--- BasiliskII/src/rom_patches.cpp	2000/08/20 14:08:40	1.16
+++ BasiliskII/src/rom_patches.cpp	2000/10/09 17:45:58	1.18
@@ -54,6 +54,17 @@ uint16 ROMVersion;
 
 
 /*
+ *	Convenience functions for retrieving a particular 16-bit word from
+ *	a 32-bit word value.
+ *	
+ *	gb-- probably put those elsewhere...
+ */
+
+#define HiWord(X) (((X) >> 16) & 0xffff)
+#define LoWord(X) ((X) & 0xffff)
+
+
+/*
  *  Search ROM for byte string, return ROM offset (or 0)
  */
 
@@ -818,8 +829,8 @@ bool CheckROM(void)
 	// Read version
 	ROMVersion = ntohs(*(uint16 *)(ROMBaseHost + 8));
 
-#if REAL_ADDRESSING
-	// Real addressing mode requires a 32-bit clean ROM
+#if REAL_ADDRESSING || DIRECT_ADDRESSING
+	// Real and direct addressing modes require a 32-bit clean ROM
 	return ROMVersion == ROM_VERSION_32;
 #else
 	// Virtual addressing mode works with 32-bit clean Mac II ROMs and Classic ROMs
@@ -1221,19 +1232,22 @@ static bool patch_rom_32(void)
 
 #if REAL_ADDRESSING
 	// Move system zone to start of Mac RAM
-	lp = (uint32 *)(ROMBaseHost + 0x50a);
-	*lp++ = htonl(RAMBaseMac);
-	*lp = htonl(RAMBaseMac + 0x1800);
+	wp = (uint16 *)(ROMBaseHost + 0x50a);
+	*wp++ = htons(HiWord(RAMBaseMac + 0x2000));
+	*wp++ = htons(LoWord(RAMBaseMac + 0x2000));
+	*wp++ = htons(HiWord(RAMBaseMac + 0x3800));
+	*wp = htons(LoWord(RAMBaseMac + 0x3800));
 #endif
 
 #if !ROM_IS_WRITE_PROTECTED
-#if defined(AMIGA)
+#if defined(USE_SCRATCHMEM_SUBTERFUGE)
 	// Set fake handle at 0x0000 to scratch memory area (so broken Mac programs won't write into Mac ROM)
-	extern uint32 ScratchMem;
+	extern uint8 *ScratchMem;
+	const uint32 ScratchMemBase = Host2MacAddr(ScratchMem);
 	wp = (uint16 *)(ROMBaseHost + 0xccaa);
 	*wp++ = htons(0x203c);			// move.l	#ScratchMem,d0
-	*wp++ = htons(ScratchMem >> 16);
-	*wp = htons(ScratchMem);
+	*wp++ = htons(ScratchMemBase >> 16);
+	*wp = htons(ScratchMemBase);
 #else
 #error System specific handling for writable ROM is required here
 #endif
@@ -1245,7 +1259,14 @@ static bool patch_rom_32(void)
 	*wp++ = htons(M68K_NOP);
 	*wp = htons(M68K_NOP);
 #endif
-
+	
+#if REAL_ADDRESSING && !defined(AMIGA)
+	// gb-- Temporary hack to get rid of crashes in Speedometer
+	wp = (uint16 *)(ROMBaseHost + 0xdba2);
+	if (ntohs(*wp) == 0x662c)		// bne.b	#$2c
+		*wp = htons(0x602c);		// bra.b	#$2c
+#endif
+	
 	// Don't write to VIA in InitTimeMgr
 	wp = (uint16 *)(ROMBaseHost + 0xb0e2);
 	*wp++ = htons(0x4cdf);			// movem.l	(sp)+,d0-d5/a0-a4
@@ -1441,12 +1462,14 @@ static bool patch_rom_32(void)
 	if (ROMSize > 0x80000) {
 
 		// BlockMove()
-		static const uint8 ptest_dat[] = {0xa0, 0x8d, 0x0c, 0x81, 0x00, 0x00, 0x0c, 0x00, 0x6d, 0x06, 0x4e, 0x71, 0xf4, 0xf8};
-		base = find_rom_data(0x87000, 0x87800, ptest_dat, sizeof(ptest_dat));
-		D(bug("ptest %08lx\n", base));
+		static const uint8 bmove_dat[] = {0x20, 0x5f, 0x22, 0x5f, 0x0c, 0x38, 0x00, 0x04, 0x01, 0x2f};
+		base = find_rom_data(0x87000, 0x87800, bmove_dat, sizeof(bmove_dat));
+		D(bug("block_move %08lx\n", base));
 		if (base) {		// ROM15/22/23/26/27/32
-			wp = (uint16 *)(ROMBaseHost + base + 8);
-			*wp = htons(M68K_NOP);
+			wp = (uint16 *)(ROMBaseHost + base + 4);
+			*wp++ = htons(M68K_EMUL_OP_BLOCK_MOVE);
+			*wp++ = htons(0x7000);
+			*wp = htons(M68K_RTS);
 		}
 
 		// SANE
@@ -1578,14 +1601,6 @@ static bool patch_rom_32(void)
 	*wp++ = htons(base >> 16);
 	*wp = htons(base & 0xffff);
 
-#if EMULATED_68K
-	// Replace BlockMove()
-	wp = (uint16 *)(ROMBaseHost + find_rom_trap(0xa02e));	// BlockMove()
-	*wp++ = htons(M68K_EMUL_OP_BLOCK_MOVE);
-	*wp++ = htons(0x7000);
-	*wp = htons(M68K_RTS);
-#endif
-
 	// Look for double PACK 4 resources
 	if ((base = find_rom_resource(FOURCC('P','A','C','K'), 4)) == 0) return false;
 	if ((base = find_rom_resource(FOURCC('P','A','C','K'), 4, true)) == 0 && FPUType == 0)