Re: Start address of unknown ROMs and cartridges

From: Mike Naberezny <>
Date: Wed, 2 Nov 2016 11:50:30 -0700
Message-ID: <>
On 10/31/16 11:55 PM, Baltissen, GJPAA (Ruud) wrote:
> So, Mike, how did you find out that it was 37000? If you look at the BIN
> and see that the first bytes are a copyright text, It is obvious to start
> with the code behind that text. But 37000? I just hope there is a trick
> involved we all can learn from.

I disassembled the ROM using da65.  Its output includes labels for locations 
accessed by the code.  I looked for familiar addresses.  There was a label for 
$70, which is the CHRGET routine in RAM.  BASIC wedges patch this routine, so 
I knew the ROM was some kind of wedge.

I looked for where the ROM writes to $70+ to install its CHRGET patch.  I 
found it at $9088 and below it at $9094 was the code to print the banner. 
$9088 makes the nice decimal number in SYS 37000 so I figured that was it. 
The MONJANA/1 ROM uses a similarly nice number; it starts with SYS 38000.

>> but requires BASIC 2 (won't work on BASIC 4).
> I assume you found this out by putting the ROM in a 8032 as well?

I tried SYS 37000 on a 2001 with BASIC 2 and it worked.  I then tried it on an 
8032 and it crashed.  Since the 8032 has BASIC 4, I thought it might be a 
difference between BASIC 2 and 4.  I went back to the disassembly and looked 
for calls into the BASIC ROM area.  I looked up a few of them in "Programming 
the PET/CBM" by Raeto West.  That book has a map of BASIC routines and their 
addresses in BASIC 1, 2, and 4.  One of the calls was to $C9E2, which only 
works on BASIC 2.


Mike Naberezny (

       Message was sent through the cbm-hackers mailing list
Received on 2016-11-02 19:00:02

Archive generated by hypermail 2.2.0.