directory data. Most important: when tracing the program through
         it's loading process, you will generally run into a decryption
         routine and a sector or two of encrypted code.

         When this encryption is located, you can be sure it is hiding the
         protection check code.

         Remember, I stated that a sector or two in memory will be
         encrypted, and that this area in memory surely contained
         the protection check. Well, one other thing needs to be
         mentioned.

         This is the fact that this encrypted memory starts out as garbled
         code, then decrypts into a protection check routine and finally
         after the protection check has been satisfied, is REPLACED with
         valid program code. This code, as previously stated, is one or two
         sectors in length and can be found anywhere on the program disk.
         You'll find that the directory track (track 18) is the most likely
         spot. In most cases, we can let the program insert the hidden code
         in it's proper place. Then a memory save and replacement over the
         encrypted code in the proper file will not only defeat protection
         but will totally remove the check for it.

         Most of the programs protected with this scheme can be
         defeated with a simple memory save, but a few have had to
         have some of the code re-written by hand. This is
         relatively uncommon and cannot be explained in the scope
         of this manual.

         Experience will prove to be the best teacher.

         Before starting to work on the following programs, please
         do a disk file log (print out is best), format a blank
         work disk, and have a (non-working) backup available.
         Please make sure you have a write protect tab on your
         original program disk as you will be using  it in the
         breaking process.  Now  let's  get on to the specifics.



         INFILTRATOR : MINDSCAPE

         Procedure:

         Loading the original produces a rattle free load, and an
         error scan shows no standard errors. A backup made with
         the C-64 Fast Copier provides a non-working backup. Nybble
         utilities also provide a non-working backup. Loading the
         backup results in a load that stalls rather quickly. We
         can assume the protection is in the loader file. Before
         starting to work on this title, please make a backup and a
         disk log (printout is best).

         Working with your original:

         1) Place a write protect tab on your original to 
         protect it during the breaking process.

            K.J. REVEALED TRILOGY    PAGE [51]     (C)1990 K.J.P.B.