number to be corrupted. One way to repair it is as follows:
        Cursor to position 144 and type  for text mode. In this mode
        type COLOSSUS followed by shifted spaces  (decimal 160)  to
        position 162. Now type CHESS and hit RETURN. Write these changes
        to the backup by typing  followed by a . Lastly while at
        this sector hit  to go to the next sector in the directory.
        You'll find that it goes to Track 18/Sector 1. Continue hitting
        n to go to each linked sector in the directory. You'll find
        every sector to be normal with the last directory sector at
        Track 18) Sector 5. Now power down and load and check the
        directory. The file names should be present. Validate the disk
        and then using the disk logger, log the file addresses.

        2) With Hesmon in the cartridge port, load the boot file
        < L "Firebird",08 >. At the end of the load, Disassemble code at
        $02A7  and using the cursor down key, scroll down
        through memory. The code highlights are:

          A) D 02C6 : JSR FF90 (control load messages)

          B) D 02CF : JSR FFBA (set logical addresses)

          C) D 02D8 : JSR FFBD (set file name: 3 characters located at
                      $02C1. Use Interpret command to see  the
                      file name GM1.

          D) D 02F1 : JSR FFD5 (load into ram)

          E) D 02FD : JMP 0334 (Jump to location $0334.)

        3) We now know that the next file loaded in is GM1 and that the
        code at $0334 is the jump link. Load the GM1 file as
        < L "GM1",08 >. Notice that the code fills the screen. This is
        because it is loaded into screen memory. Cursor down and start
        disassembly of code at $0334.

          A) Disassemble code at $0334 . You'll find a jump to
             $034B. Cursor down and inspect the code from $034B-$036B.
             This code represents the key to the protection.
             This particular code can be found in many similar titles
             and the break for all is about the same. This code sets up
             a load of the actual protection check code within the GMA3
             file. (Those of you interested in the drive code for the
             protection should load and inspect GMA3.) A JSR to $C800
             within this code checks protection, and if the check is
             successful, a value of $97 is place at computer location
             $0002. Upon return from the JSR C800, the value in
             location $0002 is loaded into the accumulator and EORed
             with a value of $97. Lastly the code Branches if Equal
             (to 0) to $036C. Remember, if protection WAS satisfied, a
             value of $97 was placed at $0002. The EOR Truth Table in
             the back of the book tells us that $97 EORed with


            K.J. REVEALED TRILOGY    PAGE [69]     (C)1990 K.J.P.B.