Hacking my KTM2 (6507)

From: Dwight K. Elvey <dwightk.elvey_at_amd.com>
Date: Mon Mar 17 17:28:00 2003

Hi
 I've been disassembling the code for the KTM2 keyboard.
I see now how they generate the various sync signals.
The 6507 uses address line A0 to A9. A10 to A12 can
be used for various strobes. Jumping to these addresses
with different values fro A10 to A12 cause no change
in the code executed but effect the video.
 A8 is used as a ROM select and A9 is used for A8 in the
ROM. This way, the code maps into the first two 256 byte
blocks of the ROM but the addresses look like 1xxH and
3xxH. They chose 1xxH because they do no subroutines
but use the TXS and RTS to execute strings of addresses
( a little like a Forth engine does ).
 Now, as I've been disassembling the code, I've found some
funny looking code. It causes difficulty for my disassembler.
Here is a chunk of what I found. It sure looks like someone
was on something when they did it. I suspect that it was
to adjust the execution times to be equal, regardless
of the result but I thought I'd pass it on and someone
could explain how it worked.

F1E2 03E2 5001 BVC L014 ; 03E5
F1E4 03E4 2A ROL A
F1E5 03E5 L014: ; 1
F1E5 03E5 3002 BMI L015 ; 03E9
F1E5 03E7 F0 DB F0 ; note this could have been
                              ; F04C BEQ ...
F1E8 03E8 L017: ; 1
F1E8 03E8 4CF00D JMP L021 ; 0DF0 ; You can see that my
                                       ; disassembler loses it here
F1E9 03E9 L015: ; 1
F1E9 03E9 F00D BEQ L016 ; 03F8
F1EB 03EB 30FB BMI L017 ; 03E8
F1ED 03ED 4CF50D JMP L018 ; 0DF5

Anyway, it is a screwy piece of code?? The addresses at the
front of the line are the ROM addresses. The next col is
what the 6507 thinks it is addressing. You'll note that I'd
dropped any high order bits above A9 since they don't effect
flow, only the strobe lines( see L021 above really goes to 1F0H ).
Dwight
Received on Mon Mar 17 2003 - 17:28:00 GMT