› ›

Hacking the ZX Spectrum 48K ROM

repetto74repetto74
in Hardware
Hi Guys,

I have modded my Speccy with a dual boot ROM loading on first bank the original ZX kernel and on the second bank an enhanced version. I have modified already the welcome message at the prompt with an hex editor but I would like for example to change the border and paper colour at startup or any other nice trick. Is that possible and where do I need to look at?
Thanks,
Rick

Comments

  • GReWGReW
    The initial border colour is set during the NEW routine at 
    11CC:	LD A,$07
    So changing the byte at 11CD will set the initial border colour. However, for the border to keep that colour after any sound or tape access, you also need to set the appropriate system variables; which are set later in the NEW routine: 
    1265:	LD A,$38	
1267:	LD ($5C8D),A
126A:	LD ($5C8F),A
126D:	LD ($5C48),A
    As you can see, the ATTR-T, ATTR-P and BORDER variables are all initialised to the same value. Since only bits 3-5 of BORDER are relevant; and ATTR-T and ATTR-P use the standard attribute byte format, you can't easily have the border and paper as different colours without changing the length of the routine.

    So, for example to change the default colours to bright yellow ink on blue paper, with a blue border, change the following bytes: 
    11CD <-- $01
1266 <-- $4E
    Comp.Sys.Sinclair Crap Games Competition 2017
    Everyone has a crap game inside them, let yours out!
  • repetto74repetto74
    Hi GRew,

    Thanks a lot for the explanation :-). I will look at this closely. Actually each memory address of the rom is filled with HEX instructions of course so I need to understand exactly what is what :-).
    As far as I understand each colour has a value ranging from $01($00?) to $07.
  • GReWGReW
    edited November 2017
    repetto74 wrote: »
    Hi GRew,
    Actually each memory address of the rom is filled with HEX instructions of course so I need to understand exactly what is what :-).

    If you're going to hack the ROM, I'd recommend having a read through the ROM disassembly, particularly as the ROM is coded for space efficiency rather than being easy to modify. Obviously you can't modify it too much if you want to maintain compatibility with software, you certainly wouldn't want to start moving routines around in memory for example. If you're careful you won't cause problems just by changing initial attribute values except possibly any games that use the ROM as data.
    repetto74 wrote: »
    As far as I understand each colour has a value ranging from $01($00?) to $07.
    That's correct.
    In the routines I listed above, the initial border colour is set using a single colour: 
    0 = BLACK
1 = BLUE
2 = RED
3 = MAGENTA
4 = GREEN
5 = CYAN
6 = YELLOW
7 = WHITE
    For the BORDER, P-ATTR and T-ATTR system variables; the flash, bright, paper and ink are packed into the same byte: 
    Bit 7: Flash
Bit 6: Bright
Bits 5-3: Paper
Bits 2-0: Ink

    The other most obvious cosmetic change would be a custom character set; which you can insert into the ROM as a 768 byte (96 characters of 8 rows each) from $3D00.

    For something more minor you can tweak the initial memory test routine to fill memory with $FE instead of $02 and test on increments instead of decrements; the routine still works as before but it fills the screen with flashing yellow and white stripes instead of the familiar red on black: 
    11DD: FE
11E9: 34
11EC: 34

    Post edited by GReW on
    Comp.Sys.Sinclair Crap Games Competition 2017
    Everyone has a crap game inside them, let yours out!
  • repetto74repetto74
    Hi GReW,
    I am a noob sorry ^-^. This is what I see at address 11CD for example with the HEX editor

    https://ibb.co/hcFmtG

    Looks a long string of HEX data. (??)
  • Ast_A_MooreAst_A_Moore
    God almighty, @repetto74! Use Hex Fiend.
    repetto74 wrote: »
    This is what I see at address 11CD for example with the HEX editor
    Looks a long string of HEX data. (??)
    What else did you expect to see with a hex editor? The data displayed is correct. It displays the value 0x3e at address 0x11cc, which is the opcode for the Z80 instruction LD A,n, where n is the immediate load number, fetched by the Z80 from the next address up. In this case, the value at the next address (0x11cd) is 07. After decoding, the Z80 will execute LD A,7.

    15hbrrc.png
    Every man should plant a tree, build a house, and write a ZX Spectrum game.

    Author of A Yankee in Iraq, a 50 fps shoot-’em-up—the first game to utilize the floating bus on the +2A/+3,
    and zasm Z80 Assembler syntax highlighter.
    Member of the team that discovered, analyzed, and detailed the floating bus behavior on the ZX Spectrum +2A/+3.

    A few Spectrum game fixes.
  • Ast_A_MooreAst_A_Moore
    Just to clarity (forgive me, if I’m taking your “I am a noob” too literally). A hex editor is not a disassembler. It will display any file you throw at it as a “string of hex data.” That’s what its sole purpose is. The link GReW gave you does contain the disassembly of the Spectrum ROM. Moreover, it’s the most comprehensive and profusely commented disassembly you can find. Using it, as well as a list of Z80 opcodes, as a reference, you can make appropriate changes in the ROM file with a hex editor.

    Depending on your level of knowledge, you might also want to familiarize yourself with how the Z80 fetches and executes instructions, especially multibyte ones (e.g. low/high byte order), so you don’t get confused by, say, LD BC,$1234 represented as 01 34 12, rather than 01 12 34.
    Every man should plant a tree, build a house, and write a ZX Spectrum game.

    Author of A Yankee in Iraq, a 50 fps shoot-’em-up—the first game to utilize the floating bus on the +2A/+3,
    and zasm Z80 Assembler syntax highlighter.
    Member of the team that discovered, analyzed, and detailed the floating bus behavior on the ZX Spectrum +2A/+3.

    A few Spectrum game fixes.
  • repetto74repetto74
    Hi Ast_A_Moore,

    Actually I do have a basic knowledge of ML instructions for the 6502 processor but none for the Z80 so in that area yes I am a total noob. Also I always worked with an assembler when coding and never used an HEX editor to modify a code but only to program eproms or limited to text mod (for example the ZX Prompt welcome message which is visible in the ASCII section of the editor) :-D
    I need to get more into the Z80 to better understand :-) and also have a better knowledge on how to decode instructions as seen from the HEx editor ;-)
    I will give a try to GreW advices and see what happens :-)
    Thanks
    Rick
  • Ast_A_MooreAst_A_Moore
    No worries, Rick. It’s just difficult to make correct assumptions from limited information.

    Do give Hex Fiend a try (no need to launch Wine when there’s a great native macOS hex editor available.) And if you ever feel like coding in assembly for the Z80 (and the Spectrum), check out the second link in my signature.

    You could also use a disassembler (such as z80dasm, for instance), of course, but then you’ll need to assemble the modified code and save it as a .bin file. Not too difficult and perhaps a little less error prone. The only problem is you’ll have to define entry points for each chunk of code/data, so for making small changes, a hex editor is probably the best choice.
    Every man should plant a tree, build a house, and write a ZX Spectrum game.

    Author of A Yankee in Iraq, a 50 fps shoot-’em-up—the first game to utilize the floating bus on the +2A/+3,
    and zasm Z80 Assembler syntax highlighter.
    Member of the team that discovered, analyzed, and detailed the floating bus behavior on the ZX Spectrum +2A/+3.

    A few Spectrum game fixes.
  • GReWGReW
    edited November 2017
    repetto74 wrote: »
    Hi GReW,
    Looks a long string of HEX data. (??)
    In an 8-bit CPU (like the Z80, 6502 etc) each memory location holds a number from 0 - 255 ($00 to $FF). The long string of HEX data highlighted actually shows 16 consecutive memory locations. I think you're misunderstanding the column and row labels in your hex editor.

    The row labels are showing the address to rounded down to the nearest 16 ($10); and the column labels are showing the offsets from 0 to 15 ($00 to $0F), to get the address of a particular byte, add the column label to the row label.

    So location $11CC contains $3E (which is the Z80 opcode for LD A,nn); while $11CD contains $07 (the operand for the LD A,nn instruction, ie. the "nn"; in this case representing the colour code for white).


    Post edited by GReW on
    Comp.Sys.Sinclair Crap Games Competition 2017
    Everyone has a crap game inside them, let yours out!
  • repetto74repetto74
    Hi,

    Thanks to both of you for this clear explanation :-D. I had no idea really on how to read out the ROM content from an HEX editor and now it makes sense of course :-)
  • colonel32colonel32
    edited November 2017
    Good stuff. Stick with it Rick! It wil come quickly enough if you've used 6502. In some respects Z80 has a very different feel, as it's got far more registers and far less addressing modes. And of course the mnemonics are different. But in other respects it's pretty darn similar.

    It might also be fun to use an emulator and put breakpoints on those addresses in the emulator's debugger, then you can step through the startup sequence and follow along, relating it to the disassembly on the website, and also to your hex editor display.
    Post edited by colonel32 on
    Robin Verhagen-Guest
    SevenFFF / Threetwosevensixseven / colonel32
    NXtel • NXTP • ESP Update • ESP Reset • CSpect Plugins
  • colonel32colonel32
    edited November 2017
    This is Zeus stepping through the Skoolkit ROM disassembly:

    zeus-rom-1.png?dl=0

    zeus-rom-2.png?dl=0

    Zeus run nicely under Wine on Macs.
    Post edited by colonel32 on
    Robin Verhagen-Guest
    SevenFFF / Threetwosevensixseven / colonel32
    NXtel • NXTP • ESP Update • ESP Reset • CSpect Plugins
  • repetto74repetto74
    Hi Colonel32

    Zeus OMG this is the one I will definitely grab! :-). Thanks a lot!
  • ClaudiusClaudius
    If you are after a good ZX Spectrum simulator under OSX, have a look there ZXSP
  • Ast_A_MooreAst_A_Moore
    zxsp is good, but Günter hasn’t been working on it for quite some time. He’s all into zasm nowadays. ;)
    Every man should plant a tree, build a house, and write a ZX Spectrum game.

    Author of A Yankee in Iraq, a 50 fps shoot-’em-up—the first game to utilize the floating bus on the +2A/+3,
    and zasm Z80 Assembler syntax highlighter.
    Member of the team that discovered, analyzed, and detailed the floating bus behavior on the ZX Spectrum +2A/+3.

    A few Spectrum game fixes.
  • John ElliottJohn Elliott
    Here's a ROM mod that makes the cursor blue and white, and the error cursor red and white, to match the 128: 
    Address	Value
0025	D9
0026	18
0027	03
002B	2A
002C	8F
002D	5C
002E	18
002F	2F
005F	E5
0060	21
0061	D7	;Attribute for error cursor
0062	00
0063	C3
0064	CA
0065	18
189F	25
18A0	00
18C6	21
18C7	CF	;Attribute for normal cursor
18C8	00
18C9	00
Sign In or Register to comment.