Shadow ROM (Interface 1) disassembly
Jonathan Needle
Does anyone have an electronic version of the disassembly of the shadow ROM
they could send me, please?
Ian Logan's Spectrum Microdrive Book mentions it briefly. Was it ever
published?
Thanks,
Jon.
--
Jonathan Needle
Spectaculator development
http://www.spectaculator.com/
Geoff Wearmouth
<j...@berewyk.freeserve.co.uk.no.junkmail> writes
>Hi everyone,
>
>Does anyone have an electronic version of the disassembly of the shadow ROM
>they could send me, please?
wrote a word-processor "The Writer".
I've never seen an electronic version though several people have
commenced independent disassemblies.
>Ian Logan's Spectrum Microdrive Book mentions it briefly. Was it ever
>published?
I don't remember Ian Logan commenting on it. He wrote the Interface 1
ROM for Sinclair Research ( in conjunction with Martin Brennan ) and was
prevented from publishing the actual Assembly Listing as it was Sinclair
Research's intellectual property.
--
Geoff Wearmouth
The ZX ROM Files http://www.wearmouth.demon.co.uk
Ramsoft staff
<j...@berewyk.freeserve.co.uk.no.junkmail> wrote:
>Hi everyone,
>
>Does anyone have an electronic version of the disassembly of the shadow ROM
>they could send me, please?
>
>Ian Logan's Spectrum Microdrive Book mentions it briefly. Was it ever
>published?
We have a copy of the original book by Gianluca Carri, published by
Melburne House. We'll surely try to make it available in electronic
format, but not that soon as it's quite a huge work even with a good
OCR...
Ramsoft staff <ram...@bbk.org>
---------------------------------------------
Ramsoft - ZX Spectrum demogroup ////
Visit us at http://www.ramsoft.bbk.org ////
Home of RealSpectrum and MakeTZX ////
------------------------------------------
Jonathan Needle
> Melburne House. We'll surely try to make it available in electronic
> format, but not that soon as it's quite a huge work even with a good
> OCR...
You couldn't, by any chance, post an index to the routines - e.g.:
Routine name Address
------------ -------
Format Cartridge 0x0000
Or if anyone else has a list either they could post.
Thanks,
Jon.
Jim Grimwood
<jonatha...@uk.ibm.com.nojunkmail> wrote:
>[...]
>You couldn't, by any chance, post an index to the routines - e.g.:
> Routine name Address
> ------------ -------
> Format Cartridge 0x0000
>Or if anyone else has a list either they could post.
Here's an If.1 hook code & ROM routine summary from Andy Pennell's book -
although there's a lot more information on the routines in the book than
what I'm giving here. There's several If.1/Microdrive books which give
this info (and a lot more besides), but "Master Your ZX Microdrive" was
the first one that came to hand on the shelf. There's some inconsistency
in the naming of the routines between different books and even in the same
book (usually with/out the "_M" suffix), but that's not very important.
Those routines without their own hook code use the SHADOW routine with
their address in sysvar HD_11.
CODE NAME LOCATION SUMMARY
---- ------ -------- --------------------------------
CAT 1C58 Catalogue a Microdrive cartridge
FORMAT_M 1B6E Format a Microdrive cartridge
OPEN_R 0B13 Open an RS232 channel
1B PAUSE 19D9 Wait for a key to be pressed - value in A
1C PRINT 19EC Print CHR$ A on stream FE (the screen)
1D 232IN 0B81 RS232 input in A - carry if valid
1E 232OUT 0C51 RS232 output - character code in A
-or- 0C5A (contradictory info in book)
1F LPRINT 19FC Print CHR$ on stream 3 (the printer)
20 SCAN_K 1A01 Scan the keyboard matrix - NZ if any pressed
21 MOTOR 17F7 Switch Microdrive motors on or off
22 OPEN_M 1B29 Open a temporary "M" channel
23 CLOSE_M 12A9 Close an "M" channel
24 ERASE 1D6E Erase a file from a cartridge
25 READ_NP 1A09 Read in the next PRINT buffer
26 WRITE_S 11FF Send the "M" buffer to cartridge
27 READ_P 1A17 Read in a PRINT buffer
28 READ_R 1A4B Search for a random file
29 READ_S 1A86 Search for a serial file
2A WRITE_R 1A91 Write a block randomly
2B OPEN_M 1B29 Same as 22 - a mistake - FAULTY
2C RECLAIM 10C4 Reclaim a 595 byte "M" area
2D OPEN_N 0EA9 Open a temporary "N" channel
2E CLOSE_N 1A24 Close a "N" channel
2F READ_N 1A31 Read a Network packet - FAULTY
30 WRITE_N 0DB2 Write a Network packet
31 NEWVARS 19A8 Create the extra system variables if required
32 SHADOW 19A4 Call the shadow ROM routine addressed by HD_11
(HD_11 is an If.1 sysvar at 5CED/E)
(It's possible that the routines marked as FAULTY may have been corrected
in a later version of the ROM released after AP's book was published. The
other books I have - all dated 1983 or 1984 - also say they're faulty.)
As I keep pointing out to people, these books can still be ordered from
your local library (if you're in the UK, anyway). The best two are Andy
Pennell's book as already mentioned, and Ian Logan's "Spectrum Microdrive
Book". The "Spectrum Advanced User Guide" by Dickens, Plumbley & Whewell
also has a lot of useful reference info.
--
Another Fine Product from:
Jim Grimwood, Weardale, England (jimg at domain globalnet.co.uk); home of:
Your Spectrum Unofficial Archive (YRUA?)
Spectrum Oracle on Trumpton (SPOT*On) magazine index
The Type Fantastic (TTFn) magazine type-ins archive
http://www.users.globalnet.co.uk/~jimg/
Geoff Wearmouth
<see...@bottom.of.page> writes
>Here's an If.1 hook code & ROM routine summary from Andy Pennell's book -
>although there's a lot more information on the routines in the book than
>what I'm giving here.
>
Yes Jim that's what happened. Your book is the 1983 first edition.
I managed to get hold of a 1984 second edition which has the following
hook codes. Andy worked on the second and third ROM but ROM3 was
probably never released.
Interface 1s with serial number up to 87315 are ROM1.
Code Name ROM1 ROM2 ROM3 Function
---- ---- -------------- --------
1B PAUSE 19D9 1ECD 1ECF Wait for key to be pressed - value A.
1C PRINT 19EC 1EE0 1EE2 print CHR$ A on system stream $FE (the
screen).
1D 232IN 0B81 0B88 0B88 RS232 input in A - carry if invalid.
1E 232OUT 0C5A 0D07 0D07 RS232 output character code in A.
1F LPRINT 19FC 1EF0 1EF2 print CHR$ A on stream 3 (the printer).
20 SCAN_K 1A01 1EF5 1EF7 scan the keyboard matrix - NZ if any
pressed.
21 MOTOR 17F7 1532 1532 switch microdrive motors on or off.
22 OPEN_M 1B29 1B05 1B05 open a temporary "M" channel.
23 CLOSE_M 12A9 138E 138E close a "M" channel.
24 ERASE_M 1D6E 1D79 1D7B erase a file from a cartridge.
25 READ_NP 1A09 1EFD 1EFF read in the next PRINT buffer.
26 WRITE_S 11FF 12DA 12DA send the "M" buffer to the cartridge.
27 READ_P 1A17 1F0B 1F0D read in a PRINT buffer.
28 READ_R 1A4B 1F3F 1F41 search for a random file.
29 READ_S 1A86 1F7A 1F7C search for a serial file.
2A WRITE_R 1A91 1F85 1F87 write a block randomly.
2B MAKE_M ---- 10A5 10A5 create "M" area.
2C RECLAIM 10C4 119F 119F reclaim a 595 byte "M" channel.
2D OPEN_N 0EA9 0F46 0F46 open a temporary "N" channel.
2E CLOSE_N 1A2F 1F18 1F1A close a "N" channel.
2F READ_N ---- 1F25 1F27 read a Network packet.
30 WRITE_N 0DB2 0E4F 0E4F write a Network packet.
31 NEWVARS 19A8 1E98 1E9A create the extra system vars if required.
32 SHADOW 19A4 1E94 1E96 call the shadow ROM routine addressed.
33 SCAN_M ---- 1FE4 1FE6 read the next cartridge header.
34 OPEN_B ---- 1FF6 1FF8 open "B" channel.
After the last time you mentioned the Advanced Spectrum Guide I did a
Google Search and managed to find one in an Ebay Shop. A good
recommendation. Cheers.
Gianluca's Book has an alphabetical listing of both ROM1 and ROM2 labels
and I guess this is what Jonathan needs. Nice emulator Jonathan by the
way. Which ROM version are you interested in?
Geoff Wearmouth
<jonatha...@uk.ibm.com.nojunkmail> writes
>You couldn't, by any chance, post an index to the routines - e.g.:
>
> Routine name Address
> ------------ -------
> Format Cartridge 0x0000
>
>Or if anyone else has a list either they could post.
For the first version of the ROM,
Addr Routine Name
---- ------------------
0000 Return to main ROM
0008 Start
0010 Call a main ROM routine
0018 Test if syntax is being checked
0020 Shadow-error
0028 Main ROM error restart
0030 Create new system variables restart
0038 Maskable interrupt
003A TEST-SP
0040 Main ROM error routine
0066 Non-maskable interrupt
0068 ST-ERROR
0077 CHECK-SP
0081 CALBAS-2
009A Control routine
0IF7 Create new system variables routine
023A System variables default values
024D Reset new system variables
0258 Shadow report printing
02B7 Shadow report messages
0486 CAT command syntax routine
04B4 FORMAT command syntax routine
04ED OPEN command syntax routine
0531 ERASE command syntax routine
053D MOVE command syntax routine
0359 CLS# command routine
057F CLEAR# command routine
059F Exchange file specifiers
05BI SEPARATOR
05B7 End of statement
05CI Return to the main interpreter
05E7 Evaluate string expression
05F2 Evaluate channel expression
061E Evaluate numeric expression
062F Evaluate filename
064E Evaluate stream number
0665 Check "m" parameters
0685 Check "m" parameters and filename
068F Check station number
06A3 Evaluate "x";n;"name"
06BO Check baud rate
06B9 Evaluate stream or expression
0700 UNPAGE
0701 Evaluate parameters
082F SAVE command syntax routine
0880 Save a byte to network or PS232 link
0894 LOAD command syntax routine
089E VERIFY command syntax routine
08A8 MERGE command syntax routine
08AF LOAD-VERIFY-MERGE commands routine
OA5C LOAD or VERIFY
OA95 Load "run" program
OAC9 Set "BAUD'- system variable
OAEF RS232 timing constants
OB13 open RS232 channel in CHANS area
OB47 Attach channel to a stream
OB64 "T" channel data
OB6F "T" channel input
OB75 "B" channel input
OB7B "T" channel input service routine
OB81 "B" channel input service routine
OC3C "T" channel output
OC5A "B" channel output
OCA9 Border colour restore
OCB4 Break into I/O operation
OCBD CALL-INP
ODOC "N" channel input
OD12 "N" channel input service routine
OD6C "N" channel output
OD93 OUT-BLK-N
ODAB S-PACK-1
ODB2 SEND-PACK
OEOF BR-DELAY
OE18 Header and data block receiving
OEA3 OPEN "N" channel command routine
OEA9 Open temporary "n" channel
OEB5 Open permanent "n" channel
OEEA "N" channel data
OEF5 Send EOF block to network
OF03 Network state
OFOE Check-resting
OF1E Wait-scout
OF61 Send-scout
OF92 INPAK
OFBE Send response byte
OFC5 OUTPAK
OFEB Set a temporary I'm" channel
1OC4 Reclaim I'm" channel
1122 "M" channel input
112C "M" channle input service routine
1177 Get a record
11A5 Get header and data block
11D8 "M" channel output
11FF Write record onto Microdrive
1264 CHK-FULL
1275 SEND-BLK
12A6 Close file
12BE ERR-RS
12C4 Fetch header from Microdrive
12DA Check map bit state
12FE Reset bit in map area
1306 Check 'Pseudo-map' bit state
1312 Decrease sector counter
131E CHECK-NAME
1341 Calculate/compare checksums
135F Restore stream data
1391 Restore map addresses
13CC "M" channel data
13E5 Preamble data
13F1 MOVE command
1455 Use stream or temporary channel
14A4 Close 'MOVE' channel
14C7 Exchange DSTRI and STR2 contents
14DA Save data block into Microdrive
1580 Get header information from Microdrive
15A9 Load or verify block from Microdrive
1613 Save Microdrive Map contents
162D Restore Microdrive Map contents
1648 LD-VE-M
1666 Fetch record from Hicrodrive.
1691 Restore address of filename
1708 CLOSE STREAM
1718 CLOSE command
17B9 Reclaim temporary channels
17F7 Select drive motor
1867 1 millisecond delay
1872 Send data block to Microdrive Head
18A3 Receive block from Microdrive Head
1BE9 TEST-BRK
1BFA DELAY-BC
1902 UNKN-1
196C UNKN-8
1981 HOOK-CODE
19A4 Hook code +32
19A8 Hook code +31
19A9 Hook code addresses
19D9 Console input
19EC Console out@ut
19FC Printer output
1A01 Keyboard test
1A09 Read sequential
1A17 Read random
lA24 Close network channel
1A31 Get packet from network
1A4B Read sector
1A86 Read next sector
1A91 Write sector
1AEO Clear buffer contents
1AFO Open a permanent "m" channel
1B29 Open a temporary "m" channel
1B6E FORMAT "m" command
1C38 CAT command
1D38 FREESECT
1D50 PRNAME
1D66 PRCHAR
1D6E ERASE command
1E3E Signal 'free sector'
1E53 Obtain record descriptor
1E66 Calls to the command routines
1E87 DISP-HEX
1E9E DISP-HEX2
1EA9 DISP-CH
1ECE HEX-LINE
Jonathan Needle
"Geoff Wearmouth" <ge...@wearmouth.demon.co.uk> wrote in message
news:OWMrmLAI...@wearmouth.demon.co.uk...
Thanks guys - just the ticket :)
> Gianluca's Book has an alphabetical listing of both ROM1 and ROM2 labels
> and I guess this is what Jonathan needs. Nice emulator Jonathan by the
> way. Which ROM version are you interested in?
It probably doesn't matter too much (think my Interface 1 was v2 - it didn't
work with some older programs).
Most of the programs I wrote for the speccy are still on Microdrive cartridge
so I'd like to support .MDR files. Just needed to know what routine does what
so I can see how the Interface 1 formats cartridges, reads and writes file
etc.
Thanks again :)
Jon.
Jonathan Needle
> In article <aa0er9$i3u$1...@sp15at20.hursley.ibm.com>, Jonathan Needle
> <jonatha...@uk.ibm.com.nojunkmail> writes
>
[lots of labels and addresses]
Thanks Geoff :)
Cheers,
Jon.
Jim Grimwood
There's some Andy Pennell articles from Your Spectrum magazine, on the
bugs in and various versions of the If.1 ROM, on my site at:
http://www.users.globalnet.co.uk/~jimg/
./yr02/yr02_45.htm Those Moody Microdrives
./yr10/yr10_26.htm Interface ROM - The Inside Story
./yr18/yr18_27.htm New ROM Antics
plus a review of the Shadow ROM disassembly book from Melbourne House at:
./yr18/yr18_05.htm#Book
Geoff Wearmouth
<jonatha...@uk.ibm.com.nojunkmail> writes
>
>Thanks,
>
>Jon.
I've stuck a list of the ROM1 and ROM2 labels in the directory
http://www.wearmouth.demon.co.uk/shadow/
Also the routine addresses as previously posted.
Now all we need are the two ROMS from Philip Kendall's
ROM collection, a few 2 second sessions with Mark Incley's
disZ80, a bit of pattern recognition and substitution and we'll
have the CSS Interface 1 disassemblies.
It's a bit more complicated as there will be some error reports
and tables but not too complicated. Just keep assembling it until
the object code is 8K in size and has no differences to the original.
Geoff Wearmouth
<ge...@wearmouth.demon.co.uk> writes
>Now all we need are the two ROMS from Philip Kendall's
>ROM collection, a few 2 second sessions with Mark Incley's
>dZ80, a bit of pattern recognition and substitution and we'll
>have the CSS Interface 1 disassemblies.
There were a few OCR errors in the original lists but now
you can assemble your own version of the Interface 1 ROM
for use in a growing number of emulators.
Both computer-generated versions can be read online at the
bottom of page
http://www.wearmouth.demon.co.uk
so if you can work out what the "Unknown" section in
version 1 does write in.
After reading Jim's articles it does seem that the version 3 ROM
was more than a flash in the pan so if you have a version that is
neither of these then send it in.
Jonathan Needle
> In article <NL77RKAU...@wearmouth.demon.co.uk>, Geoff Wearmouth
> <ge...@wearmouth.demon.co.uk> writes
>
> bottom of page
>
> http://www.wearmouth.demon.co.uk
Thanks Geoff, I'll stop work on my version now - not got too far anyway :)
Cheers,
Jon.
Frans
I've never finished mine...
Frans
Geoff Wearmouth
<ge...@wearmouth.demon.co.uk> writes
>Both computer-generated versions [of Interface 1 ROMs] can be read
>online at the
>bottom of page
>http://www.wearmouth.demon.co.uk
>so if you can work out what the "Unknown" section in
>version 1 does write in.
In fact John Hutcheson of New Zealand has sent in an explanation of what
this bit of code, in the version 1 ROM only, does.
The first routine inserts, or checks, a 32 bit Cyclic Redundancy
checksum of the microdrive buffer contents. So at one time, it seems,
there wasn't a one-byte checksum following the buffer, as there is now,
but 4 bytes which contained a unique fingerprint of the sector in much
the same way as WinZip checks that a file has not changed.
The second routine is a short Encryption/Decryption routine which
encrypts the microdrive buffer on the first call and decrypts it when
called again. It's not going to cause the guys at Cheltenham any
sleepless nights but it is enough to stop one idly peeking the buffer
region for clues to adventures. Not that there ever was much adventure
software issued on microdrive. Anyway it never got called. I won't give
the key away as we don't want everyone knowing.
I've pasted John's code in around $1902.
Cheers John.