transformA:
push bc
ld c, 11h
sub c
jp nc, loc_4F03
or a
adc a, c
cp 0
jr z, loc_4F03
cp 1
jr z, loc_4F03
ld b, a
dec b
ld a, 2

loc_4EFA:
sla a
djnz loc_4EFA
ld b, 1
sub b
jr loc_4F05

loc_4F03:
ld a, 0

loc_4F05:
pop bc
ret

First off, what is the purpose of this routine? It is a really complicated way to calculate the number of trials an app should have, I'll show the code that calls it at the end. But let's try to figure out what this routine does. (To be honest, I didn't figure it out until just now.)

The expected results are given by this table:
if A = 0-16  result = 2^A - 1
if A >= 17  result = 0

However, since the result is returned in A, the real table is:
if A = 0-8  result = 2^A - 1
if A >= 9-16  result = 255
if A >= 17  result = 0


Now, let's break this down and see where they went so wrong.

transformA:
push bc
ld c, 11h
sub c
jp nc, loc_4F03
or a
adc a, c

When you see this, your expected response should be "wtf." What are they doing? First off, why don't they just do CP 11h \ JR NC, loc_4F03? Then, why do they use ADC? I honestly believe the person who wrote this code didn't know that ADD existed.

cp 0
jr z, loc_4F03
cp 1
jr z, loc_4F03
ld b, a
dec b
ld a, 2

Again, horrible. CP 0 is a no. CP 1 is acceptable, but DEC A is preferred. And would you look at that, they DEC A anyways!

loc_4EFA:
sla a
djnz loc_4EFA
ld b, 1
sub b
jr loc_4F05

They actually did the loop correct, which is a surprise. But what on earth are they doing at the end. Again, I don't think this programmer knew that you are allowed to do actions to A, like ADD and SUB. But the worst part is that they could have used DEC A, but what really sets this apart is that they have already used DEC once! It's not like they didn't know it existed.

loc_4F03:
ld a, 0

loc_4F05:
pop bc
ret

They finally wrap it up with this. XOR A would be preferred, but the programmer probably didn't know what XOR does.

For comparison, here's how the routine should look:
transformA:
or a
ret z
cp 11h
jr c, notOver17
xor a
ret
notOver17:
ld b, a ;b is trash anyways
ld a, 1
shiftLoop:
add a, a
djnz shiftLoop
dec a
ret

Ok, but it doesn't stop there, here's the code that calls it.

call getCertByte

loc_4E55:
push af
ld b, 9
sub b
jr c, loc_4E6B
pop af
ld b, 8
sub b
call transfromA
ld d, a
ld a, 8
call transformA
ld e, a
jr loc_4E72

loc_4E6B:
ld d, 0
pop af
call transformA
ld e, a

loc_4E72:

It should be noted that LD A, 8 \ CALL transformA is the equivalent of LD A, 255.


Well, I hope you enjoyed that. Hopefully this will help to explain the dislike of TI that the more advanced assembly programmers share. It is code like this that causes Err:Version and Err:Bad Address, and the OS is full of it.

Edit:
   Hey, what an awesome post to be number 1000.

Yeah, it's pretty obvious that the security code was written by one or more other people, probably with a stronger background in security than Z80 coding.

I've gone nuts more than a few times over disassembling some of this stuff, but I started to realize that perhaps I'm nitpicking a little bit. We're heavily analyzing code that was probably done in a hurry 15 years ago.

wows, even i can see what's going wrong there.
brandonw does have a point, but they should have at least looked back through it afterwards and cleaned it up.

Er...
It's not really about the code (which I don't understand - I don't know ASM)
But what do you mean with paid apps??
So It should protect apps for which you've paid??? Why should I pay for an app? I can get everything for free, I want to have!!
And it should protect the apps. But, of what?? Of archieve-clears??? Of editing them???

TI originally designed a whole system for app signing, where you could either sign it with a free key and distribute it freely... or you could sell your app, but in order to do that you would need to buy an a key to sign it with from TI. Frankly, I don't think TI ever sold ever more than 2 of those keys tops...
As you may have deduced, everyone here uses the free key. (And yes, you CAN get everything good for free. ^_^)

Another thing, sla a should probably be add a,a (and like you said, the programmer probably didn't know about add )

Good call

Most of the stuff here is stuff anyone would do if they had little experience,...

but still: only TI does 'or   a \ adc   a, c'. Everyone that knows what a z80 is uses 'add a, c'.