PET WordCraft tape port dongle

Hi all. I was looking into the PET version of WordCraft. It is one of
the fairly few programs that uses the 8096 memory expansion. But it is
protected with a dongle on the tape port, and I did not come across any
cracked versions.

Does anybody know how to emulate the dongle? Or have one? Or have a
cracked version of WordCraft?

After startup, WordCraft appears to work, and you get into command mode.
However no command actually works, and when trying to get into editing
mode (STOP key), it executes a JAM instruction.

So far I found out that you get to the "interesting" part of the code if
you set a read breakpoint on E811. The code being executed is
"encrypted" in the file as loaded from disk. It gets decrypted before it
is run, and re-encrypted afterwards. I haven't found a trivial way to
disarm it yet.

There is a ROM on zimmers.net that suggests it is for use with
WordCraft, but if so, it's not the protection part, since installing it
does't seem to make a difference (although according to Vice, it does
read from the $9xxx area several times).

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert                            <rhialto/at/falu.nl>
\X/ There is no AI. There is just someone else's work.           --I. Rose