ROM hacking
ROM hacking
Any tips for hacking the '81 ROM?
I'm thinking of patching the existing ROM for my main hack machine. I'll be removing the printer routines, most likely. Has anyone done this?
I'm thinking of patching the existing ROM for my main hack machine. I'll be removing the printer routines, most likely. Has anyone done this?
Re: ROM hacking
Have a peek at the ZX97 ROM in the EightyOne emulator. I hacked the ZX81 ROM to expand the 8K ZX BASIC ROM to up to 16K with the additonal ROM area between $A000 to $BFFF. Only a small part of this additional ROM space was used to expand ZX81 BASIC syntax routine and to customize ZX81 BASIC with 10 new keywords.
I placed a hook in the original ZX81 ROM sysntax parsing routine to jump to address $A000 were the syntax routine continues. The comand structure for the new commands is the same as in the original ROM. If the command being parsed is not one of the new commands, the routine returns and continues in the old ROM. If the command is a new command, then the new syntax routine directs it to execute the new command routine with parameter passing based on the the command class.
Three new command were added for ZX97 (using shift N/L or Function 1, 2 and 3) which are named DIRECTORY, HSAVE and HLOAD. The remaining 7 keywords are placeholders named F3 - F9 and F0 and are functionally the same as the REM command. To customize each of these new keywords you simply replace the existing entries in the new token table, jump address and command class table. Then a new command routine must be added, the start of which is pointed to by the new jump table entry.
By following the same syntax as the ZX81, the new keywords plus their arguments are syntax checked during entry and are displayed like all other ZX81 keywords in listings.
The ZX97 emulation in EightyOne includes a RAMDISK of 16 banks of 16K non-volatile memory accessed by the DIRECTORY command. On page 0 of the directory you will find the source code for the ZX97 hack and copies the ZX Assembler and ZX Disassembler programs to edit the code. By assembling your own code to the expanded ZX ROM space, commands can be implemented. The old ZX81 ROM at $0000 can also be directly modified or a copy of the ZX81 ROM can first be loaded to $8000 - $9FFF, then modified with new code and finally this copy can be swapped with the orignal ROM at $0000.
I wrote an article for Jack Raats mailing list many moons ago on the details of this. Look at http://www.user.dccnet.com/wrigter/ menu item 27 and also check item 16 for details on a ROM patch for auto running basic programs stored in RAMDISK on powerup.
I placed a hook in the original ZX81 ROM sysntax parsing routine to jump to address $A000 were the syntax routine continues. The comand structure for the new commands is the same as in the original ROM. If the command being parsed is not one of the new commands, the routine returns and continues in the old ROM. If the command is a new command, then the new syntax routine directs it to execute the new command routine with parameter passing based on the the command class.
Three new command were added for ZX97 (using shift N/L or Function 1, 2 and 3) which are named DIRECTORY, HSAVE and HLOAD. The remaining 7 keywords are placeholders named F3 - F9 and F0 and are functionally the same as the REM command. To customize each of these new keywords you simply replace the existing entries in the new token table, jump address and command class table. Then a new command routine must be added, the start of which is pointed to by the new jump table entry.
By following the same syntax as the ZX81, the new keywords plus their arguments are syntax checked during entry and are displayed like all other ZX81 keywords in listings.
The ZX97 emulation in EightyOne includes a RAMDISK of 16 banks of 16K non-volatile memory accessed by the DIRECTORY command. On page 0 of the directory you will find the source code for the ZX97 hack and copies the ZX Assembler and ZX Disassembler programs to edit the code. By assembling your own code to the expanded ZX ROM space, commands can be implemented. The old ZX81 ROM at $0000 can also be directly modified or a copy of the ZX81 ROM can first be loaded to $8000 - $9FFF, then modified with new code and finally this copy can be swapped with the orignal ROM at $0000.
I wrote an article for Jack Raats mailing list many moons ago on the details of this. Look at http://www.user.dccnet.com/wrigter/ menu item 27 and also check item 16 for details on a ROM patch for auto running basic programs stored in RAMDISK on powerup.
Re: ROM hacking
And what changes would You propose, instead of printer routines, SirMorris? Well, that's just my curiosity.
Maybe some euper-extra-hyper-turbo-loading-from-tape-or-mp3-player?
Maybe some euper-extra-hyper-turbo-loading-from-tape-or-mp3-player?
IN NIHILUM REVERTERIS - a big text-adventure game for ZX81: http://tiny.pl/g2m6m
"MONOCHROME" issue 5 - (Spring 2014) free paper/PDF magazine about ZX81: http://tiny.pl/q2m44
ZX81 COMPETITIONS 2007/2009: http://zx81.republika.pl/
"MONOCHROME" issue 5 - (Spring 2014) free paper/PDF magazine about ZX81: http://tiny.pl/q2m44
ZX81 COMPETITIONS 2007/2009: http://zx81.republika.pl/
Re: ROM hacking
Hi,sirmorris wrote:Any tips for hacking the '81 ROM?
I'm thinking of patching the existing ROM for my main hack machine. I'll be removing the printer routines, most likely. Has anyone done this?
" I'll be removing the printer routines" ????
A ZX81 rom without printer routine is a ZX80 Rom !!!
... A new Xtender rom patch ?
Xavier ...on the Facebook groupe : "Zx81 France"(fr)
Re: ROM hacking
I just need enough room for my MMC bootstrap code. Anything else is a bonus.. If I can get to a file on the card then I don't need to hard-code the menu system/dos into the ROM.
And if my DMA project gets off the ground I won't need any hacks.. 1 button click to load the bootstrap code, the next to peek RAM to find out which file to load. Yummy!
And if my DMA project gets off the ground I won't need any hacks.. 1 button click to load the bootstrap code, the next to peek RAM to find out which file to load. Yummy!
Re: ROM hacking
Yes, I did it. I replaced the printer routines by my own printer routine located at the same address. My printer routine looks for a printer driver loaded into ram. If it is found, this driver is called. So I can use the standard PRINT command to print to an ASCII printer or to the PC (via a serial port) or to the original Sinclair routine.sirmorris wrote:I'll be removing the printer routines, most likely. Has anyone done this?
Caution! There is a routine in the rom to clear the printer buffer. You should NOT overwrite this routine! At least MEMOCALC calls that routine directly to clear the printer-buffer and copy its contents into its own variable region to clear its own variables there. A nice trick to save some bytes of code
I also replaced the LOAD and SAVE routines to load/save program from my MMC. The standard commands like
LOAD "c:games/..." are used and redirected to MEFISDOS calls like "L c:games/..."
The sources (for the ASDIS assembler) are stored on my server.
But I added an ASCII listing of my save/load rom patch:
- ------------------
02F6;=========================
02F6;ROMPATCH FOR "LOAD" AND
02F6;"SAVE" REDIRECTION TO
02F6;MEFISDOS/MULDOS
02F6;;
02F6; SIEGFRIED ENGEL
02F6; SIGGI(A)ZX81.DE
02F6; SEPTEMBER 2005
02f6;;
02F6;SYNTAX:
02F6;LOAD "" -> MFDOS EDITOR
02F6;LOAD "NAME" ->
02F6; MFDOS "L D:TAPE/NAME"
02F6;LOAD "D:PATH/NAME" ->
02F6; MFDOS "L D:PATH/NAME"
02F6;;
02F6;SAVE: EQUIVALENT
02F6;;
02F6;HOTKEY:
02F6;PRESS "RAND" IN COMMAND
02F6;MODE TO JUMP INTO
02F6;MEFISDOS EDITOR
02F6;;
02F6;=========================
02f6;;
02F6;"SAVE" COMMAND AT $2F6
02F6SAVE CALL SETUP CDFB02
02F9;JUMP TO MFDOS CMD EXECUTION
02F9 JR TOSYN 184D
02FB;;
02FB;========================
02FB;;
02FB;SETUP MEFISDOS COMMAND
02FB;DEFAULT FOR "SAVE"
02FB;;
02FB;BASIC SYNTAX CHECK?
02FBSETUPCALL SYNTX CDA60D
02FE;DROP CALLER"S ADDRESS
02FE POP HL E1
02FF;BACK IF SYNTAX CHECK ONLY
02ff RET Z C8
0300;RESTORE CALLER"S ADDRESS
0300 PUSH HL E5
0301;GET NAME STRING
0301 CALL NAME CDA803
0304;NO NAME GIVEN -> MEFISDOS
0304 JR C,JMFDS 3847
0306;CORRECT LENGTH
0306 INC C 0C
0307;NULLSTRING -> MEFISDOS
0307 JR Z,JMFDS 2844
0309;REGISTER USAGE:
0309;DE:NAME,BC:LEN,HL:LAST CHR.
0309;SET NORMAL LAST CHAR
0309 RES 7,(HL) CBBE
030B;SET HL TO POINT TO NAME
030b EX DE,HL EB
030C;PREPARE FOR MEFISDOS CALL
030C CALL ENAB CD5603
030F;CREATE MFDOS CMD "S "
030F LD DE,EDBUF 11C8F2
0312 LD A,$38 3E38
0314 LD (DE),A 12
0315 INC DE 13
0316 XOR A AF
0317 LD (DE),A 12
0318 INC DE 13
0319;TEST FOR DRIVE LETTER GIVEN
0319;SAVE NAME STRING DATA
0319 PUSH BC C5
031A PUSH HL E5
031B;NAME LEN>=3?
031b LD A,C 79
031C CP $03 FE03
031E;NO: SET DEFAULT PATH
031E JR C,ADFPT 3806
0320;YES: IS 2ND CHAR ":"?
0320 LD A,$0E 3E0E
0322 INC HL 23
0323 CP (HL) BE
0324;YES: ADD GIVEN PATH/NAME
0324 JR Z,ADDNM 280E
0326;NO: ADD DEFAULT PATH LEN 7
0326ADFPTLD HL,DRVPT 218203
0329;NOTE:B IS 0
0329 LD C,$07 0E07
032B;TEST FOR RUN MODE
032B BIT 7,(IY+$08) FDCB087E
032f JR Z,RUNPT 2801
0331;COMMAND MODE->USE "CMDS/"
0331 ADD HL,BC 09
0332RUNPTLDIR EDB0
0334;;
0334;RESTORE NAME STRING
0334ADDNMPOP HL E1
0335 POP BC C1
0336;APPEND NAME
0336 LDIR EDB0
0338;CLEAR BUFFER PAST NAME
0338 EX DE,HL EB
0339 LD B,$40 0640
033BCLLOPLD (HL),C 71
033C INC HL 23
033D DJNZ CLLOP 10FC
033f RET C9
0340;;
0340;===========================
0340;NO UNUSED SPACE TILL "LOAD"
0340;===========================
0340;;
0340;"LOAD"-COMMAND AT $340
0340LOAD CALL SETUP CDFB02
0343;SET MDFOS COMMAND "L"
0343 LD HL,EDBUF 21C8F2
0346 LD (HL),$31 3631
0348;JUMP TO MFDOS CMD EXECUTION
0348TOSYNCALL SYNT CD2C20
034B JR DISAB 1828
034D;;
034D;=========================
034d;JUMP TO MEFISDOS EDITOR
034D;DROP RETURN ADDRESS
034DJMFDSPOP AF F1
034ETOMFDCALL ENAB CD5603
0351 CALL MFDOS CD0020
0354 JR DISAB 181F
0356;;
0356;==========================
0356;ENABLE MEFISDOS
0356;NOTE: MUST BE MODIFIED
0356;FOR USE WITH ZX96
0356;;
0356ENAB PUSH HL E5
0357;TEST FOR RAM OR EEPROM
0357 LD HL,$2000 210020
035A LD A,(HL) 7E
035b INC (HL) 34
035C CP (HL) BE
035D;NOTE:DONT DESTROY FLAGS
035D;RESTORE RAM
035D LD (HL),A 77
035E POP HL E1
035F;SET FLAG "EEPROM ENABLED":0
035F;DONT DESTROY FLAGS
035F LD A,$00 3E00
0361 JR Z,EPROM 2801
0363;SET FLAG "RAM ENABLED":1
0363 INC A 3C
0364;SAVE FLAG IN SYSTEM VAR
0364EPROMLD (COORD),A 323640
0367;SWITCH TO MFDOS EEPROM
0367 LD A,$02 3E02
0369 OUT EPSEL,A D37F
036B;SELECT WORK BANK
036B LD A,WORK 3E0D
036D CALL SELRB CD7A3C
0370;SET "RETURN TO MC"
0370 XOR A AF
0371 LD (FRET),A 325FF6
0374 RET C9
0375;;
0375;==========================
0375;DISABLE MFDOS FOR SAFETY
0375;NOTE: MUST BE MODIFIED
0375;FOR USE WITH ZX96
0375;;
0375DISABLD A,(COORD) 3A3640
0378;HAS RAM BEEN ENABLED?
0378 CP $01 FE01
037A LD A,$04 3E04
037C;YES:JUMP
037C JR Z,SET 2801
037E;ELSE: ENABLE EEPROM BANK 0
037E XOR A AF
037FSET OUT EPSEL,A D37F
0381 RET C9
0382;;
0382;==========================
0382;;
0382;DEFAULT DRIVE/PATH NAMES
0382;NOTE: BOTH LENGTHS MUST
0382;BE 7.
0382;;
0382;TAPE DIR (RUN MODE)
0382DRVPTD:TAPE/
0389;;
0389;COMMAND DIR (COMMAND MODE)
0389DRVCMD:CMDS/
0390;;
0390;==========================
0390;"RAND" HOTKEY FOR MEFISDOS
0390HKEY BIT 7,(IY+$08) FDCB087E
0394 JP Z,RAND CA6C0E
0397 JR TOMFD 18B5
0399;;
0399;==========================
0399;HERE: FREE SPACE FOR
0399;FURTHER ROM PATCHES.
0399;SOME BYTES USED TO PATCH
0399;"RAND" COMMAND
0399;(MAY BE DELETED)
0399;;
0399;PATCH CODE FOR "RAND" CMD
0399;TO BE SINGLE-STEPPED ...
0399PATCHLD HL,HKEY 219003
039C LD ($0C87),HL 22870C
039F;;
039F;;
039F;;
039F;==========================
039F;;
039F;END OF ROM PATCH
039F;CHECK HERE FOR OVERRWRITTEN
039F;ROM CODE ..
039F;;
039F;;
039f;END MAY NOT EXCEED $03A7
039F;ROUTINE "NAME" IS AT $03A8
039F;;
039F;THIS IS THE END, THE ONLY
039F;END, MY FRIEND ...
039F;==========================
Siggi
Last edited by siggi on Fri Oct 03, 2008 12:35 pm, edited 1 time in total.
My ZX81 web-server: online since 2007, running since dec. 2020 using ZeddyNet hardware
http://zx81.ddns.net/ZxTeaM
http://zx81.ddns.net/ZxTeaM
Re: ROM hacking
No. The ZX80 does use INTEGER arithmetic, the ZX81 FLOATING-POINT. And can run SLOWXavSnap wrote: A ZX81 rom without printer routine is a ZX80 Rom !!!
Siggi
My ZX81 web-server: online since 2007, running since dec. 2020 using ZeddyNet hardware
http://zx81.ddns.net/ZxTeaM
http://zx81.ddns.net/ZxTeaM
Re: ROM hacking
I can see how ZX97 adds new commands (albeit via FUNCTION 0-9) by adding CALL's in syntax and scanning etc. But I don't see how you can (as easily) add true functions (ie. unary like PEEK).
I wanted to add IN (& OUT) but have had to resort to using PEEK (& POKE). If address is <256 then do IN or OUT, else default to PEEK/POKE. Unlikely you would want to read write addresses 0-255
I wanted to add IN (& OUT) but have had to resort to using PEEK (& POKE). If address is <256 then do IN or OUT, else default to PEEK/POKE. Unlikely you would want to read write addresses 0-255
Re: ROM hacking
In PowerBasic, Matthias Swatosch have made the commands **IN and **OUT.
(http://www.swatosch.de/zx81/index.html)
(http://www.swatosch.de/zx81/index.html)