M100 "Hackers Guide"
complied and converted to html by Andy Diller for Web100 1996
______________________________________________________________________________________________________________________________
* M100 Rom hooks
* Machine Language Files Explained
* M100 Tips and Tricks
______________________________________________________________________________________________________________________________
Detailed Study of Model 100 ROM Hooks
Copyright 1986 by Bob Andersen, Micro Analog Associates. Monroe, CT. 06468
Routine RST 7 calls the nth 2-byte address specified in the HOOK table located in RAM, starting at 64218, where 2N is the
value of the byte that follows the RST 7 instruction.
This study details the location and nature of all RST 7 instructions within a Model 100 ROM.
Default indicates the action installed by a cold start. Address 32755 is installed in the HOOK table for RET and 2267 is
installed for FC ERROR.
Hook Addr 2N Addr Default In Function (Addr)
RST 7
_____________________________________________________________________________________________________________________
64218 0 16643 RET CLEAR 16633 64220 2 7592 RET MAX(RAM) 7579 64222 4 4820 RET CHGET 4811 64224 6 5102 RET CHSNS 5083 64226 8 17175 RET LCD 19268 64228 10 5232 RET PNOTAB 5232 64230 12 19656 RET INPUT$ 20110 64232 14 20101 RET INPUT$(NM ERROR) 20110 64234 16 20194 RET INPUT$ 20110 64236 18 20510 RET LINE(NM ERROR) 3141 64238 20 19796 RET CLOSE(IE ERROR) 20008 64240 22 19944 RET SAVE 19919 64242 24 19727 RET OPEN 19659 64244 26 19851 RET LOAD 19824 64246 28 19751 RET OPEN 19659 64248 30 19625 RET EOF(IE ERROR) 6281 64250 32 20064 RET LCD(NM ERROR) 19268 64252 34 19992 RET SAVE(NM ERROR) 19919 64254 36 19997 RET LOAD(NM ERROR) 19824 64256 38 6281 RET EOF 6281 64258 40 20597 RET OPEN 19659 64260 42 20627 RET OPEN 19659 64262 44 20643 RET OPEN(NM ERROR) 19659 64264 46 20630 RET OPEN(NM ERROR) 19659 64266 48 20771 RET OPEN 19659 64268 50 21789 RET TELCOM(TERM-F6) 20806 64270 52 21792 RET TELCOM(TERM-F7) 20806 64272 54 22064 RET TELCOM(TERM-UP) 20806 64274 56 24673 RET TEXT 24046 64276 58 7619 FC ERROR WIDTH 7619 64278 60 17226 FC ERROR LCD 19268 64280 62 7760 FC ERROR SCREEN 7714 64282 64 NOT IN ROM FC ERROR NonemTHROUGH 64294 76 NOT IN ROM FC ERROR None 64296 78 20587 FC ERROR LOF 20587 64298 80 20589 FC ERROR LOC 20589 64300 82 20591 FC ERROR LFILES 20591 64302 84 20595 FC ERROR DSKI$ 20595 64304 86 20593 FC ERROR DSK0$ 20593 64306 88 8095 FC ERROR KILL 8081 64308 90 8272 FC ERROR NAME 8247 64310 92 8923 FC ERROR SAVEM 8908 64312 94 9381 FC ERROR LOADM,RUNM 9361 64314 96 NOT IN ROM (zeroed) None
THROUGH
64328 NOT IN ROM (zeroed) None 110
Bob Anderson (70526,1233) kindly provided a compendium of RAM hooks in the Model 100 actuated by means of RST 7. Here are
a few hooks to add to his list.
FB1A CRT open
FB1E CRT put
FB20 WAND open
FB22 WAND close
FB24 WAND get
FB26 WAND other
_____________________________________________________________________________________________________________________
Machine Language Files Explained
There is a lot of mystery surrounding CO programs because of the way they are loaded into the Model 100, what you should
know first is that who ever designed its software evidently did so with Text files and Basic programs in mind were as
Machine language programs were an after thought. You see file management is done automatically for Text files and Basic
programs, their file type, starting address and name are recorded directly into the file directory in machine memory
(63930-64138) when they are created. As old files are deleted and new ones created the remaining files are moved up and
down in RAM and as their locations change their starting addresses are automatically updated in the file directory.
Machine language or CO programs on the other hand often times cannot be moved because of address specific routines within
the program so they are given a fixed address and here's were things get sticky for this is not compatible with the
operations of the file manager. To accommodate CO programs a modification had to be made, instead of going directly to the
program from the address found in the file directory the machine goes to a pseudo file which contains a 6 byte table with
the address information for the the location of the programs code. In this way the file manager can move the pseudo file
but not the real CO program.
When you create a Text file or Basic program in the Model 100 you do so through the built-in programs TEXT and BASIC which
use the file manager but when you create a CO program you must first load it from a Text file (the file may be in decimal,
hexadecimal or ASCII characters) to its end location in RAM. This is done using a "loader" which converts the file from
what ever form it's in to single bytes, it may even be tailored for that specific program saving you any further work. If
the loader wasn't tailored for that program or the file was loaded from tape you must enter the programs name and address
information so that the file directory can CALL the program, this is done in two steps:
First go to BASIC and set the HIMEM pointer to the very first address of the CO programs code, this is done with the CLEAR
command and keeps the machine from using that area as the RAM fills up.
Second you have to enter the programs name and address information with the SAVEM routine, this puts the 6 byte address
table in the pseudo file which is automatically recorded in the file directory as the CO program. The SAVEM routine
incorporates many of the functions of the file manager but you control it manually.
If the CO program is loaded from a Tandy Disk Drive the SAVEM operation is automatically done for you but you still have
to set HIMEM.
If you do not know the addresses for either the first or the second step just type RUNM "program name" (the "CO" extension
is not needed) and you will get the "Top","End","Exe" addresses followed by a "OM Error".
If you should accidentally KILL a CO program from the Menu and find that you have to get back into it you can still run
the program by CALLing its Execution address, if it is the lowest CO program or the only one in RAM and its Top address
and Execution address are the same (they usually are) you can CALL HIMEM.
_____________________________________________________________________________________________________________________
M100 Tricks and Tips
There are 36 bytes of RAM from 62982 to 63017 which can effectively be rendered invisible if an optional ROM is not
installed. Whatever you poke into those 36 bytes will stay there regardless of any BASIC or M/L programs that you may run.
The original routine from 62981 to 63011 checks for the existence of an optional ROM every time you power up, if one is
present the value 255 is stored at 63018 and the name of that ROM is stored from 64164 to 64171. Addresses 63012 to 63017
are used when selecting the optional ROM from the Menu.
POKE 62981,201: RET, which effectively makes your 100 think that an optional ROM is installed.
POKE 63018,255: To prevent a cold-start on power-up, the remaining 36 bytes are now free to poke in anything you want.
Telcom
Interested in more free space to poke stuff into? TELCOM uses 64704 to 65023 as a buffer for its previous screen function,
it is also used by the Lucid ROM when it is installed and for some Menu functions which begin at 64904. There are 320
bytes, the first 200 of which are perfectly safe. The remaining 120 bytes may be used as long as the program using that
area doesn't use the Menu's date and time routine while running.
Addresses 63109 to 63362 are reserved for the INPUT buffer, the later part of which has been used to store short M/L
routines while leaving enough space for normal buffer operations.
The MDM & COM buffer from 65350 to 65413 can be used as long as it is not being accessed for input or output operations,
there are 64 more bytes.
CALL 20806 Enter TELCOM with modem on.
CALL 21172 Connect telephone line.
CALL 21179 Disconnect telephone line.
CALL 21795 Prev screen (64704-65023).
CALL 21608:
_____________________________________________________________________________________________________________________
POKE to restore the built-in modem:
FOR A=63067 TO 63071:READ Z:POKE A,Z:NEXT:DATA 77,55,73,49,69
POKES for the F6 and F7 in TELCOM:
Bytes Free message: 64268,172
64269,126
Clear Screen: 64270,49
64271,66
Stop Scrolling: 64268,63
64269,66
Start Scrolling: 64270,68
64271,66
_____________________________________________________________________________________________________________________
POKES for LABLE and PRINT
Disable LABEL key: 64173,0 Enable LABEL key: 64173,1 Enable by returning to the Menu
Address 64228 is the place to intercept the print routine just before it prints a character, PCSG and others use that
location to add line feeds.
Disable printer port: 64228,136
64229,20
Enable printer port: 64228,243
64229,127
_____________________________________________________________________________________________________________________
If you wish to test the printer port to determine the status of the printer use one of these two routines:
10 CLS 20 IF (INP(187)AND6)=0 THEN BEEP:PRINT@136,"POWER OFF" 30 IF (INP(187)AND6)=2 THEN PRINT@137,"ONLINE" 40 IF (INP(187)AND6)=4 THEN BEEP:PRINT@136,"OFFLINE" 50 IF (INP(187)AND6)=6 THEN BEEP:PRINT@134,"DISCONNECTED" 60 FOR X=1TO575:NEXT:CLS
10 CLS 20 IF (INP(187)AND6)<>2 THEN BEEP:PRINT@131,"PRINTER NOT READY" 30 IF (INP(187)AND6)=2 THEN PRINT@133,"PRINTER READY" 40 FOR X=1TO575:NEXT:CLS
_____________________________________________________________________________________________________________________
These addresses return memory locations in a two address jump:
64192 Lowest address of installed RAM. 64430 Start of DO files. 64432 Start of index for CO files. 64434 Start of Variable table. 64436 Start of Array table. 64438 The first available byte in RAM.
______________________________________________________________________________________________________________________________
Address 65451 returns a non ASCII value for the last key pressed and it is also first address in the type-ahead buffer
which uses the odd addresses from 65451 to 65493.
End
Return to Web 100