copy. Now the protection scheme will look for our relocated data on
      track/sector 18/18 ($12/$12), load it in, and continue on its merry
      way. After you copy sides B through D of MBTT using any nybbler
      (tracks 1 through 35) you'll have a fully functional, unprotected
      backup of your valued typing tutor.
      
      
      
      < < < CAPCOM : 1942 V2 & GHOSTS & GOBLINS > > >
      
      It was quite a surprise when CAPCOM released these titles using
      a protection scheme other than RapidLok. This scheme is as
      different from RapidLok as it is easy to trace and defeat. Please
      note that both programs are identical in their protection check
      routines except as noted.
      
      You will need the following:

         1) An original "1942" or "Ghosts & Goblins" diskette.
         
         2) A backup copy of both sides of 1942 or Ghosts & Goblins using
            our "C-64 Fast Copier".

         3) A disk log of the 1942 or Ghosts & Goblins disk to get the
            load addresses.
            
      One thing is obvious when you boot the copy of these programs:
      they check protection immediately! Load the $8000 Kracker-Mon then
      the boot file "1942 or GHOSTS & GOBLINS". They load from $02BB-
      $0305. The BASIC cold/warm start vectors at $0300/$0302 show the
      entry point to be $02D6. The boot file loads the "1.0" file, then
      jumps to $CC00.

      Load "1.0", which resides from $C900 - $D000. The entry point at
      $CC00 JMPs to $CC71, which calls a subroutine at $C900. This
      subroutine sends protection check code to the drive. If you look at
      memory in the range $CA00 - $CAFF, you will see numerous BACKWARDS
      "Memory-Write" (M-W) commands. The drive code is at $CA8D. This
      code looks for some special bytes on the disk and stores them in
      drive memory. When its finished, the computer Memory-Reads them
      into memory and stores them.
      
      Disassemble the code from $C900 and keep scrolling down to
      $C9E0. This is the M-R routine. At $C9EC, it reads in 3 bytes and
      over-writes them into $CA87 - $CA89. It checks $CA87 for a zero
      value. If it's zero, the protection fails. If not, it reads 2 more
      bytes into $CA8A - $CA8B. At $CA36, the weak point in this
      protection scheme becomes readily apparent. It checks the 5 bytes
      from the drive for specific values. It even shows us the values! If
      all the values are correct, it stores an $FF at $CFFF. Lets store

            K.J. REVEALED TRILOGY    PAGE [129]    (C)1990 K.J.P.B.