Filecracking Joust?

[Steve Nickolas <usotsuki@buric.co>]

OK, here goes.

Joust is two stages.  Stage 1 is a loader and a subroutine to configure 
the game, and Stage 2 is the game itself.  (Exit to Stage 1, via Ctrl-Q, 
is done by a reboot.  I haven't found that code yet.)

The important part of Stage 1 seems to be 6000-7FFF.  I am trying to 
figure out where it modifies when you select options but the code is 
intentionally obfuscated and is a nightmare to trace through.

http://www.brutaldeluxe.fr/crack/JOUST.DSK

Here's what I'm working with.

What I've figured out so far is that the configurator's entry point from 
the loader is 7000, and the keyboard handling code for the options menu is 
at 70AD.  The function is JMP'd to:

  S (toggle sound on/off)   - 70D4
  J (use joystick)          - 7011
  K (use keyboard)          - 7126
  Space (exit and run game) - 717B

Obviously any memory areas this code uses would need to be marked 
"protected" when I go through the actual game code.

Because of memory usage, it may not be possible to reliably protect the 
ProDOS global page, so it will still be necessary to reboot on Ctrl-Q, 
making it "Quit" instead of the traditional Atarisoft "Options" key. 
(This can be worked around at the cost of potentially stepping on the 
Selector... not worth it, really, unless I want to go 128K, and that's a 
bit of a waste.)

Basically, my plan here is to replace the loader, while keeping this first 
stage intact.

-uso.