Newsgroups: comp.sys.apple2 Path: news.weeg.uiowa.edu!news.uiowa.edu!hobbes.physics.uiowa.edu!math.ohio-state.edu!cs.utexas.edu!uunet!zib-berlin.de!news.belwue.de!news.uni-ulm.de!rz.uni-karlsruhe.de!stepsun.uni-kl.de!uklirb!sylt!koch From: koch@sylt.informatik.uni-kl.de (Peter Koch - DA Gesmann) Subject: PATCHES for ProDOS 1.0.1 and 1.0.2 Message-ID: Sender: news@uklirb.informatik.uni-kl.de (Unix-News-System) Nntp-Posting-Host: sylt.informatik.uni-kl.de Organization: University of Kaiserslautern, Germany Date: Sat, 4 Dec 1993 08:42:11 GMT Lines: 156 Hi! A few people asked me, if i could post the patches for 48k ProDOS. I've checked some old Apple magazines and Arne Schaerpers book "ProDOS-Analyse". I don't know, if these were available outside Germany, but i doubt it; therefore i'll give a summary now. But before i do that, i have to announce, that these patches are provided AS IS, without any warranty. #include The patches are described for ProDOS 1.0.1. They can be applied to Prodos 1.0.2 too, but some of the adresses have moved slightly. Simply add 12 ($000C) to every address above $E94B. ProDOS 1.1.1 can't boot with 48k any more, but the other bugs described below are present too. ProDOS 1.1.1 is completely reassembled, and this scrambles all adresses. Therfore i'll not give the patches for 1.1.1. 1. Patch for 48k These old ProDOS versions have a relocater, which allows them to run with only 48k of memory. To accomplish correct relocation even if adresses are loaded into zero-page registers, these adresses aren't loaded with LDA #$F6 immediate, but from a already relocated address, for example: LDA $D82A, while $D828 contains a LDA $F602. At two positions, the programmer's of ProDOS have forgotten to do so and without a patch, ProDOS refuse to work with 48k!!! Do NOT use ProDOS with 48k without these patches. It destroys the volume bit map of your disks. Not many programs will run with 48k, but EXER.SYSTEM does. Unfortunately, BASIC.SYSTEM won't run. D57D- A9 F6 LDA #$F6 <--- here D57F- 85 49 STA $49 D581- A9 04 LDA #$04 and D692- A9 F6 LDA #$F6 <--- here D694- 85 49 STA $49 D696 A9 04 LDA #$04 Simply replace the $F6 at $D57E and $D693 with $B6. 2. Patches for bugs in ProDOS 1.0.1 and 1.0.2 2.1 The command handler for the READ and WRITE call doesn't check, if addresses above $BFFF are used. If you do so, ProDOS will happlily bomb itself, because the language card is write enabled all the time :-) D0C8- E8 INX D0C9- 20 89 EE JSR $EE89 <--- here D0CC B0 08 BCS $D0D6 The JSR to $EE89 isn't correct; it jumps BEHIND the test for >$BFFF. Replace $D0C8-$D0CB with $EA $20 $84 $EE giving D0C8- EA NOP D0C9- 20 89 EE JSR $EE84 2.2 The error exit for SET FILE DATA invalidates the file reference number, but with the wrong command :-) This bug is totally redundant; the reference number is already invalid and the wrong command bombs only the MLI scrtatchpad area (which is freshly set up for every MLI-call). D421- A9 00 LDA #$00 D423- 99 52 F0 STA $F052,Y <--- here D426- A9 43 LDA #$43 D428- 38 SEC D429- 60 RTS The programmer has intermixed the FCB-index with the FCB-base pointer. Replace $D424-$D425 with $00 $F3 giving D423- 99 00 F3 STA $F300,Y 2.3 The error exit in SET MARK tries to set the file reference number too. It looks like: DE6D- A0 52 LDY #$52 <-- here DE6F- 99 00 F3 STA $F300,Y DE72- A9 43 LDA #$43 DE74- 38 SEC DE75- 60 RTS Obviously, there slipped a # into the assember file of ProDOS. Correct is a LDY $F052. Change $DE6D-$DE75 to $AC $52 $F0 $99 $00 $F3 $4C $26 $D4. This gives: DE6D- AC 52 F0 LDY $F052 DE70- 99 00 F3 STA $F300,Y DE73- 4C 26 D4 JMP $D426 $D426 is the remainder of the error exit for SET FILE DATA. It does the necessary LDA #$43 SEC RTS. This bug can destroy data on your disk. If you have 4 open files and this error occurs, some bytes are misplaced in the written file resulting in damage or loss of data. 2.4 Bug in SEEKABS (RWTB for Disk ][) If SEEKABS finds, that it is already on the desired track, it jumps incorrectly into the arm mover and enables one of the four phases. After that, it returns to the MYSEEK routine, which disables all phases (phew!!!). This is not a serious bug. F931- 18 CLC F932- 60 RTS F933- 8D 72 FB STA $FB72 F936- CD 5A FB CMP $FB5A F939- F0 4C BEQ $F987 <--- here Correct would be a jump to the next CLC RTS (right before): F939- F0 F6 BEQ $F931 2.5 Two addresses of the MLI scratchpad area are used twice: $F0B5 and $F0B6. First, they are used for indirect jumps. Second, they are used as scratch area for the interrupt!!! If a interrupt arrives, while $F0B5/B6 has set up, but the indirect JMP ($F0B5) hasn't been performed, then this could happen: If there isn't enough space on the stack, 16 bytes are popped and stored at locations $F0AF-$F0BE destroying the original address. If the interrupt is finished and the normal execution continues, the JMP ($F0B5) will go into never-never land. This is the main reason, why you shouldn't use these old ProDOS versions with a super serial or mouse card. The addresses $F0A5 and $F0A6 are free and can be used for this purpose: D24D: A5 D253: A6 D27C: 6C A5 F0 D0E8: A5 D0EE: A6 D0F0: 6C A5 F0 Peter (koch@informatik.uni-kl.de) -- @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Peter Koch, Universitaet Kaiserslautern (AG Haerder, Raum 36/318) Postfach 3049, 67653 Kaiserslautern (Germany) @@@@@@@@@@@@@@@@@@ koch@informatik.uni-kl.de @@@@@@@@@@@@@@@@@@