TRIPWIRE

; TRIPWIRE: a PATCH job. The key check itself is correct, but a hidden tripwire
; rides alongside it: a counter ticks once per pass and a detonation guard at the
; end rejects the verdict if that counter is anything but zero. The real key
; clears every content check and is then nuked by the tripwire. Only the marked
; tick line (label "fuse") is yours to edit; the detonation guard and the verdict
; are frozen, so you cannot reach the verdict by force, you have to DISARM the
; counter so it never arms.
;
; The real key is FUSE7. The tripwire loop runs exactly five times, so the counter
; ends at five times the per-tick step. Five is coprime to the byte modulus, so
; the only step that leaves the counter at zero is a step of zero.
;
; r0 = 1 on accept; rule: nonzero. SHIPPED step is 1: the counter reaches 5, the
; detonation guard sees nonzero, and the real key is rejected.

        len   r2
        cmp   r2, 5
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x46      ; 'F'
        jnz   bad
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x55      ; 'U'
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x53      ; 'S'
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x45      ; 'E'
        jnz   bad
        mov   r7, 4
        ldb   r0, [r7]
        cmp   r0, 0x37      ; '7'
        jnz   bad

        ; hidden tripwire: ticks once per pass, must end at zero
        mov   r6, 0
        mov   r7, 0
tloop:  cmp   r7, 5
        jge   tdone
fuse:   add   r6, 1         ; SHIPPED BROKEN: ticks the counter -> want a step of 0
        inc   r7
        jmp   tloop
tdone:  cmp   r6, 0         ; detonation guard: nonzero counter rejects
        jnz   bad

        mov   r0, 1
        ret
bad:    mov   r0, 0
        ret