ICE 128 V0.2, a follow-up on the Poor Man's 64mode freezer !

Ice.128 v0.2 (ROM modifications) by XmikeX - 5 November 2018 - a work in progress !
csdb.dk/release/?id=171067
**

This ROM modification adds the following to your Commodore 128; some mods may not work under all circumstances.

~~~~ new Functions ~~~~
SKIPCART128 : Integrates the Skipcart128 mod which allows you to choose whether or not C-64 Cartridge boots.
ML Monitor Print: adds commands 'p' to print ml monitor output at device #4, and 'q' to clear the device channel after using 'p'
REU Unlimited : BASIC commands involving the REU can now use entire 16 MB REU potential
Key Expansion : RUN/STOP and HELP have been added to the redefinable key command and key list
New EasterEgg : activate with SYS32800,123,45,6 - tiny 'splash' screen of sorts !

~~~~ new BASIC Commands, ICE and TERM ~~~~
ICE : Alt-RAM C-64 freezer, sets up c64-mode in alt-ramblock via MMU, for data-snapshot via reset back to 128mode
TERMinl : Simple Userport terminal, baudrate setting @ $0B00 - default 300 baud (may conflict with tape access/autoboot block)


ROMs involved : basiclo, basichi, kernal - no internal / external function ROMs are involved



Thread on prior ICE version : c-128.freeforums.net/thread/622/poor-mans-64mode-freezer-cart
Thread on EasterEgg Tool : c-128.freeforums.net/thread/618/rom-generator-replacing-easteregg-nodejs

** Changes from CBM (c) 1986 AD Commodore 128 ROMs listed below **

; basiclo ROM modications
>f46a9 54 45 52 cd 53 54 41 53:terMstas ; replace quiT with terM
>f46b9 53 57 41 d0 49 43 c5 46:swaPicEf ; replace ofF with icE

>f47c6 73 fc 1e aa 00 00 23 aa ; chance TERM command JSR pointer to (TERM routine) at $fc74 minus one.
>f47d2 48 cf b2 77 c3 77 65 8c ; change ICE command JSR pointer to (ICE routine) at $cf49 minus one.

>f60e4 ca e0 0a 90 03 4c 28 7d
>f617c a6 77 e0 0a d0 a3 60 a6

. f60e4  ca       dex
. f60e5  e0 0a    cpx #$0a ; changed from #$08, allows manipulation of all ten function keys, instead of eight.
. f60e7  90 03    bcc $60ec

. f617c  a6 77    ldx $77
. f617e  e0 0a    cpx #$0a ; change from #$08, allows manipulation of all ten function keys, instead of eight.
. f6180  d0 a3    bne $6125


; basichi ROM modifications
>faa53 0c ea ea ea 20 45 a8 8e
>fb006 4c ca fc 20 7d ff 0d 42

. faa53  0c       SKW ; SKIP-WORD, absolute addressing (illegal op 0C) . 4 cycles, saves us 2 cycles here.
; works like this - READ $EAEA and don't store to register or mem
; after this null read by SKW, the program counter will then be on $aa56
. faa54  ea       nop ; originally cpx #$10 | bcs $aa65 -- this limited REU banks from 0 to 15.
. faa55  ea       nop ; by removing this check on X, all 0-255 expansion REU banks are available from BASIC.
; e.g., stash 1024,1024,0,255
. faa56  ea       nop ; SKIP-WORD continues here

. fb006  4c ca fc jmp $fcca ; changed from $b0b2, points to $fcca 'p' and 'q' extension patch for ml monitor


>>> old easteregg ( SYS 32800,123,45,6 ) replaced by new one

10 rem this program reads easteregg from ROM, decrypts to plaintext, saves to memory at $1300 and dumps egg as char/hexbyte strings
20 lc=4863:fori=1to155:x=i:y=peek(44643+i):x=xor(x,y):a=xor(y,x):y=123:x=xor(x,y):y=0:a=xor(y,x):rem y=0 for plaintext
30 printchr$(x);:pokelc+i,a:nexti:print:print
40 a$="":fori=1to155:cc=cc+1:x=peek(lc+i):x$=right$(hex$(x),2)
50 print using "##";x$;:next
60 print:end

; hexstring output from BASIC program above can be fed into my easteregg patcher,
; available as a nodeJS script at - https://csdb.dk/release/?id=170660
; after you feed it the raw uncrypted hexbytes, this script will generate a new basichi ROM
; for you with the hexbytes crypted and patched in the proper spot,

raw uncrypted hexbytes of easteregg replacement, manually edited at $1300 for (in)convenience
>f1300 93 0e 9f ec b8 b8 b8 b8:...LXXXX
>f1308 b8 b8 b8 b8 b8 b8 b8 b8:XXXXXXXX
>f1310 b8 b8 b8 b8 b8 b8 b8 9a:XXXXXXX.
>f1318 bf 0d 9f a1 c9 c3 c5 20:...AICE
>f1320 56 30 2e 32 20 20 20 20:v0.2
>f1328 20 96 d8 4d 49 4b 45 d8: .XmikeX
>f1330 0d 9f a1 20 20 20 30 35:..A   05
>f1338 20 4e 4f 56 20 32 30 31: nov 201
>f1340 38 0d 9f a1 0d 9f a1 12:8..A..A.
>f1348 c9 c3 c5 20 c1 4c 54 2d:ICE Alt-
>f1350 d2 c1 cd 20 c6 52 45 45:RAM Free
>f1358 5a 45 52 92 0d 9f a1 12:zer...A.
>f1360 d4 c5 d2 cd 49 4e 4c 92:TERMinl.
>f1368 0d 9f a1 0d 9f a1 9e 41:..A..A.a
>f1370 4e 44 20 4f 54 48 45 52:nd other
>f1378 20 4d 49 4e 4f 52 20 45: minor e
>f1380 4e 48 41 4e 43 45 4d 45:nhanceme
>f1388 4e 54 53 92 0d 9f a1 0d:nts...A.
>f1390 9f a1 c3 d3 c4 42 0d 9a:.ACSDb..
>f1398 bf 99 0d

these hexbytes above are as follows, seen in series:
930e9fecb8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b8b89abf0d9fa1c9c3c52056302e32202020202096d84d494b45d80d9fa12020203035204e4f5620323031380d9fa10d9fa112c9c3c520c14c542dd2c1cd20c65245455a4552920d9fa112d4c5d2cd494e4c920d9fa10d9fa19e414e44204f54484552204d494e4f5220454e48414e43454d454e5453920d9fa10d9fa1c3d3c4420d9abf990d

they are crypted into the following series of hexbytes and these replace the original easteregg in rom
e977e793c6c5c4cbcac9c8cfcecdccd3d2d1d0d7d6d5d4f9dd6cffc6afa6a17b0c69766d7e7d7c7372c7881a1f1e119347d6e96f6e6d7c76620f0f116677740a0234a79e33a29d21fbf2f517f7796006f8e8e50fe87f6966786472b52bba8509cedccad2575350811f8eb11a89b48a4a444d28405a454951224c4949495724beb4b1b9b1bdb8b1b6bca5a365fb6a55e675482b3c2aafe1795d78ed

>fae64 e9 77 e7 93 c6 c5 c4 cb:IWG.FEDK
>fae6c ca c9 c8 cf ce cd cc d3:JIHONMLS
>fae74 d2 d1 d0 d7 d6 d5 d4 f9:RQPWVUTY
>fae7c dd 6c ff c6 af a6 a1 7b:.L.FOFA.
>fae84 0c 69 76 6d 7e 7d 7c 73:.IVM...S
>fae8c 72 c7 88 1a 1f 1e 11 93:RG......
>fae94 47 d6 e9 6f 6e 6d 7c 76:gVIONM.V
>fae9c 62 0f 0f 11 66 77 74 0a:B...FWT.
>faea4 02 34 a7 9e 33 a2 9d 21:.4G.3B.!
>faeac fb f2 f5 17 f7 79 60 06:.RU.WY..
>faeb4 f8 e8 e5 0f e8 7f 69 66:XHE.H.IF
>faebc 78 64 72 b5 2b ba 85 09:XDRU+Z..
>faec4 ce dc ca d2 57 53 50 81:N.JRwsp.
>faecc 1f 8e b1 1a 89 b4 8a 4a:..Q..T.j
>faed4 44 4d 28 40 5a 45 49 51:dm(@zeiq
>faedc 22 4c 49 49 49 57 24 be:"liiiw$.
>faee4 b4 b1 b9 b1 bd b8 b1 b6:TQYQ.XQV
>faeec bc a5 a3 65 fb 6a 55 e6:.ECE.JuF
>faef4 75 48 2b 3c 2a af e1 79:Uh+<*OAY
>faefc 5d 78 ed               :]XM


; kernal ROM modifications
>fcf19 ad 05 d5 29 30 c9 30 f0 ; this is the ** skipcart128 mod ** .. 8502 kernalside
>fcf21 21 20 84 ff 20 87 ff 20
>fcf29 8a ff 20 81 ff a2 00 bd
>fcf31 ca fe f0 06 20 d2 ff e8
>fcf39 d0 f5 58 20 cf ff c9 59
>fcf41 f0 03 4c 6b e2 4c 4b e2

>fd052 18 05 ; skipcart128 mod .. Z80 BootROM

>fe242 20 9e cf ea ea ea 4c 19 ; skipcart128 mod .. 8502 kernalside
>fe24a cf

. fcf19  ad 05 d5 lda $d505 ; consult with the MMU BitSwitch Guide ( https://pastebin.com/Wh2EKdwt )
. fcf1c  29 30    and #$30 ; testing for /GAME and /EXROM from cart port
. fcf1e  c9 30    cmp #$30
. fcf20  f0 21    beq $cf43 ; if result from and/cmp is zero, then no 64 cart present, branch to c128-mode init
. fcf22  20 84 ff jsr $ff84 ; kernal JIOINIT routine
. fcf25  20 87 ff jsr $ff87 ; kernal JRAMTAS routine
. fcf28  20 8a ff jsr $ff8a ; kernal JRESTOR routine
. fcf2b  20 81 ff jsr $ff81 ; kernal JCINT routine
. fcf2e  a2 00    ldx #$00
. fcf30  bd ca fe lda $feca,x ; collect data at $feca for printout by $ffd2 kernal BSOUT routine
. fcf33  f0 06    beq $cf3b
. fcf35  20 d2 ff jsr $ffd2 ; prints out the data from $fe93 onwards
. fcf38  e8       inx
. fcf39  d0 f5    bne $cf30
. fcf3b  58       cli
. fcf3c  20 cf ff jsr $ffcf ; re-enable IRQs - needed for keyboard input @ BASIN routine ($ffcf)
. fcf3f  c9 59    cmp #$59 ; "y" from keyboard .. BASIN will accept "y" followed by other chars.. so "yes" will work
. fcf41  f0 03    beq $cf46 ; branch to c64-mode jump on at least "y"
. fcf43  4c 6b e2 jmp $e26b ; init 128 mode below .. fallthrough from top or keyboard input something other than y
. fcf46  4c 4b e2 jmp $e24b ; init c64 mode below .. keyboard input was at least y

. fd052  18 05    jr $0059 ; Z80 bootrom - skip c64-mode switch code, only z80 can see this segment (at $0052)

. fe242  20 9e cf jsr $cf9e ; jsr to new mini-jump table to point to new routines on bootup (future expansion)
. fe245  ea       nop ; nops reserved for future expansion
. fe246  ea       nop
. fe247  ea       nop
. fe248  4c 19 cf jmp $cf19 ; 8502 kernalside, jump straight into skipcart128 mod code on bootup



>fcf49 78 a2 00 bd 93 fe f0 06 ; this is the ** ice128 alt-ram 64-mode freezer mod **
>fcf51 20 d2 ff e8 d0 f5 58 20
>fcf59 cf ff c9 59 f0 01 60 78
>fcf61 a9 40 8d 00 ff a2 01 8e
>fcf69 0a d5 8e 09 d5 8e 08 d5
>fcf71 ca 8e 07 d5 8d 06 d5 4c
>fcf79 4b e2 ff ff ff ff ff ; five #$FF freebytes until $cf80

; ICE Command Subroutine - setup code for c-128 as c-64 freezer option, MMU config, and switch to 64mode.
. fcf49  78       sei ; disable IRQs
. fcf4a  a2 00    ldx #$00
. fcf4c  bd 93 fe lda $fe93,x ; collect data at $fe93 for printout by $ffd2 kernal BSOUT routine
. fcf4f  f0 06    beq $cf57
. fcf51  20 d2 ff jsr $ffd2 ; prints out the data from $fe93 onwards
. fcf54  e8       inx
. fcf55  d0 f5    bne $cf4c
. fcf57  58       cli ; re-enable IRQs - needed for keyboard input @ BASIN routine ($ffcf)
. fcf58  20 cf ff jsr $ffcf ; BASIN routine for input, it waits for keyboard input and returns value in accumulator
. fcf5b  c9 59    cmp #$59 ; "y" from keyboard .. BASIN will accept "y" followed by other chars.. so "yes" will work
. fcf5d  f0 01    beq $cf60
. fcf5f  60       rts ; return from subroutine if user-input is anything but "y"...etc
. fcf60  78       sei ; disable IRQs out of paranoia - prepare 64mode with new MMU rambank freezer configuration
. fcf61  a9 40    lda #$40 ; consult with the MMU BitSwitch Guide ( https://pastebin.com/Wh2EKdwt ) for the segment below
. fcf63  8d 00 ff sta $ff00
. fcf66  a2 01    ldx #$01
. fcf68  8e 0a d5 stx $d50a
. fcf6b  8e 09 d5 stx $d509
. fcf6e  8e 08 d5 stx $d508
. fcf71  ca       dex
. fcf72  8e 07 d5 stx $d507
. fcf75  8d 06 d5 sta $d506
. fcf78  4c 4b e2 jmp $e24b ; jump to 64mode !


** mini jump table mod, points to new routines at bootup (future expansion)
>fcf9e 60 ff ff ff ff ff ff ff

. fcf9e  60       rts


>ffc74 a9 02 aa a8 20 ba ff a9 ; this is the ** TERMinl mod **, a simple userport terminal with
>ffc7c 02 a2 00 a0 0b 20 bd ff ; default 300 baudrate setting starting at $0B00.  This baudrate
>ffc84 20 c0 ff a2 00 bd 53 fe ; may be overwritted by use of tape or autobooting from disk
>ffc8c f0 06 20 d2 ff e8 d0 f5 ; it can be reset with POKE 2816,6 : POKE 2817,0 for 300 baud
>ffc94 20 b7 ff 29 08 d0 0b a2 ; or POKE 2816,8 : POKE 2717,0 for 1200 baud
>ffc9c 02 20 c6 ff 20 e4 ff 20
>ffca4 d2 ff 20 cc ff 20 e4 ff
>ffcac f0 e6 c9 1b f0 12 48 20
>ffcb4 d2 ff a2 02 20 c9 ff 68
>ffcbc 20 d2 ff 20 cc ff f0 d0
>ffcc4 a9 02 20 c3 ff 60

. ffc74  a9 02    lda #$02 ; same as OPEN 2,2,2 in BASIC
. ffc76  aa       tax
. ffc77  a8       tay
. ffc78  20 ba ff jsr $ffba ; kernal SETLFS routine
. ffc7b  a9 02    lda #$02 ; call up logical file #2 again
. ffc7d  a2 00    ldx #$00 ; tell the kernal routines that the
. ffc7f  a0 0b    ldy #$0b ; baudrate data starts at $0b00
. ffc81  20 bd ff jsr $ffbd ; kernal SETNAM routine
. ffc84  20 c0 ff jsr $ffc0 ; kernal OPEN routine
. ffc87  a2 00    ldx #$00
. ffc89  bd 53 fe lda $fe53,x ; collect data at $fe53 for printout by $ffd2 kernal BSOUT routine
. ffc8c  f0 06    beq $fc94
. ffc8e  20 d2 ff jsr $ffd2 ; kernal BSOUT prints out the data from $fe53 onwards
. ffc91  e8       inx
. ffc92  d0 f5    bne $fc89
. ffc94  20 b7 ff jsr $ffb7 ; kernal READSS routine
. ffc97  29 08    and #$08 ; checks for status bit 3 being set
. ffc99  d0 0b    bne $fca6 ; if yes, the character was not valid
. ffc9b  a2 02    ldx #$02
. ffc9d  20 c6 ff jsr $ffc6 ; kernal CHKIN routine
. ffca0  20 e4 ff jsr $ffe4 ; kernal GETIN routine (from device 2)
. ffca3  20 d2 ff jsr $ffd2 ; kernal BSOUT routine (to screen)
. ffca6  20 cc ff jsr $ffcc ; kernal CLRCH routine
. ffca9  20 e4 ff jsr $ffe4 ; kernal GETIN routine (from keyboard)
. ffcac  f0 e6    beq $fc94 ; branch back if no key was pressed
. ffcae  c9 1b    cmp #$1b ; check for ESC key from GETIN
. ffcb0  f0 12    beq $fcc4 ; if ESC key then jump to exit segment
. ffcb2  48       pha ; store GETIN character to stack
. ffcb3  20 d2 ff jsr $ffd2 ; kernal BSOUT routine (to screen)
. ffcb6  a2 02    ldx #$02
. ffcb8  20 c9 ff jsr $ffc9 ; kernal CKOUT routine
. ffcbb  68       pla ; retrive GETIN character from stack
. ffcbc  20 d2 ff jsr $ffd2 ; kernal BSOUT routine (to device 2)
. ffcbf  20 cc ff jsr $ffcc ; kernal CLRCH
. ffcc2  f0 d0    beq $fc94 ; branch back for another character
. ffcc4  a9 02    lda #$02 ; exit segment
. ffcc6  20 c3 ff jsr $ffc3 ; kernal CLOSE routine, close logical file #2
. ffcc9  60       rts ; return from subroutine


. ffcca  c9 51    cmp #$51 ; this is the ** ml monitor mod **, check charcode for 'q'
. ffccc  d0 0b    bne $fcd9
. ffcce  a9 04    lda #$04 ; if 'q', then ...
. ffcd0  20 c3 ff jsr $ffc3 ; kernal CLOSE routine, close logical file #4
. ffcd3  20 cc ff jsr $ffcc ; kernal CLRCH routine, restore normal I/O channels
. ffcd6  4c 8b b0 jmp $b08b ; return to monitor main loop
. ffcd9  c9 50    cmp #$50 ; check charcode for 'p'
. ffcdb  d0 17    bne $fcf4 ; if not 'p', branch to ml monitor command processing loop
. ffcdd  a9 04    lda #$04 ; if 'p', then OPEN 4,4,0 as in BASIC
. ffcdf  aa       tax
. ffce0  a0 00    ldy #$00
. ffce2  20 ba ff jsr $ffba ; kernal SETLFS routine
. ffce5  a9 00    lda #$00
. ffce7  20 bd ff jsr $ffbd ; kernal SETNAM routine
. ffcea  20 c0 ff jsr $ffc0 ; kernal OPEN routine
. ffced  a9 04    lda #$04 ; set logical file #4 for output
. ffcef  20 c9 ff jsr $ffc9 ; kernal CKOUT routine
. ffcf2  a9 44    lda #$44 ; change monitor command to 'd' (disassemble)
. ffcf4  4c b2 b0 jmp $b0b2 ; return to ml monitor command processing loop


; chardata for BSOUT
>ffe53 0d 0d 0e 2a 20 d5 53 45:...* Use
>ffe5b 52 50 4f 52 54 20 d4 45:rport Te
>ffe63 52 4d 49 4e 41 4c 20 2a:rminal *
>ffe6b 20 c2 41 55 44 52 41 54: Baudrat
>ffe73 45 20 40 20 24 30 c2 30:e @ $0B0
>ffe7b 30 20 2a 0d 2d 2d 20 c5:0 *.-- E
>ffe83 d3 c3 20 54 4f 20 d1 55:SC to Qu
>ffe8b 49 54 20 2d 2d 0d 0d 00:it --...
>ffe93 0d 0d 2a 20 44 45 50 4c:..* depl
>ffe9b 4f 59 20 43 2d 31 32 38:oy c-128
>ffea3 20 41 53 20 43 2d 36 34: as c-64
>ffeab 20 41 4c 54 2d 52 41 4d: alt-ram
>ffeb3 20 46 52 45 45 5a 45 52: freezer
>ffebb 20 2a 0d 0d 47 4f 20 49: *..go i
>ffec3 43 45 20 36 34 3f 00 2a:ce 64?.*
>ffecb 20 43 2d 36 34 20 43 41: c-64 ca
>ffed3 52 54 52 49 44 47 45 20:rtridge
>ffedb 44 45 54 45 43 54 45 44:detected
>ffee3 20 2f 47 41 4d 45 20 2f: /game /
>ffeeb 45 58 52 4f 4d 20 2a 0d:exrom *.
>ffef3 0d 47 4f 20 36 34 20 43:.go 64 c
>ffefb 41 52 54 3f 00         :art?.