Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
mg_notes:iie_card:iie_startup_resources [2017/07/17 22:04] M.G. ↷ Page moved from :mg_notes:iie_card:iie_startup_resources to :foo:iie_card:iie_startup_resources |
mg_notes:iie_card:iie_startup_resources [2018/02/08 13:00] (current) M.G. [Monx] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== IIe Startup Resources ====== | + | ====== LC //e Card - IIe Startup Resources ====== |
| These are the most interesting resources in ''IIe Startup''. | These are the most interesting resources in ''IIe Startup''. | ||
| Line 20: | Line 20: | ||
| </code> | </code> | ||
| - | ===== 'CNxx' ===== | + | ===== CNxx ===== |
| - | These appear to be the slot-mapped firmware, but a curiosity is that two of them, the memory card and the workstation card, are larger than the allocated slot space. These are not obfuscated. | + | These are the slot-mapped firmware. The ones with only 256 bytes have relocatable firmware. The ones that are 1792 (256*7) bytes have 7 copies of the firmware, each specific to the slot they are installed in. These are not obfuscated. |
| <code> | <code> | ||
| Line 38: | Line 38: | ||
| ===== C8xx ===== | ===== C8xx ===== | ||
| - | These appear to be the C8 Firmware for the various cards. They are not obfuscated. | + | These are the C8 Firmware for the various cards. They are not obfuscated. |
| <code> | <code> | ||
| Line 55: | Line 55: | ||
| ===== Monx ===== | ===== Monx ===== | ||
| - | These have simple XOR obfuscation with the key "DoubleX". | + | These have simple XOR obfuscation with the key "DoubleX" (a reference to the card's code name, "Double Exposure"). |
| - | At least A2EMonitorROM has 6 extra bytes at the beginning, an apparent header that tells the IIe application where to put the firmware | + | After de-obfuscating there is a header that tells the IIe application where to put the firmware within the Card's memory. |
| ^ Bytes ^ Use ^ | ^ Bytes ^ Use ^ | ||
| | 0,1 | 6502 Address | | | 0,1 | 6502 Address | | ||
| - | | 2,3 | Firmware RAM address low 16 bits? | | + | | 2,3 | Firmware address | |
| - | | 4,5 | ? | | + | | 4,5 | Length (less header 6 bytes) | |
| <code> | <code> | ||
| Line 74: | Line 74: | ||
| C292: 6 bytes | C292: 6 bytes | ||
| ~C3F0-C5FF: large sections different | ~C3F0-C5FF: large sections different | ||
| + | C5B7 appears to be a speed-compensated paddle read routine. | ||
| CB21: 5 bytes | CB21: 5 bytes | ||
| E006: N $C4, C: $31 (CPY $20 -> AND ($20),Y) | E006: N $C4, C: $31 (CPY $20 -> AND ($20),Y) | ||
| Line 86: | Line 87: | ||
| FAD5: N $00 $00 | FAD5: N $00 $00 | ||
| C $EA $EA | C $EA $EA | ||
| - | FB1E: 17 bytes except 3B20 | + | FB1E: 17 bytes except 3B20, patch to PREAD to go to |
| + | Int CX ROM $C5B7 | ||
| FB63: N $A0 $09 | FB63: N $A0 $09 | ||
| C $02 $04 | C $02 $04 | ||
| FBBE: N $00, C: $03 | FBBE: N $00, C: $03 | ||
| FBDD: 5 bytes | FBDD: 5 bytes | ||
| - | FC7A: 27 bytes | + | FC7A: 27 bytes - patch to "IRQ Sniffer for Video Code" |
| - | FCC9: 9 byte (C: all $60 RTS) | + | to essentially remove the IRQ sniffing |
| + | FCC9: 9 byte (C: all $60 RTS) - write tape header RTSed away | ||
| FD78: N $C9 $95 | FD78: N $C9 $95 | ||
| C $02 $06 | C $02 $06 | ||
| FECD: 10 bytes, start with $60 RTS | FECD: 10 bytes, start with $60 RTS | ||
| - | FEFD: 13 bytes, start with $60 RTS | + | Tape write routine. |
| + | FECE=short routine to set CPU speed to option panel | ||
| + | speed at cold start. | ||
| + | FEFD: 13 bytes, start with $60 RTS, tape read | ||
| + | replacement doesn't appear to be code. | ||
| | | ||
| | | ||
| Line 118: | Line 125: | ||
| 5632 2042 "5.25� Disk" ; 00 c8 00 f0 00 08 | 5632 2042 "5.25� Disk" ; 00 c8 00 f0 00 08 | ||
| 5120 9478 "PFI Bank 0" ; 00 d4 00 54 00 25 | 5120 9478 "PFI Bank 0" ; 00 d4 00 54 00 25 | ||
| - | ProDOS Filing Interface | + | ProDOS Filing Interface. Actually loads in bank D1. |
| 5121 9478 "PFI Bank 1" ; 00 d4 00 94 00 25 | 5121 9478 "PFI Bank 1" ; 00 d4 00 94 00 25 | ||
| - | ProDOS Filing Interface | + | ProDOS Filing Interface. Actually loads in bank D2. |
| completely different than the bank 0 code above. | completely different than the bank 0 code above. | ||
| - | <code> | + | </code> |
| + | |||
| + | Load address tables for 'Monx': | ||
| + | |||
| + | ^ Name ^ Bank ^ 6502 \\ Start ^ 6502 \\ End ^ Load \\ Addr ^ | ||
| + | | A2EMonitorROM | Main | $C000 | $FFFF | $0000 | | ||
| + | | D1 INTCX | D1 | $C3FA | $C5A0 | $43FA | | ||
| + | | D1 NMI-IRQ Rcvr | D1 | $D000 | $D065 | $5000 | | ||
| + | | PFI Bank 0 | D1 | $D400 | $F8FF | $5400 | | ||
| + | | D1 Vectors | D1 | $FFFA | $FFFF | $7FFA | | ||
| + | | D2 INTCX | D2 | $C3FA | $C5A0 | $83FA | | ||
| + | | D2 NMI-IRQ Rcvr | D2 | $D000 | $D065 | $9000 | | ||
| + | | PFI Bank 1 | D2 | $D400 | $F8FF | $9400 | | ||
| + | | D2 Vectors | D2 | $FFFA | $FFFF | $BFFA | | ||
| + | | 5.25 Disk | * | $C800 | $CFFF | $F000 | | ||
| + | |||
| + | * This appears in the shared C8 space after the 5.25 controller slot ROM is accessed. | ||
| + | |||
| + | Conclusion: | ||
| + | |||
| + | **Memory Map of the "ROM" portion of the 256K Card RAM** | ||
| + | |||
| + | ^ Bank ^ Load Address Range ^ | ||
| + | | Main | $0000-$3FFF | | ||
| + | | D1 | $4000-$7FFF | | ||
| + | | D2 | $8000-$BFFF | | ||
| + | | Slot ROM, probably | $C000-$FFFF | | ||
| + | |||
| ===== BBLK ==== | ===== BBLK ==== | ||
| - | These contain the Workstation Card [[projects:iie_boot_blocks|Boot Blocks]]. | + | These contain the Workstation Card [[projects:appleshare_boot_blocks|Boot Blocks]]. |
| <code> | <code> | ||