💾 Archived View for mirrors.apple2.org.za › active › ftp.apple.asimov.net › emulators › rom_images ›… captured on 2024-07-09 at 07:15:34.
⬅️ Previous capture (2023-01-29)
-=-=-=-=-=-=-
*********************************** * Apple ][e ROM Hacking * * by * * Galael * * June 1, 2007 * * * /*/*/*//*/*/*//*/*/*//*/*/*//*/*/*/ /*/ /*/ /*/ Updated by Eric Neilson /*/ /*/ January 2, 2009 /*/ /*/*/*//*/*/*//*/*/*//*/*/*//*/*/*/ NOTE: The original APPLE2EKRK.ROM image posted by Galael overwrote portions of the monitor subroutines that follow the cassette tape save area of ROM. The reason for this is because the original articles on ROM hacking were written for the Apple II+ and not the IIe Enhanced, which has less room for this code in the cassette tape save/load areas. The bulk of APPLE2EKRK_V2.ROM has been relocated to the Apple self-test area ($C600) and doesn't trounce critical code anymore. In this directory is a modified Apple ][e ROM image that will let you break into the Monitor at any time, regardless of what program is loaded. Back in the day, many of the better "Krackists" used this technique to break into a game and examine the code for cracking purposes. At the time, you needed to have an old Integer Basic ROM or burn your own modified ROM chip, but with the marvelous Apple ][e emulators out today, all you need to do is point your emulator to APPLE2KRK_V2.ROM and boot away. If you tire of the virtual world and decide to play with the real thing, modified CD and EF ROM images are included here as well for burning your own replacement EEPROMs. Usage: 1) Select the APPLE2KRK_V2.ROM file for use with your emulator 2) Boot 3) The system will appear to hang. It's waiting for a key press: ESC - Go directly to the monitor Space - Copy stack and register values to $2901-$2904, memory from $0000-$08FF up into $2000-$28FF and then enter monitor (see articles below for why this is important) Any other key - proceed normally 4) You will probably want to press any key at boot time to get where you are going. You will know the ROM is working if you see "Apple //k" at boot 5) Anytime you press Reset or Boot on your Apple ][e, the system will wait for a key press before continuing. Now you can do your cracking. What's going on: The following sources give excellent in depth explanations: - Hardcore Computist, Volume #6: http://www.computist-project.net/pdfs/hardcore.computist/issue06.pdf - Krakowitz file which is part of this archive Summary: The original reset vector address in the ROM is changed from $FA62 to $FEFD. Why $FEFD? That's normally the cassette tape "Load" area which I've replaced with a code snippet that jumps to the main portion of code. There is not enough room in normal non-bank-switched memory to contain the complete program, so I had to divide the code into three parts: Part 1 (resides at $FEFD) - Tape load area: Handles the reset vector, bank switches, and jumps to main code at INTCX $C600 Part 2 (resides at $C600 - INTCX) - Self-test area: Checks keyboard input and then either jumps back to Part 1 for a normal pass-through Reset or jumps to Part 3 for a monitor exit Part 3 (resides at $FECD) - Tape save area: un-bank switches back to SLOTCX memory and jumps to Monitor for some fun! Other notes: - The assembly code was written and compiled with S-C MASM 1.1 which is free. The SC MASM source file is included on romkrk.dsk image, and a .pdf file of the source is also included here for easier viewing. Maybe this file is 20 years too late, but for anyone who still enjoys tinkering with their old Apple ][, I hope this helps make your hobby more enjoyable. Happy Cracking! Galael Likewise, Eric N. /*/ APPENDIX */ Here are the hex edits made to the original APPLE2E.ROM file: Location of Part 0 - Alter NMI and reset vectors: FILE OFFSET: $7FFA 4 BYTES OLD: FB0362FA NEW: FDFEFDFE Location of Part 1: FILE OFFSET:$7EFD 12 BYTES OLD: 8D07C020D1C58D06C0F032D0 NEW: 8D07C04C00C68D06C04C62FA Location of Part 2: FILE OFFSET: $4600 76 BYTES OLD: 8D50C0A004A2001879B4C79500E8D0F71879B4C7D500D010E8D0F56A2C19C0100249A58810E130065500184CCDC6860186028603A2048604E601A88D83C08D83C0A50129F0C9C0D00CAD8BC0 NEW: AD00C0F0FBC9A0F007C99BF03C4C03FF8D02298E03298C0429BA8E0129A000B90000990020B90001990021C8D0F1843C8442843EA909853FA902853DA9228543202CFE202FFB2058FC4CCDFE Location of Part 3: FILE OFFSET: $7ECD 6 BYTES OLD: A9408D07C020 NEW: 8D06C04C59FF Change the Apple //e logo to Apple //k: FILE OFFSET: $7F12 OLD: E5 NEW: EB