Site Tools


LC //e Card - IIe Startup Resources

These are the most interesting resources in IIe Startup.

CNmc

These might be Macintosh-side drivers for each of the “cards.”

      4608       2336      "SmartPort"
      5376       1110      "AppleClock"
     24576        300      "IntlKeyDriver"
      5632        126      "Slot6"
      4352       2038      "MouseCard"
      4864       2184      "Modem"
      5888       2186      "Printer"
      4096        672      "Slinky"
      6400       3080      "NetPrint"
      5120      39144      "ATLK_Card"

CNxx

These are the slot-mapped firmware. The ones with only 256 bytes have relocatable firmware. The ones that are 1792 (256*7) bytes have 7 copies of the firmware, each specific to the slot they are installed in. These are not obfuscated.

      4608        256      "SmartPort"
      5376        256      "AppleClock"
      5632        256      "5.25� Disk"
      4352        256      "MouseCard"
      4864        256      "Modem"
      5888        256      "Printer"
      4096       1792      "Memory Card"
      6400        256      "NetPrint"
      5120       1792      "ATLK_Card"

C8xx

These are the C8 Firmware for the various cards. They are not obfuscated.

      4608       2036      "SmartPort"
      5376          1      "AppleClock"
      4352        428      "MouseCard"
      4864       1823      "Modem"
      5888       1823      "Printer"
      4096       2048      "Memory Card"
      6400       1823      "NetPrint"
      5120       2048      "ATLK_Card"

ATLK_Card: A quick look shows that this modifies the memory config to switch in one of the PFI banks and then jumps to it.

Monx

These have simple XOR obfuscation with the key “DoubleX” (a reference to the card's code name, “Double Exposure”).

After de-obfuscating there is a header that tells the IIe application where to put the firmware within the Card's memory.

Bytes Use
0,1 6502 Address
2,3 Firmware address
4,5 Length (less header 6 bytes)
      2606      16390      "A2EMonitorROM"          ; 00 c0 00 00 00 00
                              This is the Apple IIe Enhanced Monitor ROM.  Differences
                              from normal (N) enhanced IIe ROM vs card (C) ROM:
                              C000-C0FF: N all $00
                                         C repeating CE 48 CF 4A
                              C280: N $0A, C $0B
                              C287: 10 bytes
                              C292: 6 bytes
                              ~C3F0-C5FF: large sections different
                                C5B7 appears to be a speed-compensated paddle read routine.
                              CB21: 5 bytes
                              E006: N $C4, C: $31 (CPY $20 -> AND ($20),Y)
                              F778: 15 bytes (except 377C), C: $60 followed by all $00
                              F8CF: N $00, C: $EA
                              FA78: N $B4 $FB $EA $AD
                                    C $CE $FE $EA $2C
                              FAB4: N $A9 $C8
                                    C $02 $02
                              FAC0: N $C9 $C0
                                    C $02 $03
                              FAD5: N $00 $00
                                    C $EA $EA
                              FB1E: 17 bytes except 3B20, patch to PREAD to go to
                                      Int CX ROM $C5B7
                              FB63: N $A0 $09
                                    C $02 $04
                              FBBE: N $00, C: $03
                              FBDD: 5 bytes
                              FC7A: 27 bytes - patch to "IRQ Sniffer for Video Code"
                                      to essentially remove the IRQ sniffing
                              FCC9: 9 byte (C: all $60 RTS) - write tape header RTSed away
                              FD78: N $C9 $95
                                    C $02 $06
                              FECD: 10 bytes, start with $60 RTS
                                  Tape write routine.
                                  FECE=short routine to set CPU speed to option panel
                                       speed at cold start.
                              FEFD: 13 bytes, start with $60 RTS, tape read
                                       replacement doesn't appear to be code.
                              
                  
                              
      2607        108      "D1 NMI-IRQ Rcvr"        ; 00 d0 00 50 66 00
                              The bank D1 IRQ and NMI handler code.
      2608        108      "D2 NMI-IRQ Rcvr"        ; 00 d0 00 90 66 00
                              The bank D2 IRQ and NMI handler code.
      2609        429      "D1 INTCX"               ; fa c3 fa 43 a7 01
      2610        429      "D2 INTCX"               ; fa c3 fa 83 a7 01
      2611         12      "D1 Vectors"             ; fa ff fa 7f 06 00
                              These are the 6502 hardware vectors in bank D1:
                              00 d0 62 fa 03 d0
                              NMI=$d000   RESET=$fa62   IRQ/BRK=$d003
                              The NMI and IRQ vectors are within the space
                              of the handlers mentioned above.
      2612         12      "D2 Vectors"             ; fa ff fa bf 06 00
                              These are the 6502 hardware vectors in bank D2:
                              00 d0 62 fa 03 d0
                              same discussion as above
      5632       2042      "5.25� Disk"             ; 00 c8 00 f0 00 08
      5120       9478      "PFI Bank 0"             ; 00 d4 00 54 00 25
                              ProDOS Filing Interface.  Actually loads in bank D1.
      5121       9478      "PFI Bank 1"             ; 00 d4 00 94 00 25
                              ProDOS Filing Interface.  Actually loads in bank D2.
                              completely different than the bank 0 code above.

Load address tables for 'Monx':

Name Bank 6502
Start
6502
End
Load
Addr
A2EMonitorROM Main $C000 $FFFF $0000
D1 INTCX D1 $C3FA $C5A0 $43FA
D1 NMI-IRQ Rcvr D1 $D000 $D065 $5000
PFI Bank 0 D1 $D400 $F8FF $5400
D1 Vectors D1 $FFFA $FFFF $7FFA
D2 INTCX D2 $C3FA $C5A0 $83FA
D2 NMI-IRQ Rcvr D2 $D000 $D065 $9000
PFI Bank 1 D2 $D400 $F8FF $9400
D2 Vectors D2 $FFFA $FFFF $BFFA
5.25 Disk * $C800 $CFFF $F000

* This appears in the shared C8 space after the 5.25 controller slot ROM is accessed.

Conclusion:

Memory Map of the “ROM” portion of the 256K Card RAM

Bank Load Address Range
Main $0000-$3FFF
D1 $4000-$7FFF
D2 $8000-$BFFF
Slot ROM, probably $C000-$FFFF

BBLK

These contain the Workstation Card Boot Blocks.

      5120      35243      "Apple //e Boot Blocks"                            

IWEM

ImageWriter Emulator 1.4 PostScript file

      1810      29154      "NetPrint"