Inflitrator (Mindscape) Code below is loaded from t/s 18/18 and decrypted. Checks data block lengths and byte before/after data block sync. Does this for 16 sectors. Stores results in a table at $4c0. When complete, table should contain: >8:04c0 63 01 af 55 63 01 af 55 >8:04c8 63 01 af 55 63 01 af 55 >8:04d0 63 01 af 55 63 01 af 55 >8:04d8 63 01 af 55 63 01 af 55 >8:04e0 63 01 af 55 63 01 af 55 >8:04e8 63 01 af 55 63 01 af 55 >8:04f0 63 01 af 55 63 01 af 55 >8:04f8 63 01 af 55 63 01 af 55 These values are used to decrypt the next sector (18/17) that's loaded into $500. Interesting point is at $031A due to timing condition. Sync might be set after $315, so $318 won't branch. Then BVC sits through entire sync until next data byte is ready, so the sync was missed. This means the header block is skipped through and next header is read as part of the byte count. .8:0207 A9 12 LDA #$12 .8:0209 A2 12 LDX #$12 .8:020b 85 06 STA $06 .8:020d 86 07 STX $07 .8:020f A9 B0 LDA #$B0 .8:0211 20 1E 02 JSR $021E ; read t/s 18/18 header ID .8:0214 A9 80 LDA #$80 .8:0216 20 1E 02 JSR $021E ; read t/s 18/18 into $300 .8:0219 B0 F4 BCS $020F .8:021b 4C C0 04 JMP $04C0 ; decrypt $300 and execute .8:021e 85 00 STA $00 .8:0220 A5 00 LDA $00 .8:0222 30 FC BMI $0220 .8:0224 C9 02 CMP #$02 .8:0226 60 RTS ; Main protection routine .8:0300 20 0A F5 JSR $F50A ; Find data block (16/0) .8:0303 98 TYA .8:0304 50 FE BVC $0304 ; wait for byte ready .8:0306 B8 CLV .8:0307 50 FE BVC $0307 ; wait for byte ready (skips first two bytes of data block) .8:0309 84 85 STY $85 .8:030b 85 0C STA $0C .8:030d A0 00 LDY #$00 .8:030f 84 0D STY $0D .8:0311 AE EA EA LDX $EAEA ; cycle waster .8:0314 B8 CLV .8:0315 AE 00 1C LDX $1C00 .8:0318 10 0C BPL $0326 ; branch when sync found (but doesn't trigger on entry into header block sync mark due to timing conditions. However, also sometimes misses entry into data block sync on Vice, which messes up the protection) .8:031a 50 FE BVC $031A ; wait for byte ready .8:031c AD 01 1C LDA $1C01 ; read GCR byte .8:031f C8 INY ; increase byte counter (low byte) .8:0320 D0 EF BNE $0311 ; branch until we read $100 bytes .8:0322 E6 0D INC $0D ; increase the high byte of the count .8:0324 D0 EE BNE $0314 ; this should always branch .8:0326 A6 0C LDX $0C .8:0328 9D C2 04 STA $04C2,X ; store last GCR byte in table (also overwrites $4c0 decryption code) .8:032b 98 TYA .8:032c 9D C0 04 STA $04C0,X ; store low byte of GCR count in table .8:032f A5 0D LDA $0D .8:0331 9D C1 04 STA $04C1,X ; store high byte of GCR count in table .8:0334 18 CLC .8:0335 A4 85 LDY $85 .8:0337 B8 CLV .8:0338 50 FE BVC $0338 ; wait for byte (we should have been in data block sync mark at this time) .8:033a B8 CLV .8:033b AD 01 1C LDA $1C01 ; read GCR byte after sync mark .8:033e 9D C3 04 STA $04C3,X ; and store it in the table .8:0341 8A TXA .8:0342 69 04 ADC #$04 ; move ahead 4 bytes in the table .8:0344 C8 INY .8:0345 C0 10 CPY #$10 ; read 16 sectors .8:0347 90 BE BCC $0307 .8:0349 A0 37 LDY #$37 .8:034b B9 C0 04 LDA $04C0,Y ; quick verify of the table contents .8:034e D9 C8 04 CMP $04C8,Y ; the data retrieved from each sector should be the same .8:0351 D0 13 BNE $0366 .8:0353 88 DEY .8:0354 10 F5 BPL $034B .8:0356 A5 0B LDA $0B .8:0358 4D 05 02 EOR $0205 ; EOR the next sector (result is $11). Ensures no tampering of the $205 byte and also obfuscates .8:035b 85 0B STA $0B .8:035d A2 80 LDX #$80 .8:035f 86 02 STX $02 ; Read track 18 sector 17 into buffer #2 ($500) .8:0361 A9 01 LDA #$01 .8:0363 4C 69 F9 JMP $F969 ; Drive error routine. RTS to $3A6 .8:0366 C6 09 DEC $09 .8:0368 F0 F7 BEQ $0361 .8:036a 4C 00 03 JMP $0300 ; try reading the track up to 5 times before just proceeding to an inevitable crash .8:0371 84 0C STY $0C .8:0373 B9 00 03 LDA $0300,Y .8:0376 85 0D STA $0D .8:0378 A0 08 LDY #$08 .8:037a 06 0D ASL $0D .8:037c 6A ROR A .8:037d 29 80 AND #$80 .8:037f 45 0A EOR $0A .8:0381 06 0B ASL $0B .8:0383 2A ROL A .8:0384 90 0A BCC $0390 .8:0386 AA TAX .8:0387 A5 0B LDA $0B .8:0389 49 05 EOR #$05 .8:038b 85 0B STA $0B .8:038d 8A TXA .8:038e 49 80 EOR #$80 .8:0390 85 0A STA $0A .8:0392 88 DEY .8:0393 D0 E5 BNE $037A .8:0395 A4 0C LDY $0C .8:0397 C8 INY .8:0398 D0 D7 BNE $0371 .8:039a 84 07 STY $07 .8:039c 4D 06 02 EOR $0206 ; decrypt the track and sector for the next load .8:039f 85 0A STA $0A .8:03a1 A9 E0 LDA #$E0 .8:03a3 20 1E 02 JSR $021E ; load the sector (track 18 sector 17) into $300 and execute .8:03a6 B0 F9 BCS $03A1 .8:03a8 A5 02 LDA $02 .8:03aa 30 FC BMI $03A8 .8:03ac A0 1D LDY #$1D .8:03ae 99 00 02 STA $0200,Y ; wipe out $200 code .8:03b1 88 DEY .8:03b2 10 FA BPL $03AE .8:03b4 C8 INY .8:03b5 B9 00 05 LDA $0500,Y ; take an encrypted byte from t/s 18/17 in the $500 buffer... .8:03b8 59 C0 04 EOR $04C0,Y ; ...EOR with the sector info table... .8:03bb 59 00 03 EOR $0300,Y ; ...and with the $300 protection code (Hope you didn't modify it!) .8:03be 99 00 05 STA $0500,Y ; write the decrypted byte back .8:03c1 C8 INY .8:03c2 D0 F1 BNE $03B5 .8:03c4 A9 12 LDA #$12 .8:03c6 85 06 STA $06 .8:03c8 85 08 STA $08 .8:03ca 84 09 STY $09 .8:03cc 85 0A STA $0A .8:03ce 84 0B STY $0B .8:03d0 A9 80 LDA #$80 .8:03d2 85 01 STA $01 .8:03d4 4C 1E 02 JMP $021E .8:04c0 A0 00 LDY #$00 .8:04c2 A9 FF LDA #$FF .8:04c4 59 00 03 EOR $0300,Y ; decrypt $300 code .8:04c7 99 00 03 STA $0300,Y .8:04ca C8 INY .8:04cb D0 F7 BNE $04C4 .8:04cd A9 05 LDA #$05 .8:04cf 85 09 STA $09 ; 5 attempts to pass the protection check .8:04d1 A9 10 LDA #$10 .8:04d3 85 06 STA $06 ; track 16 is where the protection will be checked .8:04d5 84 0B STY $0B .8:04d7 84 0A STY $0A .8:04d9 4C 71 03 JMP $0371 Decrypted t/s 18/17 ($500) code: .8:0500 78 SEI .8:0501 A9 01 LDA #$01 .8:0503 8D 1A D0 STA $D01A .8:0506 8E 12 D0 STX $D012 .8:0509 AD 11 D0 LDA $D011 .8:050c 29 7F AND #$7F .8:050e 8D 11 D0 STA $D011 .8:0511 A5 45 LDA $45 .8:0513 8D 14 03 STA $0314 .8:0516 A5 46 LDA $46 .8:0518 8D 15 03 STA $0315 .8:051b A9 7F LDA #$7F .8:051d 8D 0D DC STA $DC0D .8:0520 58 CLI .8:0521 60 RTS .8:0522 20 8A 0D JSR $0D8A .8:0525 A2 05 LDX #$05 .8:0527 20 6C 0C JSR $0C6C .8:052a 60 RTS .8:052b 20 BD FF JSR $FFBD .8:052e A9 03 LDA #$03 .8:0530 A2 08 LDX #$08 .8:0532 A0 00 LDY #$00 .8:0534 20 BA FF JSR $FFBA .8:0537 A2 03 LDX #$03 .8:0539 20 C6 FF JSR $FFC6 .8:053c A6 49 LDX $49 .8:053e A4 4A LDY $4A .8:0540 A9 00 LDA #$00 .8:0542 20 D5 FF JSR $FFD5 .8:0545 A9 03 LDA #$03 .8:0547 20 C3 FF JSR $FFC3 .8:054a 20 CC FF JSR $FFCC .8:054d 60 RTS .8:054e A2 07 LDX #$07 .8:0550 20 6C 0C JSR $0C6C .8:0553 60 RTS .8:0554 CA DEX .8:0555 8A TXA .8:0556 8E 41 03 STX $0341 .8:0559 0A ASL A .8:055a 0A ASL A .8:055b 6D 41 03 ADC $0341 .8:055e AA TAX .8:055f BD 99 0C LDA $0C99,X .8:0562 85 49 STA $49 .8:0564 BD 9A 0C LDA $0C9A,X .8:0567 85 4A STA $4A .8:0569 BD 97 0C LDA $0C97,X .8:056c A8 TAY .8:056d BD 98 0C LDA $0C98,X .8:0570 8D 5F 03 STA $035F .8:0573 BD 96 0C LDA $0C96,X .8:0576 AA TAX .8:0577 AD 5F 03 LDA $035F .8:057a 20 43 0C JSR $0C43 .8:057d 60 RTS .8:057e DC 0C 01 NOOP $010C,X .8:0581 00 BRK .8:0582 90 DD BCC $0561 .8:0584 0C 06 00 NOOP $0006 .8:0587 84 DD STY $DD .8:0589 0C 0E 00 NOOP $000E .8:058c 88 DEY .8:058d DD 0C 0B CMP $0B0C,X .8:0590 00 BRK .8:0591 C4 E8 CPY $E8 .8:0593 0C 09 00 NOOP $0009 .8:0596 68 PLA .8:0597 F1 0C SBC ($0C),Y .8:0599 0C 00 A0 NOOP $A000 .8:059c FD 0C 0C SBC $0C0C,X .8:059f 00 BRK .8:05a0 68 PLA .8:05a1 09 0D ORA #$0D .8:05a3 05 00 ORA $00 .8:05a5 68 PLA .8:05a6 09 0D ORA #$0D .8:05a8 07 00 SLO $00 .8:05aa 90 10 BCC $05BC .8:05ac 0D 0A 00 ORA $000A .8:05af 68 PLA .8:05b0 1A NOOP .8:05b1 0D 0A 00 ORA $000A .8:05b4 90 24 BCC $05DA .8:05b6 0D 08 00 ORA $0008 .8:05b9 68 PLA .8:05ba 2C 0D 0A BIT $0A0D .8:05bd 00 BRK .8:05be 90 36 BCC $05F6 .8:05c0 0D 0A 00 ORA $000A .8:05c3 68 PLA .8:05c4 46 53 LSR $53 .8:05c6 54 45 NOOP $45,X .8:05c8 4E 43 49 LSR $4943 .8:05cb 4C 2E 43 JMP $432E .8:05ce 48 PHA .8:05cf 52 JAM .8:05d0 54 49 NOOP $49,X .8:05d2 54 4C NOOP $4C,X .8:05d4 45 2E EOR $2E .8:05d6 50 49 BVC $0621 .8:05d8 43 43 SRE ($43,X) .8:05da 41 4D EOR ($4D,X) .8:05dc 50 53 BVC $0631 .8:05de 49 54 EOR #$54 .8:05e0 45 2E EOR $2E .8:05e2 44 41 NOOP $41 .8:05e4 54 42 NOOP $42,X .8:05e6 52 JAM .8:05e7 49 45 EOR #$45 .8:05e9 46 49 LSR $49 .8:05eb 4E 47 2E LSR $2E47 .8:05ee 50 49 BVC $0639 .8:05f0 43 4C SRE ($4C,X) .8:05f2 4F 41 44 SRE $4441 .8:05f5 53 49 SRE ($49),Y .8:05f7 4D 41 57 EOR $5741 .8:05fa 41 52 EOR ($52,X) .8:05fc 44 31 NOOP $31 .8:05fe 2E 50 00 ROL $0050