[MEMOTECH] Centronics I/F ROM Disassembly.

[XavSnap]

The Memotech Centronics I/F ROM Disassembly:

Code: Select all

;------- TASM ASM mnemonics. -------
; Compile this file using:
; Set TASMOPTS = -b
; tasm -80 ThisCode.tas MyBinary.BIN
;-----------------------------------
; Zx81 Program name: VB81 XuR [] : Empty Basic Segment.
; REM   line   name: D=10240/10623 : H=2800/297F
#define ORG  .org       ; TASM cross-assembler definitions
#define equ  .equ

;------- Rom and Ram Symbols -------
COPY_N_L equ $08C7
COPY_NEXT equ $089C
COPY_END equ $08DE
DISPLAY_6 equ $04C1

ORG $2800 ; [@10240/@h2800]

.db " "; ASCII TEXT
.db $00,$00,$00,$00,$00,$00,$00,$00; DATA
.db $00,$00; DATA
.db ""","#","$",":","?","(",")",">"; ASCII TEXT
.db "<","=","+","-","*","/",";",","; ASCII TEXT
.db ".","0","1","2","3","4","5","6"; ASCII TEXT
.db "7","8","9","A","B","C","D","E"; ASCII TEXT
.db "F","G","H","I","J","K","L","M"; ASCII TEXT
.db "N","O","P","Q","R","S","T","U"; ASCII TEXT
.db "V","W","X","Y","Z"," "; ASCII TEXT
.db $00,$00,$00,$00,$00,$00,$00,$00; DATA
.db $00,$00; DATA
.db "|","%","&","'","!","{","}","~"; ASCII TEXT
.db "_","[","@","]","","\","^","`"; ASCII TEXT
.db $1B; DATA
.db "0","1","2","3","4","5","6","7"; ASCII TEXT
.db "8","9","a","b","c","d","e","f"; ASCII TEXT
.db "g","h","i","j","k","l","m","n"; ASCII TEXT
.db "o","p","q","r","s","t","u","v"; ASCII TEXT
.db "w","x","y","z"; ASCII TEXT

	LD A,$00 
	CALL Lb2935 ; [10549]
	JP COPY_N_L+21 ; []*BIOS ROM*
	CP $06 ; [6]
	JP NZ,  COPY_NEXT+16 ; []*BIOS ROM*
	PUSH HL 
	LD HL, Lb4082 
Lb2891:
	LD A,(HL) 
	CP $00 ; [0]
	JR Z, Lb289C ; [$289C:10396]
	CALL Lb2935 ; [10549]
	INC HL 
	JR Lb2891 ; [$2891:10385]
Lb289C:
	POP HL 
	JP COPY_N_L+18 ; []*BIOS ROM*
	PUSH HL 
	PUSH DE 
	CALL $24F8 ; [9464]
	PUSH HL 
	LD BC,$8076 
	CALL $255C ; [9564]
	LD D,C 
	PUSH DE 
	LD BC,$8078 
	CALL $255C ; [9564]
	POP DE 
	LD E,C 
	PUSH DE 
	LD BC,$806A 
	CALL $255C ; [9564]
	INC C 
	POP DE 
	POP HL 
	CALL Lb2904 ; [10500]
	POP DE 
	POP HL 
	RET ; ==========================

Lb28C6:    ; <<< Uncharted Entry ]

	PUSH HL 
	PUSH DE 
	CALL Lb28D0 ; [10448]
	POP DE 
	POP HL 
	JP COPY_END+1 ; []*BIOS ROM*
Lb28D0:
	CALL $2475 ; [9333]
	LD D,$80 
	LD E,$07 
	LD C,$20 
	INC HL 
	INC HL 
	LD B,$1B 
Lb28DD:
	PUSH BC 
	PUSH HL 
	LD A,$0A 
	CALL Lb2935 ; [10549]
	CALL Lb2904 ; [10500]
	POP HL 
	LD BC,$00E7 
	ADD HL,BC 
	POP BC 
	DJNZ Lb28DD ; [$28DD:10461]
	LD E,$03 
	LD A,$0A 
	CALL Lb2935 ; [10549]
	CALL Lb2904 ; [10500]
	LD A,$0A 
	CALL Lb2935 ; [10549]
	LD A,$14 
	CALL Lb2935 ; [10549]
	RET ; ==========================

Lb2904:
	DEC C 
	RET Z 
	LD B,$08 
Lb2908:
	PUSH HL 
	PUSH DE 
	LD D,$09 
	XOR A 
Lb290D:
	PUSH DE 
	LD D,(HL) 
	RLC D 
	LD (HL),D 
	POP DE 
	RRA 
	DEC D 
	DEC E 
	JR Z, Lb2926 ; [$2926:10534]
	PUSH AF 
	LD A,$21 
	ADD A,L 
	LD L,A 
	LD A,$00 
	ADC A,H 
	LD H,A 
	POP AF 
	JR Lb290D ; [$290D:10509]
Lb2924:
	SRL A 
Lb2926:
	DEC D 
	JR NZ, Lb2924 ; [$2924:10532]
	POP DE 
	ADD A,D 
	CALL Lb2935 ; [10549]
	POP HL 
	DEC B 
	JR NZ, Lb2908 ; [$2908:10504]
	INC HL 
	JR Lb2904 ; [$2904:10500]
Lb2935:
	PUSH AF 
Lb2936:
	IN A,($3F) ; User port. (\ACK) Send bits.
	RRCA 
	JR C, Lb2936 ; [$2936:10550]
	POP AF 
	IN A,($2F) ; User port. (Get \ error ?) 
	RET ; ==========================

Lb293F:    ; <<< Uncharted Entry ]

	CALL DISPLAY_6+12 ; []*BIOS ROM*
	ADD HL,HL 
	POP DE 
	POP HL 
	RET ; ==========================

Lb2946:    ; <<< Uncharted Entry ]

	PUSH HL 
	PUSH DE 
	CALL Lb28D0 ; [10448]
	POP DE 
	POP HL 
	JP COPY_END+1 ; []*BIOS ROM*
	CALL $2475 ; [9333]
	LD D,$80 
	LD E,$07 
	LD C,$20 
	INC HL 
	INC HL 
	LD B,$1B 
Lb295D:
	PUSH BC 
	PUSH HL 
	LD A,$0A 
	CALL Lb2935 ; [10549]
	CALL Lb2904 ; [10500]
	POP HL 
	LD BC,$00E7 
	ADD HL,BC 
	POP BC 
	DJNZ Lb295D ; [$295D:10589]
	LD E,$03 
	LD A,$0A 
	CALL Lb2935 ; [10549]
	CALL Lb2904 ; [10500]
	LD A,$0A 
	CALL Lb2935 ; [10549]
	LD A,$14 
	; return to the ZX rom...
.end

Uncharted routine seem to be moved in the main ROM routine…
To be called with a "Lprint" command.
ROM offset ?
Lenght ?

[XavSnap]

Hi,
Some text files to compare the original rom, to the IF patched rom...

Code: Select all

16514:32,0,0,0,0,0,0,0,0,0,0,34
16526:35,36,58,63,40,41,62,60,61
16535:43,45,42,47,59,44,46,48,49
16544:50,51,52,53,54,55,56,57,65
…

RomIF_dec.txt

(1.58 KiB) Downloaded 149 times

Code: Select all

     1  REM [HEX:\
20,00,00,00,00,00,00,00,\
00,00,00,22,23,24,3A,3F,\
28,29,3E,3C,3D,2B,2D,2A,...

ROMIF_[ZX81 BASIC TEXT CODES].txt

(1.37 KiB) Downloaded 140 times

Code: Select all

2880   3E;00            LD A,$00             
2882   CD;35;29         CALL $2935          ; [10549]
2885   C3;DC;08         JP $08DC            ; []*BIOS ROM*
2888   FE;06            CP $06              ; [6]
...

RomIF.txt

(13.11 KiB) Downloaded 152 times

Code: Select all

0000    D3;FD            OUT ($FD),A         ; ZX81 NMI GENERATOR
0002    01;FF;7F         LD BC,$7FFF          
0005    C3;CB;03         JP $03CB            ; [RAM-CHECK]
...

RomZx81.txt

(271.12 KiB) Downloaded 127 times

This ROM is patch on the display, load and save routine entry ! (VB81 ROM)

[XavSnap]

Hi,
The rom is avalable here : http://www.zx81stuff.org.uk/zx81/hardware/MemopakIF

But, is it 512 bytes ROM on the Centronics I/F card ?

The asm code seem to be cut !

[Paul]

The topic is very interesting and I would really like to help here but it's not an easy task.
I have the Centronics interface and a Zeddy of course.
But I need to save any results/images to something.
I have both zxpand versions and zxblast and also zxnu.
But any of these interfere with the ROM content. And none of these allow the usage of the internal 1K RAM. I heard that Centronics interface uses the internal 1K RAM to modify the ROM code.
I will need to build a battery backed RAM so I can make sure to save the content there, switch off, take zxpand and save what is in the battery backuped area.
Any better idea?

[mrtinb]

Or maybe use a regular Sinclair 16k RAMpack, and save to Tape

[XavSnap]

HI Paul,

I try to emulate this card, and it seem to call the $2800 throw the ROM.
But, the \RD card read seem to redirect the "Real" address :
"Peek" an address between $0800 & $2A00 seem capte the ($0800-$2000) address.

The Memotch HRG, use a RAM buffer at $0000 to $0200 (512 bytes), and is switchable thru an IORQ.
A ROM able to be write "on" the main bios, and intercept the "LPRINT" routine (near $800)

On the "zxpand", there is a ROM conflict between the IF rom and the zxpand config.
You add to copy the IF routine in the "zxpand" ROM ($0-$2000).

The internal Zx81 ram can't be used, the HRG Memotech had to "copy" the Main rom in it to Rebout the monitor!

The direct launch… using a physical switch like the MemoText card seem to redirect the \RD address too…

It should be remembered that the rom is repeated throughout the unassigned memory.
A CALL $0 = CALL $2000...
But, the HRG rom is located @$2000.

We had to compare the mirrored room address to target the right mirrored segment.
… to create a new rom... to use the IF card for the "zxpand" card.
The best way to dump this rom is to write a tape file… and convert it in a "p" file.

I asked to Philippe to dump his rom with a Centronics I/F, and he will send the printer listing to me.

We will be able to reconstruct the patched ROM image to use the I/F ROM.
same problem to use the Memotext image using the "zxpand"... with the "auto-load" switch/IF card.


I/F ROM:

1.jpg (9.36 KiB) Viewed 3727 times

I/F manual:

2.jpg (32.53 KiB) Viewed 3727 times

EO HELP (MemoPack 64):

[XavSnap]

The ROM saver:

saverom.zip

(12.09 KiB) Downloaded 154 times

- Work on a 1k ram.
- Save the rom in a RAW tape (convert it in EO, using the WAV >P converter)
- I add the wav file.

… From the sZ81 emulator:

saverom - save ROM from ZX81.

Public domain by Russell Marks, 2001.


Description
-----------

saverom saves a ZX81's ROM in the usual ZX81 tape-saving format.
Normally you can't save anything other than Basic programs from a
ZX81; saverom gets around this by only using the save-a-byte-to-tape
routine, and doing the rest itself. The saved ROM should be readable
by anything which can read ZX81 tapes (e.g. zx81get) and which doesn't
check that the actual data looks like a Basic program. The ZX81
filename given to the saved file is `b', mainly because this helps
keep the program short.

Note that saverom does *not* require a 16k ZX81 - it will work
perfectly well with just the 1k, and in fact I recommend running it
that way to avoid any possible problems with RAM pack wobble.


Warning
-------

Before running saverom, you should obviously check that your tape
reader can cope with reading the ZX81's output (if it's connected
directly), or a tape saved from it (if not).

Note that you may *have* to go via tape (or some other kind of
recording) if your machine's sound device isn't getting the signal
from the ZX81 to a high enough level. (Indeed, I had to do this myself
when testing the program.) A `noisy' signal generally isn't too much
of a problem with zx81get, but the signal does still have to be at a
decent level.


Getting the program to the ZX81
-------------------------------

With that out of the way, the usual way to get saverom across to the
ZX81 is to type it in (an alternative approach is described later on).
The machine code is designed with this in mind, so it's relatively
short and can be entered as `Basic' directly, without having to enter
hex or anything.

The program goes like this:

10 REM code here
20 RAND USR 16514

The "code here" bit is listed below, with separate tokens/chars
separated by spaces for clarity (but *don't* type any spaces unless it
actually *says* "space"!). It's listed on multiple lines, but should
be typed on a single line 10 (after the REM):

LN 7 ? 5 0 > ( RETURN F

invJ invO invP TAB invM

RND I ( LN 2 graphs7 5

space space Y RUN ? <=

RETURN 3 SQR LN 2 graphs7

7 FAST D D D LPRINT ABS

invO RND : space INKEY$

( RETURN TAN / USR / STOP

A few things need explaining about that:

- 0 is zero, O is capital o. It's very, very important not to confuse
the two.

- `invA' means an inverse A. To type this, do shift-9 (for GRAPH
mode), then `A', then shift-9 again. (Better to stay in graph mode
for the three in a row, though. )

- `graphs7' is similar - shift-9, shift-7, shift-9.

- RETURN and RUN need to be entered in K mode. To do this, type THEN
(shift-3) followed by the keyword, then go back and delete THEN,
then move the cursor forward again. So for RETURN for example, it's
shift-3, Y, shift-5, shift-0, shift-8.

- don't forget, `<=' is a single token (shift-r).

You might want to see how that looks on a ZX81 once it's typed in
correctly, to check you've got it right, so there's LLIST output here
in listing.png.


Alternative transfer method
---------------------------

Skip this if you decided to type in the program.

If you'd rather not type in the program, and have a Linux box with a
suitable sound device, you could try using my `zx81send' (see
zx81send.c in ../tetris-src.tar.gz) to send the program (a copy of
which is here as saverom.p, in case you want to do it this way). But I
won't say any more about this, as it's probably easier to keep the
transfer one-way.


Running the program
-------------------

Once you've got the program in place, and everything's ready to go,
run it. There should be a few seconds of silence before the data
starts being saved, and you'll see the usual tape-saving pattern on
the screen. The saving process should take less than 4 minutes. If
things go wrong on the receiving end (for example), you can press
space (break) to abort, and re-run the program to try again.

If all goes well, you should end up with an 8192-byte `.p' file,
probably called `b.p'. This isn't really a .p of course, so rename it
to `zx81.rom'. The usual ROM gives the following output from `md5sum
zx81.rom':

db398d4e4e93a6d4dee3bfe146918219 zx81.rom

So if you get that output, you know you've successfully transferred
the usual ZX81 ROM. If not, try a second transfer and see if the files
match - I believe early ZX81s had slightly different ROMs, so it could
still be ok. (But if the two copies don't match, something's clearly
gone wrong.)

BTW, after saving the ROM, saverom leaves the ZX81 in FAST mode. This
shouldn't be a problem, but I just thought I'd mention it.


Source
------

FWIW, assembly source for the machine code is here as saverom.z.


-Rus.

[XavSnap]

The "DB" is an IN opcode, but it's use as an OUT commande:

$DB;xx = IN A,(n)

Where the actual A register is sent on the data bus, and the n address on the address bus.
It return A register, but it can be ignored !

[XavSnap]

[XavSnap]

HI,

Can't run using a G007 and a QS HRG !