Using a nibble editor we found that: track 00 is normal tracks 01..09 data prologue is A9 BA F7 address prologue is CA EE DD tracks 0A..19 are normal tracks 1A..22 no useful data Super-Demuffin come in handy to copy tracks 01..09 the others tracks can easly copied with e.g. Copy II+ Now looking for something like C9 A9, C9 BA, ... can you guess? Nothing found! Boot the (not working) copy with AppleWin and use the debugger to investigate the memory, can you guess again? Found! 2122:49 A9 EOR #$A9 \ 212C:C9 BA CMP #$BA - data prologue 2137:C9 F7 CMP #$F7 / 2190:C9 CA CMP #$CA \ 219B:C9 EE CMP #$EE - address prologue 21A5:C9 DD CMP #$DD / Fascinating! (insert Spock's eyebrow rise here) we have a partially encrypted disk... After a "little" more disassembly & trace here the first patch: track sector byte change to 00 02 23 53 AB \ 00 02 2D 75 55 - data prologue when decoded = D5 AA ED 00 02 38 EF 5B / 00 02 91 95 AB \ 00 02 9B DD 55 - address prologue when decoded = D5 AA 96 00 02 A6 BB 2D / Now the copy boot, show a couple of text screen, show the graphic title, play the music. Hit any key then black screen and the disk spin forever and ever (amen) Time to go back at the AppleWin debugger: 2453:20 B8 24 JSR $24B8 ;a nibble check/counter. We want to change 20 -> 2C 2456:A5 D5 LDA $D5 ;the result 2458:C9 03 CMP #$03 ;the "magic" number 245A:90 03 BCC $245F ;is the value in $D5 <= 3? We want to change 90 -> B0 245C:4C DC 21 JMP $21DC ;no, zap memory $2200..$BFFF and reboot 245F:AE 20 20 LDX $2020 ;yes, continue... Remember this code in encrypted on the disk. Here is the second patch: track sector byte change to 00 05 53 40 58 - when decoded = 2C, BIT 00 05 5A 21 61 - when decoded = B0, BCS Boot the copy and now the program ask if we want to "Restore a saved game?", no we do not want, thanks. Hit 'n' key and we are required to "Hit space to load part one!" We obey and... "Error!" This bloody thing needs another patch. This is the code executed after the output of "Hit Space to load part one!" 0A90:20 88 0A JSR $0A88 ;read a key 0A93:C9 20 CMP #$20 ;it was a ? 0A95:D0 F9 BNE $0A90 ;no, read again 0A97:60 RTS ;yes, return to the caller 084D:20 90 0A JSR $0A90 ;the above code, loop until 0850:A9 43 LDA #$43 ;more "magic" number. Whe want to change 43 -> 00 0852:8D 84 E5 STA $E584 ... EB58:AD 84 E5 LDA $E584 ;load "magic" number EB5B:48 PHA ;save it on the stack EB5C:A5 E9 LDA $E9 EB5E:8D 8F E5 STA $E58F EB61:68 PLA ;restore "magic" form the stack EB62:F0 08 BEQ $EB6C ;if it is = 0 then load part one ; repeat the sequence: output string, read The memory address E584 is NOT accessed between the STA in 0852 and the LDA in EB58. If you have more time to analyze this code, please do so and enlighten me. The third and final patch, this time in a not encrypted section of the disk: track sector byte change to 03 01 51 43 00