the $FF ourselves and see what happens. Change the code at $CA31
to read:
A CA31 LDA #$FF
CA33 STA $CFFF
CA36 RTS
Now execute the loader (G CC00). It should load. In fact, if you
return to the subroutine call at $CC71, you can see where it checks
the value of $CFFF. If it doesn't match, it goes into an endless
loop. You could change the JMP $CC71 at $CC00 to JMP $CC79 for a
one-byte break ($71 = $79)! Use the File Tracer utility to make any
of these changes to your backup copy for a completely un-protected
backup.
< < < EPYX : L.A. CRACKDOWN > > >
"L.A. Crackdown" represents state of the art disk protection
caught with its pants down. It is uncopyable with software
nybblers, but it CAN be had with a little persistence and
ingenuity.
You will need the following:
1) An original "L.A. Crackdown" (LAC) diskette.
2) A backup copy of LAC using "C-64 Fast Copy".
3) A formatted blank work disk.
4) A printout or the results of an error-scan of both sides of
the original diskette.
Examining the disk maps show that side 2 is completely normal,
but tracks 1 - 5 and part of track 18 on side 1 are unreadable by
normal methods. A directory shows only 2 short files with 432
blocks free on the diskette. We know from our error-scan that there
are very few unused sectors on side 1. So where is the program
coming from? Use the file tracer to determine the files' beginning
and ending addresses. Boot MON1000, and let's examine these 2
files. The first file loads at $02A7 - $0304. Disassembly shows
that it does nothing more than load the second file, followed by a
JMP to $CA00.
Load the "(C) 1988 EPYX" file. It resides from $C74F - $CA19.
Disassemble from $CA00, which is the entry point. The first few
instructions do some initialization of the system, followed by 2
K.J. REVEALED TRILOGY PAGE [130] (C)1990 K.J.P.B.
<<previous page -
next page>>