This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
mg_notes:iie_card:iie_startup_resources [2017/07/17 23:51] M.G. [Monx] |
mg_notes:iie_card:iie_startup_resources [2018/02/08 13:00] (current) M.G. [Monx] |
||
---|---|---|---|
Line 20: | Line 20: | ||
</code> | </code> | ||
- | ===== 'CNxx' ===== | + | ===== CNxx ===== |
- | These appear to be the slot-mapped firmware, but a curiosity is that two of them, the memory card and the workstation card, are larger than the allocated slot space. These are not obfuscated. | + | These are the slot-mapped firmware. The ones with only 256 bytes have relocatable firmware. The ones that are 1792 (256*7) bytes have 7 copies of the firmware, each specific to the slot they are installed in. These are not obfuscated. |
<code> | <code> | ||
Line 38: | Line 38: | ||
===== C8xx ===== | ===== C8xx ===== | ||
- | These appear to be the C8 Firmware for the various cards. They are not obfuscated. | + | These are the C8 Firmware for the various cards. They are not obfuscated. |
<code> | <code> | ||
Line 55: | Line 55: | ||
===== Monx ===== | ===== Monx ===== | ||
- | These have simple XOR obfuscation with the key "DoubleX". | + | These have simple XOR obfuscation with the key "DoubleX" (a reference to the card's code name, "Double Exposure"). |
- | At least A2EMonitorROM has 6 extra bytes at the beginning, an apparent header that tells the IIe application where to put the firmware | + | After de-obfuscating there is a header that tells the IIe application where to put the firmware within the Card's memory. |
^ Bytes ^ Use ^ | ^ Bytes ^ Use ^ | ||
Line 74: | Line 74: | ||
C292: 6 bytes | C292: 6 bytes | ||
~C3F0-C5FF: large sections different | ~C3F0-C5FF: large sections different | ||
+ | C5B7 appears to be a speed-compensated paddle read routine. | ||
CB21: 5 bytes | CB21: 5 bytes | ||
E006: N $C4, C: $31 (CPY $20 -> AND ($20),Y) | E006: N $C4, C: $31 (CPY $20 -> AND ($20),Y) | ||
Line 86: | Line 87: | ||
FAD5: N $00 $00 | FAD5: N $00 $00 | ||
C $EA $EA | C $EA $EA | ||
- | FB1E: 17 bytes except 3B20 | + | FB1E: 17 bytes except 3B20, patch to PREAD to go to |
+ | Int CX ROM $C5B7 | ||
FB63: N $A0 $09 | FB63: N $A0 $09 | ||
C $02 $04 | C $02 $04 | ||
FBBE: N $00, C: $03 | FBBE: N $00, C: $03 | ||
FBDD: 5 bytes | FBDD: 5 bytes | ||
- | FC7A: 27 bytes | + | FC7A: 27 bytes - patch to "IRQ Sniffer for Video Code" |
- | FCC9: 9 byte (C: all $60 RTS) | + | to essentially remove the IRQ sniffing |
+ | FCC9: 9 byte (C: all $60 RTS) - write tape header RTSed away | ||
FD78: N $C9 $95 | FD78: N $C9 $95 | ||
C $02 $06 | C $02 $06 | ||
FECD: 10 bytes, start with $60 RTS | FECD: 10 bytes, start with $60 RTS | ||
- | FEFD: 13 bytes, start with $60 RTS | + | Tape write routine. |
+ | FECE=short routine to set CPU speed to option panel | ||
+ | speed at cold start. | ||
+ | FEFD: 13 bytes, start with $60 RTS, tape read | ||
+ | replacement doesn't appear to be code. | ||
| | ||
| | ||
Line 118: | Line 125: | ||
5632 2042 "5.25� Disk" ; 00 c8 00 f0 00 08 | 5632 2042 "5.25� Disk" ; 00 c8 00 f0 00 08 | ||
5120 9478 "PFI Bank 0" ; 00 d4 00 54 00 25 | 5120 9478 "PFI Bank 0" ; 00 d4 00 54 00 25 | ||
- | ProDOS Filing Interface | + | ProDOS Filing Interface. Actually loads in bank D1. |
5121 9478 "PFI Bank 1" ; 00 d4 00 94 00 25 | 5121 9478 "PFI Bank 1" ; 00 d4 00 94 00 25 | ||
- | ProDOS Filing Interface | + | ProDOS Filing Interface. Actually loads in bank D2. |
completely different than the bank 0 code above. | completely different than the bank 0 code above. | ||
- | <code> | + | </code> |
+ | |||
+ | Load address tables for 'Monx': | ||
+ | |||
+ | ^ Name ^ Bank ^ 6502 \\ Start ^ 6502 \\ End ^ Load \\ Addr ^ | ||
+ | | A2EMonitorROM | Main | $C000 | $FFFF | $0000 | | ||
+ | | D1 INTCX | D1 | $C3FA | $C5A0 | $43FA | | ||
+ | | D1 NMI-IRQ Rcvr | D1 | $D000 | $D065 | $5000 | | ||
+ | | PFI Bank 0 | D1 | $D400 | $F8FF | $5400 | | ||
+ | | D1 Vectors | D1 | $FFFA | $FFFF | $7FFA | | ||
+ | | D2 INTCX | D2 | $C3FA | $C5A0 | $83FA | | ||
+ | | D2 NMI-IRQ Rcvr | D2 | $D000 | $D065 | $9000 | | ||
+ | | PFI Bank 1 | D2 | $D400 | $F8FF | $9400 | | ||
+ | | D2 Vectors | D2 | $FFFA | $FFFF | $BFFA | | ||
+ | | 5.25 Disk | * | $C800 | $CFFF | $F000 | | ||
+ | |||
+ | * This appears in the shared C8 space after the 5.25 controller slot ROM is accessed. | ||
+ | |||
+ | Conclusion: | ||
+ | |||
+ | **Memory Map of the "ROM" portion of the 256K Card RAM** | ||
+ | |||
+ | ^ Bank ^ Load Address Range ^ | ||
+ | | Main | $0000-$3FFF | | ||
+ | | D1 | $4000-$7FFF | | ||
+ | | D2 | $8000-$BFFF | | ||
+ | | Slot ROM, probably | $C000-$FFFF | | ||
+ | |||
===== BBLK ==== | ===== BBLK ==== | ||
- | These contain the Workstation Card [[projects:iie_boot_blocks|Boot Blocks]]. | + | These contain the Workstation Card [[projects:appleshare_boot_blocks|Boot Blocks]]. |
<code> | <code> |