RR                   *
*      CRACKING-PART 3                *
*                                     *
*   MEMORY MOVES, BINARY FILES, AND   *
*       KRAMMING FOR THE FINALS       *
*                                     *
***************************************

     IN THE LAST EPISODE, WE PONDERED
THE STARTING ADDRESS OF A PROGRAM AND
WAYS TO FIND IT IN SPITE OF THE
PROTECTORS' SUBTERFUGE.  THIS TIME
WE'LL DISCUSS HOW TO GET THE PROGRAM
INTO SAVEABLE FORMAT, EVEN IF IT'S TOO
LONG TO SAVE AS A BFILE. ALTHOUGH WE'LL
BE REFERRING AT FIRST TO SINGLE-LOAD
PROGRAMS, MOST OF THESE TECHNIQUES ARE
APPLICABLE TO PROGRAMS WITH DISK
ACCESS.

     BEFORE WE BEGIN THE PROCESS, LET
ME PHILOSOPHIZE FOR A FEW SECONDS ON
THE PROCEDURES AND PRACTICES TO BE
USED.  THIS IS A DISCIPLINE: PERHAPS
NOT SO DEMANDING AS CHAMPIONSHIP KARATE
OR THE UNIFICATION CHURCH, BUT IT
REQUIRES KNOWLEDGE, PATIENCE, AND
ATTENTION TO DETAIL. I URGE YOU TO
BEGIN EACH ADVENTURE IN KRACKING WITH A
SHARP PENCIL, PLENTY OF PAPER, AND A
GOOD ERASER.  FROM THIS POINT FORWARD
IN OUR QUEST, RECORD-KEEPING WILL
OCCUPY AN IMPORTANT PART OF THE TOTAL
ACTIVITY.  IF YOU HAVE A PRINTER, PRINT
OUT ANY PERTINENT SECTIONS OF CODE AND
WRITE IN YOUR OWN COMMENTS ABOUT WHAT
IT MEANS.  WRITE DOWN EVERY ADDRESS OF
INTEREST, AND KEEP ESPECIALLY CAREFUL
NOTES OF THE NATURE AND SEQUENCE OF ALL
MEMORY MOVES, STARTING POINTS, AND
TRICKS USED BY THE PROTECTORS.  DO THIS
NOT JUST BECAUSE IT'S CHARACTER
BUILDING, BUT BECAUSE UNLESS YOU HAVE
EXCEPTIONAL RECALL, ALL PROGRAMS WILL
EVENTUALLY BLEND TOGETHER INTO A WARM
AND FUZZY MEMORY.  KEEP GOOD NOTES ON
EVERYTHING YOU LEARN, AND REMEMBER:
"THOSE WHO CANNOT RECALL THE MISTAKES
OF THE PAST ARE DOOMED TO REPEAT THEM."

     SUPPOSE YOU HAVE LOADED IN, RESET
WITH YOUR OLD MONITOR ROM, AND FINALLY
LOCATED THE STARTING ADDRESS TO THE
GREATEST GAME EVER WRITTEN: "HYPERSPACE
ANDROID CLONE KILLER" OR "HACK".  THE
STARTING ADDRESS IS 4123, AND THE GAME
OCCUPIES MEMORY FROM 800 TO B000. YOU
ALREADY KNOW THAT IF ANY MEMORY ABOVE
9D00 HAS BEEN USED BY THE PROGRAM, DOS
IS DEAD, AND YOU CAN'T SAVE THE PROGRAM
TO DISK WITH A DOS COMMAND. AS YOU ALSO
UNDOUBTEDLY KNOW, IF THE PROGRAM WERE
SMALLER YOU WOULD HAVE THE OPTION OF
BOOTING A DISK AND SAVING THE GAME AS A
BINARY FILE.  LET'S TAKE JUST A SECOND,
THOUGH, AND REVIEW WHAT HAPPENS TO
MEMORY WHEN YOU BOOT A DISK.

     FIRST OF ALL, DON'T USE A MASTER
DISK, SINCE THE DOS ON A MASTER IS
LOADED FIRST INTO 1600-3FFF AND THEN
RELOCATED TO THE HIGHER REGIONS OF
MEMORY.  BOOTING A 48K SLAVE DISK WILL
DISTURB ONLY 0-8FF AND 9600-BFFF, AND
IF YOUR PROGRAM LIVES WITHIN OR CAN BE
REARRANGED TO FIT THESE BOUNDARIES, YOU
CAN SAFELY BOOT THE DISK AND SAVE THE
PROGRAM AS A BINARY FILE.

     AN OLD METHOD OF SAVING A BINARY
FILE IS WELL-KNOWN TO THOSE OF
US WHO BOUGHT APPLES IN THE DARK AGES
BEFORE THE DISK II, BUT THERE ARE NOW
MAYBE HALF A MILLION (!) APPLE OWNERS
WHO ARE UNFAMILIAR WITH THE CASSETTE
PORT AND ITS USE. IN GENERAL, ALMOST
ANY CASSETTE RECORDER THAT HAS A TONE
CONTROL CAN BE USED, BUT FOR SOME
REASON THE CHEAPER ONES ARE GENERALLY
BETTER. TO USE ONE, PLUG BOTH CABLES
INTO THE CORRECT CONNECTOR ("IN" MEANS
INTO THE COMPUTER, NOT INTO YOUR
RECORDER), AND TURN THE TONE CONTROL
ALMOST TO THE TOP OF THE TREBLE RANGE.
SAVE A SMALL BASIC PROGRAM (REFER TO
THE MANUAL FOR USE OF THE BASIC
COMMANDS) AT ANY OLD VOLUME CONTROL
SETTING.  TRY LOADING THE PROGRAM BACK
IN SEVERAL TIMES, INCREASING THE VOLUME
CONTROL SETTING UNTIL THE PROGRAM LOADS
RELIABLY.  YOU'LL FIND THAT THE TAPE
WORKS VERY WELL, EVEN ON LONG FILES,
ESPECIALLY WHEN THE SAME RECORDER IS
USED TO RECORD AND PLAYBACK.

     WHAT'S GOOD ABOUT THE TAPE SYSTEM
IS THAT EVEN WHEN DOS IS COMPLETELY
DEAD, THE MONITOR COMMANDS FOR TAPE I/O
ARE STILL ACTIVE (ASSUMING YOU DIDN'T
WIPE THEM OUT OF YOUR OLD MONITOR ROM).
SEE THE REFERENCE MANUAL, PAGE 46 FOR A
COMPLETE DESCRIPTION. WITH TAPE, YOU
CAN ALWAYS SAVE ANY PART OF MEMORY AT
ANY TIME! (WORTH KEEPING IN MIND FOR
THOSE CRUCIAL SITUATIONS WHEN THE
SYSTEM CRASHES JUST AS YOU ARE
FINISHING YOUR TERM PAPER ON THE WORD
PROCESSOR).  THE CASSETTE ROUTINES USE
ONLY LOCATIONS 3C-3F AND 42-43 IN ZERO
PAGE, AND THE ONLY PART OF MEMORY YOU
SHOULDN'T TRY TO SAVE IS C000-C0FF--
SOME TERRIBLE THINGS CAN HAPPEN IF YOU
TRY.  IN MOST CASES, IT'S BEST TO SAVE
A LONG PROGRAM IN TWO FILES SO IT CAN
BE RELOADED IN BETWEEN 800 AND 9600
AFTER DOS IS IN MEMORY.  FOR OUR
EXAMPLE OF "HACK", THE NECESSARY
MONITOR COMMANDS ARE:

      *0.4FFFW  (LONG WAIT)
      *5000.AFFFW  (LONGER WAIT)

AFTER BOOTING A DISK, YOU CAN RELOAD
WITH:

      *1000.5FFFR (RELOAD FIRST HALF)
      *BSAVE HACKLOW,A$1000,L$5000

      *1000.6FFFR (LOAD SECOND HALF)
      *BSAVE HACKHI,A$1000,L$6000

NOTE THAT IN THE TAPE READ AND WRITE
COMMANDS, UNLIKE DOS, THE ACTUAL
STARTING AND ENDING LOCATIONS ARE
LISTED.  BE SURE YOU UNDERSTAND THE
ONE-BYTE DIFFERENCE BETWEEN THE TWO
BEFORE YOU USE THEM.

     THERE ARE ALSO OCCASIONS WHEN YOU
WOULD LIKE TO SAVE APPLESOFT OR INTEGER
BASIC PROGRAMS LOADED IN FROM A
MODIFIED DOS ON A PROTECTED DISK
(ARCADE MACHINE AND THE RAPID-FIRE
SERIES FROM SSI ARE EXAMPLES). THIS IS
SIMPLE WITH THE TAPE RECORDER, SINCE
THE MONITOR ROUTINES ARE TOTALLY
IGNORANT OF THE OPERATING SYSTEM IN
RAM.  IF YOU CAN LIST A BASIC PROGRAM,
YOU CAN USUALLY SAVE IT TO TAPE. TRY
THE FOLLOWING WITH ONE OF THE ABOVE
PROGRAMS: LOAD IN A PROGRAM MODULE
(ANYTHING IN ARCADE MACHINE EXCEPT THE
MAIN MENU), THEN HIT RESET WHILE IT'S
RUNNING. TYPE D6:00 (THIS REMOVES THE
APPLESOFT INTERNAL "PROTECTION"), THEN
C081 TO SELECT THE MOTHER BOARD ROM
(UNLESS YOU HAVE AN APPLE II WITH
APPLESOFT ON A ROM CARD, THEN IT'S C080
TO SELECT SLOT 0). TYPE CONTROL-C AND
YOU SHOULD BE ABLE TO LIST THE PROGRAM
AND THEN SAVE IT TO TAPE WITH THE
"SAVE" COMMAND (SOMETIMES AN ADDITIONAL
FAIRLY TRIVIAL PROTECTION SCHEME IS
USED WITH APPLESOFT PROGRAMS: DELETING
THE FIRST LINE NUMBER SO IT WON'T LIST.
IT WILL STILL SAVE TO TAPE AND YOU CAN
RECONSTRUCT THE LINE NUMBER AT YOUR
LEISURE). REMEMBER THAT THE BASIC
"LOAD" AND "SAVE" COMMANDS DON'T ALLOW
A FILE NAME TO BE ADDED. IF THERE ARE
MORE THAN A FEW FILES ON THE DISK, THIS
IS A VERY TEDIOUS WAY TO KRACK A
PROGRAM, BUT BACK IN THE MIDDLE AGES
BEFORE DEMUFFIN PLUS IT WAS SOMETIMES
THE ONLY WAY.  YOU ALSO HAVE TO BE WARY
OF BINARY ROUTINES WHICH ARE CALLED
FROM OR MODIFY THE BASIC PROGRAMS.

     YES, YOU'RE RIGHT. GETTING OUT AND
HOOKING UP THE TAPE RECORDER IS A CRAMP
IN THE CALVINS, SO IT'S USUALLY LEFT
FOR EMERGENCIES WHEN NOTHING ELSE
WORKS.  IN GENERAL, IT'S BEST TO LEARN
HOW TO MANIPULATE MEMORY TO SCRUNCH
YOUR PROGRAM DOWN INTO A DOS FILE (IT
WILL ALWAYS HAVE TO BE DONE, ANYWAY).
IN THE BEST OF ALL POSSIBLE WORLDS,
YOUR DOS WOULD BE IN ROM MEMORY, AND
WOULD ALLOW YOU TO SAVE ANY PROGRAM
THAT RESIDED IN RAM MEMORY.  IN THE
REAL WORLD, IT'S GENERALLY NECESSARY TO
REDUCE A PROGRAM TO A FILE THAT CAN BE
LOADED IN BY DOS FROM A NORMAL DISK
(WE'LL TALK LATER ABOUT THOSE THAT
CAN'T BE). THIS PROCESS IS USUALLY
CALLED "MEMORY MOVING", AND THE PURPOSE
IS TO "TUCK IN" ALL THE PIECES OF THE
PROGRAM THAT LIE OUTSIDE THE NORMAL
PROGRAM MEMORY OF 800-9600 ALLOWED BY
DOS.  THE OTHER HALF OF THE PROCESS IS
THE "UNFOLDING" OF THE TUCKED-IN
PORTIONS OF MEMORY AFTER THE PROGRAM IS
RELOADED UNDER DOS.  TO GAIN
PERSPECTIVE ON THE PROCESS, LET'S
LOOK AT MEMORY MAPS WITH DOS ACTIVE AND
WITH "HACK" IN MEMORY.
_______________________________________
!           !           !             !
!F800-FFFF->!MONITOR ROM!AUTOSTART ROM!
!-------------------------------------!
!F000-F7FF->! INTEGER   ! APPLESOFT   !
!E800-EFFF->!     BASIC !     "       !
!E000-E7FF->!  "    "   !     "       !
!D800-DFFF->!(INSPECTOR)!     "       !
!D000-D7FF->! (WATSON)  !     "       !
!-------------------------------------!
!C800-CFFF->!PERIPHERAL SLOT ROM SPACE!
!C000-C7FF->!SOFT SWITCHES & SLOT ROMS!
!-------------------------------------!
!B800-BFFF->!           ^             !
!B000-B7FF->!           !             !
!A800-AFFF->!          DOS            !
!A000-A7FF->!           !             !
!9800-9FFF->!           V             !
!-------------------------------------!
!9000-97FF->!      ^                  !
!8800-8FFF->!      !                  !
!8000-87FF->!      !                  !
!7800-7FFF->!      !                  !
!7000-77FF->!      !                  !
!6800-6FFF->! PROGRAM MEMORY          !
!6000-67FF->!      !                  !
!------------------!------------------!
!5800-5FFF->!      !        ^         !
!5000-57FF->!      !  (HI-RES PAGE 2) !
!4800-4FFF->!      !        !         !
!4000-47FF->!      !        V         !
!------------------!------------------!
!3800-3FFF->!      !        ^         !
!3000-37FF->!      !  (HI-RES PAGE 1) !
!2800-2FFF->!      !        !         !
!2000-27FF->!      !        V         !
!------------------!------------------!
!1800-1FFF->!      !                  !
!1000-17FF->!      !                  !
!0800-0FFF->!      V  (TEXT PAGE 2)   !
!--------------------------------------
!0000-07FF->!ZERO PG,STACK,TEXT PAGE 1!
---------------------------------------
       AND, WITH "HACK" IN MEMORY:
_______________________________________
!           !           !             !
!F800-FFFF->!MONITOR ROM!AUTOSTART ROM!
!-------------------------------------!
!F000-F7FF->! INTEGER   ! APPLESOFT   !
!E800-EFFF->!     BASIC !     "       !
!E000-E7FF->!  "    "   !     "       !
!D800-DFFF->!(INSPECTOR)!     "       !
!D000-D7FF->! (WATSON)  !     "       !
!-------------------------------------!
!C800-CFFF->!PERIPHERAL SLOT ROM SPACE!
!C000-C7FF->!SOFT SWITCHES & SLOT ROMS!
!-------------------------------------!
!B800-BFFF->!         (EMPTY)         !
!B000-B7FF->!      ^                  !
!A800-AFFF->!      !                  !
!A000-A7FF->!      !                  !
!9800-9FFF->!      !                  !
!------------------!------------------!
!9000-97FF->!      !                  !
!8800-8FFF->!      !  (EMPTY)         !
!8000-87FF->!      !  (EMPTY)         !
!7800-7FFF->!      !                  !
!7000-77FF->!      !                  !
!6800-6FFF->! PROGRAM "HACK"          !
!6000-67FF->!      !                  !
!------------------!------------------!
!5800-5FFF->!      !        ^         !
!5000-57FF->!      !  (HI-RES PAGE 2) !
!4800-4FFF->!      !        !         !
!4000-47FF->!      !        V         !
!------------------!------------------!
!3800-3FFF->!      !        ^         !
!3000-37FF->!      !  (HI-RES PAGE 1) !
!2800-2FFF->!      !        !         !
!2000-27FF->!      !        V         !
!------------------!------------------!
!1800-1FFF->!      !  (EMPTY)         !
!1000-17FF->!      !  (EMPTY)         !
!0800-0FFF->!      V  (TEXT PAGE 2)   !
!-------------------------------------!
!0000-07FF->!ZERO PG,STACK,TEXT PAGE 1!
---------------------------------------
  
   BEFORE WE BEGIN THE DISCUSSION OF
THE TECHNIQUES OF MEMORY MOVING, LET'S
RESTATE THE OBJECTIVE: WE'RE TRYING TO
ARRANGE ALL THE PROGRAM INTO A SMALL
ENOUGH SPACE THAT WE CAN BSAVE A FILE
UNDER DOS (THE DOS MANUAL WILL TELL YOU
THAT THE LARGEST BINARY FILE YOU CAN
SAVE IS 128 SECTORS, BUT IF YOU CHANGE
LOCATION $A964 (43364) TO $BF(191) YOU
CAN SAVE A FILE AS LARGE AS THE ENTIRE
RAM MEMORY). REMEMBER THAT BOOTING A
SLAVE DISK WILL MESS UP 0-8FF AND
9600-BFFF, SO THE LARGEST FILE IT'S
PRACTIVAL TO SAVE IS ABOUT 145 SECTORS
(YOU CAN, WITH CARE, OVERWRITE MUCH OF
THE SCREEN MEMORY AND PAGES 2 & 3 TO
SAVE A BFILE OF ABOUT 151 SECTORS, BUT
THAT REQUIRES KNOWLEDGE AND
CONSIDERABLE CARE).

     LOOKING AT THE MEMORY MAP WITH
HACK, YOU CAN SEE THAT THE MEMORY FROM
9600 TO B000 WILL HAVE TO BE STORED
SOMEWHERE ELSE TO BRING THE FILE SIZE
DOWN, AND THE PAGE FROM 800-8FF WILL
HAVE TO BE STASHED TEMPORARILY DURING
THE DISK BOOT TO RESTORE DOS.  TO FIND
OUT WHAT AREAS OF MEMORY ARE FREE,
SEARCH THROUGH ALL MEMORY WITH THE
INSPECTOR AND LOOK FOR BLANK PAGES. THE
FOLLOWING TRICK WILL HELP: BEFORE YOU
LOAD THE ORIGINAL, CLEAR ALL OF MEMORY
TO ZERO (OR ANY OTHER BYTE YOU LIKE)
WITH:
           *800:0
           *801<800.95FFM
THEN YOU'LL BE ABLE TO SEE UNUSED
MEMORY AREAS. THIS DOESN'T ALWAYS WORK,
SINCE MANY AREAS ARE COPIED TO A SECOND
LOCATION AND NOT USED AFTERWARDS, SO
IF YOU'RE HARD PRESSED FOR STORAGE
MEMORY, IT'S A GOOD IDEA TO SCAN
THROUGH ONCE WITH THE INPECTOR SET TO
DECODE ASCII TO DETECT SUSPICIOUS
SECTORS (LATELY, SOME OF THE PROTECTORS
HAVE TAKEN TO STORING GARBAGE SUCH AS
SOURCE CODE IN UNUSED PAGES OF MEMORY
AND ON EMPTY DISK SECTORS). NOTE DOWN
ANY PAGES THAT ARE TOTALLY CLEAR, ANY
THAT ARE ALL ONE BYTE, REGARDLESS OF
WHAT IS IS, OR ANY THAT CONTAIN JUNK.
LET'S ASSUME FOR THIS EXAMPLE THAT
LOCATIONS 1000-1FFF AND 8000-8FFF ARE
BLANK. WE HAVE 1A00 (B000-9600) BYTES
OF MEMORY "LEFTOVER" OR OUTSIDE OF THE
DOS BOUNDARIES, SO THEY WILL ALL FIT
INTO THE $2000 BLANK LOCATIONS THAT WE
LOCATED.

     STORE THE EXCESS BYTES IN THE
HOLES BY TYPING:

     *8000<9600.A5FFM
     *1000<A600.AFFFM

OR EQUIVALENT; THE SPLIT CAN BE ANY WAY
THAT HELPS YOU KEEP TRACK OF THE
PROCESS.  FINALLY, STASH THE MEMORY
FROM PAGE 8 WITH *1B00<800.8FFM.
REMEMBER THAT THIS IS ONLY TEMPORARY.
BEFORE YOU DO ANYTHING ELSE, BOOT YOUR
48K SLAVE DISK, THEN RESTORE PAGE 8
WITH *800<1B00.1BFFM.  BEFORE YOU DO
ANYTHING ELSE, SAVE THE PROGRAM WITH
"BSAVE HACKALL,A$800,L$8E00 (NINE OUT
OF TEN TIMES YOU'LL FORGET TO CHANGE
$A964; CONSIDER CHANGING IT IN THE DOS
IN MEMORY BEFORE YOU INITIALIZE THE
DISK SO IT WILL BE PERMANENT). YOU CAN
NOW TAKE A DEEP BREATH AND RELAX: ALL
OF THE PROGRAM MEMORY IS SAFELY TUCKED
AWAY.  ALL THAT'S LEFT IS TO
WRITE A SHORT PROGRAM TO REVERSE THE
MEMORY STORAGE.

     TWO SHORT ROUTINES, SIMILAR TO
THOSE SHOWN IN OUR FIRST BASICS LESSON
ARE REQUIRED. AGAIN, LET'S REVIEW THE
STEPS NECESSARY FROM HERE TO RUN THE
GAME:

  1. LOAD THE (COMPRESSED) GAME INTO
     800-95FF.
  2. MOVE THE PIECE OF MEMORY AT
     8000-9FFF TO 9600-A5FF.
  3. MOVE THE PIECE OF MEMORY AT
     1000-19FF TO A600-AFFF.
  4. JUMP TO THE STARTING ADDRESS AT
     $4123.

     THE FOLLOWING PROGRAM WILL TAKE
CARE OF STEPS 2-4.  IT MAY NOT BE
IMMEDIATELY OBVIOUS THAT THIS PROGRAM
MUST BE STORED WITHIN THE COMPRESSED
PROGRAM IN A PAGE THAT IS BOTH EMPTY
AND UNAFFECTED BY THE MEMORY MOVES
YOU ARE ABOUT TO MAKE. IN THIS CASE,
PAGE 1C IS SAFE.

 1C00  LDY #$0     ;CLR Y-REG
 1C02  LDA $8000,Y ;GET A BYTE AT 8000+
 1C05  STA $9600,Y ;STORE IT AT 9600+
 1C08  INY         ;INCR. COUNTER
 1C09  BNE $1C02   ;IF NOT PAGEND, REDO
 1C0B  INC $1C04   ;INCR. SOURCE HIBYTE
 1C0E  INC $1C07   ;INCR. DEST HIBYTE
 1C11  LDA $1C07   ;GET THE DEST HIBYTE
 1C14  CMP #$90    ;IF 90,WE'RE DONE
 1C16  BNE $1C02   ;IF NOT, DO MORE
 1C18  LDA $1000,Y ;REPEAT THE PROCESS
 1C1B  STA $A600,Y ;FOR THE SECOND
 1C1E  INY         ;BLOCK
 1C1F  BNE $1CA8
 1C21  INC $1C1A
 1C24  INC $1C1D
 1C27  LDA $1C1D
 1C2A  CMP #$1B
 1C2D  BNE $1CA8
 1C2F  JMP 4123    ;AND JUMP TO THE
                    STARTING LOCATION

     THIS MAY SEEM HARD AT FIRST, BUT
THE FORM IS SO CONSTANT THAT YOU'LL BE
ABLE TO WRITE THESE MOVES IN YOUR SLEEP
AFTER A FEW TRIES WITH THE MINI-
ASSEMBLER (THE PLACE YOU'LL MOST LIKELY
MESS UP IS IN THE 'CMP #90' BY TYPING
'CMP $90'--WATCH IT CAREFULLY!).

     TIME OUT FOR A BRIEF DISCUSSION OF
ONE OF THE SUBTLE POINTS OF MEMORY
MOVES.  ALTHOUGH YOU'RE GENERALLY ABLE
TO MAKE YOUR MEMORY MOVES
NON-OVERLAPPING, YOU CAN HAVE A PROBLEM
MOVING LARGE AMOUNTS OF MEMORY.  THE
MEMORY MOVE ROUTINES SHOWN ABOVE ARE
"FORWARD" MEMORY MOVES: THAT MEANS THAT
EACH PAGE MOVES IS ONE AHEAD OF THE ONE
JUST MOVED.  SOMETIMES YOU WILL NEED TO
MOVE, FOR INSTANCE, LOCATIONS 6000-8FFF
TO 8000-AFFF. IF YOU USE THE FORWARD
MOVES AS SHOWN, YOU CAN SEE THAT THE
FIRST PAGE (PAGE 60 OR 6000-60FF) WILL
LAND AT 8000-80FF, SMACK ON TOP OF THE
ORIGINAL PAGE THAT WAS SUPPOSED TO BE
MOVED LATER TO PAGE A0 (A000-A0FF).  TO
AVOID THIS CONFLICT, YOU CAN USE WHAT'S
CALLED A "BACKWARDS" MEMORY MOVE.  THIS
TECHNIQUE MOVES THE LAST PAGE FIRST AND
WORKS "DOWN" IN MEMORY INSTEAD OF UP.
IN THIS EXAMPLE, PAGE 8F IS FIRST MOVED
TO AF, THEN 8E TO AE, ETC. THIS WAY,
WHEN IT FINALLY COMES TIMES TIME FOR
PAGE 60 TO BE MOVED TO PAGE 80, THE
ORIGINAL PAGE 80 WILL ALREADY HAVE BEEN
MOVED. A TYPICAL ROUTINE FOR THIS IS:

 1000  LDY #$0
 1002  LDA $8F00,Y
 1005  STA $6000,Y
 1008  INY
 1009  BNE $1002
 100B  DEC $1004
 100E  DEC $1007
 1011  LDA $1007
 1014  CMP #$5F
 1017  BNE $1002

     OK--ALL THAT REMAINS IS TO GET TO
THE START OF THE EARLIER MEMORY MOVE
ROUTINE WHEN WE "BRUN" THE GAME.  THIS
IS ACCOMPLISHED BY PUTTING THE CODE FOR
"JMP $1C00" OR 4C 00 1C AT LOCATION
$7FD-$7FF AND MAKING THIS THE FIRST
LOCATION OF THE PROGRAM. WE CAN THEN
SAVE A COMPLETE, FUNTIONING VERSION OF
HACK WITH "BSAVE HACK,A$7FD,L$8E03".
THIS CREATES YOUR FINAL, 145-SECTOR
FILE OF HACK WHICH WILL BRUN WHENEVER
YOU WISH.

----------A FEW HELPFUL HINTS----------

1. ALWAYS KEEP A FEW INITIALLIZED 48K
