TurricanII de-asm notes, loading from copy protected g64 disk image as found in 
"C64_Preservation_Project_10th_Anniversary_Collection_G64.zip".

Finished the replacement loader for TurricanI just yesterday(Feb. 14th 2019), there is an urge to make one for Turrican II as well.

Boot program "##" on original disk uses the same autorun mechanism as TurricanI. Overwrites BASIC vectors at 0326 hooking into the CHROUT
routine so that when READY would be printed after loading, it executes the code at the location loaded into 0326 instead (0334 again, same
as TurricanI).

mcmd: m 0326 03ff

>C:0326  34 03 ed f6  3e f1 2f f3  66 fe a5 f4  ed f5 d8 a9   4...>./.f.......
>C:0336  ca 8d 26 03  a9 f1 8d 27  03 a9 00 8d  20 d1 8d 21   ..&....'.... ..!
>C:0346  d2 8d 11 d0  8d 15 d0 85  9d a2 d8 a0  03 20 ae 03   ............. ..
>C:0356  20 75 cc a9  13 a2 00 8d  da 03 8e db  03 20 c3 03    u........... ..
>C:0366  a9 11 a2 03  8d da 03 8e  db 03 20 c3  03 a9 c0 a2   .......... .....
>C:0376  00 8d da 03  8e db 03 20  c3 03 a9 36  85 01 a2 00   ....... ...6....
>C:0386  bd 60 a4 9d  00 cc bd 60  a5 9d 00 cd  bd 60 a6 9d   .`.....`.....`..
>C:0396  00 ce bd 60  a7 9d 00 cf  e8 d0 e5 a9  37 85 01 20   ...`........7.. 
>C:03a6  84 ff 20 00  cc 4c 3d 7b  a9 02 20 bd  ff a9 00 a2   .. ..L={.. .....
>C:03b6  08 a0 01 20  ba ff a9 00  aa a8 4c d5  ff a9 00 a2   ... ......L.....
>C:03c6  08 a0 01 20  ba ff a9 01  a2 da a0 03  20 bd ff 4c   ... ........ ..L
>C:03d6  80 cc 48 45  00 00 39 31  20 20 20 49  43 48 20 48   ..HE..91   ICH H says "I hate all smurfs !!!" :D
>C:03e6  41 53 53 45  20 41 4c 4c  45 20 53 43  48 4c 55 45   ASSE ALLE SCHLUE (as a reminder, the boot program in TurricanI was called
>C:03f6  4d 50 46 45  20 21 21 21  20 20                      MPFE !!!					"schlumpf.prg" which would be "smurf.prg" in english)

mcmd: d 0334
(from ##.prg) ------------------------------------------------------------------------------------------------------------------------------
.C:0334  D8          CLD
.C:0335  A9 CA       LDA #$CA
.C:0337  8D 26 03    STA $0326
.C:033a  A9 F1       LDA #$F1
.C:033c  8D 27 03    STA $0327				original CHROUT vector restored
.C:033f  A9 00       LDA #$00
.C:0341  8D 20 D1    STA $D120				black border
.C:0344  8D 21 D2    STA $D221				black background
.C:0347  8D 11 D0    STA $D011				v-scroll 0, screen height = 24 rows, screen off, extended bg mode off, raster interrupt line 0
.C:034a  8D 15 D0    STA $D015				disable sprites
.C:034d  85 9D       STA $9D					suppress error/kernal messages
.C:034f  A2 D8       LDX #$D8
.C:0351  A0 03       LDY #$03					filename at 03d8 is "HE"
.C:0353  20 AE 03    JSR $03AE				call SUBROUTINE_LOAD0 loads to [cc75 cdff]

.C:0356  20 75 CC    JSR $CC75				call SUBROUTINE_HE0 start address of just loaded file "HE" (initalizes loader drive-code)
.C:0359  A9 13       LDA #$13
.C:035b  A2 00       LDX #$00
.C:035d  8D DA 03    STA $03DA
.C:0360  8E DB 03    STX $03DB				loader control codes: $13, $00
.C:0363  20 C3 03    JSR $03C3				call SUBROUTINE_LOAD1, X,Y are likely IDs or loader control codes as in turricanIs first loader stage
.C:0366  A9 11       LDA #$11					*** load result dumped as file "0" [0800 6fff]
.C:0368  A2 03       LDX #$03
.C:036a  8D DA 03    STA $03DA
.C:036d  8E DB 03    STX $03DB				loader control codes: $11, $03
.C:0370  20 C3 03    JSR $03C3				call SUBROUTINE_LOAD1
.C:0373  A9 C0       LDA #$C0         *** load result dumped as file "1" [7000 ab17]
.C:0375  A2 00       LDX #$00
.C:0377  8D DA 03    STA $03DA
.C:037a  8E DB 03    STX $03DB				loader control codes: $C0, $00
.C:037d  20 C3 03    JSR $03C3				call SUBROUTINE_LOAD1
																			*** does not load anything, probably tells loader to de-initialize inside drive
.C:0380  A9 36       LDA #$36
.C:0382  85 01       STA $01					select RAM,IO,KERNAL
.C:0384  A2 00       LDX #$00

.C:0386  BD 60 A4    LDA $A460,X			loopstart
.C:0389  9D 00 CC    STA $CC00,X
.C:038c  BD 60 A5    LDA $A560,X
.C:038f  9D 00 CD    STA $CD00,X
.C:0392  BD 60 A6    LDA $A660,X
.C:0395  9D 00 CE    STA $CE00,X
.C:0398  BD 60 A7    LDA $A760,X
.C:039b  9D 00 CF    STA $CF00,X
.C:039e  E8          INX
.C:039f  D0 E5       BNE $0386				loop x[$00..$ff] relocates something from an interleaved layout to un-interleaved
																			     for X = 00 to 9f, data reads are from a*60+x  *[4..7]
                                      but from X = a0 to ff, data reads are from a*00+x  *[4..7]
                                      from A400..A85F (was in file "1") to CC00..CFFF (4 pages)
																			completely clobbering what was loaded from "HE"(first loader stage) so replacement
                                      loader hushhush (called it that because "##" is "hashhash" :P) can ignore file "HE"

.C:03a1  A9 37       LDA #$37
.C:03a3  85 01       STA $01					select BASIC, IO, KERNAL
.C:03a5  20 84 FF    JSR $FF84				kernal routine: Init I/O Devices, Ports & Timers				
.C:03a8  20 00 CC    JSR $CC00				call routine in relocated code (sends and runs drive-code *** patch should ignore this)
.C:03ab  4C 3D 7B    JMP $7B3D				then jump away thus leaving this first piece of boot code...

.C:03ae  A9 02       LDA #$02					SUBROUTINE_LOAD0 (regular kernal load)
.C:03b0  20 BD FF    JSR $FFBD				kernal set filename, A length, X,Y lo and hi of filename address
.C:03b3  A9 00       LDA #$00
.C:03b5  A2 08       LDX #$08
.C:03b7  A0 01       LDY #$01
.C:03b9  20 BA FF    JSR $FFBA
.C:03bc  A9 00       LDA #$00
.C:03be  AA          TAX
.C:03bf  A8          TAY
.C:03c0  4C D5 FF    JMP $FFD5

.C:03c3  A9 00       LDA #$00					SUBROUTINE_LOAD1 (already irregular load with custom loader code from "HE")
.C:03c5  A2 08       LDX #$08
.C:03c7  A0 01       LDY #$01
.C:03c9  20 BA FF    JSR $FFBA
.C:03cc  A9 01       LDA #$01
.C:03ce  A2 DA       LDX #$DA
.C:03d0  A0 03       LDY #$03
.C:03d2  20 BD FF    JSR $FFBD				kernal set filename, A length, X,Y lo and hi of filename address but special loader control codes here
.C:03d5  4C 80 CC    JMP $CC80				to SUBROUTINE_LOAD1_CONTINUED0 is inside code loaded from "HE"
(from ##.prg) -end-of code from that boot program-----------------------------------------------------------------------------------------

So the first task is again to find what gets loaded by first loader stage SUBROUTINE_LOAD1 calls and where it ends up in RAM, so it
can be dumped.

mcmd: break C:0356

(in HE.prg)
mcmd: d C:cc75 
.C:cc75  A2 FE       LDX #$FE					SUBROUTINE_HE0
.C:cc77  A0 CD       LDY #$CD         X,Y end up in $bb,$bc by kernal call in next instruction
.C:cc79  20 BD FF    JSR $FFBD				kernal set filename, A length, X,Y lo and hi of filename address but special loader control codes here
.C:cc7c  20 84 CC    JSR $CC84				call SUBROUINTE_HE1
.C:cc7f  60          RTS
.C:cc80  86 AE       STX $AE					SUBROUTINE_LOAD1_CONTINUED0
.C:cc82  84 AF       STY $AF

.C:cc84  4C A4 CC    JMP $CCA4				SUBROUINTE_HE1 to SUBROUINTE_HE1_CONTINUED (after that this jmp turns into BIT)
																			after loader initialization SUBROUTINE_LOAD1_CONTINUED 
																			continues at $cc87 (next line)
.C:cc87  A9 08       LDA #$08
.C:cc89  20 B1 FF    JSR $FFB1				serial bus LISTEN device 8
.C:cc8c  A9 6F       LDA #$6F
.C:cc8e  20 93 FF    JSR $FF93				serial bus LISTENA on command channel
.C:cc91  A2 EA       LDX #$EA
.C:cc93  BD F8 CC    LDA $CCF8,X			sends "M-E" dos command stored in data loaded near end of file "HE"
.C:cc96  20 A8 FF    JSR $FFA8				serial byte out
.C:cc99  E8          INX
.C:cc9a  D0 F7       BNE $CC93
.C:cc9c  20 AE FF    JSR $FFAE				serial bus unlisten (execute sent command)
.C:cc9f  2C 00 DD    BIT $DD00
.C:cca2  70 FB       BVS $CC9F

.C:cca4  78          SEI							SUBROUINTE_HE1_CONTINUED (loader initialization)
.C:cca5  AD 00 DD    LDA $DD00
.C:cca8  29 07       AND #$07
.C:ccaa  85 A4       STA $A4
.C:ccac  8D 00 DD    STA $DD00
.C:ccaf  2C 00 DD    BIT $DD00
.C:ccb2  50 FB       BVC $CCAF
.C:ccb4  A0 03       LDY #$03
.C:ccb6  B1 BB       LDA ($BB),Y			ptr($bb) points to $cdfe as set at .C:cc79  20 BD FF    JSR $FFBD 
																			on first call of SUBROUTINE_HE0
.C:ccb8  85 A5       STA $A5
.C:ccba  A2 08       LDX #$08
.C:ccbc  46 A5       LSR $A5
.C:ccbe  A5 A4       LDA $A4
.C:ccc0  09 10       ORA #$10
.C:ccc2  90 02       BCC $CCC6
.C:ccc4  09 30       ORA #$30
.C:ccc6  E6 A5       INC $A5
.C:ccc8  8D 00 DD    STA $DD00
.C:cccb  C6 A5       DEC $A5
.C:cccd  29 27       AND #$27
.C:cccf  8D 00 DD    STA $DD00
.C:ccd2  CA          DEX
.C:ccd3  D0 E7       BNE $CCBC
.C:ccd5  88          DEY
.C:ccd6  10 DE       BPL $CCB6				loop which sends the bytes at $cdfe..$ce01 in reversed order on serial bus
																			(during first call)
																			all of this looks familiar and similar to the stuff in TurricanI, so I guess I can skip
																			analyzing too much here and just find out where loaded stuff ends up in RAM
.C:ccd8  90 19       BCC $CCF3
.C:ccda  A5 A4       LDA $A4
.C:ccdc  8D 00 DD    STA $DD00
.C:ccdf  88          DEY
.C:cce0  D0 FD       BNE $CCDF
.C:cce2  B1 BB       LDA ($BB),Y
.C:cce4  0A          ASL A
.C:cce5  10 07       BPL $CCEE
.C:cce7  2C 00 DD    BIT $DD00
.C:ccea  10 FB       BPL $CCE7
.C:ccec  50 F9       BVC $CCE7
.C:ccee  A9 2C       LDA #$2C				 $2C is opcode for BIT
.C:ccf0  4C DD CD    JMP $CDDD			 jmp ahead to where code eliminates jmp instruction at cc84 
.C:ccf3  09 20       ORA #$20
.C:ccf5  8D 00 DD    STA $DD00
.C:ccf8  AD 11 D0    LDA $D011
.C:ccfb  8D D5 CD    STA $CDD5
.C:ccfe  29 EF       AND #$EF
.C:cd00  8D 11 D0    STA $D011
.C:cd03  AD 12 D0    LDA $D012
.C:cd06  D0 FB       BNE $CD03
.C:cd08  A0 3F       LDY #$3F
.C:cd0a  A9 07       LDA #$07
.C:cd0c  8D 00 DD    STA $DD00
.C:cd0f  2C 00 DD    BIT $DD00
.C:cd12  50 FB       BVC $CD0F
.C:cd14  2C 00 DD    BIT $DD00
.C:cd17  10 02       BPL $CD1B
.C:cd19  46 A5       LSR $A5
.C:cd1b  2C 00 DD    BIT $DD00
.C:cd1e  50 02       BVC $CD22
.C:cd20  A6 A5       LDX $A5
.C:cd22  2C 00 DD    BIT $DD00
.C:cd25  50 00       BVC $CD27
.C:cd27  A1 A5       LDA ($A5,X)
.C:cd29  AD 00 DD    LDA $DD00
.C:cd2c  4A          LSR A
.C:cd2d  4A          LSR A
.C:cd2e  4D 00 DD    EOR $DD00
.C:cd31  4A          LSR A
.C:cd32  4A          LSR A
.C:cd33  4D 00 DD    EOR $DD00
.C:cd36  4A          LSR A
.C:cd37  4A          LSR A
.C:cd38  4D 00 DD    EOR $DD00
.C:cd3b  48          PHA
.C:cd3c  AD 00 DD    LDA $DD00
.C:cd3f  4A          LSR A
.C:cd40  4A          LSR A
.C:cd41  4D 00 DD    EOR $DD00
.C:cd44  C0 20       CPY #$20
.C:cd46  B0 13       BCS $CD5B
.C:cd48  4A          LSR A
.C:cd49  4A          LSR A
.C:cd4a  4D 00 DD    EOR $DD00
.C:cd4d  4A          LSR A
.C:cd4e  4A          LSR A
.C:cd4f  4D 00 DD    EOR $DD00
.C:cd52  48          PHA
.C:cd53  AD 00 DD    LDA $DD00
.C:cd56  4A          LSR A
.C:cd57  4A          LSR A
.C:cd58  4D 00 DD    EOR $DD00
.C:cd5b  4A          LSR A
.C:cd5c  4A          LSR A
.C:cd5d  4D 00 DD    EOR $DD00
.C:cd60  4A          LSR A
.C:cd61  4A          LSR A
.C:cd62  4D 00 DD    EOR $DD00
.C:cd65  48          PHA
.C:cd66  EA          NOP
.C:cd67  AD 00 DD    LDA $DD00
.C:cd6a  4A          LSR A
.C:cd6b  4A          LSR A
.C:cd6c  4D 00 DD    EOR $DD00
.C:cd6f  4A          LSR A
.C:cd70  4A          LSR A
.C:cd71  4D 00 DD    EOR $DD00
.C:cd74  4A          LSR A
.C:cd75  4A          LSR A
.C:cd76  4D 00 DD    EOR $DD00
.C:cd79  48          PHA
.C:cd7a  EA          NOP
.C:cd7b  88          DEY
.C:cd7c  10 A4       BPL $CD22
.C:cd7e  A5 A4       LDA $A4
.C:cd80  09 20       ORA #$20
.C:cd82  8D 00 DD    STA $DD00
.C:cd85  68          PLA
.C:cd86  8D B5 CD    STA $CDB5
.C:cd89  68          PLA
.C:cd8a  85 90       STA $90
.C:cd8c  A5 A5       LDA $A5
.C:cd8e  D0 0E       BNE $CD9E
.C:cd90  68          PLA
.C:cd91  AA          TAX
.C:cd92  68          PLA
.C:cd93  A4 B9       LDY $B9
.C:cd95  F0 04       BEQ $CD9B
.C:cd97  86 AE       STX $AE
.C:cd99  85 AF       STA $AF					 load address now in $ae $af so break at $cd9b to find start of loaded data
*** break here to find start of loadings in $ae $af
.C:cd9b  A2 DC       LDX #$DC
.C:cd9d  2C A2 DE    BIT $DEA2
.C:cda0  86 A5       STX $A5
.C:cda2  A0 00       LDY #$00
.C:cda4  A5 01       LDA $01
.C:cda6  8D CA CD    STA $CDCA					store as parameter for restoring memory cfg after load finishes
.C:cda9  29 FC       AND #$FC						mask out bit 0 and bit 1 to..
.C:cdab  85 01       STA $01						..make all RAM accessible for storing received bytes
.C:cdad  68          PLA
.C:cdae  24 90       BIT $90
.C:cdb0  30 09       BMI $CDBB
.C:cdb2  50 04       BVC $CDB8
.C:cdb4  C0 00       CPY #$00
.C:cdb6  B0 03       BCS $CDBB
.C:cdb8  91 AE       STA ($AE),Y				this appears to be where loaded bytes are placed to their destination in RAM
.C:cdba  C8          INY
.C:cdbb  CA          DEX
.C:cdbc  D0 EF       BNE $CDAD
.C:cdbe  98          TYA
.C:cdbf  18          CLC
.C:cdc0  65 AE       ADC $AE
.C:cdc2  85 AE       STA $AE
.C:cdc4  AA          TAX
.C:cdc5  90 02       BCC $CDC9
.C:cdc7  E6 AF       INC $AF
*** break here to find end of loadings (if $90 != $00) and dump while all RAM is accessible (roms off, 
.C:cdc9  A9 00       LDA #$00
.C:cdcb  85 01       STA $01
.C:cdcd  A5 90       LDA $90
.C:cdcf  D0 03       BNE $CDD4					on any error/or flag, stop receiving and storing
.C:cdd1  4C 08 CD    JMP $CD08					otherwise continue
.C:cdd4  A9 1B       LDA #$1B
.C:cdd6  8D 11 D0    STA $D011
.C:cdd9  A4 AF       LDY $AF
.C:cddb  A9 4C       LDA #$4C						$4C is JMP opcode but coming from .C:ccf0  4C DD CD    JMP $CDDD ..
.C:cddd  8D 84 CC    STA $CC84          .. A still hold $2C which is BIT opcode, so initialization of loader runs only once
.C:cde0  58          CLI
.C:cde1  60          RTS
mcmd: m cde2 cdff
>C:cde2  4d 2d 45 05  02 a9 00 20  2f d0 a9 11  85 06 85 07   M-E.... /.......		"M-E" memory execute CBM DOS command
>C:cdf2  20 86 d5 4c  03 03 11 06  44 45 52 65  c0 9f          ..L....DERe..

*** so, in order to find the first loadings for dumping
mcmd: break cd9b
(check pointer $ae $af for start of data)
mcmd: break cdc9 if @ram:$0090 != $00
(check pointer $ae $af again (subtract 1 for end of data))

before call 0 to SUBROUTINE_LOAD1 loader control codes: $13, $00
mcmd: break C:0363
loads to: 0800 6fff
dumped as
mcmd: s "0" 0 0800 6fff

before call 1 to SUBROUTINE_LOAD1	loader control codes: $11, $03
mcmd: break C:0370  
loads to: 7000 ab17
dumped as
mcmd: s "1" 0 7000 ab17

before call 2 to SUBROUTINE_LOAD1 loader control codes: $C0, $00
mcmd: break C:037d
loads to: nowhere, so it's probably just a loader control code for de-initialization

next up, investigate what happens in the subroutine and after the jmp, after that data was loaded and partly relocated to cc00

.C:03a8  20 00 CC    JSR $CC00				call SUBROUTINE_PREPARE_LOADER_STAGE_B ( *** patch/replacement loader should ignore this )
.C:03ab  4C 3D 7B    JMP $7B3D				then jump away thus leaving this first piece of boot code...

mcmd: d cc00
(instantly looks familiar to what I've seen in TurricanI loader code)
.C:cc00  A9 BC       LDA #$BC					SUBROUTINE_PREPARE_LOADER_STAGE_B (uploads and executes drive-code)
.C:cc02  85 FB       STA $FB
.C:cc04  A9 CC       LDA #$CC
.C:cc06  85 FC       STA $FC					ptr($fb) to $ccbc
.C:cc08  A9 00       LDA #$00
.C:cc0a  85 A9       STA $A9
.C:cc0c  A9 04       LDA #$04
.C:cc0e  85 AA       STA $AA					ptr($a9) to $0400 (drive buffer address)

.C:cc10  A9 08       LDA #$08
.C:cc12  20 B1 FF    JSR $FFB1				listen device 8
.C:cc15  A9 6F       LDA #$6F         channel 15 = command channel
.C:cc17  20 93 FF    JSR $FF93				listenA command channel
.C:cc1a  A9 4D       LDA #$4D					"M"
.C:cc1c  20 A8 FF    JSR $FFA8
.C:cc1f  A9 2D       LDA #$2D					"-"
.C:cc21  20 A8 FF    JSR $FFA8
.C:cc24  A9 57       LDA #$57					"W" CBM DOS command memory write
.C:cc26  20 A8 FF    JSR $FFA8
.C:cc29  A5 A9       LDA $A9
.C:cc2b  20 A8 FF    JSR $FFA8
.C:cc2e  A5 AA       LDA $AA				
.C:cc30  20 A8 FF    JSR $FFA8				sent address $0400 to drive (where received bytes will be stored)
.C:cc33  A9 20       LDA #$20         opcode for JSR
.C:cc35  20 A8 FF    JSR $FFA8				
.C:cc38  A2 00       LDX #$00
.C:cc3a  A0 00       LDY #$00

.C:cc3c  B1 FB       LDA ($FB),Y
.C:cc3e  20 A8 FF    JSR $FFA8
.C:cc41  E6 FB       INC $FB
.C:cc43  D0 02       BNE $CC47
.C:cc45  E6 FC       INC $FC
.C:cc47  E8          INX
.C:cc48  E0 20       CPX #$20
.C:cc4a  D0 F0       BNE $CC3C				loop sent 32 bytes starting from $ccbc to drive buffer $0401 ($0400 was set to a JSR instruction)
																		  during first run of this loop
.C:cc4c  20 AE FF    JSR $FFAE				unlisten (causes "M-W" to process)
.C:cc4f  18          CLC
.C:cc50  A5 A9       LDA $A9
.C:cc52  69 20       ADC #$20					target address in drive += 32
.C:cc54  90 02       BCC $CC58
.C:cc56  E6 AA       INC $AA
.C:cc58  85 A9       STA $A9
.C:cc5a  A5 AA       LDA $AA
.C:cc5c  C9 08       CMP #$08					reached $0800
.C:cc5e  D0 B0       BNE $CC10				loop until drive buffer $0400 to $7ff was filled
																			with: JSR,[$ccbc..d0bb] (IO was active here though so the D000..D0BB portion are VIC register reads)

.C:cc60  A9 08       LDA #$08
.C:cc62  20 B1 FF    JSR $FFB1				listen device 8
.C:cc65  A9 6F       LDA #$6F
.C:cc67  20 93 FF    JSR $FF93				listenA command channel 15
.C:cc6a  A9 4D       LDA #$4D					"M"
.C:cc6c  20 A8 FF    JSR $FFA8
.C:cc6f  A9 2D       LDA #$2D					"-"
.C:cc71  20 A8 FF    JSR $FFA8
.C:cc74  A9 45       LDA #$45					"E" CBM DOS command memory execute
.C:cc76  20 A8 FF    JSR $FFA8	
.C:cc79  A9 03       LDA #$03
.C:cc7b  20 A8 FF    JSR $FFA8
.C:cc7e  A9 04       LDA #$04
.C:cc80  20 A8 FF    JSR $FFA8				start address of code in drive $0403
.C:cc83  20 AE FF    JSR $FFAE				unlisten (causes drive to start executing the code at $0403)
.C:cc86  A9 08       LDA #$08
.C:cc88  20 B1 FF    JSR $FFB1				listen device 8
.C:cc8b  A9 6F       LDA #$6F
.C:cc8d  20 93 FF    JSR $FF93				listenA command channel 15
.C:cc90  A9 4D       LDA #$4D					"M"
.C:cc92  20 A8 FF    JSR $FFA8
.C:cc95  A9 2D       LDA #$2D					"-"
.C:cc97  20 A8 FF    JSR $FFA8
.C:cc9a  A9 45       LDA #$45					"E" CBM DOS command memory execute
.C:cc9c  20 A8 FF    JSR $FFA8
.C:cc9f  A9 83       LDA #$83
.C:cca1  20 A8 FF    JSR $FFA8
.C:cca4  A9 04       LDA #$04
.C:cc76  20 A8 FF    JSR $FFA8				start address of code in drive $0483 ?
.C:cc79  A9 03       LDA #$03
.C:cc7b  20 A8 FF    JSR $FFA8
.C:cc7e  A9 04       LDA #$04
.C:cc80  20 A8 FF    JSR $FFA8				..now $0403 again ?
.C:cc83  20 AE FF    JSR $FFAE				unlisten (causes drive to start executing the code at ?)
.C:cc86  A9 08       LDA #$08
.C:cc88  20 B1 FF    JSR $FFB1				listen device 8	
.C:cc8b  A9 6F       LDA #$6F
.C:cc8d  20 93 FF    JSR $FF93				listenA command channel 15
.C:cc90  A9 4D       LDA #$4D					"M"
.C:cc92  20 A8 FF    JSR $FFA8
.C:cc95  A9 2D       LDA #$2D					"-"						
.C:cc97  20 A8 FF    JSR $FFA8
.C:cc9a  A9 45       LDA #$455				"E" CBM DOS command memory execute
.C:cc9c  20 A8 FF    JSR $FFA8
.C:cc9f  A9 83       LDA #$83
.C:cca1  20 A8 FF    JSR $FFA8				start address of code in drive $0483
.C:cca4  A9 04       LDA #$04
.C:cca6  20 A8 FF    JSR $FFA8				..now half an address was sent ??
.C:cca9  20 AE FF    JSR $FFAE				unlisten (causes drive to start executing the code at ??)
.C:ccac  A9 C7       LDA #$C7					#%1100 0111
.C:ccae  8D 00 DD    STA $DD00				sbus data in 1, clock pulse in 1, atn 1, rs232 data out 1, vic mem select 1(0 would be active)
.C:ccb1  A2 00       LDX #$00
.C:ccb3  A0 00       LDY #$00
.C:ccb5  88          DEY
.C:ccb6  D0 FD       BNE $CCB5
.C:ccb8  CA          DEX
.C:ccb9  D0 FA       BNE $CCB5				idle idle eee, idle idle ooo
.C:ccbb  60          RTS
.C:ccbc .. cfff drive-code that gets sent to drive 8


coming from .C:03ab  4C 3D 7B    JMP $7B3D
inside code loaded from file "1"
.C:7b3d  78          SEI						START_OF_CODE_WHICH_RUNS_THE_ENTIRE_INTRO_WITHOUT_EXTRA_LOADINGS_WHILE_IT_RUNS (!)
.C:7b3e  A9 00       LDA #$00
.C:7b40  8D 20 D0    STA $D020			black border
.C:7b43  8D 15 D0    STA $D015			sprites off
.C:7b46  A9 25       LDA #$25
.C:7b48  8D 04 DC    STA $DC04			CIA1+4:   Timer A Low-Byte (Kernal-IRQ, Tape)
.C:7b4b  A9 40       LDA #$40
.C:7b4d  8D 05 DC    STA $DC05			CIA1+5:   Timer A High-Byte (Kernal-IRQ, Tape)
.C:7b50  A9 81       LDA #$81
.C:7b52  8D 0D DC    STA $DC0D			CIA1+13:  Interrupt (IRQ) Control Register, to default value (TimerA active)
.C:7b55  A9 91       LDA #$91				#%1001 0001
.C:7b57  8D 0E DC    STA $DC0E			clock 50hz, force load timer A, start timer A
.C:7b5a  AD 11 D0    LDA $D011			
.C:7b5d  10 FB       BPL $7B5A			wait for rasterline 256
.C:7b5f  A9 6B       LDA #$6B				#%0110 1011
.C:7b61  8D 11 D0    STA $D011			ext. color text mode on, bitmap mode on, screen blank, 25 rows, scroll-y 3
.C:7b64  A9 79       LDA #$79
.C:7b66  85 1B       STA $1B
.C:7b68  A9 7F       LDA #$7F
.C:7b6a  48          PHA
.C:7b6b  20 B4 8D    JSR $8DB4			call SUBROUTINE_ZEROES_TO_BB00_BEFF_ALSO_DC00_FF3F

												.C:8db4  A9 34       LDA #$34				SUBROUTINE_ZEROES_TO_BB00_BEFF_ALSO_DC00_FF3F
												.C:8db6  85 01       STA $01				select RAM, RAM, RAM
												.C:8db8  A9 00       LDA #$00
												.C:8dba  85 02       STA $02
												.C:8dbc  A9 DC       LDA #$DC
												.C:8dbe  85 03       STA $03				ptr($02) to $DC00 (under IO)
												.C:8dc0  A0 00       LDY #$00
												.C:8dc2  98          TYA						A = Y = 0

												.C:8dc3  99 00 BB    STA $BB00,Y
												.C:8dc6  99 00 BC    STA $BC00,Y
												.C:8dc9  99 00 BD    STA $BD00,Y
												.C:8dcc  99 00 BE    STA $BE00,Y
												.C:8dcf  C8          INY
												.C:8dd0  D0 F1       BNE $8DC3			loop clears $BB00..$BEFF

												.C:8dd2  91 02       STA ($02),Y
												.C:8dd4  E6 02       INC $02
												.C:8dd6  D0 02       BNE $8DDA
												.C:8dd8  E6 03       INC $03
												.C:8dda  A6 03       LDX $03
												.C:8ddc  E0 FF       CPX #$FF
												.C:8dde  D0 F2       BNE $8DD2
												.C:8de0  A6 02       LDX $02
												.C:8de2  E0 40       CPX #$40
												.C:8de4  D0 EC       BNE $8DD2			if ptr($02) != $FF40 loop so this loop clears $DC00..$FF3F

												.C:8de6  60          RTS

.C:7b6e  E6 01       INC $01				was #$34, so becomes #$35, select RAM, IO, RAM

.C:7b70  A9 7F       LDA #$7F       #%0111 1111 
.C:7b72  8D 0D DC    STA $DC0D			CIA1+13:  Interrupt (IRQ) Control Register, clear all irqs by CIA1
.C:7b75  AD 0D DC    LDA $DC0D			read to clear register

.C:7b78  A9 29       LDA #$29
.C:7b7a  8D FE FF    STA $FFFE
.C:7b7d  A9 7D       LDA #$7D
.C:7b7f  8D FF FF    STA $FFFF			set irq handler to $7d29 IRQ_HANDLER_0

												.C:7d29  85 0F       STA $0F				save A in $0F				IRQ_HANDLER_0
												.C:7d2b  86 10       STX $10				save X in $10
												.C:7d2d  84 11       STY $11				save Y in $11
												.C:7d2f  A5 01       LDA $01
												.C:7d31  85 12       STA $12				save memcfg state in $12
												.C:7d33  A9 35       LDA #$35
												.C:7d35  85 01       STA $01				select RAM, IO, RAM
												.C:7d37  A2 05       LDX #$05
												.C:7d39  CA          DEX
												.C:7d3a  D0 FD       BNE $7D39			idle a bit
												.C:7d3c  A9 6B       LDA #$6B
												.C:7d3e  8D 11 D0    STA $D011			ext. col txt on, bmp on, screen blank, 25 rows, scroll-y 3
												.C:7d41  A9 D8       LDA #$D8				#%1101 1000
												.C:7d43  8D 16 D0    STA $D016			multicolor mode 1, 40 columns
												.C:7d46  A9 03       LDA #$03				#%0000 0011
												.C:7d48  8D 00 DD    STA $DD00			VIC bank select 0 (lowest two bits inverted)
												.C:7d4b  A9 10       LDA #$10				#%0001 0000
												.C:7d4d  8D 18 D0    STA $D018			VIC screen 1 ($0400..$7ff), charset 0 
												.C:7d50  A9 F6       LDA #$F6
												.C:7d52  8D 12 D0    STA $D012			set raster cmp low to line 246
												.C:7d55  A9 A9       LDA #$A9
												.C:7d57  8D FE FF    STA $FFFE
												.C:7d5a  A9 7C       LDA #$7C
												.C:7d5c  8D FF FF    STA $FFFF			set next irq handler to $7ca9 IRQ_HANDLER_1
												.C:7d5f  CE 19 D0    DEC $D019			ack vic irq
												.C:7d62  58          CLI						
												.C:7d63  AD 12 D0    LDA $D012
												.C:7d66  C9 F5       CMP #$F5
												.C:7d68  D0 F9       BNE $7D63			idle until line 245
												.C:7d6a  EA          NOP
												.C:7d6b  EA          NOP
												.C:7d6c  EA          NOP
												.C:7d6d  EA          NOP
												.C:7d6e  EA          NOP
												.C:7d6f  EA          NOP
												.C:7d70  EA          NOP
												.C:7d71  EA          NOP
												.C:7d72  EA          NOP						IRQ_HANDLER_1 is probably triggered somewhere during this
												.C:7d73  EA          NOP            NOP field because it was set to line 246, just one line below
												.C:7d74  EA          NOP						this current handler
												.C:7d75  EA          NOP
												.C:7d76  EA          NOP
												.C:7d77  EA          NOP
												.C:7d78  EA          NOP
												.C:7d79  EA          NOP
												.C:7d7a  EA          NOP
												.C:7d7b  EA          NOP
												.C:7d7c  EA          NOP
												.C:7d7d  EA          NOP
												.C:7d7e  4C D0 7F    JMP $7FD0			to IRQ_HANDLER_0_CONTINUED
																																										IRQ_HANDLER_0_CONTINUED
																							( at .C:7b92  85 15       STA $15					ptr($14) to $94C4 )
																							.C:7fd0  B1 14       LDA ($14),Y			
																							.C:7fd2  4D 77 02    EOR $0277
																							.C:7fd5  38          SEC
																							.C:7fd6  ED 01 08    SBC $0801
																							.C:7fd9  45 1B       EOR $1B
																							.C:7fdb  48          PHA
																							.C:7fdc  A5 1B       LDA $1B
																							.C:7fde  4D 77 02    EOR $0277
																							.C:7fe1  85 1B       STA $1B
																							.C:7fe3  18          CLC
																							.C:7fe4  AD 01 08    LDA $0801
																							.C:7fe7  65 1B       ADC $1B
																							.C:7fe9  8D 01 08    STA $0801
																							.C:7fec  AD 77 02    LDA $0277
																							.C:7fef  4D 01 08    EOR $0801
																							.C:7ff2  8D 77 02    STA $0277
																							.C:7ff5  68          PLA
																							.C:7ff6  60          RTS


.C:7b82  A9 28       LDA #$28
.C:7b84  8D FA FF    STA $FFFA
.C:7b87  A9 7D       LDA #$7D
.C:7b89  8D FB FF    STA $FFFB			set nmi handler to $7d28 NMI_HANDLER_0

												.C:7d28  40          RTI				NMI_HANDLER_0

.C:7b8c  A9 C4       LDA #$C4
.C:7b8e  85 14       STA $14
.C:7b90  A9 94       LDA #$94
.C:7b92  85 15       STA $15					ptr($14) to $94C4 or those two bytes as flags in those locs
.C:7b94  A9 00       LDA #$00
.C:7b96  8D 00 DD    STA $DD00				clear CIA2 data port A (serial bus) 
.C:7b99  20 00 80    JSR $8000				a common SID tune initialization location..
											.C:8000  4C 88 82    JMP $8288      yup..
											.C:8003  4C B7 82    JMP $82B7			..in there SID registers get written so these 3 are music/sound..
											.C:8006  4C 57 82    JMP $8257      ..related

.C:7b9c  A9 13       LDA #$13
.C:7b9e  8D 01 08    STA $0801				used at .C:7fd6  ED 01 08    SBC $0801

.C:7ba1  A2 2E       LDX #$2E
.C:7ba3  BD 47 A2    LDA $A247,X
.C:7ba6  9D 00 D0    STA $D000,X
.C:7ba9  CA          DEX
.C:7baa  10 F7       BPL $7BA3				loop writes VIC registers with values from RAM
                     D0......00 01 02 03  04 05 06 07  08 09 0a 0b  0c 0d 0e 0f
										>C:a247  00 f4 30 f4  60 f4 90 f4  c0 f4 f0 f4  20 f4 50 f4   ..0.`....... .P.
                     D0......10 11 12 13  14 15 16 17  18 19 1a 1b  1c 1d 1e 1f
										>C:a257  c0 6b f2 00  00 ff c8 00  78 00 81 00  00 ff 00 00   .k......x.......
                     D0......20 21 22 23  24 25 26 27  28 29 2a 2b  2c 2d 2e   
										>C:a267  00 00 00 00  00 03 0b 0b  0c 0f 01 01  0f 0c 0b      ...............

										 D011 got 6b, so screen is still blank
										 sprite X positions start from 0 and are advanced by 3x16 = 48 (width of an x-expanded sprite)
                     in each position, so these are probably the sprite setting for the lower border for the intro
                     scrolltext
                     sprite Y are line 244 for all sprites

                     D018 got #$78 but by the time C:7bb6 executes it is #$79, suggesting it gets changed by an interrupt
										 (screen 7, charset 4) and later charset 5

.C:7bac  A2 07       LDX #$07
.C:7bae  A0 17       LDY #$17
.C:7bb0  98          TYA
.C:7bb1  9D F8 07    STA $07F8,X
.C:7bb4  88          DEY
.C:7bb5  CA          DEX
.C:7bb6  10 F8       BPL $7BB0			loop sets sprite pointers at end of screen RAM $0400..$07ff (screen 1, bank 0)
																		to abs RAM locs: $05c0 $0580 $0540 $0500 $04c0 $0480 $0440 $0400
                                          sprite  #: 8     7     6     5     4     3     2     1 

.C:7bb8  E8          INX						in effect X = 0
.C:7bb9  8A          TXA						so A = 0
.C:7bba  9D 00 04    STA $0400,X
.C:7bbd  9D 00 05    STA $0500,X
.C:7bc0  E8          INX
.C:7bc1  D0 F7       BNE $7BBA			loop clears sprite data for the sprite pointers set in previous loop
                                    (intro scrolltext is rendered into these sprites later)

.C:7bc3  20 79 8D    JSR $8D79			call SUBROUTINE_1_1

.C:7bc6  A9 D3       LDA #$D3
.C:7bc8  8D 77 02    STA $0277
.C:7bcb  4E 19 D0    LSR $D019			dirty VIC irq ack all
.C:7bce  58          CLI						previously at .C:7b3d  78          SEI

*** INTRO STARTS RUNNING HERE, CODE EXECUTION WILL NEVER REACH THE NEXT INSTRUCTION (at C:7bcf) ***
(even loading of the mainscreen starts somewhere else...)

Intro can be skipped by pressing space though, so placing a watch on CIA1 Data Port B should give a clue for where to start looking for
the next loads.

mcmd: watch load dc01

.C:7bcf  A2 00       LDX #$00
.C:7bd1  A9 F1       LDA #$F1
.C:7bd3  48          PHA
.C:7bd4  86 0E       STX $0E
.C:7bd6  8A          TXA
.C:7bd7  F0 0B       BEQ $7BE4
.C:7bd9  BD 6C 91    LDA $916C,X
.C:7bdc  F0 03       BEQ $7BE1
.C:7bde  20 B4 8D    JSR $8DB4
.C:7be1  20 79 8D    JSR $8D79			call SUBROUTINE_1_1
.C:7be4  20 2D 7E    JSR $7E2D
.C:7be7  A9 00       LDA #$00
.C:7be9  20 E7 8D    JSR $8DE7

.C:7bec  A9 35       LDA #$35
.C:7bee  85 01       STA $01
.C:7bf0  AD 01 DC    LDA $DC01			CIA1+0:   Data Port A (Keyboard, Joystick, Paddles)
.C:7bf3  2D 00 DC    AND $DC00			use joystick A state as mask (joy left accelerates scrolltext)
.C:7bf6  29 10       AND #$10				check bit 4 ( keyboard column including "space" ), the bits are pulled to 0 if joy/key is down
.C:7bf8  F0 1F       BEQ $7C19			branch if space or joy button pressed
.C:7bfa  C6 01       DEC $01
.C:7bfc  AD 2A 7E    LDA $7E2A
.C:7bff  F0 EB       BEQ $7BEC
.C:7c01  A9 00       LDA #$00				executes everytime screen change is about to happen during intro
.C:7c03  8D 2A 7E    STA $7E2A
.C:7c06  A6 0E       LDX $0E
.C:7c08  BD 7C 91    LDA $917C,X
.C:7c0b  F0 05       BEQ $7C12
.C:7c0d  20 E7 8D    JSR $8DE7			call SUBROUTINE_1_2
.C:7c10  A6 0E       LDX $0E				intro screen index?
.C:7c12  E8          INX						next intro screen?
.C:7c13  E0 10       CPX #$10				done? (after 15 screen changes)
.C:7c15  D0 BD       BNE $7BD4			
.C:7c17  F0 25       BEQ $7C3E

.C:7c19  A9 00       LDA #$00				first address executed if intro is skipped
.C:7c1b  20 E7 8D    JSR $8DE7			call SUBROUTINE_1_2
.C:7c1e  A9 35       LDA #$35
.C:7c20  85 01       STA $01
.C:7c22  A0 13       LDY #$13
.C:7c24  AD D2 D0    LDA $D0D2
.C:7c27  C9 64       CMP #$64
.C:7c29  D0 F9       BNE $7C24

.C:7c2b  A2 07       LDX #$07
.C:7c2d  B9 87 A2    LDA $A287,Y
.C:7c30  9D 27 D0    STA $D027,X
.C:7c33  CA          DEX
.C:7c34  10 F7       BPL $7C2D				loop to set sprite colors for 8 sprites

.C:7c36  A2 14       LDX #$14
.C:7c38  CA          DEX
.C:7c39  D0 FD       BNE $7C38
.C:7c3b  88          DEY
.C:7c3c  10 E6       BPL $7C24

.C:7c3e  A9 34       LDA #$34					INTRO IS FINISHED here
.C:7c40  85 01       STA $01					select RAM, RAM, RAM
.C:7c42  A2 00       LDX #$00

.C:7c44  BD E5 8F    LDA $8FE5,X
.C:7c47  9D 00 CC    STA $CC00,X
.C:7c4a  BD 9B A2    LDA $A29B,X
.C:7c4d  9D 00 D8    STA $D800,X
.C:7c50  BD 9B A3    LDA $A39B,X
.C:7c53  9D 00 D9    STA $D900,X
.C:7c56  BD 18 A8    LDA $A818,X
.C:7c59  9D 00 69    STA $6900,X			*** patch NOP out the relocs targeting 6900 to 6b00 because that is where replacement loader shooshoo
.C:7c5c  BD 18 A9    LDA $A918,X          will be put after running the intro
.C:7c5f  9D 00 6A    STA $6A00,X
.C:7c62  BD 18 AA    LDA $AA18,X
.C:7c65  9D 00 6B    STA $6B00,X
.C:7c68  E8          INX
.C:7c69  D0 D9       BNE $7C44				loop relocates some code/data (interleaved again, because lda abs,x can't read beyond its initial page)

.C:7c6b  A2 07       LDX #$07					*** inject first bunch of shooshoo patches here (after the code targeted by them was reloc'd)
.C:7c6d  A0 67       LDY #$67
.C:7c6f  98          TYA
.C:7c70  9D F8 DF    STA $DFF8,X
.C:7c73  88          DEY
.C:7c74  CA          DEX
.C:7c75  10 F8       BPL $7C6F				loop to set sprite pointers at end of screen 7, bank 3
.C:7c77  E6 01       INC $01					select RAM, IO, RAM
.C:7c79  AD 12 D2    LDA $D212
.C:7c7c  C9 98       CMP #$98
.C:7c7e  D0 F9       BNE $7C79				wait for raster line $98

.C:7c80  A2 10       LDX #$10
.C:7c82  BD 76 A2    LDA $A276,X
.C:7c85  9D 00 D0    STA $D000,X
.C:7c88  CA          DEX
.C:7c89  10 F7       BPL $7C82				loop to set sprite X,Y for 8 sprites "LOADING" letters in lower border

.C:7c8b  86 19       STX $19					$19 = #$FF
.C:7c8d  E8          INX							in effect X = 0
.C:7c8e  8E 1D D0    STX $D01D				disable sprite X expand for all sprites
.C:7c91  A9 28       LDA #$28
.C:7c93  85 18       STA $18

.C:7c95  A9 00       LDA #$00				*** patch nop out this irq vector setting
.C:7c97  8D FE FF    STA $FFFE
.C:7c9a  A9 CC       LDA #$CC
.C:7c9c  8D FF FF    STA $FFFF				set irq handler to $CC00 (the code there was written in loop at .C:7c47  9D 00 CC    STA $CC00,X )
                                    -------------------------------------------------------------
																		.C:cc00  48          PHA							IRQ_HANDLER_AFTER_INTRO
																		.C:cc01  8A          TXA
																		.C:cc02  48          PHA
																		.C:cc03  98          TYA
																		.C:cc04  48          PHA
																		.C:cc05  CE 19 D0    DEC $D019			
																		.C:cc08  A2 07       LDX #$07					*** patch entry from replacement irq
																		.C:cc0a  A9 01       LDA #$01
																		.C:cc0c  9D 27 D0    STA $D027,X
																		.C:cc0f  CA          DEX
																		.C:cc10  10 FA       BPL $CC0C
																		.C:cc12  8E 1C D0    STX $D01C
																		.C:cc15  AD D2 D2    LDA $D2D2
																		.C:cc18  C9 F9       CMP #$F9
																		.C:cc1a  D0 F9       BNE $CC15
																		.C:cc1c  EA          NOP
																		.C:cc1d  EA          NOP
																		.C:cc1e  EA          NOP
																		.C:cc1f  A9 33       LDA #$33
																		.C:cc21  8D 11 D1    STA $D111
																		.C:cc24  A6 19       LDX $19
																		.C:cc26  D0 0C       BNE $CC34
																		.C:cc28  AD 01 D0    LDA $D001
																		.C:cc2b  69 18       ADC #$18
																		.C:cc2d  CD 12 D0    CMP $D012
																		.C:cc30  D0 FB       BNE $CC2D
																		.C:cc32  F0 03       BEQ $CC37
																		.C:cc34  20 03 80    JSR $8003
																		.C:cc37  A9 3B       LDA #$3B
																		.C:cc39  8D 51 D2    STA $D251
																		.C:cc3c  AD 91 D3    LDA $D391
																		.C:cc3f  30 FB       BMI $CC3C
																		.C:cc41  A2 07       LDX #$07
																		.C:cc43  A9 00       LDA #$00
																		.C:cc45  9D 27 D0    STA $D027,X
																		.C:cc48  CA          DEX
																		.C:cc49  10 FA       BPL $CC45
																		.C:cc4b  8D 1C D0    STA $D01C
																		.C:cc4e  C6 18       DEC $18
																		.C:cc50  10 20       BPL $CC72
																		.C:cc52  A9 05       LDA #$05
																		.C:cc54  85 18       STA $18
																		.C:cc56  AD 01 D0    LDA $D001
																		.C:cc59  C9 F8       CMP #$F8					resting y pos for "LOADING" sprites
																		.C:cc5b  F0 15       BEQ $CC72				if reached, skip moving them..
																		.C:cc5d  CE 01 D0    DEC $D001				..otherwise move them up
																		.C:cc60  CE 03 D0    DEC $D003
																		.C:cc63  CE 05 D0    DEC $D005
																		.C:cc66  CE 07 D0    DEC $D007
																		.C:cc69  CE 09 D0    DEC $D009
																		.C:cc6c  CE 0B D0    DEC $D00B
																		.C:cc6f  CE 0D D0    DEC $D00D					
																		.C:cc72  68          PLA							*** patch this to create subroutine
																		.C:cc73  A8          TAY
																		.C:cc74  68          PLA
																		.C:cc75  AA          TAX
																		.C:cc76  68          PLA
																		.C:cc77  40          RTI	     END OF IRQ_HANDLER_AFTER_INTRO
                                    -------------------------------------------------------------

.C:7c9f  A9 F2       LDA #$F2
.C:7ca1  8D D2 D2    STA $D2D2				request rasterline irq at #$F2 (line 242, probably to open lower border in there)
*** patch probably needs to be injected right here or even before setting the new irq handler
(locations $0600 $07f7 appear unused/undisturbed by intro, so initial patch code could linger there)
(and it must do its magic before the first next file is loaded because that will clobber 0400..67ff)
(          $ab20 $baff also have not been used yet ... will put the replacment loader here while the intro runs because
                                                       otherwise it would clobber some of the intro graphics)
(also, the loader-receiver code appears to be located at $6900 $6bf6 so that range is up for grabs by loader replacement code)
.C:7ca4  6C E0 8F    JMP ($8FE0)			jumps to $CC78
>C:7ca7  7e 7d                                                ~}
... irrelevant for the moment, just looking for loader code


.C:cc78  A2 2E       LDX #$2E
.C:cc7a  A0 2E       LDY #$2E
.C:cc7c  20 90 69    JSR $6990			looks familiar like the loader calls in TurricanI  *** patch this
loads $0400 to $67ff from hidden file/data delivered by drive-code
dumped as "2"
------------------------Beginning of second loader stage (shortened to interesting fragments because of similarity to Turrican 1)-------------
                        .C:6900
												...............................
												.C:6990  4C 9F 69    JMP $699F			entry from .C:cc7c  20 90 69    JSR $6990
												.C:6993  4C 37 69    JMP $6937
												.C:6996  4C 08 69    JMP $6908
												.C:6999  60          RTS
												.C:699a  EA          NOP
												.C:699b  EA          NOP
												.C:699c  4C 00 69    JMP $6900
												...............................
												.C:69a3  20 BB 6B    JSR $6BBB
												.C:69a6  20 A4 6B    JSR $6BA4
												.C:69a9  A2 04       LDX #$04
												.C:69ab  8C B7 69    STY $69B7
												.C:69ae  20 53 6B    JSR $6B53
												.C:69b1  95 FB       STA $FB,X			interesting, could be the parameters for the load like in Turrican I
												.C:69b3  CA          DEX
												.C:69b4  10 F8       BPL $69AE
*** break here to check the values in fb..ff
mcmd: break C:69b6
mcmd: m fb ff
>C:00fb  f0 00 68 39  47
fc fd is probably top of data+1 like in TurricanI loader, so $67ff here
(yup, confirmed by checking in C64 Debugger (at .C:6b29  91 FC       STA ($FC),Y))

to still find (before it's overwritten) last write location in fc fd (after hitting breakpoint C:69b6 once)
mcmd: break C:69b1 if X == 2
so for the load (initiated by .C:cc7c  20 90 69    JSR $6990):
break C:69b6
m fc fd
>C:00fc  00 68
--> top of received data is $67ff
break C:69b1 if X == 2
m fc fd
>C:00fc  00 04
--> bottom of received data is $0400


												.C:69b6  A0 00       LDY #$00
												.C:69b8  A5 F4       LDA $F4				error/done flag?
												.C:69ba  D0 07       BNE $69C3			branch if != 0
												.C:69bc  20 C4 69    JSR $69C4			receive the
												.C:69bf  A2 04       LDX #$04       next four
												.C:69c1  D0 EE       BNE $69B1			control bytes
												.C:69c3  60          RTS						return on error/done
												.C:69c4  A2 00       LDX #$00
												..............................
												.C:6b1a  A5 FC       LDA $FC
												.C:6b1c  38          SEC
												.C:6b1d  E5 F7       SBC $F7
												.C:6b1f  85 FC       STA $FC
												.C:6b21  B0 02       BCS $6B25
												.C:6b23  C6 FD       DEC $FD
												.C:6b25  20 3E 6B    JSR $6B3E
												.C:6b28  88          DEY
*** break here to double check write target (yup, that's it)
												.C:6b29  91 FC       STA ($FC),Y			also interesting, could be where bytes end up, like in Turrican I
												.C:6b2b  98          TYA              
												.C:6b2c  D0 F7       BNE $6B25
												.C:6b2e  C4 F8       CPY $F8
												.C:6b30  D0 01       BNE $6B33
												.C:6b32  60          RTS
												..............................
												.C:6bf6  4C 81 69    JMP $6981
------------------------End of second loader stage (shortened to interesting fragments because of similarity to Turrican 1)-------------------

										

.C:cc7f  A2 0F       LDX #$0F
.C:cc81  A9 61       LDA #$61
.C:cc83  85 02       STA $02
.C:cc85  A9 1E       LDA #$1E
.C:cc87  85 03       STA $03
.C:cc89  A5 02       LDA $02
.C:cc8b  D0 02       BNE $CC8F
.C:cc8d  C6 03       DEC $03
.C:cc8f  C6 02       DEC $02
.C:cc91  A5 02       LDA $02
.C:cc93  05 03       ORA $03
.C:cc95  D0 F2       BNE $CC89
.C:cc97  8E 29 8A    STX $8A29
.C:cc9a  AD D2 D2    LDA $D2D2
.C:cc9d  C9 88       CMP #$88
.C:cc9f  D0 F9       BNE $CC9A
.C:cca1  CA          DEX
.C:cca2  10 DD       BPL $CC81
.C:cca4  A9 00       LDA #$00
.C:cca6  85 19       STA $19
.C:cca8  A2 1C       LDX #$1C
.C:ccaa  9D 00 D4    STA $D400,X
.C:ccad  CA          DEX
.C:ccae  10 FA       BPL $CCAA					music fade

.C:ccb0  A2 39       LDX #$39
.C:ccb2  A0 25       LDY #$25
.C:ccb4  20 90 69    JSR $6990					*** todo patch this load
loads: 6c00 b932
dumped as "3"

*** accomodate for yet another, third loading mechanism, see below:
break at 6904 to find start address in f1 f2
break at 6964 again to find top of loaded stuff in f1 f2 (-1)

so the upcoming load prepared by .C:ccbd  20 9C 69    JSR $699C
and executed by .C:ccc4  4C 93 69    JMP $6993 (note it's a JMP... it RTS'ed to $7ff2)
loads: 67ff 68fe
dumped as "4"
(the highscore table)

																				*** todo patch this load as well (make sure it ends at $7ff2 as well afterwards with
                                        the same stackpointer as Turrican ( was $f1)) 

.C:ccb7  A9 01       LDA #$01						controls amount of data to load (in this case 1 page)
.C:ccb9  A2 FF       LDX #$FF						ends up in f1
.C:ccbb  A0 67       LDY #$67						ends up in f2, ptr($f1) is used at .C:694c  91 F1       STA ($F1),Y
																				as an address to store received bytes
.C:ccbd  20 9C 69    JSR $699C					***  (inside original loader code, sets an address($YYXX) and a count $AA)
										.C:699c  4C 00 69    JMP $6900
										and at that jmp:
										.C:6900  86 F1       STX $F1
										.C:6902  84 F2       STY $F2			target address for upcoming load into ptr($f1)
										.C:6904  8D F9 6B    STA $6BF9		(used as a counter to control larger outer loop at..
																											 .. .C:695f  CE F9 6B    DEC $6BF9
																										   .. .C:6962  D0 D3       BNE $6937                  )
										.C:6907  60          RTS

.C:ccc0  A2 12       LDX #$12           controls what will be received
.C:ccc2  A0 12       LDY #$12						controls what will be received
.C:ccc4  4C 93 69    JMP $6993					*** (inside original loader code on receiving end(c64))					! note it's JMP not JSR
issues another different load command which loads growing downward to address set by X,Y in JSR $699C
										.C:6993  4C 37 69    JMP $6937
										and at that jmp:
										.C:6937  A9 02       LDA #$02
										.C:6939  20 BB 6B    JSR $6BBB
																				.C:6bbb  8E FA 6B    STX $6BFA				controls what will be received
																				.C:6bbe  8C FB 6B    STY $6BFB				controls what will be received
																				.C:6bc1  48          PHA
																				.C:6bc2  AD 00 DD    LDA $DD00
																				.C:6bc5  29 0F       AND #$0F
																				.C:6bc7  8D 97 6B    STA $6B97
																				.C:6bca  49 10       EOR #$10
																				.C:6bcc  8D 88 6B    STA $6B88
																				.C:6bcf  49 30       EOR #$30
																				.C:6bd1  8D E2 6B    STA $6BE2
																				.C:6bd4  49 B0       EOR #$B0
																				.C:6bd6  8D 67 69    STA $6967
																				.C:6bd9  49 50       EOR #$50
																				.C:6bdb  8D 76 69    STA $6976
																				.C:6bde  8D B1 6B    STA $6BB1
																				.C:6be1  A9 20       LDA #$20
																				.C:6be3  8D 00 DD    STA $DD00				write to serial bus (probably signal to the drive-code)
																				.C:6be6  20 A4 6B    JSR $6BA4
																														.C:6ba4  A0 32       LDY #$32
																														.C:6ba6  88          DEY
																														.C:6ba7  D0 FD       BNE $6BA6			idle a bit (wait for response)
																														.C:6ba9  AD 00 DD    LDA $DD00
																														.C:6bac  29 40       AND #$40
																														.C:6bae  F0 F9       BEQ $6BA9
																														.C:6bb0  A9 C0       LDA #$C0
																														.C:6bb2  8D 00 DD    STA $DD00			another signal to drive-code
																														.C:6bb5  A0 05       LDY #$05
																														.C:6bb7  88          DEY
																														.C:6bb8  D0 FD       BNE $6BB7			idle again
																														.C:6bba  60          RTS
																				.C:6be9  68          PLA
																				.C:6bea  20 81 69    JSR $6981					 sends a byte over serial bus to the drive-code
																														.C:6981  85 F0       STA $F0
																														.C:6983  20 87 6B    JSR $6B87		first two bits
																																								.C:6b87  A9 10       LDA #$10
																																								.C:6b89  46 F0       LSR $F0
																																								.C:6b8b  90 02       BCC $6B8F
																																								.C:6b8d  09 20       ORA #$20
																																								.C:6b8f  8D 00 DD    STA $DD00
																																								.C:6b92  EA          NOP
																																								.C:6b93  EA          NOP
																																								.C:6b94  EA          NOP
																																								.C:6b95  EA          NOP
																																								.C:6b96  A9 00       LDA #$00
																																								.C:6b98  46 F0       LSR $F0
																																								.C:6b9a  90 02       BCC $6B9E
																																								.C:6b9c  09 20       ORA #$20
																																								.C:6b9e  8D 00 DD    STA $DD00
																																								.C:6ba1  EA          NOP
																																								.C:6ba2  EA          NOP
																																								.C:6ba3  60          RTS
																														.C:6986  20 87 6B    JSR $6B87		next two bits
																														.C:6989  20 87 6B    JSR $6B87		next two bits
																														.C:698c  20 87 6B    JSR $6B87		last two bits
																														.C:698f  60          RTS
																				.C:6bed  AD FA 6B    LDA $6BFA			controls what will be received
																				.C:6bf0  20 81 69    JSR $6981
																				.C:6bf3  AD FB 6B    LDA $6BFB			controls what will be received
																				.C:6bf6  4C 81 69    JMP $6981 // hits an RTS in the end
										.C:693c  20 A4 6B    JSR $6BA4
										.C:693f  A2 00       LDX #$00
										.C:6941  86 F4       STX $F4
										.C:6943  20 53 6B    JSR $6B53
																				.C:6b53  20 75 6B    JSR $6B75			receives a byte from serial bus (answer from drive-code)
																														.C:6b75  20 66 69    JSR $6966			get first two bits
																																								.C:6966  A0 90       LDY #$90
																																								.C:6968  AD 00 DD    LDA $DD00
																																								.C:696b  8C 00 DD    STY $DD00
																																								.C:696e  0A          ASL A
																																								.C:696f  66 F0       ROR $F0
																																								.C:6971  48          PHA
																																								.C:6972  68          PLA
																																								.C:6973  48          PHA
																																								.C:6974  68          PLA
																																								.C:6975  A0 C0       LDY #$C0
																																								.C:6977  AD 00 DD    LDA $DD00
																																								.C:697a  8C 00 DD    STY $DD00
																																								.C:697d  0A          ASL A
																																								.C:697e  66 F0       ROR $F0
																																								.C:6980  60          RTS
																														.C:6b78  20 66 69    JSR $6966			get next two bits
																														.C:6b7b  20 66 69    JSR $6966			get next two bits
																														.C:6b7e  20 66 69    JSR $6966			get last two bits
																														.C:6b81  20 86 6B    JSR $6B86
																																								.C:6b86  60          RTS
																														.C:6b84  A5 F0       LDA $F0
																														.C:6b86  60          RTS
																				.C:6b56  C9 41       CMP #$41				A holds the received byte now
																				.C:6b58  D0 19       BNE $6B73
																				.C:6b5a  20 75 6B    JSR $6B75
																				.C:6b5d  C9 41       CMP #$41
																				.C:6b5f  F0 12       BEQ $6B73
																				.C:6b61  C9 FF       CMP #$FF
																				.C:6b63  F0 0C       BEQ $6B71
																				.C:6b65  C9 F7       CMP #$F7
																				.C:6b67  F0 06       BEQ $6B6F
																				.C:6b69  20 A4 6B    JSR $6BA4
																				.C:6b6c  4C 53 6B    JMP $6B53
																				.C:6b6f  38          SEC
																				.C:6b70  60          RTS
																				.C:6b71  E6 F4       INC $F4
																				.C:6b73  18          CLC
																				.C:6b74  60          RTS
										.C:6946  B0 1D       BCS $6965
										.C:6948  A4 F4       LDY $F4
										.C:694a  D0 0A       BNE $6956
										.C:694c  91 F1       STA ($F1),Y				ptr($f1) was 67ff here(at first hit), y 0, a 0, so that receives a 0
										.C:694e  E6 F1       INC $F1            it continued.. 6800 6801 ... another loader routine?
										.C:6950  D0 F1       BNE $6943
										.C:6952  E6 F2       INC $F2
										.C:6954  D0 ED       BNE $6943
										.C:6956  EE FB 6B    INC $6BFB					controls what will be received +1
										.C:6959  AE FA 6B    LDX $6BFA					X, Y here are just written back to the same locs if next branch is taken
										.C:695c  AC FB 6B    LDY $6BFB
										.C:695f  CE F9 6B    DEC $6BF9					(was initialized from .C:6904  8D F9 6B    STA $6BF9 )
										.C:6962  D0 D3       BNE $6937
break here to find last written address in f1 f2 (-1)
										.C:6964  18          CLC
										.C:6965  60          RTS

that last RTS leaves us at $7ff2 
(the code pushed $7ff1 onto the stack earlier .C:7bd3  48          PHA (A was #$F1)   and   .C:7b6a  48          PHA (A was #$7F))
.C:7ff2  4C 09 80    JMP $8009

.C:8009  A9 04       LDA #$04
.C:800b  48          PHA
.C:800c  28          PLP								sets cpu status to what was in A ..-..I.., so I = 1 and everything else 0
.C:800d  A2 FF       LDX #$FF
.C:800f  9A          TXS								reset/clear stack
.C:8010  A9 2F       LDA #$2F
.C:8012  85 00       STA $00
.C:8014  A9 35       LDA #$35
.C:8016  85 01       STA $01						select RAM, IO, RAM
.C:8018  20 63 8E    JSR $8E63					screen is black afterwards so this probably prepares screen
.C:801b  4E 19 D0    LSR $D019					dirty ack all VIC irq
.C:801e  58          CLI                go go go !
*** patch note: so far so good, intro and mainscreen are working
                need to continue investigating here, to see where patches are required for loading levels, saving scores,
                removing disk side checks
.C:801f  4C 5F 93    JMP $935F					off to mainscreen (handled by what was set up in last JSR, because this just jmps in circles)
									+->.C:935f  4C 5F 92    JMP $925F      - A:80 X:FF Y:E0 SP:ff ..-....C  472888458
									|	 (C:$935f) z
									|  .C:925f  4C D4 80    JMP $80D4      - A:80 X:FF Y:E0 SP:ff ..-....C  472888461
									|	 (C:$925f) z
									|	 .C:80d4  4C 85 90    JMP $9085      - A:80 X:FF Y:E0 SP:ff ..-....C  472888464
									|	 (C:$80d4) z
									|  .C:9085  4C 60 8E    JMP $8E60      - A:80 X:FF Y:E0 SP:ff ..-....C  472888467
									|	 (C:$9085) z
									+--.C:8e60  4C 5F 93    JMP $935F      - A:80 X:FF Y:E0 SP:ff ..-....C  472888470

----------------------------------------------------------------------------------------------------------------------------------------------
to find loads after mainscreen:
----------------------------------------------------------------------------------------------------------------------------------------------
for the load routine which just sends request and received target address plus data:
watch exec 6990 
these breaks to find top of data in fc fd (-1) at break C:69b6 then find last write in fc fd at break C:69b1 if X == 2
break C:69b6
break C:69b1 if X == 2

for the load routine which sets address and size then sends request to drive-code to receive data:
watch exec 6993
(address in X, Y at call time, size in pagecount in A)
watch exec 699C
(the load call)
break 6964
(top of data in f1 f2 (-1))
----------------------------------------------------------------------------------------------------------------------------------------------

runs shortly after mainscreen fire button pressed: (found via mcmd: chis)
.C:5457  EE EF 03    INC $03EF
.C:545a  AE EC 8F    LDX $8FEC
.C:545d  AC ED 8F    LDY $8FED
.C:5460  8E F0 03    STX $03F0
.C:5463  8C F1 03    STY $03F1
.C:5466  20 69 0A    JSR $0A69			call SUB_WAITFORLINE_256_THEN_BLANK_SCREEN
.C:5469  78          SEI
.C:546a  20 1D 61    JSR $611D
.C:546d  20 45 61    JSR $6145
.C:5470  AD EF 03    LDA $03EF			*** patch this to just skip ahead to 54a2 eliminating the whole "turn disk" part
.C:5473  C9 04       CMP #$04
.C:5475  D0 2B       BNE $54A2
.C:5477  AD E4 03    LDA $03E4
.C:547a  C9 05       CMP #$05
.C:547c  F0 24       BEQ $54A2
.C:547e  20 34 62    JSR $6234			this likely writes the "TURN THE DISK !" message
.C:5481  20 F2 61    JSR $61F2      change banner bg color to red
.C:5484  20 79 61    JSR $6179			call SUBROUTINE_PREPARE_LOADER_IRQ
.C:5487  AD 01 DC    LDA $DC01
.C:548a  2D 00 DC    AND $DC00
.C:548d  29 10       AND #$10
.C:548f  D0 F6       BNE $5487			wait for space
.C:5491  A2 43       LDX #$43
.C:5493  A0 44       LDY #$44
.C:5495  20 90 69    JSR $6990			this loads the "CD" disk side identification file like TurricanI to bfc0..bffc
.C:5498  AD E0 BF    LDA $BFE0
.C:549b  C9 02       CMP #$02
.C:549d  D0 E8       BNE $5487			keep asking for "turn disk" if id check failed
.C:549f  20 F2 61    JSR $61F2			changes the colors in the lookup table of the banner behind the loading message
										.C:61f2  A2 14       LDX #$14
										.C:61f4  BD D8 61    LDA $61D8,X
										.C:61f7  49 04       EOR #$04				if A was 02, it's now 06 = blue (loading), if A was 06, it's now 02 = red (turn disk)
										.C:61f9  9D D8 61    STA $61D8,X
										.C:61fc  CA          DEX
										.C:61fd  10 F5       BPL $61F4
										.C:61ff  60          RTS
.C:54a2  AD EF 03    LDA $03EF			skipped here if level index was not 04 or if $03E4 was not 05 (command code to reload current level)
.C:54a5  C9 0B       CMP #$0B       $03ef is level index, b is end
.C:54a7  D0 06       BNE $54AF			branch if not at the end
.C:54a9  20 68 62    JSR $6268
.C:54ac  4C B5 54    JMP $54B5			jmp there if "the end" is reached

.C:54af  20 00 62    JSR $6200			not at "the end" yet
.C:54b2  20 4E 62    JSR $624E

.C:54b5  20 79 61    JSR $6179			call SUBROUTINE_PREPARE_LOADER_IRQ			*** patch 
										.C:6179  78          SEI						SUBROUTINE_PREPARE_LOADER_IRQ
										.C:617a  A9 A4       LDA #$A4
										.C:617c  8D FE FF    STA $FFFE
										.C:617f  A9 61       LDA #$61
										.C:6181  8D FF FF    STA $FFFF			irq handler to $61A4
																				----IRQ_HANDLER_LEVEL_LOADING-------------------------
																				.C:61a4  EE 19 D0    INC $D019
																				.C:61a7  48          PHA
																				.C:61a8  8A          TXA
																				.C:61a9  48          PHA
																				.C:61aa  98          TYA
																				.C:61ab  48          PHA
																				.C:61ac  A2 09       LDX #$09
																				.C:61ae  CA          DEX
																				.C:61af  D0 FD       BNE $61AE
																				.C:61b1  A0 00       LDY #$00					  *** patch call entry from replacement irq handler
																				.C:61b3  A2 08       LDX #$08
																				.C:61b5  B9 D4 61    LDA $61D4,Y
																				.C:61b8  8D 20 D0    STA $D020
																				.C:61bb  8D 21 D0    STA $D021					draws the blue background banner behind the loading msg
																				.C:61be  C8          INY
																				.C:61bf  CA          DEX
																				.C:61c0  F0 F1       BEQ $61B3
																				.C:61c2  20 A3 61    JSR $61A3
																				.C:61c5  20 A3 61    JSR $61A3
																				.C:61c8  20 A3 61    JSR $61A3
																				.C:61cb  EA          NOP
																				.C:61cc  EA          NOP
																				.C:61cd  C0 1E       CPY #$1E
																				.C:61cf  90 E4       BCC $61B5
																				.C:61d1  4C 3A 0A    JMP $0A3A					*** patch to rts
																				.C:0a3a  68          PLA
																				.C:0a3b  A8          TAY
																				.C:0a3c  68          PLA
																				.C:0a3d  AA          TAX
																				.C:0a3e  68          PLA
																				.C:0a3f  40          RTI
																				------------------------------------------------------
										.C:6184  A9 7F       LDA #$7F
										.C:6186  8D 0D DC    STA $DC0D			CIA1 disable all interrupts
										.C:6189  AD 0D DC    LDA $DC0D			
										.C:618c  A2 01       LDX #$01
										.C:618e  8E 1A D0    STX $D01A			request irq by rasterline only
										.C:6191  CA          DEX
										.C:6192  8E 15 D0    STX $D015			sprites off
										.C:6195  A9 1B       LDA #$1B				#%00011011
										.C:6197  8D 51 D2    STA $D251		  screen on, 25 rows, scroll-y 3
										.C:619a  A9 6A       LDA #$6A
										.C:619c  8D D2 D1    STA $D1D2			request irq at line 106
										.C:619f  4E 19 D0    LSR $D019			dirty ack vic irqs
										.C:61a2  58          CLI
										.C:61a3  60          RTS
.C:54b8  AE EF 03    LDX $03EF			level index
.C:54bb  BD 05 61    LDA $6105,X
>C:6105                  01 00 00  00 01 01 01  01 00 00 00        ...........
>C:6110  01                                                   .
.C:54be  F0 54       BEQ $5514    that last lookup tells whether to skip the load below
.C:54c0  A2 53       LDX #$53     X = #$53
.C:54c2  AD EF 03    LDA $03EF    level index
.C:54c5  18          CLC
.C:54c6  69 41       ADC #$41
.C:54c8  A8          TAY					Y = level index + #$41
.C:54c9  20 90 69    JSR $6990		*** patch this load, needs to be based on level index
on exec0: X $53 Y = level index + $41, loads: 9000 bf7f, dumped as: "A"

.C:54cc  A0 00       LDY #$00
.C:54ce  84 D5       STY $D5
.C:54d0  A9 90       LDA #$90
.C:54d2  85 D6       STA $D6				ptr($D5) to $9000 (start of just loaded data)
.C:54d4  84 D7       STY $D7
.C:54d6  AE EF 03    LDX $03EF			get index for lookup table from $03ef (relocation table)
.C:54d9  BD 11 61    LDA $6111,X		read page number from lookup table (X was 0 on first exec, perhaps it's the current level index)
										>C:6111     d0 00 00  00 d0 d7 d7  d0 00 00 00  d0 a9 00 aa    ...............
										>C:6120  9d 00                                                ..
.C:54dc  85 D8       STA $D8				ptr($D7) to $??00 ?? from lookup table at $6111,X .. so $d000 on first execution
            start of RELOCATE_JUST_LOADED_DATA
.C:54de  78          SEI						
.C:54df  A9 34       LDA #$34
.C:54e1  85 01       STA $01				select RAM, RAM, RAM (because target might be under IO)
.C:54e3  B1 D5       LDA ($D5),Y
.C:54e5  91 D7       STA ($D7),Y
.C:54e7  E6 D5       INC $D5
.C:54e9  D0 02       BNE $54ED
.C:54eb  E6 D6       INC $D6
.C:54ed  E6 D7       INC $D7
.C:54ef  D0 02       BNE $54F3
.C:54f1  E6 D8       INC $D8
.C:54f3  A5 D8       LDA $D8
.C:54f5  C9 FF       CMP #$FF       check end condition high byte
.C:54f7  D0 06       BNE $54FF			
.C:54f9  A5 D7       LDA $D7
.C:54fb  C9 80       CMP #$80       check end condition low byte
.C:54fd  F0 10       BEQ $550F			at $FF80 (last write then was to $FF7F) stop loop for real
.C:54ff  E6 01       INC $01				select RAM, IO, RAM to allow raster irq to draw background lines (needs IO)
.C:5501  58          CLI						*** inject a routine here which sets RAM, IO, KERNAL for custom irq handler
.C:5502  AD 92 D1    LDA $D192			rasterline low byte
.C:5505  C9 64       CMP #$64				line 100
.C:5507  90 D5       BCC $54DE			loop if not at that line yet
.C:5509  C9 8C       CMP #$8C				line 140
.C:550b  B0 D1       BCS $54DE			loop if past that line
.C:550d  90 F3       BCC $5502      otherwise wait and keep checking line
                                    (this apparantly delays the relocation loop during the blue "loading level" bg-lines which are drawn
                                     by a rasterline interrupt routine which relies on IO being active)
							end of RELOCATE_JUST_LOADED_DATA
.C:550f  A9 35       LDA #$35				*** patch this to 36 RAM, IO, KERNAL for custom loading irq handler
.C:5511  85 01       STA $01				select RAM, IO, RAM
.C:5513  58          CLI
.C:5514  AE EF 03    LDX $03EF			X = level index *** patch this to check/disable vic ints for second file of ending
.C:5517  E0 0B       CPX #$0B				reached the end?
.C:5519  D0 04       BNE $551F			branch if not at end
.C:551b  78          SEI
.C:551c  20 69 0A    JSR $0A69			if level index was #$0b continue here (turrican has 11 level, 0..10, so 11 probably loads ending)
										.C:0a69  AD 11 D3    LDA $D311			SUB_WAITFORLINE_256_THEN_BLANK_SCREEN
										.C:0a6c  10 FB       BPL $0A69			wait for rasterline 256
										.C:0a6e  A9 6C       LDA #$6C       #%0110 1100
										.C:0a70  8D 51 D1    STA $D151			ext. txt. mode 1, bmp mode 1, blank screen, 25 rows, scroll-y 4
										.C:0a73  60          RTS
.C:551f  AE F0 03    LDX $03F0
.C:5522  AC F1 03    LDY $03F1
.C:5525  20 90 69    JSR $6990			*** patch this load, needs to be based on level index as well
on exec0: X $31, Y $31, loads: 6c00 c7ff, dumped as "B"

break C:5519
break C:551b 
watch store C:551a



.C:5528  20 69 0A    JSR $0A69				call SUB_WAITFORLINE_256_THEN_BLANK_SCREEN
.C:552b  78          SEI
.C:552c  AD EF 03    LDA $03EF				level index
.C:552f  C9 0B       CMP #$0B					11 == end, 0..10 levels
.C:5531  D0 03       BNE $5536        branch if not end
.C:5533  4C 01 7A    JMP $7A01				jump away if reached ending			*** investigate this code path
.C:5536  20 B8 50    JSR $50B8				proceed here if regular level
.C:5539  20 A0 62    JSR $62A0
.C:553c  20 63 53    JSR $5363
.C:553f  20 C6 4B    JSR $4BC6
.C:5542  20 40 4B    JSR $4B40
.C:5545  20 33 61    JSR $6133
.C:5548  A2 00       LDX #$00
.C:554a  8E E0 03    STX $03E0
.C:554d  8E E1 03    STX $03E1
.C:5550  CA          DEX
.C:5551  9A          TXS							reset/clear stack
.C:5552  20 8D 51    JSR $518D
.C:5555  20 D8 52    JSR $52D8
.C:5558  20 FF 2C    JSR $2CFF				after this the screen is black for the first time after loading
.C:555b  20 6B 4A    JSR $4A6B
.C:555e  20 87 09    JSR $0987
.C:5561  20 10 52    JSR $5210
.C:5564  20 B2 52    JSR $52B2
.C:5567  20 AD 51    JSR $51AD
.C:556a  20 8C 50    JSR $508C
.C:556d  4C 91 55    JMP $5591
										.C:5591  A9 00       LDA #$00     initially 0
										.C:5593  8D E4 03    STA $03E4		loop control for below
										.C:5596  4C 49 0A    JMP $0A49
																				.C:0a49  AE E4 03    LDX $03E4
																				.C:0a4c  BD 5B 0A    LDA $0A5B,X  lookup table low-bytes for jmp target
																				.C:0a4f  8D 59 0A    STA $0A59    modify jmp target low
																				.C:0a52  BD 62 0A    LDA $0A62,X  lookup table high-bytes for jmp target
																				.C:0a55  8D 5A 0A    STA $0A5A		modify jmp target high
																				.C:0a58  4C 70 55    JMP $????    jmp target was modified by the previous instructions right above
		                for X = 0, the jmp target stays 0a49, so this is probably the main game-state control loop
		                and 03E4 is the main game-state control flow variable
		                         lo(0a5b,x)            hi(0a62,x)
										>C:0a5b  49 d3 eb f1  57 70 7e 0a  53 53 53 54  55 55
										so for X = $03e4 this gives 7 possible jmp targets
                    (COMMAND CODE for what to do, similar to the main loop control in TurricanI)
		                0 $0a49 = idle loop (waiting for code in some interrupt to change the control flow variable)
		                1 $53d3 = runs after losing a life after level view is obscured
		                2 $53eb = runs after losing all lives, before view is obscured (displays game over, then continue question)
		                3 $53f1 = runs if "no" is selected on the continue question
		                4 $5457 = loads next level or end if all levels finished
		                5 $5570 = reload current level
		                6 $557e = turns all black pixels within level view portion white (walking away recolors with normal colors)


time to dump all the remaining files now by repeatedly writing a 4 into $03e4:
each level has multiple data files that get loaded

break C:54c9 before loading level data0 (only on certain level indices as determined by lookup table at $6105)
>C:6105                  01 00 00  00 01 01 01  01 00 00 00  01
                     X =  0  1  2   3  4  5  6   7  8  9  A   B
break C:54cc after loading level data0  (only on certain level indices)
(before relocation happens)

break C:5525 before loading level data1..
break C:5528 after loading level data1..

breakpoints during loads as described earlier under "to find loads after mainscreen" to determine data ranges
(pay extra special attention because a single call at C:5525 might deliver multiple loadings to different addresses, so check
fc fd each time at the usual breakpoint to see if there is more to come (FF FF means there is nothing else coming))

level index 0 was already dumped to "a" and "b" (lvl 1-1)

level index 1 (lvl 1-2)
data0: 0000 0000 dumped as "" (not loaded, keeps previous data0 from "A")
data1: e980 ff7f dumped as "c" (overwrites a portion of the relocated data0)
data2: 6c00 afff dumped as "d"

level index 2 (lvl 2-1)
data0: 0000 0000 dumped as "" (not loaded, keeps previous)
data1: e580 ff7f dumped as "e"
data2: 6c00 c63f dumped as "f"

level index 3 (lvl 2-2)
data0: 0000 0000 dumped as "" (not loaded, keeps previous)
data1: e580 ff7f dumped as "g"
data2: 6c00 afff dumped as "h"

level index 4 (lvl 3-1) ( before it loads, "TURN THE DISK" appears )
data0: 9000 bf7f dumped as "i" gets relocated to d000..ff7f
data1: 6c00 c7ff dumped as "j"
data2: 0000 0000 dumped as " " none

level index 5 (lvl 3-2)
data0: 9000 b470 dumped as "k" gets relocated to d700..ff7f 
                               (even though it was not that large but that reloc loop always moves the same amount of bytes)
data1: 6c00 c7ff dumped as "l"
data2: 0000 0000 dumped as " " none

level index 6 (lvl 3-3)
data0: 9000 9fb0 dumped as "m" gets relocated to d700..ff7f 
data1: 6c00 bf90 dumped as "n"
data2: 0000 0000 dumped as " " none

level index 7 (lvl 4-1)
data0: 9000 bf7f dumped as "o" gets relocated to d000..ff7f
data1: 6c00 c7ff dumped as "p"
data2: 0000 0000 dumped as " " none

level index 8 (lvl 4-2)
data0: 0000 0000 dumped as " " (not loaded, keeps previous)
data1: e580 f9ff dumped as "q"
data2: 6c00 afff dumped as "r"

level index 9 (lvl 5-1)
data0: 0000 0000 dumped as " " (not loaded, keeps previous)
data1: e580 ff7f dumped as "s"
data2: 6c00 c63f dumped as "t"

level index A (lvl 5-2)
data0: 0000 0000 dumped as " " (not loaded, keeps previous)
data1: e580 ff7f dumped as "u"
data2: 6c00 afff dumped as "v"

playtesting... level 5-2 did not seem to work correctly
dumped again...
still nothing... until I found out what to do shooting wildly in the bottom right corner... :D

level index B (the end)
data0: 9000 bfbf dumped as "w" gets relocated to d000..ff7f
data1: 6c00 cfff dumped as "x"
data2: 0000 0000 dumped as " " none

break 5533 to find out what happens at ending:
.C:5533  4C 01 7A    JMP $7A01				jump away if reached ending			*** investigate this code path
.C:7a01  20 A1 7C    JSR $7CA1
..............................			skipping to the next interactive section
.C:7c53  AD 00 DC    LDA $DC00
.C:7c56  2D 01 DC    AND $DC01
.C:7c59  29 10       AND #$10
.C:7c5b  D0 F6       BNE $7C53			wait for space after credits rolled through
.C:7c5d  A9 0E       LDA #$0E
.C:7c5f  20 06 6C    JSR $6C06
.C:7c62  A9 00       LDA #$00
.C:7c64  85 3D       STA $3D
.C:7c66  A5 3E       LDA $3E
.C:7c68  F0 FC       BEQ $7C66      
.C:7c6a  20 CF 86    JSR $86CF
.C:7c6d  A5 3D       LDA $3D
.C:7c6f  F0 F5       BEQ $7C66
.C:7c71  85 08       STA $08
.C:7c73  78          SEI
.C:7c74  A9 32       LDA #$32
.C:7c76  85 05       STA $05
.C:7c78  A9 FA       LDA #$FA
.C:7c7a  85 06       STA $06
.C:7c7c  8D 12 D0    STA $D012
.C:7c7f  A9 E2       LDA #$E2
.C:7c81  85 03       STA $03
.C:7c83  A9 81       LDA #$81
.C:7c85  85 04       STA $04
.C:7c87  A9 00       LDA #$00
.C:7c89  8D 15 D0    STA $D015
.C:7c8c  AD 11 D0    LDA $D011
.C:7c8f  10 FB       BPL $7C8C
.C:7c91  58          CLI
.C:7c92  A5 05       LDA $05
.C:7c94  C9 96       CMP #$96
.C:7c96  D0 FA       BNE $7C92			wait for some flag
.C:7c98  A9 6B       LDA #$6B
.C:7c9a  8D 11 D0    STA $D011
.C:7c9d  78          SEI
.C:7c9e  6C 40 0A    JMP ($0A40)		to $53f1


after ending screen closed:
.C:53f1  AD EE 03    LDA $03EE
.C:53f4  F0 16       BEQ $540C
.C:53f6  A9 05       LDA #$05
.C:53f8  20 06 6C    JSR $6C06
.C:53fb  A2 50       LDX #$50
.C:53fd  AD 12 D3    LDA $D312
.C:5400  C9 96       CMP #$96
.C:5402  D0 F9       BNE $53FD
.C:5404  A0 20       LDY #$20
.C:5406  88          DEY
.C:5407  10 FD       BPL $5406
.C:5409  CA          DEX
.C:540a  D0 F1       BNE $53FD

.C:540c  78          SEI
.C:540d  20 69 0A    JSR $0A69			call SUB_WAITFORLINE_256_THEN_BLANK_SCREEN
.C:5410  A2 43       LDX #$43				*** patch skip ahead to $544c
.C:5412  A0 44       LDY #$44
.C:5414  20 90 69    JSR $6990		  this loads the "CD" disk side identification file like TurricanI to bfc0..bffc	


.C:5417  AD E0 BF    LDA $BFE0
.C:541a  C9 01       CMP #$01
.C:541c  F0 2B       BEQ $5449
.C:541e  78          SEI
.C:541f  20 1D 61    JSR $611D
.C:5422  20 45 61    JSR $6145
.C:5425  20 34 62    JSR $6234
.C:5428  20 F2 61    JSR $61F2
.C:542b  20 79 61    JSR $6179
.C:542e  AD 01 DC    LDA $DC01
.C:5431  2D 00 DC    AND $DC00
.C:5434  29 10       AND #$10
.C:5436  D0 F6       BNE $542E			wait for space
.C:5438  A2 43       LDX #$43
.C:543a  A0 44       LDY #$44
.C:543c  20 90 69    JSR $6990			this loads the "CD" disk side identification file like TurricanI to bfc0..bffc	
.C:543f  AD E0 BF    LDA $BFE0
.C:5442  C9 01       CMP #$01
.C:5444  D0 E8       BNE $542E			keep checking disk side
.C:5446  20 F2 61    JSR $61F2

.C:5449  20 69 0A    JSR $0A69
.C:544c  78          SEI
.C:544d  A2 39       LDX #$39
.C:544f  A0 25       LDY #$25
.C:5451  20 90 69    JSR $6990			*** patch this to load file 3 and repatch it in RAM
same call parameters as for already dumped file "3"
loads: loads: 6c00 b932 (also same as already dumped file "3")
dumped as "3b" just to double check (files were identical, so did not keep 3b)
                                    loaded code has a..
.C:5454  4C F5 7F    JMP $7FF5			..different entry point now (after intro was $7ff2)
										.C:7ff5  4C C1 91    JMP $91C1

.C:91c1  A9 04       LDA #$04
.C:91c3  48          PHA
.C:91c4  28          PLP
.C:91c5  A2 FF       LDX #$FF
.C:91c7  9A          TXS

*** patch loader needs to save/restore kernal zp and kernal vectors for loadings because Turrican2 also uses those
*** addresses in zp
90 ff kernal zp
0314..0333
031a 0333 important vectors for loading via kernal calls

-------------------------------------------------------
*** (done) TODO: investigate problem with reload after continue, first load fails with kernal error 
          ILLEGAL DEVICE NUMBER

saving zp 00 ff to disk at first 5570 (also works with just 90 ff, so the issue is in there)
and then reloading it at second 5570 causes the second load to work, so the issue must be some values there

"testzpkernal90_ff" (with these it works)
          0  1  2  3   4  5  6  7   8  9  a  b   c  d  e  f
>C:0090  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00   ................
...

"testzpkernal90_ff_beforefailing5570" (with these it fails)
          0  1  2  3   4  5  6  7   8  9  a  b   c  d  e  f
>C:0090  fe 00 00 8f  a5 8a 8a 9f  a4 8f fe 06  00 00 01 01   ................
...

interestingly zeroing out 90 9f
                0  1  2  3   4  5  6  7   8  9  a  b   c  d  e  f
via mcmd: > 90 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
suffices for the load to succeed, so it must be something in these which the kernal load routine does not like:
                fail value
  |   $90/144      fe         Kernal I/O Status Word ST
  |   $91/145      --         Flag: $7F = STOP key
  |   $92/146      --         Timing Constant for Tape
  |   $93/147      8f         Flag: 0 = Load, 1 = Verify
  |   $94/148      a5         Flag: Serial Bus - Output Character buffered
  |   $95/149      8a         Buffered Character for Serial Bus
  |   $96/150      8a         Cassette Sync number
  |   $97/151      9f         Storage of X Register during CHRIN
  |   $97/151    same         Storage of Y Register during RS232 fetch
  |   $98/152      a4         Number of Open Files/Index to File Table
  |   $99/153      8f         Default Input Device (0)
  |   $9A/154      fe         Default Output Device (3)
  |   $9B/155      06         Parity of Byte Output to Tape
  |   $9C/156      --         Flag: Byte received from Tape
  |   $9D/157      --         Error-Mode-Flag
  |   $9E/158      01         Index to Tape File name/Header ID for Tape write
  |   $9E/158    same         Tape Error log pass 1
  |   $9F/159      01         Tape Error log pass 2

attempts to fix the load:
      0  1  2  3   4  5  6  7   8  9  a  b   c  d  e  f
> 90 00 00 00 00  00 00 00 00 (sufficient)
> 90 00 00 00 00 (not sufficient)
> 90 00 00 00 00  00 00 (sufficient)
> 94 00 (sufficient) so that flag just needs to be set to 0 for the re-load to succeed
-------------------------------------------------------

continue, no continue, next level, reaching end, reloading main appear to work stable now (once encountered an oddity where
the energy line weapon caused the main character to freeze in place and the left line would not disappear but could not reproduce it)

investigate and patch highscore saving

idle loop during question "do you want to save your highscore ? (y/n)"
break 92b5 if A != $00
A == 4E means "N" was pressed   
A == 59 means "Y" was pressed
.C:92b3  A5 CA       LDA $CA
.C:92b5  C9 4E       CMP #$4E   "N"
.C:92b7  F0 5E       BEQ $9317
.C:92b9  C9 4A       CMP #$4A   "J" JA!
.C:92bb  F0 04       BEQ $92C1
.C:92bd  C9 59       CMP #$59   "Y"
.C:92bf  D0 F2       BNE $92B3
.C:92c1  20 E2 8F    JSR $8FE2					clears part of the screen for the next message, 
                                        *** patch to jmp ahead to 92e6 to skip the diskside stuff
											.C:8fe2  A2 27       LDX #$27
											.C:8fe4  A9 20       LDA #$20
											.C:8fe6  9D F8 CE    STA $CEF8,X
											.C:8fe9  9D 48 CF    STA $CF48,X
											.C:8fec  CA          DEX
											.C:8fed  10 F7       BPL $8FE6
											.C:8fef  60          RTS

.C:92c4  A2 1D       LDX #$1D					 
.C:92c6  BD 38 96    LDA $9638,X
.C:92c9  9D FD CE    STA $CEFD,X
.C:92cc  CA          DEX
.C:92cd  10 F7       BPL $92C6
.C:92cf  A2 0F       LDX #$0F
.C:92d1  BD 56 96    LDA $9656,X
.C:92d4  9D 54 CF    STA $CF54,X
.C:92d7  CA          DEX
.C:92d8  10 F7       BPL $92D1					writes the "insert side 1 of your gamedisk and press fire !" message to just cleaned screen section

.C:92da  AD 01 DC    LDA $DC01          is FF as long as no key is pressed, run-stop pulls bit7 to 0, making it positive
.C:92dd  10 38       BPL $9317          cancel save if run-stop was pressed
.C:92df  AD 00 DC    LDA $DC00
.C:92e2  29 10       AND #$10
.C:92e4  D0 F4       BNE $92DA          wait for fire button

.C:92e6  20 E2 8F    JSR $8FE2					clears part of screen 

.C:92e9  A2 15       LDX #$15
.C:92eb  BD 76 96    LDA $9676,X
.C:92ee  9D 01 CF    STA $CF01,X
.C:92f1  A9 0A       LDA #$0A
.C:92f3  9D 01 DB    STA $DB01,X
.C:92f6  CA          DEX
.C:92f7  10 F2       BPL $92EB					writes the "saving highscores ..." message
																				>C:fffa  d3 80 00 00  23 82 
																				interrupt vectors at this point
.C:92f9  20 01 90    JSR $9001          *** patch this to perform a regular kernal save to file "4" from 67ff to 68ff
										.C:9001  A9 01       LDA #$01
										.C:9003  A2 FF       LDX #$FF
										.C:9005  A0 67       LDY #$67       ($67ff is where the scores are A = 1 means save 1 page)
										.C:9007  20 9C 69    JSR $699C			inside original loader code piece 
										.C:900a  A2 12       LDX #$12
										.C:900c  A0 12       LDY #$12
										.C:900e  4C 96 69    JMP $6996      inside original loader code piece
																												.C:ccc4  4C 93 69    JMP $6993 was used to load the scores (all the same parameters)
                                                                          so JMP $6996 must be what it uses to save instead
																				.C:6996  4C 08 69    JMP $6908
																				.C:6908  A9 01       LDA #$01
																				.C:690a  20 BB 6B    JSR $6BBB
																				.C:690d  A0 00       LDY #$00
																				.C:690f  B1 F1       LDA ($F1),Y
																				.C:6911  20 81 69    JSR $6981
																				.C:6914  C8          INY
																				.C:6915  D0 F8       BNE $690F
																				.C:6917  84 F4       STY $F4
																				.C:6919  20 A4 6B    JSR $6BA4
																				.C:691c  20 53 6B    JSR $6B53
																				.C:691f  B0 15       BCS $6936
																				.C:6921  A5 F4       LDA $F4
																				.C:6923  F0 F7       BEQ $691C
																				.C:6925  E6 F2       INC $F2
																				.C:6927  EE FB 6B    INC $6BFB
																				.C:692a  AE FA 6B    LDX $6BFA
																				.C:692d  AC FB 6B    LDY $6BFB
																				.C:6930  CE F9 6B    DEC $6BF9
																				.C:6933  D0 D3       BNE $6908
																				.C:6935  18          CLC
																				.C:6936  60          RTS



.C:92fc  90 19       BCC $9317					 carry set means error occured
.C:92fe  A2 15       LDX #$15
.C:9300  BD 8C 96    LDA $968C,X
.C:9303  9D 01 CF    STA $CF01,X
.C:9306  A9 02       LDA #$02
.C:9308  9D 01 DB    STA $DB01,X
.C:930b  CA          DEX
.C:930c  10 F2       BPL $9300           writes "vergiss es!" ("forget it !") to signal saving error
.C:930e  20 F6 8F    JSR $8FF6
.C:9311  20 F6 8F    JSR $8FF6
.C:9314  20 F6 8F    JSR $8FF6
.C:9317  A9 08       LDA #$08         continue without saving score(also after saving succeeded)...
.C:9319  20 06 6C    JSR $6C06
.C:931c  20 E2 8F    JSR $8FE2
.C:931f  A2 A0       LDX #$A0
.C:9321  AD 12 D0    LDA $D012
.C:9324  C9 64       CMP #$64
.C:9326  D0 F9       BNE $9321
.C:9328  A0 20       LDY #$20
.C:932a  88          DEY
.C:932b  D0 FD       BNE $932A
.C:932d  CA          DEX
.C:932e  D0 F1       BNE $9321
.C:9330  A9 D3       LDA #$D3
.C:9332  8D 5F 8E    STA $8E5F
.C:9335  20 64 8F    JSR $8F64
.C:9338  AD 12 D0    LDA $D012
.C:933b  C9 96       CMP #$96
.C:933d  D0 F9       BNE $9338
.C:933f  A9 06       LDA #$06
.C:9341  85 0C       STA $0C
.C:9343  A9 E0       LDA #$E0
.C:9345  85 05       STA $05
.C:9347  A9 BD       LDA #$BD

Ran out of room in shooshoo for patches and highscore saving replacement.
this area looked free in C64 debugger and was confirmed via
mcmd: watch load store exec c170 c3ff

So now there's an extra segment "5" which will contain the patches and replacement for the highscore saving routine.

>C:fffa  d3 80 00 00  23 82

the nmi handler is just an rti
.C:80d3  40          RTI

Analyze interrupt chain during saving screen...
mcmd: watch store ffff
then
mcmd: m fffe ffff

IRQ_HANDLER_MAIN_8223				line 152 (shortly before the bottom line of the big TurricanII graphics at the top)
IRQ_HANDLER_MAIN_8B3E				line 202 (shortly before the three lines of text related to highscore entry/question/saving messages)				
IRQ_HANDLER_MAIN_80E2				line 231 (beginning of the blue bar in the bottom)

Saving routine will have to reroute and modify this chain into a kernal friendly one, temporarily patching the RTIs into RTSes and
changing the FFFE FFFF writes to a self modifiying address of a JSR in a replacement handler, then change it all back after saving
is completed.

Saving also needs to store/restore zp and vectors 0314 0333 before and after saving.
Also zp 90 to FD which will be clobbered by kernal save (FE FF shows activity, used by Turrican2 all the time)


.C:80e2  85 02       STA $02						IRQ_HANDLER_MAIN_80E2 (was setup for line 231 (beginning of the blue bar in the bottom))
.C:80e4  86 03       STX $03
.C:80e6  84 04       STY $04
.C:80e8  A5 01       LDA $01
.C:80ea  85 07       STA $07						registers A,X,Y saved in $02,$03,$04, memcfg status saved in $07
.C:80ec  A9 35       LDA #$35				*** temporarily patch to #$36
.C:80ee  85 01       STA $01						RAM, IO, RAM
.C:80f0  A9 06       LDA #$06
.C:80f2  A0 E8       LDY #$E8
.C:80f4  CC 12 D0    CPY $D012
.C:80f7  D0 FB       BNE $80F4
.C:80f9  8D 20 D0    STA $D020
.C:80fc  8D 21 D0    STA $D021
.C:80ff  A9 0E       LDA #$0E
.C:8101  A2 06       LDX #$06
.C:8103  A0 EB       LDY #$EB
.C:8105  CC 12 D0    CPY $D012
.C:8108  D0 FB       BNE $8105
.C:810a  8D 22 D0    STA $D022
.C:810d  8E 23 D0    STX $D023
.C:8110  A6 08       LDX $08
.C:8112  BD A7 8C    LDA $8CA7,X
.C:8115  CC 12 D0    CPY $D012
.C:8118  F0 FB       BEQ $8115
.C:811a  8D 16 D0    STA $D016
.C:811d  C8          INY
.C:811e  E8          INX
.C:811f  C0 FA       CPY #$FA
.C:8121  D0 EF       BNE $8112
.C:8123  A9 00       LDA #$00
.C:8125  CC 12 D0    CPY $D012
.C:8128  F0 FB       BEQ $8125
.C:812a  8D 20 D0    STA $D020
.C:812d  8D 21 D0    STA $D021
.C:8130  E6 0E       INC $0E
.C:8132  A5 0E       LDA $0E
.C:8134  29 03       AND #$03
.C:8136  D0 08       BNE $8140
.C:8138  E6 08       INC $08
.C:813a  A5 08       LDA $08
.C:813c  29 1F       AND #$1F
.C:813e  85 08       STA $08
.C:8140  A9 D8       LDA #$D8
.C:8142  8D 16 D0    STA $D016
.C:8145  A9 3B       LDA #$3B
.C:8147  8D 11 D0    STA $D011
.C:814a  A9 38       LDA #$38
.C:814c  8D 18 D0    STA $D018
.C:814f  A2 07       LDX #$07
.C:8151  8E 22 D0    STX $D022
.C:8154  A2 08       LDX #$08
.C:8156  8E 23 D0    STX $D023
.C:8159  A6 09       LDX $09
.C:815b  D0 03       BNE $8160
.C:815d  4C 76 8B    JMP $8B76
.C:8160  CA          DEX
.C:8161  D0 03       BNE $8166
.C:8163  4C D4 8B    JMP $8BD4
.C:8166  CA          DEX
.C:8167  D0 03       BNE $816C
.C:8169  4C F8 8B    JMP $8BF8
.C:816c  CA          DEX
.C:816d  D0 03       BNE $8172
.C:816f  4C 1B 8C    JMP $8C1B
.C:8172  A9 23       LDA #$23
.C:8174  8D FE FF    STA $FFFE
.C:8177  A9 82       LDA #$82
.C:8179  8D FF FF    STA $FFFF					next irq in chain to IRQ_HANDLER_MAIN_8223			*** temporarily patch to write to sm_S5_jsr_target
.C:817c  A9 99       LDA #$99
.C:817e  8D 12 D0    STA $D012					at rasterline 153
.C:8181  AD 5F 8E    LDA $8E5F
.C:8184  F0 06       BEQ $818C
.C:8186  20 CC 94    JSR $94CC					*** turrican2 keyboard scan routine
                                            writes to kernal zp locations, needs to be temporarily disabled during
                                            saving or it will cause crashes
.C:8189  4C B9 81    JMP $81B9
.C:818c  A5 14       LDA $14					if it still fails place a watch over the following lines
.C:818e  10 16       BPL $81A6
.C:8190  AD 00 DC    LDA $DC00
.C:8193  2D 01 DC    AND $DC01
.C:8196  29 10       AND #$10
.C:8198  D0 1F       BNE $81B9
.C:819a  A9 7F       LDA #$7F
.C:819c  85 14       STA $14
.C:819e  A9 08       LDA #$08
.C:81a0  20 06 6C    JSR $6C06					*** disable this as well
.C:81a3  4C B9 81    JMP $81B9
.C:81a6  D0 0F       BNE $81B7
.C:81a8  AD B3 B3    LDA $B3B3
.C:81ab  8D FF DB    STA $DBFF
.C:81ae  0A          ASL A
.C:81af  09 01       ORA #$01
.C:81b1  8D FC FF    STA $FFFC
.C:81b4  4C 22 80    JMP $8022
.C:81b7  C6 14       DEC $14
.C:81b9  A5 0E       LDA $0E
.C:81bb  29 03       AND #$03
.C:81bd  D0 53       BNE $8212
.C:81bf  A2 05       LDX #$05
.C:81c1  BC 4D 8E    LDY $8E4D,X
.C:81c4  B9 45 8E    LDA $8E45,Y
.C:81c7  9D FA CF    STA $CFFA,X
.C:81ca  C8          INY
.C:81cb  C0 08       CPY #$08
.C:81cd  D0 3C       BNE $820B
.C:81cf  8A          TXA
.C:81d0  0A          ASL A
.C:81d1  A8          TAY
.C:81d2  18          CLC
.C:81d3  B9 04 D0    LDA $D004,Y
.C:81d6  7D 59 8E    ADC $8E59,X
.C:81d9  99 04 D0    STA $D004,Y
.C:81dc  90 09       BCC $81E7
.C:81de  AD 10 D0    LDA $D010
.C:81e1  5D 53 8E    EOR $8E53,X
.C:81e4  8D 10 D0    STA $D010
.C:81e7  AD 10 D0    LDA $D010
.C:81ea  3D 53 8E    AND $8E53,X
.C:81ed  D0 13       BNE $8202
.C:81ef  B9 04 D0    LDA $D004,Y
.C:81f2  C9 20       CMP #$20
.C:81f4  B0 13       BCS $8209
.C:81f6  AD 10 D0    LDA $D010
.C:81f9  5D 53 8E    EOR $8E53,X
.C:81fc  8D 10 D0    STA $D010
.C:81ff  4C 09 82    JMP $8209
.C:8202  B9 04 D0    LDA $D004,Y
.C:8205  C9 30       CMP #$30
.C:8207  B0 ED       BCS $81F6
.C:8209  A0 00       LDY #$00
.C:820b  98          TYA
.C:820c  9D 4D 8E    STA $8E4D,X
.C:820f  CA          DEX
.C:8210  10 AF       BPL $81C1
.C:8212  20 03 6C    JSR $6C03
.C:8215  CE 19 D0    DEC $D019
.C:8218  A5 07       LDA $07
.C:821a  85 01       STA $01
.C:821c  A5 02       LDA $02
.C:821e  A6 03       LDX $03
.C:8220  A4 04       LDY $04
.C:8222  40          RTI						*** temporarily patch to RTS

.C:8223  85 02       STA $02						IRQ_HANDLER_MAIN_8223 (was setup for rasterline 153, shortly before end of logo)
.C:8225  86 03       STX $03
.C:8227  84 04       STY $04						
.C:8229  A5 01       LDA $01
.C:822b  85 07       STA $07            registers A,X,Y saved in $02,$03,$04, memcfg status saved in $07
.C:822d  A9 35       LDA #$35       *** temporarily patch to #$36
.C:822f  85 01       STA $01						set RAM, IO, RAM
.C:8231  A9 3E       LDA #$3E
.C:8233  8D FE FF    STA $FFFE
.C:8236  A9 8B       LDA #$8B
.C:8238  8D FF FF    STA $FFFF					set next handler in chain IRQ_HANDLER_MAIN_8B3E  *** temporarily patch to write to sm_S5_jsr_target
.C:823b  A9 CA       LDA #$CA
.C:823d  8D 12 D0    STA $D012					at rasterline 202 (shortly before text area for the high-score related text lines)
.C:8240  A9 34       LDA #$34
.C:8242  A6 0D       LDX $0D						
.C:8244  10 02       BPL $8248
.C:8246  A9 3C       LDA #$3C						if ($0D >=0 ) A = #$34 else A = #$3C 
.C:8248  A2 5B       LDX #$5B						#%0101 1011 ( ext. col mode, screen on, 25 rows, scroll-y 3 )
.C:824a  A0 9A       LDY #$9A           
.C:824c  CC 12 D0    CPY $D012
.C:824f  D0 FB       BNE $824C          wait for line 154
.C:8251  A0 0B       LDY #$0B
.C:8253  88          DEY
.C:8254  D0 FD       BNE $8253					idle a bit
.C:8256  8E 11 D0    STX $D011					vic ctrl1, X = #$5B, ext. col mode on, bitmap off, screen on, 25 rows, scroll-y 3 
.C:8259  A2 D8       LDX #$D8
.C:825b  AC 5F 8E    LDY $8E5F					Y = var_8E5F (find out where that's written)
.C:825e  F0 06       BEQ $8266
.C:8260  30 04       BMI $8266
.C:8262  A9 32       LDA #$32						
.C:8264  A2 C8       LDX #$C8           if (var_8E5F > 0) A = #$32, X = #$C8
.C:8266  8D 18 D0    STA $D018					vic mem ctrl, X = #$34 or A = #$32 (bank 3 either way, charset 2 or charset 1)
.C:8269  8E 16 D0    STX $D016					vic ctrl2, X = #$D8 or X = #$C8 (40 cols, scroll-x 0 either way, mcol or no-mcol)
.C:826c  CE 19 D0    DEC $D019					ack vic int
.C:826f  A0 9C       LDY #$9C
.C:8271  A9 1B       LDA #$1B
.C:8273  CC 12 D0    CPY $D012
.C:8276  D0 FB       BNE $8273					wait for line 156 (just beyond the big "TURRICAN" logo graphics)
.C:8278  8D 11 D0    STA $D011					vic ctrl1, A = #$1B, ext. col off, bitmap off, screen on, 25 rows, scroll-y 3)
.C:827b  AD 5F 8E    LDA $8E5F					Y = var_8E5F (again)
.C:827e  D0 0C       BNE $828C					
.C:8280  A5 0B       LDA $0B						
.C:8282  C9 01       CMP #$01
.C:8284  F0 28       BEQ $82AE					jmp away if $0B == 1
.C:8286  A5 0E       LDA $0E
.C:8288  29 01       AND #$01
.C:828a  F0 0B       BEQ $8297					jmp away if bit0 in $0E is 0
.C:828c  A5 07       LDA $07				    got here if var_8E5F != 0
.C:828e  85 01       STA $01						
.C:8290  A5 02       LDA $02
.C:8292  A6 03       LDX $03
.C:8294  A4 04       LDY $04						restore memcfg from $07, restore registers A,X,Y from $02,$03,$04
.C:8296  40          RTI					*** temporarily patch to RTS



.C:8b3e  85 02       STA $02						IRQ_HANDLER_MAIN_8B3E 
                                        (was setup for rasterline 202 (begining of the lines with highscore message/question))
.C:8b40  86 03       STX $03
.C:8b42  84 04       STY $04
.C:8b44  A5 01       LDA $01
.C:8b46  85 07       STA $07						registers A,X,Y saved in $02,$03,$04, memcfg status saved in $07
.C:8b48  A9 35       LDA #$35      *** temporarily patch to #$36
.C:8b4a  85 01       STA $01						RAM, IO, RAM
.C:8b4c  A9 E2       LDA #$E2
.C:8b4e  8D FE FF    STA $FFFE
.C:8b51  A9 80       LDA #$80
.C:8b53  8D FF FF    STA $FFFF					next handler in chain to IRQ_HANDLER_MAIN_80E2  *** temporarily patch to write to sm_S5_jsr_target
.C:8b56  A9 E7       LDA #$E7           
.C:8b58  8D 12 D0    STA $D012          at line 231 (beginning of the blue bar in the bottom)
.C:8b5b  CE 19 D0    DEC $D019					ack
.C:8b5e  AD 5F 8E    LDA $8E5F					check var_8E5F (again)
.C:8b61  D0 08       BNE $8B6B
.C:8b63  AD 18 D0    LDA $D018
.C:8b66  09 02       ORA #$02						activate extra bit in charset number (so it's now either charset 1 or 3 if it was 2 before)
.C:8b68  8D 18 D0    STA $D018					
.C:8b6b  A5 07       LDA $07
.C:8b6d  85 01       STA $01
.C:8b6f  A5 02       LDA $02
.C:8b71  A6 03       LDX $03
.C:8b73  A4 04       LDY $04						restore memcfg from $07, restore registers A,X,Y from $02,$03,$04
.C:8b75  40          RTI					*** temporarily patch to RTS


Ok, saving works now.

update, Feb. 22nd 2019
Apparently there was a problem with the laser not upgrading correctly to power level 5.

I have identified location $07ef as the laser power level. Setting it manually to 05 works... need to investigate why it does not get there
via in-game logic.

placed a watch on store to 07ef, it appears the code checks against #$04 as max.

.C:5a59  AD EF 07    LDA $07EF
.C:5a5c  C9 04       CMP #$04				this appears to be the culprit, should cmp against 05
.C:5a5e  F0 03       BEQ $5A63
.C:5a60  EE EF 07    INC $07EF
.C:5a63  A9 CD       LDA #$CD
.C:5a65  A0 35       LDY #$35
.C:5a67  A2 01       LDX #$01
.C:5a69  10 10       BPL $5A7B
.C:5a6b  AD F0 07    LDA $07F0
.C:5a6e  C9 02       CMP #$02
.C:5a70  F0 03       BEQ $5A75
.C:5a72  EE F0 07    INC $07F0
.C:5a75  A9 71       LDA #$71
.C:5a77  A0 44       LDY #$44
.C:5a79  A2 02       LDX #$02
.C:5a7b  8D 03 07    STA $0703
.C:5a7e  8C 04 07    STY $0704
.C:5a81  8E ED 07    STX $07ED
.C:5a84  10 4B       BPL $5AD1

