Re: creating a new Apple IIgs ROM 03 checksum

[Michael J. Mahon <mjmahon@aol.com>]

retrogear <larrygr510@gmail.com> wrote:
> With the hopes of someday producing a ROM 03 source which could be
> modified, I decided to embark on the issue of how to create a new ROM
> checksum. What is required from Apple is the checksum must equal a magic
> value of $1234. A fudge value called 'tweak' is placed at address FF/FFF6
> to make the sum = $1234. I figured if I could do a checksum and skip the
> tweak then use a little algebra I could come up with a new tweak value. I
> derived the following subroutine from the checksum diagnostics source. It
> does a checksum calculation without the tweak value then calculates:
> tweak = $1234 - checksum. I reassembled the gsport emulator to not do any
> ROM patches, then ran my subroutine which returned the value $6250 which
> is the tweak value in the ROM !!! Verify with FF/FFF6.FFF7
> returns FF/FFF6: 50 62.  Here is the routine in Orca/m :
> 
>  	keep	checksum
> 	mcopy	prodos.mac
> 
> * this subroutine does a ROM 03 checksum calculation to determine
> * a 'tweak' value to place in ROM location $FF/FFF6.FFF7 which
> * will certify this ROM to pass onboard ROM diagnostics.
> * to be certified, the checksum of this ROM should = $1234
> 
> checksum	start
> 
> tweak	equ	$FFF6	;tweak value address
> 
> 	clc
> 	xce		;full native mode
> 	long	i,m
> 	longa	on
> 	longi	on
> 	lda	#0
> 	sta	chksum	;reset checksum
> 	pea	$FCFC	;start with bank $FC
> 	plb
> 	plb
> 	ldy	#$FFFF
> 	jsr	chksum1	;do checksum of bank $FC
> 	pea	$FDFD	;bank $FD
> 	plb
> 	plb
> 	dey
> 	jsr	chksum2	;do checksum of bank $FD
> 	pea	$FEFE                    ;bank $FE
> 	plb
> 	plb
> 	dey
> 	jsr	chksum2	;do checksum of bank $FE
> 	pea	$FFFF                    ;bank $FF
> 	plb
> 	plb
> 	dey
> 	jsr	chksum3	;do checksum of bank $FF
> 	pea	$0000
> 	plb
> 	plb
> 	sta	chksum                   ;ROM checksum minus 'tweak'
> 	lda	#$1234	;certified checksum from Apple
> 	sbc	chksum	;carry is pre-conditioned
> 	sta	chksum                   ;new tweak = $1234 minus checksum
> 	rtl                            ;return to caller
> chksum1	lda	#$0000
> 	clc
> chksum2	dey
> nxtchk	adc	($FD),y
> 	dey
> 	beq	chkend
> 	dey
> 	bne	nxtchk
> chkend	adc	($FD),y
> 	rts
> chksum3	dey
> ffnxtchk	php		;need to preserve carry flag
> 	cpy	#tweak	;check for tweak address
> 	bne	noskip
> 	plp		;restore carry
> 	bra	skip                     ;skip adding tweak into checksum
> noskip	plp		;restore carry
> 	adc	($FD),y
> skip	dey
> 	beq	ffchkend
> 	dey
> 	bne	ffnxtchk
> ffchkend	adc	($FD),y
> 	rts		;returns w/conditioned carry
> 
> chksum	ds	2	;will contain the new tweak value
> 
> 	end

This is essentially the same approach I took in creating the NadaBoot
ROM(s) for AppleCrate machines. 

Just once, load the original ROM file and compute its checksum, then for
each modification:

1. Load the new ROM file, with zero "twiddle"
2. Compute the checksum
3. Subtract new checksum from original ROM checksum
4. Poke difference into "twiddle"
5. Re-checksum to verify same as original

Of course, the "twiddle" value can be any unused location within the ROM. 

-michael - NadaNet 3.1 and AppleCrate II: http://home.comcast.net/~mjmahon