Ok, looking through the 83+-specific code:
        ex de, hl    ;HL is too close to SP
        ld (hl), b    ;b is zero
    ld a, $1F
     jr c, notLocking
    ld (hl), a        ;should be $0F
notLocking:
    dec    hl
    out    (06), a
    out    (05), a        ;should be 7
    call    $46D8        ;hack, works on 1.00 and 1.01It seems like there are a couple shortcuts taken, for example instead of outputting $7 to port 05 they send $1F to both port 05 and 06, i assume the upper bits of port 05 are unused? Then it runs the 84+ code? I'm also not sure how we get back to "returnPoint". I've really got no idea what's going on in the unlock flash section, is the size of the routine taken into consideration? I tried adding some extra code to debug it but it caused weird stuff to happen when exiting. I see that some stuff ($8214-$8167 bytes) is getting LDDR'd into $8214, though i'm not sure where all these numbers come from. The code getting copied stretches into the main program code (ie. beyond Fullrene).