Protection: $11, $2cd, $2cf (17, 717, 719) phantom
Track 1 has 19 sectors, track 40 has 20 sectors

Identical protection:
	Batty Builders (1987)(Thunder Mountain)(US)[!]
	Bop'n Wrestle (1986)(Mindscape)(US)(Side A)[!]
	Boulder Dash Construction Kit (1986)(Epyx)(US)[!]
	Gauntlet - The Deeper Dungeons (198x)(Mindscape)(US)[BASIC][req 64K][req Gauntlet]
	Gauntlet (1985)(Mindscape)(US)(Side A)[!][req 64K]
	Infiltrator (1986)(Mindscape)(US)(Side A)[!][req 64K]
	Lode Runner (1984)(Broderbund Software)(US)(Side B)[!]
	Trailblazer (1986)(Mindscape)(US)[!]
	Winter Challenge (1989)(Thunder Mountain)(US)(Disk 1 of 2 Side A)[!][req 64K]

Similar protection:
	Ace of Aces (1987)(Accolade)(US)[!][req 64K]
	Ace of Aces (1987)(Accolade)(US)[a][!][req 64K]
	World Karate Championship (1986)(Epyx)(US)[!]


Cracked by:
 - Phantom sector $11 moved to $2c1
 - Second copy of $2cd moved to $2cc
 - Second copy of $2cf moved to $2d0
 - Changed loading code


----------------------------------------------------------
sector	-> loaded to		-> replacement
$f	-> $2800		-> $20f
$11	-> $2800	sec11b	-> $2c1
$2cb	-> $2880
$2cd	-> $2880	sec2cda	-> $2cc
$2cd	-> $2900	sec2cdb
$2bf-$2ce -> $400
$2cf	-> $2a80	sec2cfa
$2cf	-> $2a00	sec2cfb	-> $2d0


Routine in sectors $1-$2:
----------------------------------------------------------

0709: 03 03 00 7C 1A 01 04 00-7D CB 07

0714: AC 0E 07          LDY $070E	# =1
0717: F0 36             BEQ $074F
0719: AD 12 07          LDA $0712	# buffer $7cb
071C: 85 43             STA $43
071E: 8D 04 03          STA DBUFLO
0721: AD 13 07          LDA $0713
0724: 85 44             STA $44
0726: 8D 05 03          STA DBUFHI
0729: AD 10 07          LDA $0710	# sector $4
072C: AC 0F 07          LDY $070F
072F: 18                CLC
0730: AE 0E 07          LDX $070E	# =1
0733: 20 6C 07          JSR $076C
0736: 30 17             BMI $074F
0738: AC 11 07          LDY $0711

073B: B1 43             LDA ($43),Y
073D: 29 03             AND #$03
073F: 48                PHA
0740: C8                INY
0741: 11 43             ORA ($43),Y
0743: F0 0E             BEQ $0753
0745: B1 43             LDA ($43),Y
0747: A8                TAY
0748: 20 57 07          JSR $0757
074B: 68                PLA
074C: 4C 2F 07          JMP $072F
074F: A9 C0             LDA #$C0
0751: D0 01             BNE $0754
0753: 68                PLA
0754: 0A                ASL
0755: A8                TAY
0756: 60                RTS
0757: 18                CLC
0758: A5 43             LDA $43
075A: 6D 11 07          ADC $0711
075D: 8D 04 03          STA DBUFLO
0760: 85 43             STA $43
0762: A5 44             LDA $44
0764: 69 00             ADC #$00
0766: 8D 05 03          STA DBUFHI
0769: 85 44             STA $44
076B: 60                RTS

076C: 8D 0B 03          STA DAUX2
076F: 8C 0A 03          STY DAUX1
0772: A9 52             LDA #$52
0774: A0 40             LDY #$40
0776: 90 04             BCC $077C
0778: A9 50             LDA #$50
077A: A0 80             LDY #$80
077C: 8D 02 03          STA DCOMND
077F: 8C 03 03          STY DSTATS
0782: A9 31             LDA #$31
0784: A0 0F             LDY #$0F
0786: 8D 00 03          STA DDEVIC
0789: 8C 06 03          STY DTIMLO
078C: A9 03             LDA #$03
078E: 8D FF 12          STA $12FF
0791: A9 00             LDA #$00
0793: A0 80             LDY #$80
0795: CA                DEX
0796: F0 04             BEQ $079C
0798: A9 01             LDA #$01
079A: A0 00             LDY #$00
079C: 8D 09 03          STA DBYTHI
079F: 8C 08 03          STY DBYTLO
07A2: 20 59 E4          JSR SIOV
07A5: 10 1D             BPL $07C4
07A7: CE FF 12          DEC $12FF
07AA: 30 18             BMI $07C4
07AC: A2 40             LDX #$40
07AE: A9 52             LDA #$52
07B0: CD 02 03          CMP DCOMND
07B3: F0 09             BEQ $07BE
07B5: A9 21             LDA #$21
07B7: CD 02 03          CMP DCOMND
07BA: F0 02             BEQ $07BE
07BC: A2 80             LDX #$80
07BE: 8E 03 03          STX DSTATS
07C1: 4C A2 07          JMP $07A2
07C4: AE 01 13          LDX $1301
07C7: AD 03 03          LDA DSTATS
07CA: 60                RTS


Routine in sector $bd (219) at offset $6d10:
----------------------------------------------------------

3000: A2 0A             LDX #$0A
3002: BD 00 03          LDA DDEVIC,X
3005: 9D 80 29          STA $2980,X
3008: CA                DEX
3009: 10 F7             BPL $3002
300B: 20 3B 30          JSR $303B	# buffer $2800
300E: A9 0F             LDA #$0F	# sector $f

3010: A0 00             LDY #$00
----------------------------------------------------------
3010: A0 02             LDY #$02	# have $2 in place for sector $2xx

3012: 20 57 30          JSR $3057

3015: A9 11             LDA #$11	# sector $11 2of2
----------------------------------------------------------
3015: A9 C1             LDA #$C1	# sector $2c1

3017: 20 5A 30          JSR $305A
301A: A9 5B             LDA #$5B
301C: 48                PHA
301D: A9 BF             LDA #$BF
301F: 8D 16 28          STA $2816
3022: A9 80             LDA #$80	# buffer $2880
3024: A0 28             LDY #$28
3026: 20 50 30          JSR $3050
3029: A9 CB             LDA #$CB	# sector $2cb
302B: A0 02             LDY #$02
302D: 20 57 30          JSR $3057

3030: A9 CD             LDA #$CD	# sector $2cd 2of2
----------------------------------------------------------
3030: A9 CC             LDA #$CC	# sector $2cc

3032: 20 5A 30          JSR $305A
3035: A9 99             LDA #$99
3037: 48                PHA
3038: 4C 00 28          JMP $2800

303B: A2 00             LDX #$00
303D: 8E 09 03          STX DBYTHI
3040: 86 41             STX SOUNDR
3042: A9 04             LDA #$04
3044: A0 00             LDY #$00
3046: 8D 06 03          STA DTIMLO
3049: 8C 07 03          STY $0307
304C: A9 00             LDA #$00
304E: A0 28             LDY #$28
3050: 8D 04 03          STA DBUFLO
3053: 8C 05 03          STY DBUFHI
3056: 60                RTS

3057: 8C 0B 03          STY DAUX2
305A: 8D 0A 03          STA DAUX1
305D: A9 52             LDA #$52
305F: A2 80             LDX #$80
3061: A0 40             LDY #$40
3063: 8D 02 03          STA DCOMND
3066: 8E 08 03          STX DBYTLO
3069: 8C 03 03          STY DSTATS
306C: 20 59 E4          JSR SIOV
306F: 30 EC             BMI $305D
3071: 60                RTS


Routine in sector $2c1 (705, moved from $11 phantom) at offset $16010:
----------------------------------------------------------

2800: A9 00             LDA #$00	# buffer $2900
2802: A0 29             LDY #$29
2804: 20 50 30          JSR $3050
2807: A9 CD             LDA #$CD	# sector $2cd	=> 1of2 @ $2900
2809: 20 5A 30          JSR $305A
280C: 10 72             BPL $2880	# status is OK

280E: A9 00             LDA #$00
2810: A0 30             LDY #$30
2812: 20 22 29          JSR $2922
2815: A9 BF             LDA #$BF
2817: 4C 00 2A          JMP $2A00


Routine in sector $2cc (716, moved from $2cd phantom) at offset $16590:
----------------------------------------------------------

2880: A9 00             LDA #$00	# buffer $400
2882: A0 04             LDY #$04
2884: 20 22 29          JSR $2922
2887: A2 BF             LDX #$BF	# sectors $2bf-2ce 703-718
2889: 8A                TXA
288A: 48                PHA
288B: 20 0A 29          JSR $290A
288E: 68                PLA
288F: AA                TAX
2890: E8                INX
2891: E0 CF             CPX #$CF	# until $2ce (incl. $2cd 1of2)
2893: 90 F4             BCC $2889

2895: A9 80             LDA #$80	# buffer $2a80
2897: A0 2A             LDY #$2A
2899: 20 00 29          JSR $2900	# sector $2cf 1of2
289C: A9 00             LDA #$00	# buffer $2a00
289E: A0 2A             LDY #$2A

28A0: 20 00 29          JSR $2900	# read sector $2cf 2of2
----------------------------------------------------------
28A0: 20 29 29          JSR $2929	# read sector $2d0

28A3: A0 D5             LDY #$D5
28A5: A9 64             LDA #$64
28A7: 8C 5A 2A          STY $2A5A
28AA: 8D 5B 2A          STA $2A5B

28AD: A2 00             LDX #$00
28AF: BD 00 2A          LDA $2A00,X	# $2cfb EOR $2ce
28B2: 5D 00 04          EOR $0400,X
28B5: 9D 26 04          STA $0426,X
28B8: 9D 00 2A          STA $2A00,X
28BB: E8                INX
28BC: 10 F1             BPL $28AF

28BE: A2 00             LDX #$00
28C0: A9 55             LDA #$55
28C2: 5D 00 2A          EOR $2A00,X
28C5: 9D 00 2A          STA $2A00,X
28C8: E8                INX
28C9: A9 55             LDA #$55
28CB: 5D 00 2A          EOR $2A00,X
28CE: 9D 00 2A          STA $2A00,X
28D1: E8                INX
28D2: D0 EC             BNE $28C0

28D4: 4C 0E 28          JMP $280E


Routine in sector $2cd (717) at offset $16610:
----------------------------------------------------------

2900: 20 22 29          JSR $2922	# set buffer
2903: A9 CF             LDA #$CF	# sector $2cf
2905: D0 03             BNE $290A
2907: 8C 0B 03          STY DAUX2
290A: 8D 0A 03          STA DAUX1
290D: A9 52             LDA #$52
290F: A2 80             LDX #$80
2911: A0 40             LDY #$40
2913: 8D 02 03          STA DCOMND
2916: 8E 08 03          STX DBYTLO
2919: 8C 03 03          STY DSTATS
291C: 20 59 E4          JSR SIOV
291F: 10 07             BPL $2928
2921: 02                KIL
2922: 8D 04 03          STA DBUFLO
2925: 8C 05 03          STY DBUFHI
2928: 60                RTS

Own code added to the end of sector $2cd at offset $16610:
----------------------------------------------------------

2929: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
----------------------------------------------------------
2929: 20 22 29          JSR $2922	# buffer $2a00
292C: A9 D0             LDA #$D0	# sector $2d0
292E: D0 DA             BNE $290A	# read it and RTS


DISKMAP - 40 TRACKS - 18 SECTORS

 1 ********** ********** ********** ***......*
 2 ********** ********** ********** ***......*
 3 ********** ********** ********** ***......;
 4 ********** ********** .********* ***......;
 5 ********** ********** .********* **.......;
 6 ********** ********** .********* **.......;
 7 ********** ********** .********* **.......;
 8 ********** ********** .********* **.......;
 9 ********** ********** ********** **.......;
10 ********** ********** ********** **.......;

11 ********** ********** ********** **.......;
12 ********** ********** ********** **.......;
13 ********** ********** ********** **.......;
14 ********** ********** ********** **.......;
15 ********** ********** ********** **.......*
16 ********** ********** ********** **.......*
17 ********** ********** ********** **.......*
18 ********** ********** ********** **.......;

* OK/DATA  .,;: OK/EMPTY ($00, $1A, $FF, other)
| MISSING  d DELETED  C BAD CRC  l/L LONG/l+DELETED


crack.rup
NINJA1T
raw 7fee9c95 9f3bf371eedc899717a168fd19c9cb1d 635921043fe03d864638bffda1595afe319ed31a
6d27 02
6d2c c1
6d47 cc
16010 a900a029205030a9cd205a301072a900a030202229a9034c002a
16590 a900a004202229a2bf8a48200a2968aae8e0cf90f4a980a02a200029a900a02a202929a0d5a9648c5a2a8d5b2aa200bd002a5d00049d26049d002ae810f1a200a9555d002a9d002ae8a9555d002a9d002ae8d0ec4c0e28
16639 202229a9d0d0da
16790 8aa08308a0172a8337aaa960baa36beba3ca51780be6a10be6d008e61508e6c908e64508e68f8291b2fc4b428c77d6
167c0 199445087dda4622b30d
167cb 00f4bb122c5dd724fc0f2cee08e3fc0121b8c5cc1f13b297c515bb550d59a1029d441ca7f3c5d7a15fa15aa1d464441d16b3df97000b00160007be4813c164c5df1114f352

uncrack.rup
NINJA1T
raw 7fffffff 2fda441e51eff57228b669f46d65869d fff6a9006235efa08b456fc09893cbe9ea97198f
6d27 00
6d2c 11
6d47 cd
16010 ffffffffffffffffffffffffffffffffffffffffffffffffffff
16590 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
16639 ffffffffffffff
16790 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
167c0 ffffffffffffffffffff
167cb ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
