sector on your backup copy, editing the data block so that it
      contains the $73 byte at position $146, and then writing the 
      sector back to the backup copy. This duplicates the physical disk
      protection on the backup.
      
      If you want to completely disable the protection check, reload
      drivemon and read track/sector $12/$04 (18/04) into drive buffer
      $0600. Enter the following:
      
         A 06DF CPY #$02   ;this was "CPY #$0A"
           06E1 BEQ $06E6  ;this was "BNE $06A2"
   
      This "patch" will let the code execute normally but exit at the
      proper time with the correct value in .Y (2). Write the sector to
      your backup copy and you'll have a completely unprotected backup!
      
      Note: This same patch will have to be applied to each WWF
      "Match" diskette because the drive code in track/sectors $12/$03
      and $12/$04 is present on each of these releases - including SIDE 
      2 of the "Game" diskette.
      
      
      
      < < < SOFTWARE TOOLWORKS : MAVIS BEACON > > >
      
      "Mavis Beacon Teaches Typing" (MBTT) is another in a class of
      protection schemes that depends upon a sector of data located on a
      non-standard track. The mechanism is simple: critical data is
      placed on a track that is not used by standard DOS (36 - 40). A
      routine is called to read in the sector and transmit the data to
      the computer. Without this data the program will either crash or
      function improperly - sometimes in very subtle ways.

      Before proceeding, use any good nybbler to copy side A, tracks 1
      through 36 of an original copy of MBTT. Then use the provided File
      Logger to determine the start and end addresses of the files on
      MBTT Side A and error scan it to get an error map of the original.
      Try to boot your backup copy. It will fail, due to some subtle,
      deliberate alterations to track 36.
      
      The error map shows us that valid sectors ARE present on track
      36. The next step is to find the code that reads that track. Lets
      look at the auto-boot file. Load the $2000 monitor then insert your
      backup copy of MBTT and load "MAVIS". The file resides from $032C
      to $0400. The first 2 bytes are the KERNAL "close all files" vector
      (CLALL), which now contain $34 and $03. This is the entry point of
      the auto-booter ($0334). Analysis of this code at $0334 reveals
      that a series of Block-Reads are made of track 35 (the "U1" command
      text is located at $03D6) then a JMP to $0F00 at $03C5 continues
      the loading process.

            K.J. REVEALED TRILOGY    PAGE [127]    (C)1990 K.J.P.B.