In an effort to make information about C64 commercial turbo loaders available, I collected part of my work in this page.

Please note that only docs in a "Released" status are trustworthy.

Index of documented loaders:

• Accolade/EA (BY: J S EASTERBROOK)
• Audiogenic
• Burner (Mastertronic variant)
• Cult tape
• Freeload Slowload
• Ocean New tape 4
• ODEload
• Rainbow Arts tape (Microload variants)
• Tengen/Domark and Image Works tape
• Trilogic v3.2
• Flashload
• Power Load
• Snakeload V5.0
• Snakeload V5.1
• Elder Gremlin tape
• Gremlin's Fastload
• Gremlin tape 2
• Ocean New tape 1
• Ocean New tape 2
• Ocean New tape 3
• New Hi-Tec/Titus/Krisalis tape
• Atlantis tape
• FF tape
• Rack-it variant
• Ash & Dave tape
• Bleepload variant
• BITURBO (BY SC 85)
• Anirog tape (22/09-84)
• Anirog tape (10/01/85)

Last Updated on: May 10, 2008

"Apollo 18", "Mini Putt-The Ultimate Challenge", "Powerboat USA", "Rack'em Up", "Serve and Volley" (supplied by c64heaven).

"Card Sharks", "Chuck Yeager", "Bards Tale", "The Cycles-International Grand Prix Racing", "Grand Prix Circuit", "Jack Nicklaus Greatest 18 Holes of Major Championship Golf", "PHM Pegasus", "Steel Thunder", "Test Drive", "Test Drive 2" and "World Tour Golf" (supplied by c64heaven).

After the CBM boot file, there is another CBM file that contains the main turbo loader.

Threshold: 0x01EA (490) clock cycles (TAP value: 0x3D)
Bit 0 pulse: 0x29
Bit 1 pulse: 0x4A
Endianess: MSbF

Pilot byte: 0x0F (size: 8 bytes)
Sync  byte: 0xAA

Header
------
16 bytes: Filename
02 bytes: Load address (LSBF)
02 bytes: Data size (LSBF)
01 byte : XOR Checksum of all Header bytes

Data
----
Data is splitted in sub-blocks of 256 bytes each, or less for the last one.
Each sub-block is followed by its XOR checksum byte.
There are no pauses between sub-blocks.

Trailer: 8 Bit 0 pulses + 1 longer pulse.

• The variant has Threshold: 0x01A9 (425) clock cycles, but uses the same pulsewidths, more or less. It's often used in EA releases (whose first CBM Data block CRC32 is sometimes 0xEA684D09).
• The name of the author was found in "Apollo 18".

"Emlyn Hughes Soccer", "Exile", "Graham Gooch's All Star Cricket", "Impact", "Loopz", "World Cup Rugby" (supplied by c64heaven).

CBM Data CRC32: 0x206A8B68.

Threshold: 0x013F (319) clock cycles (TAP value: 0x28)
Bit 0 pulse: 0x1A
Bit 1 pulse: 0x36
Endianess: MSbF

Pilot byte: 0xF0 (size: 4 bytes)
Sync  byte: 0xAA

Header
------
01 byte : Load address (MSB, LSB being always 0x00)

Some values refer to special blocks. They are: 0x00, 0x01, 0x02, 0xCF.
• 0xCF: it is special since part of the loader code is contained in the first turbo file, ALWAYS loaded at $CF00-$CFFF (ALWAYS the same code).
  There we find some messages and a custom print routine. The messages read as follows: LOADING ERROR, PLEASE STOP THE TAPE, PLEASE PRESS REWIND, PLEASE PRESS PLAY.
• 0x00: restores the Default IRQ Routine and initializes CIA I/O Devices before executing a custom routine.
• 0x02: it is the same as 0x00, but also restores RAM Vectors for Default I/O Routines.
• 0x01: it's a re-initialization value. Sync is hunt for again if this value is found.

Data: 256 bytes

01 byte : XOR Checksum of Data

Trailer:
If any chained turbo block follows, there's always a complete byte, whose value is 0x01.
When no block follows, but a long pulse, this byte is usually broken (read the first note below).
So the trailer byte is NOT mandatory.

• The end of a chain (also just a file) is followed by 7 bit 0 pulses, and often there's also a longer pulse which doesn't match bit 0/1 pulses (a broken byte, to make the long story short). Then we have a long pulse (pause).
  In a perfect world, each block would be followed by 8 pulses which make up a value of 0x01.
• Data blocks smaller than 256 bytes must be padded.
• For a deeper analisys of this loader's behaviour, check Fabrizio Gennari's docs.

"Orbitron", "Magic Carpet", "Hektic", "Munch Mania", "Spectipede", "Starrace", and "Darkstar".

A regular CBM part, whose CBM data CRC32 is sometimes 0x53A23D4D. After turbo blocks there's another CBM part followed by additional turbo blocks. CBM Header stores vital loader data. It's encrypted the same way as legacy Burner. The XOR value is 0x59.

Threshold: 0x0180 (384) clock cycles (TAP value: 0x30)
Bit 0 pulse: 0x23
Bit 1 pulse: 0x42
Endianess: Varies per tape

Pilot byte: Varies per tape (size: 192 bytes)
Sync  byte: Varies per tape

Header
------
02 bytes: Load address (LSBF)
02 bytes: End  address (LSBF)

Data

01 byte: EOF marker (when it's 0x00 it means end of a chain)

02 bytes: Execution address (LSBF) (dummy value until the EOF marker is 0x00)

02 bytes: Execution address repeated (last pulse of which is usually broken, so it's NOT mandatory)

Hardcoded inside CBM Header block:
$033C+$87 or $89: Pilot byte
$033C+$92 or $94: Sync byte
$033C+$82 or $84: ROR or ROL (Endianess is LSbF or MSbF respectively)

"Boxing Manager", "Cricket Captain", "International Football", "Scottish Football League", "Soccer Rivals", "World Cup" (supplied by c64heaven).

A regular CBM part, whose CBM data CRC32 is always 0xF1D441D8. This data is loaded at $02E0-$0303. $02E0 is the loader entry point too.

Threshold: 0x01A0 (416) clock cycles (TAP value: 0x34)
Bit 0 pulse: 0x28
Bit 1 pulse: 0x3E
Endianess: LSbF

Pilot bit: Bit 0 pulses (size: 2064 pulses about)
Sync  bit: a single Bit 1 pulse
Additional Sync byte: 0xAA

Data

Trailer: 2031 Bit 0 pulses + 1 Bit 1 pulse.

Hardcoded inside CBM Data block (loaded at $02E0):
$02E0+$0A=$02EA: Load address (LSB)
$02E0+$0E=$02EE: Load address (MSB)
(You may also search for pattern: A9 ll 85 AC A9 mm 85 AD)

Hardcoded inside CBM Header block (loaded at $033C):
$033C+$1B=$0357: End address+1 (LSB)
$033C+$1F=$035B: End address+1 (MSB)
(You may also search for pattern: A9 ll 85 AE A9 mm 85 AF)

"Great Escape", "Platoon", "Rambo", "Top Gun" ("Hollywood" compilation).

As genuine Freeload, but with a bigger threshold. CBM Data CRC32 is often: 0x0AC328F5.

Threshold: 0x0768 (1896) clock cycles (TAP value: 0x77)

Those games use pulses as per below:



Bit	Pulse
0	0x5A
1	0x85

"Bart VS The Space Mutants", "Lethal Weapon", "Nick Faldo's Championship Golf", and "WWF European Rampage Tour" (supplied by c64heaven and cip).

"Outrun Europa" and "Liverpool". It doesn't use data padding at all and has a trailer made up of 7 bits + 1 longer pulse (eg. 0x80).

Basically Freeload, with a different inner structure. CBM Data CRC32 is often 0xB211DFED.

Threshold: 0x0168 (360) clock cycles (TAP value: 0x2D)
Bit 0 pulse: 0x24
Bit 1 pulse: 0x44
Endianess: MSbF

Pilot byte: 0x40 (size: 128 bytes = 1024 pulses)
Sync  byte: 0x5A

Header
------
01 byte : File ID
01 byte : XOR Checksum of Data (NOT checked by the loader)
02 bytes: Load address  (LSBF)
02 bytes: End address+1 (LSBF)

Data
----
Length is multiple of 256, so a block may be padded with zeroes or memory containings during the tape mastering operation.

Trailer: 1 longer pulse (eg. 0x80).

• Padding data must not be included in checksum calculation.
• Padding data must not be removed, even if those bytes can be set to 0.

"Pipe Mania (Empire), "Better Dead than Alien (Electra)", partly in "Yes prime minister" (c64heaven), and probably in "Block Busters (TV Games)".

• First character in CBM filename is: ">" (0x3E)
• CBM Data CRC32: 0xD5961DB0

Threshold: 0x01B0 (432) clock cycles (Tap value: 0x36)
Bit 0 pulse: 0x25
Bit 1 pulse: 0x50
Endianess: MSbF

Pilot byte: 0x20 (size: 64 bytes)
Sync  byte: 0xDB

Header
------
02 bytes: Load address (LSBF)
02 bytes: End address (LSBF)


Data

01 byte : XOR checksum of Data

Trailer: a longer pulse

The first TURBO file contains a copy of this loader (load address may vary) and the string with loader's name which is sometimes shown during load (not in PipeMania):
05 0E 28 6F 64 65 4C 4F 41 44 20 31 39 38 39 29 "..(odeLOAD 1989)"

"Circus Attractions" (v1), "Curse of Ra" (v1/2), "Grand Monster Slam" (v1), "Logical" (v2), "Puffys Saga" (v1), "Rock'n'Roll" (v1/2), "Rolling Ronny" (v2), "Western Games" (v1), "X-Out" (v1/2) (supplied by c64heaven).

CBM Data CRC32 is sometimes 0xED3BB9E4.

Threshold: 0x014D (333) clock cycles (TAP value: 0x2A)
Bit 0 pulse: 0x19
Bit 1 pulse: 0x36
Endianess: LSbF

Pilot byte: 0xA0 (size: 992 bytes, even if 867 were found too)
Sync  train: 0x0A, 0x09, ... , 0x01

Header
------
01 byte : File ID
02 bytes: Load address (LSBF)
02 bytes: 0x10000 - Block Size (LSBF)

Data

01 byte : XOR Checksum of Data

Trailer: a couple of Bit 0 and Bit 1 pulses followed by a "longer" pulse.

Threshold: 0x014D (333) clock cycles (TAP value: 0x2A)
Bit 0 pulse: 0x19
Bit 1 pulse: 0x36
Endianess: LSbF

Pilot byte: 0xA0 (size: 852 bytes)
Sync  train: 0x0B, 0x0A, 0x09, ... , 0x01

Header
------
03 bytes: File name
02 bytes: Load address (LSBF)
02 bytes: 0x10000 - Block Size (LSBF)

Data

01 byte : XOR Checksum of Data

Trailer: a couple of Bit 0 and Bit 1 pulses followed by a "longer" pulse.

"3D construction kit", "Cisco Heat" (IW) [Multiloaded], "Skull and Crossbones" [Multiloaded], "Pit Fighter" [Multiloaded], "Badlands", "Rampart" [Multiloaded], "Rugby the World Cup" [Multiloaded], "The Spy who loved me" [Multiloaded], (thanks to c64heaven for those last 4 taps and "3DCK") and probably a lot of other TENGEN/DOMARK Releases.

There are 2 complete CBM files. The first CBM file (DATA size: 2 -two- bytes, Loads at $029F: 51 03, CRC32: 0x848FD0AF) autoexecutes, loads a 2nd complete CBM file (which contains the Turbo Loader) and executes it.
Autostarting ROM cartridges are disabled.

Threshold: 0x029F ??? (671) clock cycles (TAP value: 0x54)
Bit 0 pulse: 0x44
Bit 1 pulse: 0x65
Endianess: LSbF

Pilot byte: 0xA0 (size: 255 bytes, but a pulse is often missing in the beginning)
Sync  sequence: 0x0A, 0x09, ..., 0x01

Header
------
Type 1 (used to load few initial blocks only)

02 bytes: Length of Data (LSBF)
01 byte : File ID

Type 2 (used for multi-load parts, if any is present)

02 bytes: Length of Data (LSBF)
02 bytes: Load address   (LSBF)
n bytes: file name (size is customable)

n=1 in "Skull and Crossbones"
n=2 in "Cisco Heat", "Hydra" and "Pit Fighter"
n=4 in "Rampart"

Data
----
-Length of Data- bytes: encrypted data.
To uncrypt do:
  data = data ^ a;
  a = (a + 1) & 0xff;
setting a=0 BEFORE reading the first encrypted data byte.

01 byte : XOR Checksum of uncrypted Data

01 byte : 0x20 = EOF marker (last bit of which is broken if no trailer follows, so that it's NOT mandatory)

Trailer: Often missing in Type 1 blocks. It is usually made up of 7 Bit 0 pulses followed by a bigger pulse (eg. 0x76-0x82).

• Header type can be identified using the EOF markers.
• "Load address" is sometimes ignored ("Cisco Heat", "Pit Fighter", "Rampart").

A lot of Alternative releases, as "Double Dare", "Fireman Sam", "Hellfire Attack", "Kentucky Racing", "Merlin", "Metranaut", "Strike Force", "Superted" (supplied by c64heaven).

CBM Data CRC32: 0x848FD0AF.

Threshold: 0x0141 (321) clock cycles (TAP value: 0x28)
Bit 0 pulse: 0x1C
Bit 1 pulse: 0x35
Endianess: MSbF

Pilot byte: 0x0F (size: 256 bytes)
Sync  byte: 0x0E, 0x0D, ... 0x00

Header
------
02 bytes: Load address (LSBF)
02 bytes: End address+1 (LSBF)

Data

01 byte : Checkbyte
Addition of data bytes, plus 1 for each added byte.

Trailer: NONE found.

An equivalent way to calculate checksum is: (Addition of data bytes + data size LSB) & 0xFF.

"Ghostbusters", "Hacker", "On Court Tennis" (supplied by cip and BGK), "Master of Lamps", "Rock'n'Bolt" and "Great American Cross Country Road Racing" (supplied by c64heaven).

After the CBM boot file (DATA size: 255 bytes, CRC32: 0x8E027BD2) there's another CBM Data block containing the loader.
It checks for autostarting ROM cartridges (eg. SIMON's BASIC) and disk drives. If any is found, usually load doesn't end successfully.

Threshold: 0x0118 (280) clock cycles (TAP value: 0x22)
Bit 0 pulse: 0x1F (very close to threshold!)
Bit 1 pulse: 0x31
Endianess: MSbF

Pilot bit: Bit 1 pulses (size: 2048 pulses about)
Sync  bit: a single Bit 0 pulse
Additional Sync byte: 0x33

Header
------
02 bytes: Load address (LSBF)
02 bytes: End address  (LSBF)

Data

01 byte : XOR Checksum of Data

Two variants were found so far (CBM DATA CRC32 not matching the documented one):

• Return of the Jedi: whole pilot is 20480 pulses
• Falcon Patrol 2: no sync byte at all

"Felix in the factory", "Ghouls", "Jet Power Jack" - probably any other "Micro Power, Tynesoft" release -, and "Stock Car" (supplied by cip and BGK).

There are 2 complete CBM files (first one DATA CRC32: 0xD407EAA3, second one HEADER CRC32: 0x4140B476).
The second CBM file contains the Main Loader ($CE47-$CF09) where the needed load information is stored (eg. Load Address, see Notes later).
The name of this loader was found on game boxes. It's very similiar to "Anirog tape" and its variants.
A clone with a different loader structure can be found on "Builder Ben" (supplied by BGK), and with small variants in its code on "Shockway Rider" (supplied by c64heaven).

Threshold: 0x0107 (263) clock cycles (TAP value: 0x20)
Bit 0 pulse: 0x1C
Bit 1 pulse: 0x29
Endianess: MSbF

Pilot byte: 0x02 (size: 1043 bytes)
Sync  sequence: 0x09 down to 0x00

Data

n bytes: Additional Data not read (size varies)

1 byte : XOR checksum of all data bytes included those n additional bytes

Trailer: 2048 Bit 0 pulses about

• Load Address is at:      $CE48 (LSB)/$CE4A (MSB)
  End Address+1 is at:     $CE50 (LSB)/$CE52 (MSB)
  Execution Address is at: $CF07 (LSB)/$CF08 (MSB)
• The clones store those infos somewhere else, but, seeking for a common pattern, they can be extracted easily from both versions with a common method.
• Power Load-er doesn't read and check the checksum byte, but a checksum byte is present and just after data block.

"Soldier of Light" (under check), "Shinobi", "Saint Dragon", "Ninja Warriors", "Narc" (these last two were supplied by c64heaven) and probably some more.

This turbo loader is usually contained in a CBM file loaded at $0801 (BASIC area) without an autostart.

The following text was found in "Ninja Warriors"' CBM Data block:
SNAKELOAD V5.0 (C) STEVE SNAKE, KML 1987. THIS IS NOT SUPPOSED TO BE PROTECTED
SO DON'T THINK YOU ARE GOOD FOR CRACKING IT !!!KYLIE RULES!

2 pulsewidth sets were found so far:



Bit	Shinobi, Ninja Warriors	Saint Dragon, Narc
0	0x60	0x3F
1	0xA0	0x5F
Th	0x03FF (0x80)	0x0240 (0x48)


Endianess: MSbF

Pilot bit: Bit 0 pulses (size: 2063 pulses = 257 bytes + 7 bits)
Sync bit: a single Bit 1 pulse

Header
------
05 bytes: 65 69 6C 79 4B: "eilyK" - Identifier (read backwards: "Kylie")

01 byte : File ID
02 bytes: Load address  (LSBF)
02 bytes: End address+1 (LSBF)


Data

01 byte : Checksum (addition of data bytes)

Trailer: Bit 0 pulses, last one being usually longer.
• size: 2032 = 0xFE bytes in "Shinobi"
• size: 248  = 0x1F bytes in "Narc", "Saint Dragon" and "Ninja Warriors"

"Final Blow", "Rodland", "SWIV" (supplied by c64heaven) "Double Dragon 3", "Indy Heat" (supplied by Mr.Fox).

This turbo loader is usually contained in a CBM file loaded at $0801 (BASIC area) without an autostart.

Threshold: 0x01BE (446) clock cycles (TAP value: 0x38)
Bit 0 pulse: 0x28
Bit 1 pulse: 0x48
Endianess: MSbF

Pilot bit: Bit 0 pulses (size: 2055 pulses = 256 bytes + 7 bits)
Sync bit: a single Bit 1 pulse

Header
------
08 bytes: Identifier, read backwards. 3 of them were found:

• B2 B4 B2 D4 CE CF D2 C6 ("FRONT242" - Uppercase and reversed) in "Final Blow", "Rod Land (Side1)"
• 85 8C 8C 85 88 83 89 8D ("MICHELLE" - Lowercase and reversed) in "S.W.I.V. (Side1)"
• C8 C3 D4 C9 D2 C4 CC C5 ("ELDRITCH" - Uppercase and reversed) in "Rod Land (Side2)", "Double Dragon 3", "Indy Heat"

01 byte : File ID
02 bytes: End address+1 (MSBF)
02 bytes: Load address  (MSBF)

Data

01 byte : Checksum
Its value is calculated by XORing Data bytes and adding 1 to the XOR checksum AFTER a byte is stored at an address with LSB being 0xFF (eg. $08FF, $7DFF, etc.).

Trailer: Bit 0 pulses (size: 512 = 0x40 bytes).

"Blasteroids", "Deathwish 3", "Xybots", "Peter Beardsley International Football" and "Thunderbirds (Grandslam)" (supplied by c64heaven).

There are 2 complete CBM files. The first CBM file is loaded at $02A7 (sometime Data CRC32 is: 0xF5D2B483), autoexecutes and loads a 2nd complete CBM file (which contains the Turbo Loader) at $0400 (video area) and executes it.
The second CBM file is named "PROGRAM".
There's just a single turbo block on tape.

Threshold: 0x028E (654) clock cycles (TAP value: 0x52)
Bit 0 pulse: 0x40
Bit 1 pulse: 0x70
Endianess: MSbF

Sync  byte: 0xF0

Data

Trailer:
Usually a pattern made up of 79-80 bit 1 and bit 0 pulses.
Here the patterns I found so far:


• Blasteroids: F7F7: F7 B9 FF A6 04 3F B9 BD 21 [incomplete byte]
• PBIF       : F7F7: 00 00 00 A6 04 00 00 00 00 2E
• TB Part 1  : F7F7: 00 00 00 AE 04 00 00 00 FF 2E
• TB Part 2  : F7F7: 00 00 00 AE 04 00 00 00 FF [incomplete byte]
• TB Part 3  : F7F7: 00 00 00 AE 04 00 00 00 FF 2E
• TB Part 4  : F7F7: 00 00 00 AE 04 00 00 00 FF [incomplete byte]
• Xybots     : F7F7: 00 00 00 A6 04 00 00 00 FF [incomplete byte]

I would say that this pattern should be present in legacy tapes and that the 0x04 value should always be at offset 0x05.
When Trailer is missing (as in Deathwish 3), the last pulse is broken = not matching any of the given pulsewidths!

Load address is found inside the second CBM file at: $0434 (LSB)/$0439 (MSB)
Data Size -1 is found inside the second CBM file at: $043E (LSB)/$0442 (MSB)

The last byte is always loaded at $FFF6 (this fact may be used as a plausibility check when seeking this type of files). Load address is usually $0800, but in Deathwish 3.
Due to these anomalties in Deathwish 3 I would say it's a non-genuine Elder Gremlin tape.

That said, I would only consider genuine Elder Gremlin files those that are loaded at $0800-$FFF6 (included), ie I would completely ignore the values inside the second CBM data file. Additionally, I would make the trailer pattern mandatory (the first 9 bytes at least), even if the game doesn't rely on it. A check on that 0x04 value inside the trailer should be done too.
Keep in mind that we want a safe scanner for those TAPs which are safe to clean, not a safe loader...

"Cybernoid" (from Zer0-X online archive), "Blood Brothers", "Deflektor", "Mask 2", "North Star", "Venom Strikes Back (Mask III)" (supplied by c64heaven).

There are 2 complete CBM files. The first CBM file is loaded at $02A7, autoexecutes, loads a 2nd complete CBM file (which contains the Turbo Loader) at $0400 (video area), and executes it.
The second CBM file has different names:
• "FASTLOAD" in "Deflektor", "Mask 2" and "Venom Strikes Back (Mask III)" (Header CRC32: 0x26768E85)
• "HELLO" in "Blood Brothers", "Cybernoid" and "North Star" (Header CRC32: 0xB3A82F14)

Threshold: 0x0350 (592) clock cycles (TAP value: 0x4A)
Bit 0 pulse: 0x32
Bit 1 pulse: 0x63
Endianess: MSbF

Pilot bit: Bit 1 pulses (size: 215 pulses about)
Sync bit: a single Bit 0 pulse

Header
-----
02 bytes: File ID ("01", "02", "03", etc.)
02 bytes: Load address (LSBF)
02 bytes: Data Size    (LSBF)

Data
----
Last pulse is usually broken = not matching any of the given pulsewidths!

Some pulses were found before the first turbo block pilot. They were used as separator: 7-8 Bit 1 pulses and 169 Bit 0 pulses. They must be kept.

"Auf Wiedersehen Monty", "Bulldog" (from Gremlin's "10 Great Games", supplied by cip) and "Krakout" (supplied by c64heaven).

After the boot CBM file, there is another CBM DATA block, loaded at $0400. Data files are partly encrypted and some uncrypting is needed before executing the Main Loader.

Threshold: 0x0160 (352) clock cycles (TAP value: 0x2B).
Bit 0 pulse: 0x1F
Bit 1 pulse: 0x40
Endianess: LSbF

Pilot byte: 0xE3 (size: 256 bytes)
Sync  byte: 0xED

Blocks are chained, each one has its own header, without pauses between them:

Header
------
1 byte: Block ID (descending, last one is 0x01)
2 bytes: Load Address (LSBF)
1 byte: Block Size (0x00=256, 0xFF=255, and so on)
Data
----
"Block Size" encrypted bytes.

To uncrypt them you have to XOR each read byte with an Uncrypt byte. Uncrypt byte is one from the Uncrypt block (see ahead), starting from the first one and advancing by one byte at time. Then you have to XOR the resulting value with its destination address, LSB and MSB.
When the last Uncrypt byte has been used, restart from the first one.

Example from "Krakout" (loads a $F6F9 bytes-long block at $0900):

Block| ID | Load Addr | Size | Remainder
-----+----+-----------+------+----------
1st  | F7 |     00 09 |   00 | Data
2nd  | F6 |     00 0A |   00 | Data
.
.
.
last | 01 |     00 FF |   F9 | Data


After all blocks come:

2 bytes: Execution address (LSBF), immediately executed if Checkbyte matches.
1 byte: Checkbyte (XOR of all UNCRYPTED data bytes with 0x00).

Trailer: 256 Bit 1 pulses with last one being bigger.

"Auf Wiedersehen Monty":

78 A9 E7 8D FA FF 8D FE FF A9 00 8D FB FF 8D FF
FF A2 43 9A AD FD FF 48 A2 FF 9A A9 7F 8D 0D DC
8D 0D DD AD 0D DC AD 0D DD A9 60 8D 04 DD A9 01
8D 05 DD A9 00 8D 20 D0 8D 11 D0 85 0A 85 02 A9
19 8D 0E DD 20 D7 00 66 07 A5 07 C9 E3 D0 F5 20
CA 00 C9 E3 F0 F9 C9 ED D0 EA 20 CA 00 85 05 20
CA 00 85 08 20 CA 00 85 09 20 CA 00 85 06 A0 00
20 CA 00 A6 02 55 0B E8 E0 DC D0 02 A2 00 86 02
45 09 45 08 C6 01 91 08 E6 01 8D 20 D0 45 0A 85
0A E6 08 D0 02 E6 09 C6 06 D0 D3 C6 05 D0 BB 20
CA 00 85 03 20 CA 00 85 04 20 CA 00 C5 0A D0 03
6C 03 00 AD 20 D0 18 69 04 8D 20 D0 4C BE 00 A2
08 20 D7 00 66 07 CA D0 F8 A5 07 60 A9 10 2C 0D
DC F0 FB 4E 0D DD A9 19 8D 0E DD 60

"Bulldog" and "Krakout":

78 A9 D1 8D FA FF 8D FE FF A9 00 8D FB FF 8D FF
FF A9 7F 8D 0D DC 8D 0D DD AD 0D DC AD 0D DD A9
60 8D 04 DD A9 01 8D 05 DD A9 00 8D 20 D0 85 FF
85 F6 A9 19 8D 0E DD 20 BE 00 66 FC A5 FC C9 E3
D0 F5 20 B1 00 C9 E3 F0 F9 C9 ED D0 EA 20 B1 00
85 FA 20 B1 00 85 FD 20 B1 00 85 FE 20 B1 00 85
FB A0 00 20 B1 00 A6 F6 55 02 E8 E0 CF D0 02 A2
00 86 F6 45 FE 45 FD C6 01 91 FD E6 01 45 FF 85
FF E6 FD D0 02 E6 FE C6 FB D0 D6 C6 FA D0 BE 20
B1 00 85 F7 20 B1 00 85 F8 20 B1 00 C5 FF D0 03
6C F7 00 AD 20 D0 18 69 04 8D 20 D0 4C A5 00 A2
08 20 BE 00 66 FC CA D0 F8 A5 FC 60 A9 10 2C 0D
DC F0 FB 4E 0D DD A9 19 8D 0E DD EE 20 D0 60

"Addams Family", "Adidas Soccer", "Cool World", "Darkman", "Hook", "Hudson Hawk", "Midnight Resistance", "SlySpy" and "WWF Wrestlemania" (supplied by c64heaven).

It's a freeload-like loader with an addictional byte before turbo block's header.

2 pulsewidth sets were found so far:



Bit	Adidas Soccer, Hudson Hawk, Hook, Midnight Resistance	Addams Family, Cool World, Darkman, SlySpy, WWF Wrestlemania
0	0x22	0x35
1	0x42	0x65


Endianess: MSbF

Pilot byte: 0x40 (size: 128 bytes = 1024 pulses)
Sync  byte: 0x5A

Header
------
01 byte : File ID, mostly ignored by some games
02 bytes: Load address  (LSBF)
02 bytes: End address+1 (LSBF)

Data

01 byte : XOR checksum of all data bytes

Trailer: 1 longer pulse (eg. 0x65) or 8 bits (variuos combinations were found) + 1 longer pulse (type 2).

"Klax" and "Shadow Warriors" but also in "Hero Quest", "Hero Quest Return of Witchlord" (supplied by c64heaven).

It's a freeload-like loader with an addictional byte in turbo block's header, after End address.

Threshold: 0x0168 (360) clock cycles (TAP value: 0x2D)
Bit 0 pulse: 0x22
Bit 1 pulse: 0x42
Endianess: MSbF

Pilot byte: 0x40 (size: 128 bytes = 1024 pulses)
Sync  byte: 0x5A

Header
------
02 bytes: Load address  (LSBF)
02 bytes: End address+1 (LSBF)
01 byte : File ID (not checked if searching for 0x00)

Data

01 byte : XOR checksum of all data bytes

Trailer: 1 longer pulse (eg. 0x80).

"Night Breed" and "Run the Gauntlet" (supplied by c64heaven).

There are 2 or 3 CBM files, the last one containing the loader (loads at $0800, up to $0CFE).
This loader outputs read data to the audio channel.

Threshold: 0x01B3 (435) clock cycles (TAP value: 0x36)
Bit 0 pulse: 0x2E
Bit 1 pulse: 0x49
Endianess: MSbF

Turbo blocks are chained with no pauses between them. Pauses were found after every 16 turbo files.

Pilot pulse: 0x80 (size: 64 pulses)
Sync  pulse: a single Bit 0 pulse

Header
------
01 byte : 0x00
01 byte : File ID
01 byte : 0x00
01 byte : XOR Checksum of Data

Data (256 bytes) (last one in a chain may be padded with 0x00's)

"Jahangir Khan World Championship Squash (2 versions)", "Manchester United Europe", "The Blues Brothers" (Titus), "The Jetsons" (Hi-Tec), supplied by c64heaven.

As Ocean New Tape 2, but with a bigger threshold. CBM Data CRC32 is often: 0x7E4A9653.

Threshold: 0x01B0 (432) clock cycles (TAP value: 0x36)

Even if using the same threshold, those games use different pulses:



Bit	The Blues Bros, MUE, JKWCS	The Jetsons
0	0x29	0x26
1	0x52	0x4A

"Cavemania", "Hob Goblin", "Moontorc", "Killing Machine", "Spooky Castle", "Superkid in space" (supplied by c64heaven) and probably any other Atlantis release.

Threshold: 0x0180 (384) clock cycles (TAP value: 0x2F)
Bit 0 pulse: 0x1E
Bit 1 pulse: 0x40
Endianess: LSbF

Pilot byte: 0x02 (size: 254 bytes)
Sync  couple (bytes): 0x52, 0x42

Header
------
02 bytes: Execution address (MSBF)
02 bytes: End address+1     (MSBF)
02 bytes: Load address      (MSBF)

Data

01 byte : XOR checksum of all data bytes

01 byte : internal use

Trailer: 7 bits + 1 longer pulse or 1 longer pulse (eg. 0x51).

"Addicta Ball", "Bug Bomber", "Football Manager", "Gremlin Pool", "Gremlin Snooker", "Skateboard Joust" and "Turbo 64" (supplied by c64heaven).

The boot CBM file (Filename "FF"; HEADER CRC32: 0x0E527A8B, but in "Bug Bomber"; DATA loaded at $02C0-$0303, CRC32: 0xE356E438) contains the turbo loader, inside the the Data block code Load and End addresses of 2 turbo blocks are hardcoded:


*=$02D7
LDA #$00 ; Start: $6000
STA $AC
LDA #$60
STA $AD
LDA #$00 ; End: $7400
STA $AE
LDA #$74
STA $AF
JSR $0359 ; Go load it

LDA #$00 ; Start: $1400
STA $AC
LDA #$14
STA $AD
LDA #$E0 ; End: $23E0
STA $AE
LDA #$23
STA $AF
JSR $0359 ; Go load it



The first 2 turbo blocks are usually loaded at: $6000-$7400, $1400-$23E0.

Threshold: 0x01A0 (416) clock cycles (TAP value: 0x34)
Bit 0 pulse: 0x28
Bit 1 pulse: 0x3F
Endianess: LSbF

Pilot bit: Bit 0 pulses (size: 2056 pulses about)
Sync  couple (bytes): 0x80, 0xAA

Data

Trailer: Bit 0 pulses (x2040 about)

"Scorpion" (RackIt/Hewson) (supplied by c64heaven)

Same as Rack-it without any encrypt value in header.

Threshold : 0x0160 (352) clock cycles (TAP value: 0x2C).
Bit 0 pulse: 0x1D
Bit 1 pulse: 0x3D
Endianess : MSbF

Pilot byte: 0x8F (size: about 218 found, even if very noisy at the beginning)
Sync  byte: 0x97

Header
------
01 byte : Bank-value (stored at 0x01)
01 byte : XOR checksum of data bytes
02 bytes: End Address+1 (MSBF)
02 bytes: Start Address (MSBF)
01 byte : File ID

Data

Trailer: 8 x Bit 1 pulses, last one being slightly bigger.

Last block loads at $FFFC, which is the execution address, executed at $0218 with a
"JMP ($FFFC)".

"Robin Hood-Legend Quest", "Slicks", "Hot Rod", "Johnny Quest".
Also used (with small differences) in "Dynamix" and "Poseidon Planet Eleven" (all tapes supplied by c64heaven).

Threshold: 0x0168 (360) clock cycles (TAP value: 0x2D)
Bit 0 pulse: 0x22
Bit 1 pulse: 0x44
Endianess: MSbF

Pilot byte: 0x80 (size: 255 bytes)
Sync  byte: 0x40

Header
------
01 byte : File ID (doesn't seem to be unique)
02 bytes: Load address (LSBF)
02 bytes: End address+1 (LSBF)

Data

Trailer
-------
A sequence of Bytes:
0x00 0x01 0x02 0x04 0x08 0x10 0x20 0x40 0x80
0x11 0x22 0x33 0x44 0x55 0x66 0x77 (last pulse of which is corrupted)

Pilot size is shorter (128 bytes) in Hot Rod, which also misses a trailer. Due to this fact, the last data pulse before a pause is always corrupted, as it happens in Gremlin tapes.

I would consider Hot Rod a non genuine one and make the trailer pattern mandatory (the first 15 bytes at least), even if the game doesn't rely on it.
Keep in mind that we want a safe scanner for those TAPs which are safe to clean, not a safe loader...

"Lord Of Chaos" and "Laser Squad" (supplied by c64heaven).

Threshold: 0x0232 (562) clock cycles (Tap value: 0x46)
Bit 0 pulse: 0x31
Bit 1 pulse: 0x5A
Endianess: MSbF

Leading pulse: Bit 1 (size: 2048 pulses)
Pilot byte: pb (size: 10 bytes) (custom value)
Sync  byte 1: pb^0xFF
Sync  byte 2: pb

Header
------
02 bytes: Data Size - 1 (LSBF)

Data

01 byte : XOR checksum of Header + Data

Trailer: 2048 Bit 1 pulses

• It looks hard to find out the pb, but it's not. MSb of pb is NEVER 1, therefore, immediately after the Leading Train we find pb.
• Load address and pb for some of the first blocks are hardcoded in the loader. Anyway, the core load routine is at $9100 and to call it, the asm program sets:
  
  x=Load address (LSB)
  y=Load address (MSB)
  a=pb
  
  Here there's an example:
  
  A2 00     LDX #$00    ; Load address ($5000)
  A0 50     LDY #$50
  A9 0D     LDA #$0D    ; Pilot 0x0D
  20 00 91  JSR $9100

Some magazine tapes (Radio, Elettronica & Computer).

After the CBM boot file, there's just one turbo block. Load/End addresses are hardcoded inside the CBM Data block.
More than one file per tape uses this loader, so the right CBM part has to be checked for extracting Load/End addresses.

Threshold: 0x0107 (263) clock cycles (TAP value: 0x21)
Bit 0 pulse: 0x1B
Bit 1 pulse: 0x27
Endianess: MSbF

Pilot byte: 0x02 (size: 496 bytes)
Sync  sequence: 0x10, 0x0F, ... 0x01, 0x00

Data

01 byte : XOR checksum

Trailer: Bit 0 pulses (x2040 about)

Hardcoded inside CBM Data block (loaded at $02BA):
$02BA+$4B=$0305: Load address (LSB)
$02BA+$5D=$0317: Load address (MSB)
$02BA+$59=$0313: End  address (LSB)
$02BA+$52=$030C: End  address (MSB)

"Slapshot" (Advantage Artworx - (C) Superior Quality Software).

"Alice in Videoland", "Battle through Time", "Ghostchaser", "Linkword languages", "Space Pilot".

• CBM DATA CRC32: 0x05E3D02B.
• The message "DATE:22/09-84" was found in CBM HEADER.
• The first Turbo Block is a copy of the Main Loader which shows the "ANIROG" logo while it unpacks its code. The following turbo block is game data (uncrypted after load). Unfortunately, Load and End addresses are stored between code instructions.

Threshold: 0x0107 (263) clock cycles (TAP value: 0x21)
Bit 0 pulse: 0x1B
Bit 1 pulse: 0x29
Endianess: MSbF

Pilot byte: 0x02 (size: ???)
Sync  train: 0x09 down to 0x01

Header
------
01 byte : File ID. Any value, but 0x00.


Data

"Space Pilot" ((C) Kingsoft).

• CBM DATA CRC32: 0x737CE3A9.
• Code is encrypted.
• The message "MASTER DATE:10/01/85" was found in CBM HEADER, together with "ANIROG UKP".

Threshold: 0x0107 (263) clock cycles (TAP value: 0x21)
Bit 0 pulse: 0x1B
Bit 1 pulse: 0x29
Endianess: MSbF up to "File ID" byte, LSbF for the rest

Pilot byte: 0x02 (size: ???)
Sync  sequence: 0x09 down to 0x01

Header
------
01 byte : File ID. Any value, but 0x00.
02 bytes: Load Address (LSBF)
02 bytes: End Address (LSBF)

Data

02 bytes: Execution address - 1 (MSBF <- take care!)

Additional information about loaders available at:

• http://www.geocities.com/SiliconValley/Platform/8224/c64tape/