diff --git a/Qcommon.c b/Qcommon.c
index f08e752..3689294 100644
--- a/Qcommon.c
+++ b/Qcommon.c
@@ -27,12 +27,23 @@ void serial_write_char(char c)
 	outb(COM1_BASE_PORT, c);
 }
 
+void serial_write(const char *msg)
+{
+	for (const char *c = msg; *c; c++) {
+		outb(0xE9, *c);
+		//serial_write_char(*c);
+	}
+}
+
+extern void writechar();
+
 void
 main()
 {
-	outb(0xE9, 'X');
-	serial_write_char('X');
+	serial_write("init\r\n");
+	writechar();
+	serial_write("foo\r\n");
 	for (;;) {
-		__asm__ ("hlt" :);
+		//__asm__ ("hlt" :);
 	}
 }
diff --git a/Rnbp.S b/Rnbp.S
index 15ae2c3..b534e48 100644
--- a/Rnbp.S
+++ b/Rnbp.S
@@ -1,16 +1,65 @@
             // vim: et:sw=12:ts=12:sts=12
 
             .global     _start
-            .text
-            .code16
 
             .set        SS_CODE16,  0x08
             .set        SS_DATA16,  0x10
             .set        SS_CODE32,  0x18
             .set        SS_DATA32,  0x20
 
+
+
+.macro      PROT16
+            .code32
+            mov         $SS_DATA16, %ax
+            mov         %ax, %ds
+            mov         %ax, %ss
+            ljmp        $SS_CODE16, $9f
+9:          .code16
+.endm
+
+.macro      PROT32
+            .code16
+            mov         $SS_DATA32, %ax
+            mov         %ax, %ds
+            mov         %ax, %ss
+            ljmp        $SS_CODE32, $9f
+9:          .code32
+.endm
+
+.macro      REAL
+            mov         %cr0, %eax
+            and         $0xFFFE, %ax
+            mov         %eax, %cr0
+            xor         %ax, %ax
+            mov         %ax, %ds
+            mov         %ax, %es
+            mov         real_ss, %ax
+            mov         %ax, %ss
+            shl         $4, %eax
+            sub         %eax, %esp
+            ljmp        $0x0000, $9f
+9:
+.endm
+
+.macro      PROT
+            mov         %cr0, %eax
+            or          $1, %eax
+            mov         %eax, %cr0
+            xor         %eax, %eax
+            mov         $SS_DATA16, %ax
+            mov         %ax, %ds
+            mov         %ax, %es
+            mov         %ax, %ss
+            mov         real_ss, %ax
+            shl         $4, %eax
+            add         %eax, %esp
+.endm
             
 
+
+            .text
+            .code16
             // _start: entry point
 _start:     cli
             cld
@@ -19,10 +68,18 @@ _start:     cli
             mov         %ax, %ds
             mov         %ax, %es
 
+            mov         %ss, %ax
+            mov         %ax, real_ss
+
             push        $msg_start
             call        dbgmsg
             add         $2, %sp
 
+            xor         %bx, %bx
+            mov         $0x0E, %ah
+            mov         $'B', %al
+            int         $0x10
+
             // initialize our own BSS section
             mov         $_bss_start, %di
             mov         $_bss_end, %cx
@@ -52,29 +109,10 @@ prot_enter:
 
             lgdt        GDT_PTR
 
-            // Set Protection Enable (PE) bit
-            mov         %cr0, %eax
-            or          $1, %al
-            mov         %eax, %cr0
-
-            ljmp        $SS_CODE32, $prot_trampo
+            PROT
+            PROT32
 
             .code32
-prot_trampo:
-            mov         $SS_DATA32, %eax
-            mov         %eax, %ds
-            mov         %eax, %es
-            mov         %eax, %fs
-            mov         %eax, %gs
-            mov         %eax, %ss
-
-            mov         'Y', %al
-            outb        %al, $0xE9
-
-            // TODO load proper stack pointer
-            mov         $0x90000, %ebp
-            mov         %ebp, %esp
-
             jmp         main
 
             .code16
@@ -95,8 +133,34 @@ dbgmsg:     push        %bp
             pop         %bp
             ret
 
+            .global     writechar
+            .code32
+writechar:  push        %ebp
+            mov         %esp, %ebp
+            push        %ebx
+
+            PROT16
+            .code16
+            REAL
+
+            xor         %bx, %bx
+            mov         $0x0E, %ah
+            mov         $'A', %al
+            int         $0x10
+
+            PROT
+            PROT32
+            .code32
+
+            pop         %ebx
+            mov         %ebp, %esp
+            pop         %ebp
+            ret
+
             .data
 
+real_ss:    .word       0
+
             .global     GDT
 
 GDT:        // entry 0: null descriptor