ROM hacking

Any discussions related to the creation of new hardware or software for the ZX80 or ZX81
Post Reply
sirmorris
Posts: 2811
Joined: Thu May 08, 2008 5:45 pm

ROM hacking

Post by sirmorris »

Any tips for hacking the '81 ROM?

I'm thinking of patching the existing ROM for my main hack machine. I'll be removing the printer routines, most likely. Has anyone done this?
wilf_zx
Posts: 18
Joined: Tue Jun 24, 2008 9:12 pm

Re: ROM hacking

Post by wilf_zx »

Have a peek at the ZX97 ROM in the EightyOne emulator. I hacked the ZX81 ROM to expand the 8K ZX BASIC ROM to up to 16K with the additonal ROM area between $A000 to $BFFF. Only a small part of this additional ROM space was used to expand ZX81 BASIC syntax routine and to customize ZX81 BASIC with 10 new keywords.

I placed a hook in the original ZX81 ROM sysntax parsing routine to jump to address $A000 were the syntax routine continues. The comand structure for the new commands is the same as in the original ROM. If the command being parsed is not one of the new commands, the routine returns and continues in the old ROM. If the command is a new command, then the new syntax routine directs it to execute the new command routine with parameter passing based on the the command class.

Three new command were added for ZX97 (using shift N/L or Function 1, 2 and 3) which are named DIRECTORY, HSAVE and HLOAD. The remaining 7 keywords are placeholders named F3 - F9 and F0 and are functionally the same as the REM command. To customize each of these new keywords you simply replace the existing entries in the new token table, jump address and command class table. Then a new command routine must be added, the start of which is pointed to by the new jump table entry.

By following the same syntax as the ZX81, the new keywords plus their arguments are syntax checked during entry and are displayed like all other ZX81 keywords in listings.

The ZX97 emulation in EightyOne includes a RAMDISK of 16 banks of 16K non-volatile memory accessed by the DIRECTORY command. On page 0 of the directory you will find the source code for the ZX97 hack and copies the ZX Assembler and ZX Disassembler programs to edit the code. By assembling your own code to the expanded ZX ROM space, commands can be implemented. The old ZX81 ROM at $0000 can also be directly modified or a copy of the ZX81 ROM can first be loaded to $8000 - $9FFF, then modified with new code and finally this copy can be swapped with the orignal ROM at $0000.

I wrote an article for Jack Raats mailing list many moons ago on the details of this. Look at http://www.user.dccnet.com/wrigter/ menu item 27 and also check item 16 for details on a ROM patch for auto running basic programs stored in RAMDISK on powerup.
User avatar
yerzmyey
Posts: 1240
Joined: Thu May 15, 2008 10:11 am
Location: Rubber Planet
Contact:

Re: ROM hacking

Post by yerzmyey »

And what changes would You propose, instead of printer routines, SirMorris? Well, that's just my curiosity. :)
Maybe some euper-extra-hyper-turbo-loading-from-tape-or-mp3-player? ;)
IN NIHILUM REVERTERIS - a big text-adventure game for ZX81: http://tiny.pl/g2m6m
"MONOCHROME" issue 5 - (Spring 2014) free paper/PDF magazine about ZX81: http://tiny.pl/q2m44
ZX81 COMPETITIONS 2007/2009: http://zx81.republika.pl/
User avatar
XavSnap
Posts: 1940
Joined: Sat May 10, 2008 4:23 pm
Location: 'Zx81 France' Fb group.

Re: ROM hacking

Post by XavSnap »

sirmorris wrote:Any tips for hacking the '81 ROM?

I'm thinking of patching the existing ROM for my main hack machine. I'll be removing the printer routines, most likely. Has anyone done this?
Hi,

" I'll be removing the printer routines" ????
A ZX81 rom without printer routine is a ZX80 Rom !!!
;)

... A new Xtender rom patch ?
Xavier ...on the Facebook groupe : "Zx81 France"(fr)
sirmorris
Posts: 2811
Joined: Thu May 08, 2008 5:45 pm

Re: ROM hacking

Post by sirmorris »

I just need enough room for my MMC bootstrap code. Anything else is a bonus.. If I can get to a file on the card then I don't need to hard-code the menu system/dos into the ROM.

And if my DMA project gets off the ground I won't need any hacks.. 1 button click to load the bootstrap code, the next to peek RAM to find out which file to load. Yummy!
User avatar
siggi
Posts: 988
Joined: Thu May 08, 2008 9:30 am
Location: Wetterau, Germany
Contact:

Re: ROM hacking

Post by siggi »

sirmorris wrote:I'll be removing the printer routines, most likely. Has anyone done this?
Yes, I did it. I replaced the printer routines by my own printer routine located at the same address. My printer routine looks for a printer driver loaded into ram. If it is found, this driver is called. So I can use the standard PRINT command to print to an ASCII printer or to the PC (via a serial port) or to the original Sinclair routine.
Caution! There is a routine in the rom to clear the printer buffer. You should NOT overwrite this routine! At least MEMOCALC calls that routine directly to clear the printer-buffer and copy its contents into its own variable region to clear its own variables there. A nice trick to save some bytes of code ;-)

I also replaced the LOAD and SAVE routines to load/save program from my MMC. The standard commands like
LOAD "c:games/..." are used and redirected to MEFISDOS calls like "L c:games/..."

The sources (for the ASDIS assembler) are stored on my server.
But I added an ASCII listing of my save/load rom patch:
  • ------------------
    02F6;=========================
    02F6;ROMPATCH FOR "LOAD" AND
    02F6;"SAVE" REDIRECTION TO
    02F6;MEFISDOS/MULDOS
    02F6;;
    02F6; SIEGFRIED ENGEL
    02F6; SIGGI(A)ZX81.DE
    02F6; SEPTEMBER 2005
    02f6;;
    02F6;SYNTAX:
    02F6;LOAD "" -> MFDOS EDITOR
    02F6;LOAD "NAME" ->
    02F6; MFDOS "L D:TAPE/NAME"
    02F6;LOAD "D:PATH/NAME" ->
    02F6; MFDOS "L D:PATH/NAME"
    02F6;;
    02F6;SAVE: EQUIVALENT
    02F6;;
    02F6;HOTKEY:
    02F6;PRESS "RAND" IN COMMAND
    02F6;MODE TO JUMP INTO
    02F6;MEFISDOS EDITOR
    02F6;;
    02F6;=========================
    02f6;;
    02F6;"SAVE" COMMAND AT $2F6
    02F6SAVE CALL SETUP CDFB02
    02F9;JUMP TO MFDOS CMD EXECUTION
    02F9 JR TOSYN 184D
    02FB;;
    02FB;========================
    02FB;;
    02FB;SETUP MEFISDOS COMMAND
    02FB;DEFAULT FOR "SAVE"
    02FB;;
    02FB;BASIC SYNTAX CHECK?
    02FBSETUPCALL SYNTX CDA60D
    02FE;DROP CALLER"S ADDRESS
    02FE POP HL E1
    02FF;BACK IF SYNTAX CHECK ONLY
    02ff RET Z C8
    0300;RESTORE CALLER"S ADDRESS
    0300 PUSH HL E5
    0301;GET NAME STRING
    0301 CALL NAME CDA803
    0304;NO NAME GIVEN -> MEFISDOS
    0304 JR C,JMFDS 3847
    0306;CORRECT LENGTH
    0306 INC C 0C
    0307;NULLSTRING -> MEFISDOS
    0307 JR Z,JMFDS 2844
    0309;REGISTER USAGE:
    0309;DE:NAME,BC:LEN,HL:LAST CHR.
    0309;SET NORMAL LAST CHAR
    0309 RES 7,(HL) CBBE
    030B;SET HL TO POINT TO NAME
    030b EX DE,HL EB
    030C;PREPARE FOR MEFISDOS CALL
    030C CALL ENAB CD5603
    030F;CREATE MFDOS CMD "S "
    030F LD DE,EDBUF 11C8F2
    0312 LD A,$38 3E38
    0314 LD (DE),A 12
    0315 INC DE 13
    0316 XOR A AF
    0317 LD (DE),A 12
    0318 INC DE 13
    0319;TEST FOR DRIVE LETTER GIVEN
    0319;SAVE NAME STRING DATA
    0319 PUSH BC C5
    031A PUSH HL E5
    031B;NAME LEN>=3?
    031b LD A,C 79
    031C CP $03 FE03
    031E;NO: SET DEFAULT PATH
    031E JR C,ADFPT 3806
    0320;YES: IS 2ND CHAR ":"?
    0320 LD A,$0E 3E0E
    0322 INC HL 23
    0323 CP (HL) BE
    0324;YES: ADD GIVEN PATH/NAME
    0324 JR Z,ADDNM 280E
    0326;NO: ADD DEFAULT PATH LEN 7
    0326ADFPTLD HL,DRVPT 218203
    0329;NOTE:B IS 0
    0329 LD C,$07 0E07
    032B;TEST FOR RUN MODE
    032B BIT 7,(IY+$08) FDCB087E
    032f JR Z,RUNPT 2801
    0331;COMMAND MODE->USE "CMDS/"
    0331 ADD HL,BC 09
    0332RUNPTLDIR EDB0
    0334;;
    0334;RESTORE NAME STRING
    0334ADDNMPOP HL E1
    0335 POP BC C1
    0336;APPEND NAME
    0336 LDIR EDB0
    0338;CLEAR BUFFER PAST NAME
    0338 EX DE,HL EB
    0339 LD B,$40 0640
    033BCLLOPLD (HL),C 71
    033C INC HL 23
    033D DJNZ CLLOP 10FC
    033f RET C9
    0340;;
    0340;===========================
    0340;NO UNUSED SPACE TILL "LOAD"
    0340;===========================
    0340;;
    0340;"LOAD"-COMMAND AT $340
    0340LOAD CALL SETUP CDFB02
    0343;SET MDFOS COMMAND "L"
    0343 LD HL,EDBUF 21C8F2
    0346 LD (HL),$31 3631
    0348;JUMP TO MFDOS CMD EXECUTION
    0348TOSYNCALL SYNT CD2C20
    034B JR DISAB 1828
    034D;;
    034D;=========================
    034d;JUMP TO MEFISDOS EDITOR
    034D;DROP RETURN ADDRESS
    034DJMFDSPOP AF F1
    034ETOMFDCALL ENAB CD5603
    0351 CALL MFDOS CD0020
    0354 JR DISAB 181F
    0356;;
    0356;==========================
    0356;ENABLE MEFISDOS
    0356;NOTE: MUST BE MODIFIED
    0356;FOR USE WITH ZX96
    0356;;
    0356ENAB PUSH HL E5
    0357;TEST FOR RAM OR EEPROM
    0357 LD HL,$2000 210020
    035A LD A,(HL) 7E
    035b INC (HL) 34
    035C CP (HL) BE
    035D;NOTE:DONT DESTROY FLAGS
    035D;RESTORE RAM
    035D LD (HL),A 77
    035E POP HL E1
    035F;SET FLAG "EEPROM ENABLED":0
    035F;DONT DESTROY FLAGS
    035F LD A,$00 3E00
    0361 JR Z,EPROM 2801
    0363;SET FLAG "RAM ENABLED":1
    0363 INC A 3C
    0364;SAVE FLAG IN SYSTEM VAR
    0364EPROMLD (COORD),A 323640
    0367;SWITCH TO MFDOS EEPROM
    0367 LD A,$02 3E02
    0369 OUT EPSEL,A D37F
    036B;SELECT WORK BANK
    036B LD A,WORK 3E0D
    036D CALL SELRB CD7A3C
    0370;SET "RETURN TO MC"
    0370 XOR A AF
    0371 LD (FRET),A 325FF6
    0374 RET C9
    0375;;
    0375;==========================
    0375;DISABLE MFDOS FOR SAFETY
    0375;NOTE: MUST BE MODIFIED
    0375;FOR USE WITH ZX96
    0375;;
    0375DISABLD A,(COORD) 3A3640
    0378;HAS RAM BEEN ENABLED?
    0378 CP $01 FE01
    037A LD A,$04 3E04
    037C;YES:JUMP
    037C JR Z,SET 2801
    037E;ELSE: ENABLE EEPROM BANK 0
    037E XOR A AF
    037FSET OUT EPSEL,A D37F
    0381 RET C9
    0382;;
    0382;==========================
    0382;;
    0382;DEFAULT DRIVE/PATH NAMES
    0382;NOTE: BOTH LENGTHS MUST
    0382;BE 7.
    0382;;
    0382;TAPE DIR (RUN MODE)
    0382DRVPTD:TAPE/
    0389;;
    0389;COMMAND DIR (COMMAND MODE)
    0389DRVCMD:CMDS/
    0390;;
    0390;==========================
    0390;"RAND" HOTKEY FOR MEFISDOS
    0390HKEY BIT 7,(IY+$08) FDCB087E
    0394 JP Z,RAND CA6C0E
    0397 JR TOMFD 18B5
    0399;;
    0399;==========================
    0399;HERE: FREE SPACE FOR
    0399;FURTHER ROM PATCHES.
    0399;SOME BYTES USED TO PATCH
    0399;"RAND" COMMAND
    0399;(MAY BE DELETED)
    0399;;
    0399;PATCH CODE FOR "RAND" CMD
    0399;TO BE SINGLE-STEPPED ...
    0399PATCHLD HL,HKEY 219003
    039C LD ($0C87),HL 22870C
    039F;;
    039F;;
    039F;;
    039F;==========================
    039F;;
    039F;END OF ROM PATCH
    039F;CHECK HERE FOR OVERRWRITTEN
    039F;ROM CODE ..
    039F;;
    039F;;
    039f;END MAY NOT EXCEED $03A7
    039F;ROUTINE "NAME" IS AT $03A8
    039F;;
    039F;THIS IS THE END, THE ONLY
    039F;END, MY FRIEND ...
    039F;==========================
HTH

Siggi
Last edited by siggi on Fri Oct 03, 2008 12:35 pm, edited 1 time in total.
My ZX81 web-server: online since 2007, running since dec. 2020 using ZeddyNet hardware
http://zx81.ddns.net/ZxTeaM
User avatar
siggi
Posts: 988
Joined: Thu May 08, 2008 9:30 am
Location: Wetterau, Germany
Contact:

Re: ROM hacking

Post by siggi »

XavSnap wrote: A ZX81 rom without printer routine is a ZX80 Rom !!!
;)
No. The ZX80 does use INTEGER arithmetic, the ZX81 FLOATING-POINT. And can run SLOW ;-)

Siggi
My ZX81 web-server: online since 2007, running since dec. 2020 using ZeddyNet hardware
http://zx81.ddns.net/ZxTeaM
daveZX4th
Posts: 16
Joined: Mon Dec 04, 2017 2:22 pm

Re: ROM hacking

Post by daveZX4th »

I can see how ZX97 adds new commands (albeit via FUNCTION 0-9) by adding CALL's in syntax and scanning etc. But I don't see how you can (as easily) add true functions (ie. unary like PEEK).

I wanted to add IN (& OUT) but have had to resort to using PEEK (& POKE). If address is <256 then do IN or OUT, else default to PEEK/POKE. Unlikely you would want to read write addresses 0-255 :-)
User avatar
mrtinb
Posts: 1906
Joined: Fri Nov 06, 2015 5:44 pm
Location: Denmark
Contact:

Re: ROM hacking

Post by mrtinb »

In PowerBasic, Matthias Swatosch have made the commands **IN and **OUT.

(http://www.swatosch.de/zx81/index.html)
Martin
https://zx.rtin.be
ZX81, Lambda 8300, Commodore 64, Mac G4 Cube
Post Reply