💾 Archived View for mirrors.apple2.org.za › archive › www.textfiles.com › apple › CRACKING › krackcy… captured on 2023-01-29 at 11:42:51.

View Raw

More Information

-=-=-=-=-=-=-

1


    WELCOME TO THE FIRST IN A SERIES OF TECHNICAL DISCUSSIONS ON THE USES AND ABUSES OF COPY PROTECTION TECHNIQUES. YOUR HOST IS KRAKOWICZ, BASED IN NEW YORK AND DEDICATED TO THE PROPOSITION THAT ALL MEN ARE EQUALLY ENTITLED TO THE KNOWLEDGE AND ENJOYMENT OF COMPUTERS AND SOFTWARE.  THIS SECTION OF THE BOARD IS INTENDED TO PROVIDE INFORMATION AND TO STIMULATE DIALOG AMONG THE INTERNATIONAL BROTHERHOOD OF SOFTWARE CRACKISTS.  THE MANAGEMENT OF THIS SYSTEM, AS WELL AS YOUR HOST, CERTAINLY DO NOT ADVOCATE OR ADVISE ANY ILLEGAL ACTS, AND ALL INFORMATION PRESENTED HERE IS INTENDED TO EDUCATE, INFORM, OR AMUSE THOSE WHO READ IT.
   
THAT'S ENOUGH SERIOUS CRAP, NOW LET'S HAVE SOME FUN. SIRIUS SOFTWARE, IN THEIR LATEST RELEASE (MINOTAUR, BANDITS , FLY WARS, CYCLOD, ETC) HAS RAISED THE SCIENCE OF COPY PROTECTION TO NEW HEIGHTS.  AS YOU KNOW, MOST DISKS THAT DO A LOT OF DISK ACCESSING ARE NOT  EASILY CRACKED, AND MOST PEOPLE WORK VERY HARD DEVELOPING PARMS FOR THE  POPULAR BACKUP PROGRAMS.  BECAUSE OF TH E TECHNIQUES USED BY SIRIUS, IT IS DOUBTFUL THAT ANY OF THE PRESENTLY AVAILABLE COPIERS WILL BE SUCCESSFUL, AND NEW EFFORT MUST BE FOCUSED ON THE CRACKING OF THESE PROGRAMS.
   
(PLEASE DON'T BE ALARMED IF THE TERMS USED HERE ARE UNFAMILIAR TO YOU - WE WILL BE DOING MANY OF THESE IN THE  FUTURE, AND YOU'LL HAVE A CHANCE TO GET USED TO THE TECHNIQUES AND JARGON AS WE GO ALONG).  THIS DISCUSSION  ASSUMES A BASIC KNOWLEDGE OF CRACKING TECHNIQUES - MEMORY MOVES, PROBABLE STARTING LOCATIONS, EXCLUSIVE-ORING TO HIDE SENSITIVE CODE, ETC, AND A  GOOD WORKING KNOWLEDGE OF A SECTOR EDITOR.  MY FAVORITE IS THE INSPECTOR, BUT THE ONE IN NIBBLES AWAY II ALSO HAS SOME NICE FEATURES.  HAVING THE INSPECTOR IN ROM IS JUST ABOUT A  NECESSITY FOR TODAY'S SOFTWARE ARTIST, ANYWAY.  ALL ADDRESSES ARE GIVEN IN HEXADECIMAL, WITH BINARY OR DECIMAL EQUIVALENTS AS REQUIRED.
   
THE LISTINGS BELOW WERE EXTRACTED FROM CYCLOD, BUT ARE VIRTUALLY THE SAME FOR ALL OF THE NEW SIRIUS PROGRAMS.  IF YOU CAN GET YOUR HANDS ON AN ORIGINAL, YOU WILL BE ABLE TO EXPERIMENT WITH SOME OF THE TIPS GIVEN HERE AND LEARN CONSIDERABLY MORE.
   
THE FIRST PROTECTION DEVICE BEING USED, AND ONE OF THE OLDEST, IS LOADING A  CRUCIAL PART OF THE PROGRAM ACROSS THE TEXT SCREEN MEMORY FROM 400-7FF, SO  IT WILL SCROLL THE TOP LINE OFF THE  SCREEN WHEN YOU HIT RESET.  THE PART LOADED THERE ON THESE PROGRAMS IS ONE WE WILL CALL 'LOADER', SINCE IT ACTS AS THE SUBSTITUTE 'DOS' FOR ALL DISK ACCESSES.  (IF YOU HAVE AN ORIGINAL, NOW IS THE TIME TO COPY TRACK 0 ONTO A BLANK DISKETTE USING YOUR FAVORITE COPIER - ALMOST ANY WILL GET IT. ALL FUTURE REFERENCES TO THE DISK ARE FOR THE SINGLE TRACK YOU JUST COPIED -  DON'T TAKE A CHANCE WITH THE ORIGINAL). TO GET A LOOK AT THIS LOADER, HOWEVER, WE HAVE TO GO BACK TO THE FUNDAMENTALS OF THE APPLE DISK SYSTEM.  REMEMBER  TRACK 0, SECTOR 0 OF EVERY DISK MUST ALWAYS, ALWAYS BE READABLE BY THE BOOT ROM, AND MORE OR LESS BY MOST SECTOR EDITORS.  READ T0,S0 INTO LOCATION 800 UP, AND FROM THE MONITOR TYPE IN '801L' (RECALL THAT LOCATION 800 IS USED TO  TELL THE BOOT ROM HOW MANY PAGES TO  LOAD IN) TO LIST THIS 'PRELOADER'. THE LISTING BELOW IS A REGULAR MONITOR DISASSEMBLY OF ALL THE MEANINGFUL CODE.
0801-   AD 52 C0    LDA   $C052
0804-   AD 57 C0    LDA   $C057   
0807-   AD 55 C0    LDA   $C055   
080A-   AD 50 C0    LDA   $C050   
080D-   AD 81 C0    LDA   $C081   
0810-   AD 81 C0    LDA   $C081   
0813-   A0 00       LDY   #$00    
0815-   84 00       STY   $00     
0817-   A9 D0       LDA   #$D0    
0819-   85 01       STA   $01     
081B-   A2 30       LDX   #$30    
081D-   B1 00       LDA   ($00),Y 
081F-   91 00       STA   ($00),Y 
0821-   C8          INY           
0822-   D0 F9       BNE   $081D   
0824-   E6 01       INC   $01     
0826-   CA          DEX           
0827-   D0 F4       BNE   $081D   
0829-   A6 2B       LDX   $2B     
082B-   BD 89 C0    LDA   $C089,X 
082E-   A9 04       LDA   #$04    
0830-   85 01       STA   $01     
0832-   BD 8C C0    LDA   $C08C,X 
0835-   10 FB       BPL   $0832   
0837-   C9 DD       CMP   #$DD    
0839-   D0 F7       BNE   $0832   
083B-   BD 8C C0    LDA   $C08C,X 
083E-   10 FB       BPL   $083B   
0840-   C9 AD       CMP   #$AD    
0842-   D0 F3       BNE   $0837   
0844-   BD 8C C0    LDA   $C08C,X 
0847-   10 FB       BPL   $0844   
0849-   C9 DA       CMP   #$DA    
084B-   D0 EA       BNE   $0837   
084D-   BD 8C C0    LDA   $C08C,X 
0850-   10 FB       BPL   $084D   
0852-   38          SEC           
0853-   2A          ROL           
0854-   85 02       STA   $02     
0856-   A5 01       LDA   $01     
0858-   C9 08       CMP   #$08    
085A-   F0 10       BEQ   $086C   
085C-   BD 8C C0    LDA   $C08C,X 
085F-   10 FB       BPL   $085C   
0861-   25 02       AND   $02     
0863-   91 00       STA   ($00),Y 
0865-   C8          INY           
0866-   D0 E5       BNE   $084D   
0868-   E6 01       INC   $01     
086A-   D0 E1       BNE   $084D   
086C-   4C 1F 04    JMP   $041F   
086F-   D2          ???           
0870-   A6 AD       LDX   $AD     
0872-   5D B6 F0    EOR   $F0B6,X 
0875-   08          PHP           
0876-   EE BD B5    INC   $B5BD   
0879-   D0 03       BNE   $087E   
087B-   EE BE B5    INC   $B5BE   
087E-   A9 00       LDA   #$00    
   
AFTER THE PRELIMINARY STUFF AT LOCATIONS 801-82D, YOU WILL SEE LDA #$04, STA $01 AT 82E.  THIS IS THE LOCATION WHERE THE REST OF TRACK 0 IS LOADED: 400-7FF.  CHANGE THE 04 AT 82F TO 14 TO CHANGE THE LOADING LOCATION TO 1400, THEN WRITE THE SECTOR BACK TO SECTOR 0 OF TRACK 0.  IF YOU THEN BOOT YOUR SINGLE-TRACK DISK, THE LOADER WILL BE STORED AT 1400-17FF (IT WILL PROBABLY RE-BOOT AFTER A FEW SECONDS - WE'LL SEE WHY IN A MINUTE).  INTERRUPT IT  WITH A RESET, AND LOOK AT LOCNS 1400- 17FF.  WRITE DOWN THE BYTE AT 1400! YOU HAVE NOW CAPTURED THE SIRIUS LOADER BUT BEFORE WE DISCUSS IT, LETS SAVE IT UNDER DOS.  BOOT A 48K SLAVE DISK - NOT A MASTER (THIS WAY NO MEMORY BETWEEN 0900 AND 95FF IS TOUCHED DURING THE BOOT), AND DO BSAVE LOADER,A$1400,L$400 NOW LET'S LOOK FOR A SECOND AT THE TRACK THAT THE LOADER WAS LOADED FROM - WE'LL NEED TO KNOW BEFORE THIS IS  OVER.  USING INSPECTOR, NA II, OR LS 4, DO A NIBBLE READ OF TRACK 0, AND LOCATE THE STRING "D5 AA 96".  AS EVERYONE(?) KNOWS, THIS WILL LOCATE THE START OF A SECTOR.  (IN THIS CASE THE ONLY DOS 3.3 SECTOR ON THE TRACK). ABOUT 180(HEX) BYTES LATER, YOU WILL FIND A STRING  "DD AD DA" (A TRADITION AT SIRIUS) LOOK AT THE LENGTH OF THIS SECTOR -  IT'S CERTAINLY NOT NORMAL DOS!  GO  BACK TO THE PRELOADER LISTING AND LOOK AT THE SEQUENCE FROM 832 TO 84C WHICH IS LOOKING FOR THESE THREE BYTES IN SEQUENCE ON THE TRACK.  A CAREFUL STUDY OF THE CODE FROM 84D TO 86C WOULD EXPLAIN WHY THE SECTOR IS SO LONG - IT KEEPS ON LOADING IN BYTES (REALLY NIBBLES) UNTIL THE PAGE COUNTER AT 01 BECOMES 8 (CMP #$08 AT 858). SINCE WE DIDN'T CHANGE THIS, THE DISK KEPT ON LOADING, TRYING TO FIND AN 08 AFTER WE STARTED AT 14!  NOTICE ON YOUR NIBBLE READ THAT THE NIBBLES USED AFTER THE  DD AD DA MARKER, ARE ONLY A, B, E, AND F.  THE REASON IS THAT THE SECTOR IS 'ENCODED' USING THE "OLD" FREQUENCY MODULATION TECHNIQUE DESCRIBED AS 4+4 NIBBLIZING ON PAGE 3-14 OF "BENEATH APPLE DOS" (CALLED B.A.D. HENCEFORTH). TO SEE QUICKLY HOW IT'S DONE, WRITE DOWN THE FIFTH AND SIXTH NIBBLES AFTER THE MARKER: FB AE. THE FB BYTE, IN  BINARY, IS:
               1 1 1 1   1 0 1 1
FOLLOW THE INSTRUCTIONS AT LOC 852, AND SET THE CARRY BIT, THEN ROTATE LEFT ONCE, WITH THE CARRY:
   
            C
            1  1 1 1 1    1 0 1 1
ROL <=ONE   1  1 1 1 1    0 1 1 1
   
THEN GET THE 'AE' BYTE, WHICH IS:
   
               1 0 1 0    1 1 1 0
   
NEXT, DO A LOGICAL 'AND' OF THE TWO BYTES, AS DIRECTED BY LOC 861: (REMEMBER, FOR THE RESULT TO BE A '1' IN AN 'AND' OPERATION, BOTH BITS BEING COMPARED MUST BE '1'):
   
               1 1 1 1    0 1 1 1
  'AND'        1 0 1 0    1 1 1 0
               ------------------
RESULT=        1 0 1 0    0 1 1 0
   
WHICH IS 'A6' IN HEX.  THIS IS THE BYTE STORED IN MEMORY IN THE LOADER FILE AT LOCATION 402 (FOR US, 1402). (WE DID THE THIRD BYTE BECAUSE THE  FIRST TWO WERE EA, WHICH DOESN'T SHOW THE PRINCIPLE). COMPARE IT TO THE BYTE LOADED IN AT 1402.  IF THIS IS NEW TO YOU, TRY MAKING THE NEXT FEW BYTES  OUT OF THE NIBBLE PAIRS WHICH CORRESPOND TO THEM FROM THE NIBBLE READ -  NIBBLES 7 & 8 MAKE BYTE 4 (LOC 1403), AND SO ON.  
   
OK, SO THAT'S HOW THEY LOAD IN THE LOADER, LET'S GET DOWN TO SERIOUS BUSINESS.  NOTICE THE 'JMP 41F' INSTRUCTION AT 86C - THIS IS THE JUMP INTO THE LOADER ROUTINE. A DISASSEMBLY OF THE FIRST PART OF THE LOADER CODE FOLLOWS, TAKEN FROM LOCATIONS 1400 UP.
1400-   EA          NOP           
1401-   EA          NOP           
1402-   A6 34       LDX   $34     
1404-   BD 8A C0    LDA   $C08A,X 
1407-   BD 89 C0    LDA   $C089,X 
140A-   A0 64       LDY   #$64    
140C-   A9 64       LDA   #$64    
140E-   20 89 07    JSR   $0789   
1411-   88          DEY           
1412-   D0 F8       BNE   $140C   
1414-   A6 34       LDX   $34     
1416-   BD 8E C0    LDA   $C08E,X 
1419-   EA          NOP           
141A-   EA          NOP           
141B-   EA          NOP           
141C-   4C 51 04    JMP   $0451   
141F-   86 34       STX   $34     
1421-   BD 8E C0    LDA   $C08E,X 
1424-   A9 00       LDA   #$00    
1426-   85 26       STA   $26     
1428-   EA          NOP           
1429-   EA          NOP           
142A-   4C CF 07    JMP   $07CF   
142D-   AE EE BB    LDX   $BBEE   
1430-   FF          ???           
1431-   AB          ???           
1432-   FF          ???           
1433-   AF          ???           
1434-   BB          ???           
1435-   44          ???           
1436-   00          BRK           
1437-   FF          ???           
1438-   A9 02       LDA   #$02    
143A-   85 57       STA   $57     
143C-   A9 00       LDA   #$00    
143E-   A0 00       LDY   #$00    
1440-   59 00 04    EOR   $0400,Y 
1443-   59 00 05    EOR   $0500,Y 
1446-   59 00 06    EOR   $0600,Y 
1449-   59 00 07    EOR   $0700,Y 
144C-   C8          INY           
144D-   D0 F1       BNE   $1440   
144F-   85 2C       STA   $2C     
1451-   A5 34       LDA   $34     
1453-   4A          LSR           
1454-   4A          LSR           
1455-   4A          LSR           
1456-   4A          LSR           
1457-   18          CLC           
1458-   69 C0       ADC   #$C0    
145A-   85 33       STA   $33     
145C-   A9 00       LDA   #$00    
145E-   85 32       STA   $32     
1460-   A5 2C       LDA   $2C     
1462-   F0 03       BEQ   $1467   
1464-   6C 32 00    JMP   ($0032) 
1467-   A9 90       LDA   #$90    
1469-   8D 62 04    STA   $0462   
146C-   A5 32       LDA   $32     
146E-   8D FE 03    STA   $03FE   


   
   
THE FIRST THING TO NOTICE IN THE LISTING IS THAT THE BYTES FROM 42D TO 434 ARE NOT CODE, AND THAT THE PROGRAM JUMPS AROUND THEM (AS WITH MOST CRACKING WORK, IF IT LOOKS SUSPICIOUS, CHASE IT DOWN!). THE 'JMP 7CF' GOES TO A ROUTINE WHICH CLEARS ALL OF MEMORY FROM 800 TO B800, THEN JUMPS BACK TO 438 (NOTICE THAT REFERENCES ARE MADE WITHOUT THE '1' IN FRONT OF THE ADDRESS JUST AS THE DISASSEMBLED CODE DOES). THE PROGRAM NEXT SETS UP LOCATION 57 AS THE TRACK COUNTER (ACTUALLY TWICE THE TRACK NUMBER, SINCE HALF-TRACKS ARE COUNTED), AND DOES A CHECKSUM ON THE SCREEN MEMORY PROGRAM (LOC 143C TO 144F).  THE CHECKSUM RESULT, IF IT EQUALS 0, IS STORED IN 2C.  WE'LL SEE LATER THAT IT'S NECESSARY TO AVOID THIS TO DO THE CRACK. AFTER SETTING UP TRAP VECTORS FOR RESET, IRQ, AND NMI INTERRUPTS AT 3F0-3FF, THE ACTUAL LOADING BEGINS.
   
BEFORE THE PROGRAM IS LOADED, ALL THE ACTIVE TRACKS ON THE DISK ARE CHECKED BY READING THEM IN AND CHECKING THE  TRACK CHECKSUM. THIS IS THE "QUICK CHECK" THAT THE SIRIUS DOC ALWAYS MENTIONS.  A DESTINATION ADDRESS IS PICKED OUT OF A TABLE AT LOC 7AB-7BC (FOR CYCLOD: THIS TABLE VARIES FOR EACH GAME), AND THE READ HEAD (ARM) IS  MOVED TO THE RIGHT TRACK. THE LISTING BELOW SHOWS WHAT HAPPENS NEXT:
   
1500-   A9 FC       LDA   #$FC    
1502-   85 EA       STA   $EA     
1504-   A0 00       LDY   #$00    
1506-   BD 8C C0    LDA   $C08C,X 
1509-   10 FB       BPL   $1506   
150B-   D9 2D 04    CMP   $042D,Y 
150E-   F0 07       BEQ   $1517   
1510-   A0 00       LDY   #$00    
1512-   D9 2D 04    CMP   $042D,Y 
1515-   D0 EF       BNE   $1506   
1517-   C8          INY           
1518-   C0 08       CPY   #$08    
151A-   90 EA       BCC   $1506   
151C-   BD 8C C0    LDA   $C08C,X 
151F-   10 FB       BPL   $151C   
1521-   C5 53       CMP   $53     
1523-   D0 3D       BNE   $1562   
1525-   BD 8C C0    LDA   $C08C,X 
1528-   10 FB       BPL   $1525   
152A-   38          SEC           
152B-   2A          ROL           
152C-   85 3F       STA   $3F     
152E-   BD 8C C0    LDA   $C08C,X 
1531-   10 FB       BPL   $152E   
1533-   25 3F       AND   $3F     
1535-   85 42       STA   $42     
1537-   20 9F 05    JSR   $059F   
153A-   AD 50 C0    LDA   $C050   
153D-   AD 57 C0    LDA   $C057   
1540-   A6 34       LDX   $34     
1542-   A9 71       LDA   #$71    
1544-   AD FE 07    LDA   $07FE   
1547-   A9 00       LDA   #$00    
1549-   49 21       EOR   #$21    
154B-   4D FD 07    EOR   $07FD   
154E-   A5 41       LDA   $41     
1550-   C5 42       CMP   $42     
1552-   F0 2D       BEQ   $1581   
1554-   A9 14       LDA   #$14    
1556-   20 88 05    JSR   $0588   
1559-   C6 43       DEC   $43     
155B-   10 21       BPL   $157E   
155D-   A9 3C       LDA   #$3C    
155F-   20 88 05    JSR   $0588   
1562-   A9 06       LDA   #$06    
1564-   85 43       STA   $43     
1566-   C6 44       DEC   $44     
1568-   30 0C       BMI   $1576   
156A-   A9 5A       LDA   #$5A    
156C-   85 26       STA   $26     
156E-   A9 00       LDA   #$00    
1570-   20 2E 07    JSR   $072E   
1573-   4C B0 04    JMP   $04B0   
1576-   A9 FF       LDA   #$FF    
1578-   20 88 05    JSR   $0588   
157B-   6C 32 00    JMP   ($0032) 
157E-   4C B0 04    JMP   $04B0   
1581-   E6 57       INC   $57     
1583-   E6 57       INC   $57     
1585-   4C AC 04    JMP   $04AC   


   
THE PROGRAM BEGINS TO SEARCH THE TRACK FOR THE 8-BYTE SEQUENCE THAT IT JUMPED AROUND AT LOC 42D TO 434.  THIS IS A UNIQUE SEQUENCE USED TO START EACH  TRACK ON THE DISK; IT VARIES FROM GAME TO GAME.  (THOSE OF YOU WHO ARE THINKING THAT YOU NOW HAVE ENOUGH INFORMATION TO COPY THE DISK WITH NA OR LS ARE WRONG. SO FAR, WE HAVE ONLY SEEN A FEW OF THE REALLY SNEAKY THINGS THAT SIRIUS HAS IN STORE FOR US). WHEN THE SEQUENCE IS FOUND, THE TRACK IS LOADED,STARTING AT THE LOCATION PICKED FROM THE TABLE. EACH TRACK IS A SINGLE SECTOR, IN 4+4 'FM' ENCODING, WHICH LOADS TWELVE CONSECUTIVE PAGES IN MEMORY, WITHOUT ANY BUFFERS OR EXTRA TRANSLATION - THAT'S WHY THE LOAD IS SO FAST!  
   
NOW COMES THE REALLY SNEAKY PART! (THE LISTING IS NOT INCLUDED, SINCE IT'S LONG AND OBSCURE, BUT TRY TO FOLLOW THE PROCEDURE OUTLINED BELOW). SIRIUS IS FOOLING AROUND WITH THE TIMING OF THE NIBBLE READ FROM THE TRACK, IN A MOST DEVIOUS WAY.  IN A NORMAL DISK READ, YOU WANT TO BE SURE THAT NO BITS SLIP AWAY, SO YOU MONITOR THE INPUT LATCH FROM THE READ HEAD ON THE DISK.  LOOK BACK AT THE INSTRUCTIONS AT 832-84B. THE COMBINATION OF 'LDA C08C,X' AND 'BPL 832' MEANS: KEEP CHECKING THE LATCH, AND WHEN THE 8TH BIT IS NO LONGER A 0, TAKE THE NIBBLE AND RUN. (BY DEFINITION, THE LEFTMOST OR FIRST BIT IS ALWAYS A ONE IN THE DISK NIBBLES USED, IN DOS 3.3 AS WELL AS THE SIRIUS FM ENCODING).  ON AVERAGE, A NEW NIBBLE IS "BUILT UP" A BIT AT A TIME EVERY 32 MICROSECONDS, AND IF YOU WANT TO BE SURE TO GET ALL THE DATA STORED, YOU MUST COME BACK AND EMPTY THE LATCH EVERY 32 MICROSECONDS DURING A READ. SIRIUS, HOWEVER, RECORDED THE TRACK IN A DIFFERENT TIMING PATTERN (SORT OF A STUTTERSTEP), AND A SPECIFIC MATCHING PATTERN MUST BE USED TO READ IT OUT. THEIR CODE FOR DOING THIS RUNS FROM 59F TO 6FE, AND READS IN A CAREFULLY TIMED PATTERN FOR AN 8-BYTE SERIES. THE PATTERN REPEATS EVERY 8 BYTES, BUT THERE IS ADDITIONAL JIGGERY-POKERY BEING DONE WITH A VARIABLE OFFSET BYTE IN LOCATION EA TO FURTHER CONFUSE THE ISSUE.  THIS IS WHY, ALTHOUGH BOTH NIBBLES AWAY AND LOCKSMITH CAN READ THE TRACKS GIVEN THE ADDRESS MARKER, THE BYTES READ IN AT NORMAL 32-USEC TIMING RATES ARE NEVER CORRECT WHEN READ BY THE LOADER OFF THE COPY DISK.
   
AFTER LOADING IN 12 PAGES (C00 LOCATIONS) AND CHECKING THE CHECKSUM, THE TRACK NUMBER IS INCREMENTED TWICE  (LOC 581-584), AND THE DESTINATION FOR THE NEW TRACK IS PICKED FROM THE 7AB TABLE.  THIS CONTINUES UNTIL A ZERO IS FOUND IN THE TABLE, WHERE THE PROGRAM JUMPS TO 6FF TO DECRYPT ALL THE DATA IN MEMORY WITH AN OLD-FASHIONED EXCLUSIVE- OR TECHNIQUE.  HAVING LOADED AND "UNHID" ALL OF THE PROGRAM, IT JUMPS TO LOCATION 8EAG TO BEGIN THE GAME.
   
   



SORRY, NO MORE FOR THIS CALL!

=======================================

DELTA/TIM