another ROM write bug (Speeddos 1541)

From: Nicolas Welte; address is valid for replies (Re:) only! (welte_spam_at_freenet.de)
Date: 2003-02-16 18:03:15

Another strange ROM code turned up that makes my Flash hardware behave badly, 
Wolfgang Moser found it when testing his special version of a Speeddos ROM, 
based on the patchlevel of the 1541-II. But virtually every standard Speeddos 
ROM contains the same code (disassembly from d65):

FF6D          LFF6D:
FF6E          LFF6E = * + 1
               ; Instruction parameter jumped to.
               ; this is actually a "hidden" BPL FFB1
FF6D 8D 10 41   STA L4110
FF70          LFF70:
FF70 AD 0C 18   LDA L180C
FF73 29 08      AND #$8
FF75 D0 03      BNE LFF7A
FF77          LFF77:
FF77 4C 16 E9   JMP LE916
FF7A          LFF7A:
FF7A 20 B7 E9   JSR LE9B7
FF7D 9D 67 FE   STA LFE67,X
               ; this is the offending instruction. It doesn't seem to be 
another hidden instruction, though speeddos uses LDA and STA at other places 
to hide stuff. Maybe it's only a strange coincidence, but $FE67 is also the 
interrupt service routine.

FF80 A9 01      LDA #$1
FF82          LFF82:
FF82 2C 00 18   BIT L1800
FF85 30 2A      BMI LFFB1

The code is only executed if the parallel cable is connected, and I could 
make no sense of that instruction (nor could Womo). Any ideas, anybody?

Nicolas



       Message was sent through the cbm-hackers mailing list

Archive generated by hypermail 2.1.6.