[blue1]

The 64K of RAM, amounting to the full address space of the 6510 CPU, were partially shadowed by other things (the Kernal ROM, the character map, the BASIC interpreter ROM, etc). Memory writes always went to RAM. By just setting memory location 1 appropriately (POKE 1 in BASIC) you could decide where the reads came from. Since there was a single thread/process (i.e. yours) you could do this as will.

[jacquesm]

Which lead to an interesting trick: read the ROM locations, write back the data to the same address. Flip the bit and now you have BASIC or the OS in RAM and everything just keeps on running, then you can modify these to your hearts content