Command(s) to read in Apple II ROM + save to disk?

[DeathAdderSF]

Hello, all.

I'm looking for the command(s) to "dump" the ROM of the Tiger Learning Computer to disk. This computer uses custom ASICs so I can't read any of the chips with an EPROM programmer.

I'm assuming this will be a 32kb ROM I'm after, since the "TLC" is based on Enhanced IIe technology. All I found online was a command to save the Apple II+ ROM, which is only 12kb. That's not going to do it.

Any help appreciated, thanks in advance.

[James Davis]

Can you not just bsave it?

[Steve Nickolas]

Requires bankswitching.

-uso.

[DeathAdderSF]

I could BSAVE it if I knew the correct command(s).

Since it requires bankswitching, does that mean it's not possible the BSAVE the entire ROM from Applesoft? How much of it could I successfully save? And what would the command(s) be for that?

[Nick Westgate]

On Saturday, 30 May 2020 19:36:33 UTC+10, DeathAdderSF wrote:
> I could BSAVE it if I knew the correct command(s).
>
> Since it requires bankswitching, does that mean it's not possible the BSAVE the entire ROM from Applesoft? How much of it could I successfully save? And what would the command(s) be for that?

You would start with copying and saving main ROM:
CALL-151
4100<C100.FFFFM
BSAVE TIGERROM,A$4100,L$3F00

Then you'll need to disassemble that to see how it banks in other ROM.

Cheers,
Nick.

[inexora...@gmail.com]

It would also be nice to grab its copy of the ProDOS global page $BF to see where the cartridge drivers live. I've been wondering if they are are smartport devices or completely custom.

[DeathAdderSF]

Thanks, Nick, I'll give it a shot.

And about the cartridge drivers: I'll gladly have a go, but someone'll have to walk me through the process. I'm just a casual Apple II enthusiast; I'm not hip to all the technical stuff.

[inexora...@gmail.com]

On Saturday, May 30, 2020 at 1:54:22 PM UTC-7, DeathAdderSF wrote:
> And about the cartridge drivers: I'll gladly have a go, but someone'll have to walk me through the process. I'm just a casual Apple II enthusiast; I'm not hip to all the technical stuff.

A transcription of memory addresses BF10.BF3F would be a start:

] CALL-151
* BF10.BF3F

BF10.BF2F will be the addresses of drivers for units assigned to slots 0-7 drive 1, then slots 0-7 drive 2. BF31 will be the number of units, followed by the unitnum bytes (with the slot/drive encoded in the high nibble) which point at the drivers. That will tell us what slots the cartridges are mapped to and roughly where the drivers are - firmware, ProDOS, or something novel.

[DeathAdderSF]

Here's what I got:

BF10- A5 DE A5 DE A5 DE A5 DE
BF18- A5 DE A5 DE 00 D0 A5 DE
BF20- A5 DE A5 DE A5 DE 00 FF
BF28- A5 DE A5 DE 00 D0 A5 DE
BF30- 60 02 E0 60 BF 00 00 00
BF38- 00 00 00 00 00 00 E0 60

[inexora...@gmail.com]

Thanks. So 3 drives, slot 6 drives 1 & 2, and slot 3 drive 2. The former are Disk ][ devices with drive at $D000 - the usual place for ProDOS's RWTS driver. The latter is the usual /RAM disk with driver at $FF01. So it looks like a pretty standard 128k IIe from this perspective.

I wonder if the carts emulate Disk ][s, or if ProDOS's RWTS is swapped out. I'd weakly bet on the latter.

[DeathAdderSF]

If there's any other info like that y'all would like me to collect, let me know. I want to do anything I can, big or small, to provide info on this li'l bugger.

As for the ROM, I've got (at least part of) it saved to RAM cart now. Next step's finding a way to get it off there. Ehh...

[qkumba]

You can always take a picture of the monitor listing and we can type it in. :-)

[DeathAdderSF]

I imagine you're joking, but I actually wouldn't mind taking the photos just in case my "TLC" ever croaks.

Would need to know the commands to properly BLOAD the files & get the code display.

[inexora...@gmail.com]

Not kidding. I was going to suggest scrolling through a hex dump of ProDOS and ROM using a pager, taking a video, and uploading to YouTube. It's not crazy - we don't need to retype it, just spot check some addressed looking for differences. That's probably the best way to avoid repeated back-and-forth over this slow channel.

One of us can probably code up a pager that can be keyed in.

Also, thank you for your interest and willingness to further this investigation!

[DeathAdderSF]

I never said / thought it was crazy. I think it's great. I'm happy to have the help figuring out how to get this info to the community.

I'd prefer a direct conversation over this newsgroup, so if any of y'all want to get in touch with me by e-mail so we can continue to discussion a bit quicker and in more detail, please do. It's...

getpsyched at diskman dot com

[Nick Westgate]

On Tuesday, 2 June 2020 03:36:43 UTC+10, qkumba wrote:
> You can always take a picture of the monitor listing and we can type it in. :-)

Or take pictures of the C100.FFFF hex dump and OCR it.

Cheers,
Nick.

[DeathAdderSF]

I recorded a video of the C100.FFFF command -- and with a very capable camera to boot -- but everything scrolls by WAAAAY too fast; only certain sets of the numbers are legible. Since Applesoft "SPEED=" has no effect, and I don't know a way to pipe the output to a file (is it possible?)... *shrugs* Ideas?

[DeathAdderSF]

Actually, I took a closer look and much (all?) of the output can be clearly seen in the video, at one point or another. If any of y'all want to have a look, I uploaded a compact version of the video here, temporarily...

http://www.superfighter.com/temp/C100.FFFF.rar

The MP4 is resized and compressed just a tad, but that doesn't have any effect on the legibility. With some patience, you may be able to find what you're looking for.

In recording the video, I'm sure it didn't help that I had the "TLC" hooked up to a flatscreen monitor that only "tolerates" composite video. If future videos are requested -- and someone can answer my question about setting a slower scrolling speed or dumping the output to a file -- I can always switch to my AppleColor composite monitor.

Note the video will only be hosted on my webspace for a couple of weeks. Get it while it's hot.

[Nick Westgate]

On Wednesday, 3 June 2020 20:22:15 UTC+10, DeathAdderSF wrote:
> The MP4 is resized and compressed just a tad, but that doesn't have any effect on the legibility. With some patience, you may be able to find what you're looking for.

Has this really never been properly explored yet? It seems this device has been in very capable hands before, so I find it kinda hard to believe.

Anyway I had a quick look. The only OCR software I had handy (Copyfish Chrome plugin) didn't work well, even set to the alphanumeric option. Possibly it's the low quality video at an angle, but I'm no OCR expert.

The ROM starts with Applesoft ... and ends with the enhanced //e ROM vectors.

I wonder what's at C100.CFFF, because if there's code to use the parallel port etc then that might be useful. The easiest thing I can think of is to get better quality video - don't hold the camera, use a stand or something - but disassemble that range so we can at least guess what it is.

For instance, if we set up the Ctrl-Y vector with:
3F8:4C 00 03
And put this program here:
300:20 61 FE A9 FF 20 A8 FC 4C 00 03
Then:
C100L<Return>
<Control-Y><Return>

That will continue disassembling from the last list command, pausing briefly for each page.

You can stop the video when it gets to D000, or do the whole ROM to FFFF if you like. ; - )

Cheers,
Nick.

[Raymond Wiker]

It seems that the Tiger Learning Computer has a modem port... in that
case, maybe the ROMs can be captured via that? Maybe ADTpro has
functionality useful for this purpose?

There is some prior art in printing to screen, taking photographs and
then running image recognition to capture the data, but that was
probably overkill even the first time it was done :-)

[David Schmidt]

On 6/3/20 1:25 PM, Raymond Wiker wrote:
> It seems that the Tiger Learning Computer has a modem port... in that
> case, maybe the ROMs can be captured via that? Maybe ADTpro has
> functionality useful for this purpose?

So far, no one has been able to get any data in or out via the modem
port. That's the primary reason I sat on an eBay query for YEARS... and
once I got once, nothing came of it. Here's that link again:
https://groups.google.com/d/topic/comp.sys.apple2/BbyaD_si-Zs/discussion

Here's something I just realized. The speaker is an output port. Here
we go...

[Nick Westgate]

On Thursday, 4 June 2020 07:24:28 UTC+10, schmidtd wrote:
> Here's something I just realized. The speaker is an output port. Here
> we go...

And that is why we pay you to work here! : - D

Cheers,
Nick.

[Nick Westgate]

On Thursday, 4 June 2020 03:25:45 UTC+10, Raymond Wiker wrote:
> There is some prior art in printing to screen, taking photographs and
> then running image recognition to capture the data, but that was
> probably overkill even the first time it was done :-)

Yeah, it's not a good idea ... unless it's the only way.

But now David has found a much lower bandwidth solution! ; - )

Cheers,
Nick.

[DeathAdderSF]

I have a nifty capture device on the way, to make some console recordings. But it should work w/the "TLC" as well. Once it gets here and I have time to configure it, I can try recording any disassemblies or whatnot that way, and see if it comes out any better.

In the mean time, feel welcome to make requests. I'll note them down.

[Nick Westgate]

On Thursday, 4 June 2020 14:21:23 UTC+10, DeathAdderSF wrote:
> I have a nifty capture device on the way, to make some console recordings. But it should work w/the "TLC" as well. Once it gets here and I have time to configure it, I can try recording any disassemblies or whatnot that way, and see if it comes out any better.
>
> In the mean time, feel welcome to make requests. I'll note them down.

You should get in touch with David and see how he goes with using the speaker to send data from the TLC to the outside world. Since he's a developer who also owns the device that's going to be a lot less hassle than OCR of video.

Once the ROM is obtained I'm sure the MAME guys will be keen to make a driver given that it seems to be an Apple //e derivative.

Cheers,
Nick.

[David Schmidt]

I live to serve the ship.
https://github.com/david-schmidt/tlc-apple2

[Antoine Vignau]

David,
Can I upload your files to the Apple 2 Documentation Project, please?

Antoine

[David Schmidt]

On 6/4/20 2:09 PM, Antoine Vignau wrote:
> David,
> Can I upload your files to the Apple 2 Documentation Project, please?

Absolutely, no problem. The pictures are my own (taken in 2013 with
attendant resolution :-/ )

[DeathAdderSF]

Best luck, David, and thanks for having another go at it. If I can be of any help, please get in touch. :)

[Steven Hirsch]

Awesome work as usual, Dave!

[geoff body]

David, did you ever dump the C800 - CFFF if slot 2 was accessed.
ie
lda $CFFF
lda $C200
dump C800-CFFF

[geoff body]

Those that have been looking a the TLC would have come across the photo of a prototype. You notice in the photo that the two emproms go to pads for two chips. I would think they dies would be mount on PCBs to reduce the size of the footprint compared to the standard layout of the chips. You can zoom in very nicely with the photo

If I had access I would trace out pins 9-12 of both ADM202JN chips with respect U15. I am guessing is a ACIA 6551, this would possibly allow pin positions so the transmit clock could be checked/located.

https://onlineonly.christies.com/s/first-bytes-iconic-technology-twentieth-century/prototype-tiger-learning-computer-9/895

[David Schmidt]

Here's that:
https://github.com/david-schmidt/tlc-apple2/blob/master/rom/C800-CFFF.txt

Any other slots of interest while I have the dumper typed in?

[Antoine Vignau]

No thanks, David!

[inexora...@gmail.com]

Can you grab it's copy of ProDOS? It'll require grabbing 16k from the LC (including the alternate 4K bank)

[David Schmidt]

On 6/8/20 5:52 PM, inexora...@gmail.com wrote:
> Can you grab it's copy of ProDOS? It'll require grabbing 16k from the LC (including the alternate 4K bank)

There's no way(1) they modified ProDOS, but if they did, a strategy for
banking and reading is required (I'm not a banker by trade).

(1) I mean, they _could_ have modified it, but... I doubt it.

[David Schmidt]

On 6/8/20 5:22 PM, Antoine Vignau wrote:
> No thanks, David!

Any time. The only other slot with non-floating RAM is slot 3, so I
dumped that too.

I've generalized the place where I store ROM and monitor disassembly, so
it's best to refer to the top of the project now:
https://github.com/david-schmidt/tlc-apple2

[DeathAdderSF]

If you format a flash RAM cart under DOS 3.3 in the TLC menu, you'll notice it has a unique volume name and number, instead of the standard DISK VOLUME 254. So they definitely modified DOS.

I don't know enough about ProDOS to look into it, though.