You'll find that it goes to Track 18/Sector 4. At Track
         18/Sector 4 you'll find no directory entries. The correct path
         is to Track 18/Sector 1 so go back to Track 18/Sector 0
         and change the first two bytes from rd to ra or 18 1 in decimal.
         Use the @ key to make each change and be sure to rewrite your
         changes to the backup. Now power down and load and check the
         directory. The file names should be present. Validate the disk
         and then using the disk logger, log the file addresses.

         2) With Hesmon in the cartridge port, load the boot file
         < L "B",08 >. At the end of the load, Disassemble code at $02A7
          and using the cursor down key, scroll down through
         memory. The code highlights are:

           A) D 02C6 : JSR FF90 (control load messages)
           B) D 02CF : JSR FFBA (set logical addresses)
           C) D 02D8 : JSR FFBD (set file name:3 characters located at
               $02C1 : Use I command to see [I 02C1] the file name GM1.
           D) D 02F1 : JSR FFD5 (load into ram)
           E) D 02FD : JMP C000 (Jump to location $C000.)

        3) We now know that the next file loaded in is GM1 and that the
        code at $C000 is the jump link. Load the GM1 file as
        < L "GM1",08 >. Start disassembly of code at $C000.

        A) Let's execute the code at $C000 and see what happens. Type
           [G C000]. Notice the beginning screen comes up and asks for y
           or n for fast loader. Type n and listen. A short load takes
           place and the head swings out. The drive will be locked up.
           Power down and up again, type X to return to basic and
           initialize your drive. When the drive stops, hit
           RUNSTOP/RESTORE to return to the monitor.

        B) Again load the GM1 file as before and start Disassembling
           code at $C0000 < D C000 >. Cursor down through the code to
           $C024. Here you'll find a JSR C800. This is the actual
           protection check routine. Notice the next instruction is a
           PHA which places the numeric value returned from the
           protection check on the stack. This value is the key to this
           protection scheme.

        C) Make sure you place a write protect on the ORIGINAL Artist 64
           and place it into the drive. Using the Memory Command, change
           the PHA(48) at $C027 to a BRK(00) . We can now
           execute the protection code from the original and the value
           in the left in the A register when the code breaks will be
           the numeric value we're looking for. Execute the code by
           typing < G C000 >.

        D) The opening screen will again appear and input N again and


            K.J. REVEALED TRILOGY    PAGE [67]     (C)1990 K.J.P.B.