$2000-$20ff: zero page zeo: $02 - $03 : a routine address than can be called from IRQ1 $04 - $05 : a routine address that can be called in Timer proc $06 - $07 : another routine address $d9: unknown $de-$df: unknown, GRP related pointer cache ? $e4-$e5: unknown, GRP related, word to keep the value of (_BX) set in GRP_FUNC0 restored in GRP_FUNC2 GRP paint stack ? $e6: unknown (zeo: default $8000 in system 2.0 us) $e7: unknown (zeo: could be sound related, upper bit related to "sound off?" [set to 0 by PSG_PLAY] and lower one related to "timer launched?") $e8-$e9: unknown (zeo: could be sound related) could even be the adress in mem of the sound stuff to play created from ($ea-$eb) and the current played 'frame' $ea-$eb: unknown (zeo: could be sound related) could even be the base adress in mem of the sound stuff to play (base address of the song, we add the offset of the current played 'frame' to know where is the actual data to read for the current note) $ec-$ed: unknown (VRAM address?) also used in DIV16S could be a temporary value $ef: unknown, PSG related (upper bit cleared in PSG_FUNC12) $f0-$f1 : appears to be sort of temporary values $f2: something to do with CD/ADPCM and interrupts (IRQ2)? $f3: VDP control low? $f4: VDP control high? $f5: some sort of IRQ flags $f6: unknown (VDP status?) $f7: unknown (cur VDP reg? [zeo : looks like]) $f8: _al $f9: _ah $fa: _bl $fb: _bh $fc: _cl $fd: _ch $fe: _dl $ff: _dh $2100-$21ff: stack page $2200-$3fff: ram $2200: a vector address (defaults to $e8e2) ( zeo : $e8f7 in system 2.0 us) $2202: a vector address $2204: a vector address $2206: a vector address $2208: a vector address $220a: a vector address ; there may be another vector at $220c $2215: unknown $2220: unknown $2221: unknown $2222: unknown $2223: unknown $2224: unknown $2225: unknown $2226: unknown $2227: unknown zeo: $2228-$222C: array of 5 values => current value of each joystick value $222D-$2231: array of 5 values => new dir or button pressed since last poll $2232-$2236: array of 5 values => last polled value of each joystick $2241: unknown (used in loop to wait for synchronisation, must be volatile and modified by IRQ [zeo]) $2242: unknown (VCE related ? zeo) : is used as scratch value for setting screen size and dotmod $2244: unknown (VCE related?) $2245: unknown $2246: unknown $2248: unknown $224c: CD command ID $224d-$2254: CD command buffer $2255: unknown (zeo: keep the value of _bh in CD_PLAY) $2247: unknown $2248: unknown (zeo: keep the value of _bh & 1 in CD_SEARCH) $224c: unknown //------------------ zeo: $224d-2254: command value, local variable since often set to zero ? $224d : saved place for al $224e : saved place for ah $224f : saved place for bl $2250 : saved place for bh zeo: $2250 : in mode 2-5 of reading, number of block to read $2251 : saved place for cl $2252 : saved place for ch $2253 : saved place for dl $2254 : saved place for dh $2250 (zeo: in cd_read, mode1, number of sector to read) ---------------// all of this stuff agree with the CD argument buffer hypothesis $2256-$225f: unknown (zeo : often used as temporary buffer) $225f: unknown (result code?) $2260-$2267: saved command registers? (zeo: yes) zeo: $2268: in reading function mode 2-5, number of the bank pointed before reading $2269: main code track (first found) (zeo) $226a: number of first CD track (zeo) $226b: number of last CD track (zeo) $226c: unknown $226d: unknown $226e: unknown $226f: unknown \ $2270: unknown > => ($226c-$226e) is copied here in CD_PLAY $2271: unknown / $2272: unknown (VDP mutex?) $2273: unknown (some sort of buffer index?) (gets multiplied by 3 in at least one routine) zeo: set to 0 if entering the reading routine at $ec05 for the first time for this reading else set to 1 if entering again for the same reading due to an error (maybe not error?), (system 3.0) cleared at the beginning of CD_READ and CD_SEEK (system 2.0) $2274: unknown (some sort of buffer?) \ $2275: unknown (some sort of buffer?) => number of the first sector of track 2 $2276: unknown (some sort of buffer?) / $2277: \ $2278: => could be the first sector of backup code track (zeo) $2279: / is initialized the same way as ($2274) value $227a: unknown (last CD status?) (zeo: almost, with 3 lesser bits off) $227b: unknown (zeo: seems to be the source of trouble in AD_TRANS ) $227c: unknown (zeo: store data from info_buf[2] in $f053 function) $227d: unknown (zeo: store data from info_buf[9] in $f053 function) $227e: subchannel data? $2280: unknown (zeo: in cd_read, mode1, nb of sector to read) (zeo: in cd_read, mode2-5,nb of bank to fill = nb of sector / 4 ) $2281: unknown $2282-$2283: in cd_exec of system 2.0, address to store sectors and to execute if successful reading. (zeo) $2284: soft reset vector zeo : $228f: in reading mode 2-5, mask of the MMR to fill if fact, $228e-$2290 is a self modified code set with 43 XX 60 (where XX is set on the fly) it loads A with the value of a MMR 'coz 43 XX is the TMAi function and 60 a RTS launch with a classic jsr $228e Very 'subtle' piece of code. later, it's filled with TAMi code and finally with TAMi again (!?) $2291-$229a: unknown (backup command buffer?) $229b: unknown (zeo: may be error related, if set, it obliges the error test function ($e9c5) to reset the drive and launch the calling function again) $229c: unknown $229d: unknown (AD_xxx0?) $229e: unknown (AD_xxx1?) $229f: unknown (AD_xxx2?) $22a0: unknown (AD_xxx3?) $22a4: unknown (some sort of mutex on the cd system code?) $22a5: ADPCM repeat flag $22a6: ADPCM length $22a7: ADPCM length $22a8: ADPCM start $22a9: ADPCM start $22aa: ADPCM sampling rate $22b5: save location for mmu reg 0 ($01) $22b6: save location for mmu reg 1 ($02) $22b7: save location for mmu reg 2 ($04) $22b8: save location for mmu reg 3 ($08) $22b9: save location for mmu reg 4 ($10) $22ba: save location for mmu reg 5 ($20) $22bb: save location for mmu reg 6 ($40) $22bc: save location for mmu reg 7 ($80) zeo: $22d0-dc: array of 13 bytes, sound related (not really, rather bunch of separate variables) $22d0-$22d1 : track ? ('coz set in PSG_TRACK) $22d2-$22d3 : unknown... (set by PSG_FUNC5) $22d4: unknown, set with some strange tables upper bit can avoid timer counter reloading else seems to be the counter reloading value... $22d5-$22d6 : unknown... (set by PSG_FUNC6) $22d7-$22d8 : unknown... (set by PSG_FUNC7) $22d9-$22da : unknown... (set by PSG_FUNC8) $22db-$22dc : unknown... (set by PSG_FUNC9) $22dd: unknown, sound related $22de: unknown, sound related PSG_FUNCE set the upper bit in some case PSG_FUNCA set 6th bit $22df: unknown, receive the arg of PSG_INIT if set to 1, PSG_MSTAT exits immediately and returns a special (error ?) code (0x80) if set to 1, PSG_FUNCE exits immediately if set to 1, PSG_FDOUT exits immediately if set to 1, PSG_FUNC11 exits immediately if set to 0, PSG_STAT2 exist immediately and returns a special (error ?) code (0x80) if set to 0, PSG_FUNCA exits immediately $22de: sound related, initialised with 0xC0 upper bit cleared in PSG_FUNC12 $22df: sound related, could be "all chan on", PSG_FUNCE kills all chan if zero $22e0: used as a local counter for chan number in $c2ef (bank 2) function as weel as in $cd12 (bank 2) function $22e1: sound related, initialised with 0x80 keep the arg of the PSG_PLAY function $22e2: sound related, keep the value of _AH when PSG_PLAY is called $22e3-ea: array of 8 bytes, sound related initialised with d3 00 00 06-08 20 00 60 $22eb-$22ec: a bank number used in $e6cf routine (set in PSG_BANK) maybe the bank were the song data dwells ? these bank are mapped to $8000 and $A000 in the timer routine ... I think we have then 16 Kb that need to be prepared to be put at $8000 for all song data $22ed: maybe the current audio channel (i.e. last arg to $0800) $22ee-$248a : 0x19d (413d) bytes sound releated $247c-$2481 : array of 6 bytes, one for each sound channel used to create the return value of PSG_MSTAT certainly an array of boolean since it's sometime normalized to an array of 0 and 1 (whenever there were a non zero value..) if current val is null, avoid killing corresponding chan in PSG_FUNC11 function $2488 : unknown, set to absolute value of the arg in PSG_FDOUT $2489-$248a : set to zero in PSG_FDOUT $248b-$2615 : 0x18b (395d) bytes sound related $25ff-$2604 : array of bytes, upper bit is cleared in some conditions in PSG_FUNC12 $2607-$260B : array of bytes, one for each sound channel used to create the return value of PSG_STAT2 if different from 1, PSG_FUNCE toggle the chan off (could it be "chan on?") if set to 1, avoid toggling chan off in PSG_FUNC11 set to 0 when PSG_ASTOP stop a chan if different from 0, PSG_FUNCA don't toggle the chan off if set to 0, timer routines don't perform actions for the current chan $2616-$2617 : Vram pointer to the tiles map (zeo: I bet there's a better name for that, anyway I meant it's the position in vram where we put the offset of the tiles in order to have them drawn) $2619-$2638 : unknown, set to 0 in a routine... seems to be then set this the expanded boolean value if ($fa-$fb) I mean that the value of each bit in (_BX) will be translated into a 0 or 1 in each of these bytes of course, only the 16 first are set and (_BX) is reset during the computation $2800: some sort of buffer. the CD boot sectors are loaded here $fec2 : Major number of system card $fec3 : Minor number of system card $fef4 : return value of MEM_OPEN function if super system enabled $fef5 : number of the first bank to be mapped (in MMU2, and so on until MMU7 with ($fef5)+5 )