TRSDOS v1.3 ZAPS
Page Index
Zaps changing the way TRSDOS 1.3 Boots
Fast Boot (Remove Banner)
Speed up the boot process by removing the initial banner display.
This ZAP modifies OVERLAY 0
PATCH *0 (ADD=4E88,FIND=213B51,CHG=C3394F)
PATCH *0 (ADD=4E94,FIND=213B51,CHG=C3394F)
PATCH *0 (ADD=4E9A,FIND=213B51,CHG=C3394F)
What does this do?
The routine at 4E7DH points to three different items to display. The logo, the dos version, and the copyright notice. These are set up by pointing variables at various memory locations and then GOSUBing the routine at 021BH to display them. CD,1B,02 is GOSUB 021BH. These three patches leave the variables set up, but zero out the GOSUB to 021BH to actually display them.
Bypass Model III 'picture'
PATCH *0 (ADD=516CH,FIND=D0,CHG=03) -or-
PATCH *0 (ADD=516CH,FIND=D0,CHG=0D)
What does this do?
516CH is the message storage area for the Model III logo in RAM. As discussed elsewhere, GOSUB 021BH, is a routine that displays on the screen what a variable points to. Well, it displays on screen what the variable points to, until it hits a 03H or 0DH and then stops. So what this clever ZAP does, is simply changes the very first character of the graphic logo into the 03H end character.
Bypass the copyright notice
PATCH *0 (ADD=508A,FIND=28,CHG=03) -or-
PATCH *0 (ADD=508A,FIND=28,CHG=0D)
What does this do?
508AH is the message storage area for the copyright notice in RAM. As discussed elsewhere, GOSUB 021BH, is a routine that displays on the screen what a variable points to. Well, it displays on screen what the variable points to, until it hits a 03H or 0DH and then stops. So what this clever ZAP does, is simply changes the very first character of the graphic logo into the 03H or 0DH end character.
Bypass the Date/Time query on power up
PATCH *0 (ADD=4EB8,FIND=213B51,CHG=C3394F) -or-
PATCH *0 (ADD=4EA9,FIND=CA,CHG=C3) -or-
PATCH *0 (ADD=4EB5,FIND=CD1B02,CHG=B72846)
What does this do?
The FIRST zap, looks for the code at 4EB8H which is the start of the routine to ask about the date, and instead of leaving what is there (which is LD HL,513BH which tells the computer to get ready to display what is at 513BH), it changes the instruction JP 4F39H which is the first instruction after all the date and time stuff has happened, effectively bypassing the entire routine.
The SECOND zap, modifies the routine starting at 4E9EH which test the date in RAM to see if it is valid. Whatever that subtraction is, if the answer is ZERO, it jumps to 4F2EH to bypass the date and time question, and if the answer is anything else, it continues on to the routine to ask for the time and date. What this does is change "JP Z" (which is CAH) which means 'JUMP to a new location only if you had a zero', to "JP" (which is C3H), which jumps to the location to bypass the time and date, regardless of the subtraction.
Bypass the Date/Time query on power up
Speed up the boot process by removing the time and date inquiry.
This ZAP modifies OVERLAY 0
PATCH *0 (ADD=4EA9,FIND=CA,CHG=C3)
What does this do?
The routine starting at 4E9EH fetches the RAM location that holds the date, and then does some subtraction to see if it is valid. Whatever that subtraction is, if the answer is ZERO, it jumps to 4F2EH to bypass the date and time question, and if the answer is anything else, it continues on to the routine to ask for the time and date. What this does is change "JP Z" (which is CAH) which means 'JUMP to a new location only if you had a zero', to "JP" (which is C3H), which jumps to the location to bypass the time and date, regardless of the subtraction.
Bypass only the Time query on power up
PATCH *0 (ADD=4EF7,FIND=06,CHG=36)
What does this do?
The 06H represents the number of instructions to jump from the current location due to a successful DATE entry and processing. That lands on the routine to check the time (at 4EFEH). This zap says to jump 36H bytes forward instead of just 06H bytes, bypassing the TIME check routine.
Bypass the line which tells you the RAM and Number of Drives, as well as Time/Date Prompts
PATCH *0 (ADD=5039,FIND=20,CHG=0D)
What does this do?
The 06H represents the number of instructions to jump from the current location due to a successful DATE entry and processing. That lands on the routine to check the time (at 4EFEH). This zap says to jump 36H bytes forward instead of just 06H bytes, bypassing the TIME check routine.
Bypass Date/Time on power up and set Date to 00/00/00
PATCH *0 (ADD=4EB1,FIND=06,CHG=17)
PATCH *0 (ADD=4ED4,FIND=3A81,CHG=184D)
What does this do?
4EB0H is the end of the routine to display the copyright and logo. The instruction at 4EB0H is a relative JUMP 6 bytes forward to handle getting the date from the user. The first patch changes that 6 to 23 (=17H) to skip over the code to ask the question. The second patch similarly changes an instruction to a jump to skip over the other question.
Bypass Date/Time error checking so anything can be entered
PATCH *0 (ADD=4EB5,FIND=CD1B02,CHG=C3F64E)
What does this do?
CD1B02 is GOSUB 021BH, which is a routine that displays on the screen what a variable points to. So any patch that replaces CD1B02 with 000000 leaves all the variables set up, but just doesn't have the computer do anything about them - in this case, skipping the display of the various messages.
Hasten the Boot time by eliminating the fancy displays and tell TRSDOS that you have 4 drives
PATCH *0 (ADD=4E11,FIND=21F443,CHG=C3264E)
PATCH *0 (ADD=4E43,FIND=3A1244,CHG=C3614E)
PATCH *0 (ADD=4E63,FIND=0604CDD444,CHG=3E03C3744E)
PATCH *0 (ADD=4E9A,FIND=CD1B02,CHG=000000)
PATCH *0 (ADD=5039,FIND=20,CHG=0D)
PATCH *0 (ADD=516C,FIND=D0BF9F,CHG=1C1F03)
What does this do?
The first patch (4E11H) goes to start of the routine to Decode the TRSDOS v1.3 disk serial number from Binary Coded Decimal to text and changes whatever that first instruction was into JP 4E26H which simply jumps away.
The second patch (4E43H) goes to the start of the routine to determine and display the memory size in your system and changes whatever that first instruction was to JP 4E61H to jump away.
The third patch (4E63H) goes to just after the start of the routine to determine how many floppy drives you have and just changes the variable that would have held that answer (following testing) to 03H (meaning 4 drives), and then jumps away to JP 4E74H.
The fourth patch (4E9A) deletes the GOSUB 021BH that would have displayed a message
The fifth patch (5039) cuts short a message by putting a 'stop displaying this message' code of 0DH in the middle of it
The sixth patch (516C) is where the Model III logo is stored, and, just like the fifth patch, changes that - in this case to clear the screen and abort.
Bypass the "Auto Function Engaged" message
PATCH *0 (ADD=4F62,FIND=CD1B02,CHG=000000)
What does this do?
CD1B02 is GOSUB 021BH, which is a routine that displays on the screen what a variable points to. So any patch that replaces CD1B02 with 000000 leaves all the variables set up, but just doesn't have the computer do anything about them - in this case, skipping the display of the various messages.
Patch locations for bootup items
Logo addresses in overlay 0 (PATCH *0):
Normally, a carriage return <0D Hex> follows text.
Cause the AUTO command to be displayed when executing. Since this patch affects other patches, it will be referred to as the DISPLAY AUTO patch.
PATCH *0 (ADD=4F60,FIND=6B4F,CHG=2542)
What does this do?
The instruction at 4F5FH is LD HL,4F6BH which points to the AUTO FUNCTION ENGAGED message. This zap changes it, instead to point to 4225H, which is the DOS command buffer. This then displays the command which the AUTO pushed on the screen instead of the message.
Stop Zeroing of Memory on Boot
This ZAP modifies OVERLAY 1
PATCH *1 (ADD=4E73,FIND=EDB0,CHG=0000)
What does this do?
EDH B0H is the Z-80 code for LDIR which moves a block of RAM. By zeroing out that instruction, all the parameters for the clear are set up, but the command to actually do the clearing is zero'd out.
Zaps changing the TRSDOS 1.3 Prompt
Eliminate the dots after TRSDOS Ready (next line)
PATCH *1 (ADD=4E78,FIND=2E,CHG=03) -or-
PATCH *1 (ADD=4E78,FIND=2E,CHG=20) -or-
PATCH *1 (ADD=4E75,FIND=063E3E,CHG=C37E4E)
What does this do?
The location 4E78H holds the ASCII value of the character that will fill the DOS command line. So these change that character. 03H is a "stop processing" code. 20H is a space. The third patch goes a little earlier and changes the start of the routine that draws the dots into a JUMP away (to 4E37H).
Change the "TRSDOS Ready" prompt to any 12 characters
PATCH *1 (ADD=509C,FIND=545253444F53,CHG=242003000000)
What does this do?
The message 0AH + "TRSDOS READY" + 0DH is kept at 509BH. It MUST start with the 0AH (to get a new line) and it MUST end with 0DH to say "stop processing" But the 12 characters from 509CH are free game to say whatever.
Change the "TRSDOS Ready" prompt to whatever you like.
You will have to do a little work here. The new prompt can be 12 or fewer new characters. Each character must be converted to its ascii hex value and used in the place of a pair of the "xx"'s. Almost any character works fine, even graphics blocks. Be carefull with control characters though. To find hex value, first find the ASC value. Then look up the hex table in the back of the Model III "Operation and BASIC Language Reference Manual"
PATCH *1 (ADD=509C,FIND=545253444F53,CHG=xxxxxxxxxxxx)
PATCH *1 (ADD=50A2,FIND=205265616479,CHG=xxxxxxxxxxxx)
What does this do?
Same as the previous patch, but it intrudes on the OPERATION ABORTED message as well.
Change the "TRSDOS Ready" prompt to whatever you like but 35 characters. Each character must be converted to its ascii hex value and used in the place of a pair of the "xx"'s. This one affects the opening banner. If you have not applied any of the banner patches, your new boot message could get "lost in the crowd". If your message is shorter than 35 characters, then left over message should be padded with spaces (hex val 20)
PATCH *0 (ADD=5016,FIND=5452532D383020,CHG=xxxxxxxxxxxxxx)
PATCH *0 (ADD=501D,FIND=4D6F64656C2049,CHG=xxxxxxxxxxxxxx)
PATCH *0 (ADD=5024,FIND=49492054525344,CHG=xxxxxxxxxxxxxx)
PATCH *0 (ADD=502B,FIND=4F532076657273,CHG=xxxxxxxxxxxxxx)
PATCH *0 (ADD=5032,FIND=696F6E20312E33,CHG=xxxxxxxxxxxxxx)
What does this do?
Same as the previous patches, but it intrudes on almost all the opening messages.
Alter the default values for cursor character, cursor flash, and caps on/off. Change "xx" to cursor character desired, "y" to a 1 for non-flashing or 0 for flashing, and "z" to 1 for caps lock on or 0 for Upper a.d lower case. Do not install this patch unless the DISPLAY AUTO patch has been installed (uses space freed up by the DISPLAY AUTO patch)
PATCH *0 (ADD=4E11,FIND=21F443,CHG=CD6B4F)
PATCH *0 (ADD=4F6B,FIND=4155544F2046,CHG=3E0z3219403E)
PATCH *0 (ADD=4F71,FIND=756E6374696F,CHG=0y321C403Exx)
PATCH *0 (ADD=4F77,FIND=6E20456E676167,CHG=32234021F443C9)
What does this do?
The first patch changes LD HL, 43F4H to CALL 4F6BH, overwriting the start of the routine to decode the TRSDOS v1.3 disk serial number at 4E11 to a GOSUB to 4F6BH, which holds the "AUTO FUNCTION ENGAGED" message. The rest of the patches are just a routine, broken into 3 parts, which overwrites that message with a series of instructions which puts variables into memory locations.
3Ezz: LD A, zz — Load xx into register A.
321940 LD (4019H), A — Store A at memory address 0x4019 which holds the CAPS LOCK TOGGLE.
3Eyy: LD A, yy — Load yy into register A.
32 1C 40: LD (0x401C), A — Store A at 0x401C which holds the CURSOR BLINK SWITCH.
3E 01: LD A,xx — Load xx into register A.
32 23 40: LD (0x4023), A — Store A at 0x4023 which holds the CURSOR CHARACTER IN ASCII.
21 F4 43: LD HL, 0x43F4 — This is the code that the very first patch overwrote, so it is added here.
C9: RET — Return from subroutine.
Shorten "Operation Aborted" Error to "Aborted"
This will lengthen the DOS READY Prompt Space to 22 spaces.
This ZAP modifies OVERLAY 1
PATCH *1 (ADD=4E30,FIND=A9,CHG=B3)
What does this do?
The instruction at 4E28H puts the number 50A9H in a variable. 50A9H points to "OPERATION ABORTED". By changing the last 2 parts of that from 50A9H to 40B3H, it changes the variable from pointing to "OPERATION ABORTED" to "ABORTED".
Change "TRSDOS READY" to "Zapped TRSDOS READY"
Change the DOS READY prompt from "TRSDOS Ready" to "Zapped TRSDOS Ready".
There is a carriage return "0D" to marke the end of the message
This ZAP modifies OVERLAY 1
| DISK LOCATION (Trk,Sect,Byte) | RAM ADDRESS | From | To |
|---|---|---|---|
| 10,02,AB | (509B) | STRING | NEW STRING+0D |
What does this do?
509B holds the Message 0AH + "TRSDOS READY" + 0DH and 50A9H holds the message "OPERATION ABORTED" + 0DH. By removing the first 0DH, the routine which displays the message will just keep on going, so this just overwrites the "OPERATION ABORTED" message with whatever you want, as an extention to the "TRSDOS READY" message. But it MUST end with 0DH.
Zaps changing the way DIR works
Customize filedate, using any combination of 2 Date/Time fields.
Use the following codes:
- 17 = seconds
- 18 = minutes
- 19 = hours
- 1A = year
- 1B = day
- 1C = month
PATCH *2 (ADD=4FD2,FIND=1C,CHG=1A)
PATCH *2 (ADD=4FD7,FIND=1A,CHG=17)
What does this do?
4FD1 holds the instruction LD A,(421CH) which fetches the MONTH from RAM and 4FD7 similarly fetches the YEAR. This patch changes the pointer of what is being fetched to whatever you set instead of 1A and 17.
Skip CLS before DIR listing
PATCH *3 (ADD=4FB7,FIND=EDB0,CHG=0000)
What does this do?
EDB0 is the instruction LDIR which fills a block of RAM. So the code which sets up the variables to clear the screen are still set, but the one instruction that says to actually go ahead and do it is cancelled out.
Shorten DIR command "SYS" to "S"
PATCH *6 (ADD=5CC4,FIND=5953,CHG=2020)
What does this do?
5CC3 contains the message 'SYS '. This changes the "YS" to " " leaving only "S "
Shorten DIR command "INV" to "I"
PATCH *6 (ADD=5CCC,FIND=4E56,CHG=2020)
What does this do?
5CCB contains the message 'INV '. This changes the "NV" to " " leaving only "I "
Shorten DIR command "PRT" to "P"
PATCH *6 (ADD=5CD4,FIND=5254,CHG=2020)
What does this do?
5CD3 contains the message 'PRT '. This changes the "RT" to " " leaving only "P "
Allow use of BASIC's short directory routine from TRSDOS 1.3 ready
These patches eliminate TRSDOS's Route command and "Operation Aborted" message, using no additional disk space. Type in "CAT" from DOS Ready. This patch affects other patches and will be referred to as the "SHORT DIR PATCH"
PATCH *10 (ADD=4E2E,FIND=CD3E4B,CHG=CD8A50)
PATCH *10 (ADD=508A,FIND=4469736B,CHG=4FC33E4B)
PATCH *1 (ADD=50A9,FIND=4F7065726174,CHG=0D7EFE343004)
PATCH *1 (ADD=50AF,FIND=696F6E204162,CHG=FE3030023E30)
PATCH *1 (ADD=50B5,FIND=6F727465640D,CHG=327142C31944)
PATCH *1 (ADD=51C9,FIND=524F55544520A842,CHG=434154202020AA50)
What does this do?
In the first patch, it modifies the GOSUB to 4B3EH (which is the SYS00/SYS routine to identify the track number of the directory) to GOSUB 508AH instead.
In the second patch 508AH, which currently holds the message "Disk Basic Feature" + 00H is rewritten. "Disk" becomes LD C,A (4F) and JP 4B3EH (C3 3E 4B), directly running the routine that gets the directory track number.
In the 3rd, 4th, and 5th patch 50A9H and onward, which currently holds the message "OPERATION ABORTED" + 0DH is rewritten.
"Operat" becomes LD C,A (4F) and JP 4B3EH (C3 3E 4B), directly running the routine that gets the directory track number.
The rest of the code translates into a routine which validates that the number be no less than 0 nor more than 3.
The final patch is to 51C9H, which changes the message "ROUTE " and a jump point of 42A8H to "CAT " with a jump point of 50AA.
Give TRSDOS 1.3's directory command a pagination feature.
After each video page, it pauses. Note, this will conflict with other zaps, and will be referred to as the "DIR PAGE ZAP"
PATCH *6 (ADD=616D,FIND=CD8861B7C8FE40,CHG=3A803FD620C8CD)
PATCH *6 (ADD=6174,FIND=2806C547AF78C1,CHG=CF60CDC901AFC9)
What does this do?
It rewrites a routine (but split into 2 parts due to length).
[617CH]
becomes
After installing this patch, pressing "SHIFT+@" will cause long directory listings to pause. Do not install this patch if you've installed the DIR PAGE ZAP
PATCH *6 (ADD=6173,FIND=40,CHG=60)
What does this do?
40H is @. The routine that looks for that is updated instead to look for 60H which is SHFIT+@
Puts a message at the bottom of the screen reminding you to press the ENTER key to continue
If the DIR PAGE ZAP has been made:
PATCH *6 (ADD=6111,FIND=0D0000,CHG=202003)
PATCH *6 (ADD=6174,FIND=7C61,CHG=CF60)
If the DIR PAGE ZAP has NOT been made:
PATCH *6 (ADD=6111,FIND=0D0000,CHG=202003)
PATCH *6 (ADD=616D,FIND=CD8861B7C8FE40,CHG=3A803FD620C8CD)
PATCH *6 (ADD=6174,FIND=2806C547AF78C1,CHG=CF60CDC901AFC9)
What does this do?
6111 holds the message "PRESS ENTER TO CONTINUE" + 0DH", so the first patch changes the carriage return at the end of that message to two spaces and a 'stop processing' delimeter.
The second patch finds the code JR Z,617CH which jumps to 617CH if the PAUSE routine if the "@" was pressed, and changes that jump to go to 60CFH instead which is the "PAUSE" Library Command.
Give you the option of including or not including a colon (:) when specifing a drive number for the DIR command
PATCH *6 (ADD=59EC,FIND=7EFE3A2015,CHG=2BCD781D38)
PATCH *6 (ADD=59F1,FIND=237ED630DA,CHG=06FE3A2010)
PATCH *6 (ADD=59F6,FIND=3452FE04D2,CHG=237ED630DA)
What does this do?
The first patch goes to 59EC in the middle of the DIR routine and modifies the code that says 'if there is no colon then assume there is no drive number and keep processing the command line'
[5A06H]
[5234H]
- If Register A equals 1 more than 3.
- If A < 1 more than 3, the CARRY FLAG will be set.
- if A >= 1 more than 3, the NO CARRY FLAG will be set.
[5234H]
NOTE: 4413H is the storage location for the NUMBER OF DISK DRIVES in the system.
- If Register A equals Register C, the Z FLAG is set.
- If A < Register C, the CARRY FLAG will be set.
- if A >= Register C, the NO CARRY FLAG will be set.
and changes it to
Zaps adding new LIBrary Commands
Add a DOS 'R'epeat command (similar to NEWDOS/80)
PATCH *1 (ADD=4E36,FIND=2642013F003600,CHG=8041013F000000)
PATCH *1 (ADD=5191,FIND=4D4153544552,CHG=522020202020)
PATCH *9 (ADD=603E,FIND=CD8E5FFE0D2003,CHG=21804111254201)
PATCH *9 (ADD=6045,FIND=AF1829111060CD,CHG=2500EDB0212542)
PATCH *9 (ADD=604C,FIND=5444C2,CHG=C39942)
What does this do?
The first patch changes the routine that clears the DOS COMMAND LINE BUFFER from
and changes it to wipe someplace harmless instead
The second patch goes to 5191H which holds the word "MASTER" in the Library Command Name Storage Area, and changes that library command to "R " (R followed by 5 spaces).
With those modifications to OVERLAY 1 in place, it then moves to patch the actual code in OVERLAY 9. First, to modify the code block for the MASTER library command:
[6048H]
[6071H]
[4454H]
NOTE: 4454H is the DOS PARAMETER STRING PARSE routine. It decodes DOS LIBRARY parameters.
[5219H]
to
Add a CAT command to TRSDOS 1.3 (appears to work for Drive 0 only)
PATCH *1 (ADD=50A9,FIND=4F7065726174,CHG=0D7EFE343004)
PATCH *1 (ADD=50AF,FIND=696F6E204162,CHG=FE3030023E30)
PATCH *1 (ADD=50B5,FIND=6F727465640D,CHG=327142C31944)
PATCH *1 (ADD=51C9,FIND=524F55544520A842,CHG=434154202020AA50)
What does this do?
The first three patches are contiguous and they point to the message "OPERATION ABORTED" + 0DH noting that 0DH is a 'stop processing' terminator. It replaces that with 0DH to simply wipe out that error message entirely and then adds the following programming code in the space that used to be the message. This code takes a number, makes sure its a valid drive number (or puts in 0 if not) and then calls the "short directory routine":
- If Register A equals 4, the Z FLAG is set.
- If A < 4, the CARRY FLAG will be set.
- if A >= 4, the NO CARRY FLAG will be set.
- If Register A equals 0, the Z FLAG is set.
- If A < 0, the CARRY FLAG will be set.
- if A >= 0, the NO CARRY FLAG will be set.
The last patch goes to the place where "ROUTE " + a jump address is stored in the master library command list, and changes it to "CAT " + a jump address of 50AAH
Zaps Changing Security
Bypass all password checking
PATCH *2 (ADD=4ED4,FIND=20,CHG=18)
What does this do?
4ED4H is a conditional jump that says to skip the password check and jump to 4F1AH if the NZ flag is set. By changing the 20H (which is a conditional jump) to 18H (which is a straight jump), every password will be bypassed
Enable access to all files (e.g. BASIC/CMD)
PATCH *2 (ADD=5135,FIND=2C,CHG=00)
What does this do?
5135 is at the end of the password encoding routine. When reached, the password is 00H, and the system doesn't want that, so it has an INC L to make it not zero. This patch removes that INC L, leaving L at zero.
Allow unlimited backup, no matter what limited backup count is set to
PATCH *7 (ADD=528E,FIND=C8,CHG=C9)
What does this do?
528EH is part of the routine which checks for permitted backups. The instruction being modified is RET Z which says that if the Z Flag is set, don't bother with any of the backup counter code, and just RETurn. Changing C8 to C9 changes from a conditional RETurn to a straight RETurn, bypassing all the counter code.
Remove read protection to a BACKUP of your TRSDOS 1.3 disk
PATCH *0 (ADD=4760,FIND=38,CHG=18)
What does this do?
4760 is in the routine which verifies if you have READ (or better) ACCESS, to permit operations. The code at 4760 is a CONDITIONAL jump, that if the CARRY FLAG is set, then we are good to go, so JUMP to 476CH to process. Changing 38 (a conditional jump) to 18 (a straight jump), just means that no matter what it had determined from the test, it is going to permit the read.
Restore read protection to a BACKUP of your TRSDOS 1.3 disk
PATCH *0 (ADD=4760,FIND=18,CHG=38)
What does this do?
4760 is in the routine which verifies if you have READ (or better) ACCESS, to permit operations. The code at 4760 is a CONDITIONAL jump, that if the CARRY FLAG is set, then we are good to go, so JUMP to 476CH to process. If you previously patched the CONDITIONAL jump (38) to a straight jump (18), this tells you how to reverse that.
Write to any file
PATCH *0 (ADD=47F5,FIND=62,CHG=F7)
What does this do?
47F5 is a conditional jump (JP NC,JP NC,4762H) that blocks writing in the routine and jumps to JP NC,4762H if we don't have write access. This changes the jump point to 47F7H which is just the next line, so it never jumps away.
Allow LOAD from DOS
PATCH *0 (ADD=4BF6,FIND=38,CHG=18)
What does this do?
4BF6 is in the middle of the LOAD A PROGRAM routine. Like so many other patches, this one changes a conditional jump to a mandatory one; bypassing the check which would have blocked if we have only READ or lower access.
Stop memory clear (usually)
PATCH *1 (ADD=4E5D,FIND=20,CHG=18)
What does this do?
Like so many other patches, this one changes a conditional relative jump (JR NZ,4E75H) to a mandatory one, to a mandatory jump that doesn't care about those conditions.
Allow open
PATCH *2 (ADD=4ED4,FIND=20,CHG=18)
What does this do?
Like so many other patches, this one changes a conditional relative jump (JR NZ,4F1AH) to skip the password check under certain conditions, to a mandatory jump that doesn't care about those conditions.
Lets you kill anything
PATCH *3 (ADD=4F6C,FIND=38,CHG=18)
What does this do?
Like so many other patches, this one changes a conditional relative jump (JR C,4F72H) to verify that we have KILL access and then jump to 4F72H to go ahead and kill the file, to a mandatory jump that doesn't care about those conditions.
Allow you to acces any file regardless of password. This patch affects other patches and will be referred to as the ACCESS ANY FILE patch.
PATCH *2 (ADD=4ED4,FIND=20,CHG=18)
What does this do?
Like so many other patches, this one changes a conditional relative jump (JR NZ,4F1AH) to check to see if we should skip the password check if certain conditions were met, to a mandatory one, to a mandatory jump that doesn't care about those conditions.
Give every file the protection level you designate. Change "x" to desired protection level. This patch requires that you also make the ACCESS ANY FILE patch.
PATCH *2 (ADD=4ECB,FIND=00,CHG=0x)
What does this do?
4ECAH is part of the routine which writes files and sets up the directory entry. Before patching, Register B is loaded with a 00H to set the default access level to FULL. By changing the value, you change the default access level placed on all new files.
The Model III TRSDOS Access Levels are:
- EXEC - execute only
- READ - read, execute
- WRITE - write, read, execute
- NAME - rename, write, read, execute
- KILL - all access, except re-attrib
- FULL - total access
Changes PURGE command so it no longer asks or cares for disk master password
PATCH *11 (ADD=5648,FIND=66,CHG=99)
PATCH *11 (ADD=564D,FIND=21A25B,CHG=C36E56)
PATCH *11 (ADD=5693,FIND=28,CHG=18)
What does this do?
The first patch changes the pointer to the message "'Master Password? ' + 03H" (at 5866H) to point to 5899H which is the 0DH part of the message "'Insert a SYSTEM disk' + 0DH", effectively preventing the prompt from ever showing up.
The second patch modifies the command at 564DH which points HL to 5BA2H to set up a buffer for the MASTER PASSWORD. Instead of that, there is a JUMP to 566EH skipping over all the code that deals with the master password.
The final patch, like so many others, changes a conditional jump (JR Z,569AH) which will jump only if the two password match, to a mandatory one that bypasses that check.
Zaps changing the way TRSDOS Works
Allow a Full Error Message to be Printed Instead of a Short "ERROR XX" Code Message.
This ZAP modifies OVERLAY 4
PATCH *4 (ADD=4E28,FIND=20,CHG=18)
What does this do?
Long error messages are absolutely built into TRSDOS, but Radio Shack set a variable to keep them short in some cases. Very similar to Zap 2, above, this leaves all the parts that test to see whether a long or short error messages should be shown intact but changes the JUMP from one that cares about the math (JR NZ or 20H) to just a regular JUMP that doesn't care (JP or 18H), so no matter what the result of the test is, it always jumps to the long error message routine.
BACKUP - Ignore password prompt, ignore disk master password, and improve FORMAT command.
Also, when TRSDOS asks you for disk name, pressing ENTER will name it DATADISK
PATCH *7 (ADD=5013,FIND=534F55524345,CHG=FE08C0E1211D)
PATCH *7 (ADD=5019,FIND=204469736B20,CHG=50C383564441)
PATCH *7 (ADD=501F,FIND=4D6173746572,CHG=54414449534B)
PATCH *7 (ADD=55A8,FIND=28,CHG=18)
PATCH *7 (ADD=5657,FIND=21,CHG=C9)
PATCH *7 (ADD=5673,FIND=FE0828EF,CHG=CD135000)
What does this do?
The first three are contiguous and use the space reserved for the message 'SOURCE Disk Master' stored at 5013H. That gets overwritten with the following code:
The next patch, like most other patches, changes a conditional jump (JR Z,55B3H) at 55A8H which executes the backup only if the passwords match, to an absolute jump that doesn't care.
The next one goes to 5657H which is the start of a subroutine which prompts the user for the master password for the source diskette. It changes the first instuction to a RETurn, bypassing the subroutine.
The final one in the initial list replaces the following code:
With the following, which jumps to the new subroutine:
BACKUP - Allow unlimited backup, no matter what limited backup count is set to
PATCH *7 (ADD=528E,FIND=C8,CHG=C9)
What does this do?
Like most zaps, this changes a conditional action into a mandatory one, in this case changing a RET Z which returns if it is ok to do to a backup only if the Z FLAG is set, into a mandatory RETurn which ignores whatever the Z flag was.
BASIC
Eliminates BASIC's opening banner.
Note, this patch will affect others and will be referred to as the ELIMINATE BASIC BANNER patch.
Do not make this patch if you have made the SHORTEN BASIC BANNER patch.
PATCH BASIC/CMD (ADD=62EF,FIND=CD,CHG=C9)
Shorten Basic's opening banner to 1 Line. Note, this patch will affect others and will be referred to as the SHORTEN BASIC BANNER patch. Do not make this patch if you have made the ELIMINATE BASIC BANNER patch.
PATCH BASIC/CMD (ADD=62ED,FIND=29,CHG=8F)
Allows support for 65535 logical records by expressing those above 32767 as negative numbers. Eg. record # + (65536 * (record #>32767))
PATCH BASIC/CMD (ADD=5EE8,FIND=451E,CHG=012B)
Allow a BASIC program to be read with up to a 50% increase in speed. If the program leaves less than 400 bytes in memory you will recieve an out of Memory error.
PATCH BASIC/CMD (ADD=5BFE,FIND=2AA440,CHG=CD8754)
PATCH BASIC/CMD (ADD=5C07,FIND=FF,CHG=FE)
PATCH BASIC/CMD (ADD=5C0D,FIND=CD535F7723,CHG=CD9B540000)
PATCH BASIC/CMD (ADD=53CC,FIND=8754,CHG=4A1E)
PATCH BASIC/CMD (ADD=5487,FIND=E17EFE26,CHG=2323E5DD)
PATCH BASIC/CMD (ADD=548B,FIND=C24A1ED7,CHG=E1ED5BA4)
PATCH BASIC/CMD (ADD=548F,FIND=C24A1EE5,CHG=40013300)
PATCH BASIC/CMD (ADD=5493FIND=219B54CD,CHG=0901FF00)
PATCH BASIC/CMD (ADD=5497,FIND=3F56E1C9,CHG=EDB0EBC9)
PATCH BASIC/CMD (ADD=549B,FIND=35013D3C,CHG=DD7503DD)
PATCH BASIC/CMD (ADD=549F,FIND=26751734,CHG=7404DD36)
PATCH BASIC/CMD (ADD=54A3,FIND=263C3675,CHG=0500DDCB)
PATCH BASIC/CMD (ADD=54A7,FIND=3C267516,CHG=01EEDD34)
PATCH BASIC/CMD (ADD=54AB,FIND=1A050C07,CHG=0A2003DD)
PATCH BASIC/CMD (ADD=54AF,FIND=1C121D01,CHG=340B24C3)
PATCH BASIC/CMD (ADD=54B3,FIND=1011,CHG=535F)
DEBUG
Allow 'DEBUG/CMD' to be able to examine program with starting addresses below 5600H
PATCH *5 (ADD=4ED9,FIND=56,CHG=00)
PATCH *5 (ADD=4EFF,FIND=56,CHG=00)
PATCH *5 (ADD=5068,FIND=56,CHG=00)
What does this do?
The floor of 5600H, below which DEBUG won't work, is just a number hard-coded in there by Radio Shack. So by changing the floor of "5600" to "0000" you can just go all the way down to 0000.
DUMP
Change the DUMP command so that ANY memory location can be dumped, not just those above 5FFFH
PATCH *6 (ADD=5702,FIND=60,CHG=00)
PATCH *6 (ADD=579C,FIND=D22552,CHG=000000)
What does this do?
The first patch lowers the forced floor from 6000H to 0000H
The second patch modifies a JP NC,5225H whereby if the NC FLAG (No Carry) is set, then the START address is too low, so JUMP to 5225H for an error, and simply zeroes out that check.
FREE
Modify TRSDOS 1.3's FREE command so that it also displays disk space left. Shortens Prot (PW) command.
PATCH *6 (ADD=5D52,FIND=FE28D0,CHG=CD4555)
PATCH *6 (ADD=5542,FIND=2050617373,CHG=3F2003FE28)
PATCH *6 (ADD=5547,FIND=776F72643F,CHG=D8F1C3FC5B)
What does this do?
The first patch changes the two instructions at 5D52H from CP 28H (compare the maximum number of tracks on the disk to what's held in A) and RET NC to RETurn if we are at or beyond the end of the disk to just CALL 5545H
The second and third patches replaces " PASSWORD?" (in the phrase "NEW MASTER PASSWORD?") with:
FREE
Modify TRSDOS 1.3's FREE command so that it also displays disk space left. They do not affect the Prot prompt. If the above patches have been installed, they MUST be removed!
PATCH *6 (ADD=5483,FIND=26,CHG=3C)
PATCH *6 (ADD=5526,FIND=4D617374657220,CHG=FE28D8F1C3FC5B)
PATCH *6 (ADD=5D52,FIND=FE28D0,CHG=CD2655)
What does this do?
The first patch, modifies what currently points to "MASTER PASSWORD?" (at 5526H) and instead points to 553CH which is the "MASTER PASSWORD?" of the message "NEW MASTER PASSWORD?".
The next one goes to where "MASTER PASSWORD?" was stored at 5526H and overwrites the "MASTER " part with:
The final one replaces this code:
with a direct call to
FORMAT
Better formatting routine in TRSDOS 1.3
PATCH *7 (ADD=5BEE,FIND=E5,CHG=5B)
What does this do?
Currently the bit pattern written when Formatting is 240 E5H's. E5H is 11100101. Someone much smarter than myself has decided that 5BH, 01011011, is a better pattern. So this changes to that.
LIST
Changes the default format of the LIST command from hexadecimal to ASCII instead. If you want hex format, specify (HEX) in the parameter.
PATCH *11 (ADD=593E,FIND=28,CHG=20)
PATCH *11 (ADD=5949,FIND=EDB0,CHG=0000)
PATCH *11 (ADD=595C,FIND=28,CHG=20)
PATCH *11 (ADD=5B89,FIND=4153434949,CHG=4845582020)
PATCH *11 (ADD=5AC5,FIND=20,CHG=28)
PATCH *11 (ADD=5B3C,FIND=3030303030,CHG=4153434949)
What does this do?
The first patch changes the conditional jump JR Z,594BH, which jumps to 594BH to display non-ASCII printouts if a certain test is met, to a straight JUMP there, regardless of the test for ASCII vs non-ASCII
The second patch, to 5949H, removes the LDIR which would have copied the word "ASCII" into the REC="xxxxx" display.
The third patch, to 595CH, changes the conditional jump JR Z,59B5H, which jumps to 59B5H only if we have non-ASCII to print, to a mandatory JUMP ignoring that test.
The fourth patch, to 5B89H, chanes the word "ASCII" which is stored there, to the word "HEX ".
The fifth patch, to 5AC5H, changes the conditional jump JR NZ,5AE1H, which jumps to 5AE1H only if we have ASCII to print, to a mandatory JUMP ignoring that test.
The final patch poitns to the "00000" in "REC = 00000" stored at 5B3C, and changes it to "ASCII".
LIST
Changes the pause feature of TRSDOS's List command from "@" to the "SHIFT+"@"
PATCH *11 (ADD=5265,FIND=40,CHG=60)
What does this do?
This changes the code which is being looked for from 40H which is a @ to 60H which is a SHIFT+"@.
PATCH
Allow PATCH to use only single letters for "ADD", "FIND", and "CHG" (apply in order, as the first changes ADD to A, and the second, which changes FIND to F, uses A instead of ADD ...)
PATCH *9 (ADD=56C5,FIND=044144,CHG=02413D)
PATCH *9 (A=56CA,FIND=054649,CHG=02463D)
PATCH *9 (A=56D0,F=044348,CHG=02433D)
What does this do?
The first patch changes the stored message 04H + ADD= (which means, 4 characters and then ADD=) to 02H + "A="
The other patches do the same thing to the 5 letter "FIND=" and 4 letter "CHG="
OTHER
Eliminates "Operation Aborted" message. DO NOT install this patch if the SHORT DIR PATCH has been installed
PATCH *1 (ADD=50A9,FIND=4F,CHG=0D)
What does this do?
50A9H is the memory location of the OPERATION ABORTED error message. What this patch does is replace the first character with the "stop processing" terminator code of 0DH.
Improves the way TRSDOS 1.3 accepts DOS commands.
1) Repeating DOS commands. Press ENTER key and last DOS command is repeated. 2) You can enter a DOS command in either upper or lower case or a combination of the two. 3) Any command line with a period as the first character will be ignored. This is handy for putting comment lines in BUILD files! This routine occupies the space where the TRSDOS ready dots are.
PATCH *0 (ADD=4CD1,FIND=204E53,CHG=4E530D)
What does this do?
Change the " NS" message stored at 4CD1 to read "NS"+0DH
PATCH *1 (ADD=4E32,FIND=212542112642,CHG=180B773E1BCD)
PATCH *1 (ADD=4E38,FIND=013F003600EDB0,CHG=3300CD1B02186F)
What does this do?
The routine at 4E32 clears the command buffer via LDIR by copying the 00H from a byte, into the next byte, 3F (63) times, starting with 4225H to becopied to 4226H. This patch changes those last 2 assignment:
becomes
PATCH *1 (ADD=4E9D,FIND=E5C52A,CHG=C3BB4E)
PATCH *1 (ADD=4EA0,FIND=2040E548060009,CHG=1A28917EFE6138)
PATCH *1 (ADD=4EA7,FIND=014000B7ED4222,CHG=03D620772310F5)
PATCH *1 (ADD=4EAE,FIND=20403E1ECD3300,CHG=D1E17E12FE2ECA)
PATCH *1 (ADD=4EB5,FIND=E1222040C1E1,CHG=4A4EFE0D288F)
What does this do?
4E91H-4E9CH is the routine to grab up to 63 characters from the user into the command buffer. 4E9DH is the part of the routine that starts once it sees the user has given it a character.
NOTE: 4020H is the storage location for the CURSOR POSITION ON SCREEN.
NOTE: 4020H is the storage location for the CURSOR POSITION ON SCREEN.
NOTE: 0033H is the character print routine, to put the character held in Register A at the current cursor position.
NOTE: 4020H is the storage location for the CURSOR POSITION ON SCREEN.
becomes
PATCH *1 (ADD=4E9B,FIND=28ADC3BB4E,CHG=11D44CE5D5)
This is odd - The source does not match this patch. This may not be a good patch.
Allow symbols <, =, >, ?, @ and [ to be part of a filespec
(NOTE: The decimal/hex nature of the patch is due to SU+ being the recommended applicator)
| DISK LOCATION (Trk,Sect,Byte) | From | To |
|---|---|---|
| 16,02,4E | 41 | 3C |
| 16,03,36 | 41 | 3C |
| 16,03,CF | 41 | 3C |
| 16,03,D2 | 5B | 5C |
| 18,08,D7 | 41 | 3C |
| 18,08,DA | 5B | 5C |
| 16,09,E7 | 41 | 3C |
| 16,09,EA | 5B | 5C |
| Enable lower case on power-up (NOTE: The decimal/hex nature of the patch is due to SU+ being the recommended applicator) | ||
| 00,02,A8 | FF,42 | 19,40 |
Zaps upgrading versions or fixing bugs
To Upgrade a Fri. May 1, 1981 version of TRSDOS 1.3 to a Sat. May 2, 1981 version
PATCH XFERSYS/CMD (ADD=548E,FIND=3500FD21,CHG=FD360001)
PATCH *0 (ADD=503B,FIND=467269,CHG=536174)
PATCH *0 (ADD=5044,FIND=31,CHG=32)
PATCH BASIC/CMD (ADD=58F8,FIND=F1,CHG=00)
To upgrage a Sat. May 2, 1981 version of TRSDOS 1.3 to a Wed. July 1, 1981 version
PATCH *6 (ADD=5850,FIND=3A62,CHG=BF5F)
PATCH *6 (ADD=5FBE,FIND=20697320616374,CHG=0D116544C31C44)
PATCH *0 (ADD=5044,FIND=32,CHG=31)
PATCH *0 (ADD=503A,FIND=20536174204D,CHG=20576564204A)
PATCH *0 (ADD=5040,FIND=617920,CHG=756C79)
PATCH *7 (ADD=579C,FIND=0955,CHG=3851)
PATCH *7 (ADD=5135,FIND=207468652064,CHG=3F20033A7D4E)
PATCH *7 (ADD=513B,FIND=69736B657474,CHG=FE81CA0D55C9)
Fix a bug in TRSDOS 1.3 when it tries to list nonexistant files in HIT table
PATCH *10 (ADD=4E47,FIND=02,CHG=03)
What does this do?
Right now, the routine tead the directory track into a Buffer in RAM has a routine that puts a 02H (sector 2) into Register A, and stores that into 4EEEH, and then starts a loop to fetch sector numbers and do things.
This changes that loop to start with sector 03H instead of sector 02H./
After scrolling around in BASIC, a strange memory loss occurs. The following patch corrects this. Also corrects "Can't continue" error. May not work TRSDOS dated other than Wed. Jul 1, 1981.
PATCH BASIC/CMD (ADD=58C4,FIND=D5,CHG=00)
On some of the later versions of the Model III, a new ROM chip is used and the checksum that MEMTEST comes up with does not agree with what it says it SHOULD be. The following patch corrects this.
PATCH MEMTEST/CMD (ADD=6573,FIND=32423931,CHG=32463834)
The TRSDOS I/O (machine language) call to display the directory listing of all non-protected user files must be patched. This call (at HEX 4419) does not work correctly. The following two patches will cause this I/O call to function correctly:
PATCH *10 (ADD=4E2E,FIND=CD3E4B,CHG=CD8A50)
PATCH *10 (ADD=508A,FIND=4469736B,CHG=4FC33E4B)
What does this do?
42E2 is a GOSUB to 4B3EH which is the SYS00/SYS routine to identify the track number of the directory.
The first patch changes that to GOSUB 508AH and the second patch uses the space currently occupied by the message "Disk Basic Feature" in 508AH and replaces the "Disk " part with the following code:
Correct an error in FORMAT wherein disk I/O error retry counter is left incorrectly at 2 (recommended patch).
May not apply to v1.3 - I cannot find this
Correct an I/O error in a directory USR call
PATCH *10 (ADD=4E2E,FIND=CD3E4B,CHG=CD8A50)
PATCH *10 (ADD=508A,FIND=4469736B,CHG=4FC33E4B)
What does this do?
42E2 is a GOSUB to 4B3EH which is the SYS00/SYS routine to identify the track number of the directory. The first patch changes that to GOSUB 508AH.
The second patch modifies 508AH, which currently holds the message "Disk Basic Feature" + 00H. "Disk" becomes
Corrects 2 potential errors in the DIRECTORY
PATCH *10 (ADD=4E2A,FIND=3ADA4E,CHG=784F00)
PATCH *10 (ADD=4E47,FIND=02,CHG=03)
What does this do?
4E2A is the routine to read the directory track into a Buffer in RAM. The first instruction is LD A,(4EDAH) which fetches the drive number (held in memory location 4EDAH) and stores it into Register A.
The first patch changes that to:
The second patch was already above, to deal with a bug in TRSDOS 1.3 when it tries to list nonexistant files in HIT table.
Right now, the routine tead the directory track into a Buffer in RAM has a routine that puts a 02H (sector 2) into Register A, and stores that into 4EEEH, and then starts a loop to fetch sector numbers and do things.
This changes that loop to start with sector 03H instead of sector 02H./
TRSDOS 1.3 automatically CLOSEs an OPEN file before acting on a KILL command. While Tandy considers it bad style to KILL an OPEN file, if you must, the following patch will prevent Disk BASIC from closing files before the KILL command. They note, however, that this may destory the disk directory and render all programs and data on the disk useless
PATCH BASIC/CMD (ADD=60D0,FIND=CDE95C,CHG=000000)
Zaps changing stepping speed and track count
Alter the stepping speed of TRSDOS 1.3
The stepping speed of a disk drive is set by modifying the bits 0 and 1 of any command sent to the Floppy Disk Controller. 00=6ms, 01=12ms, 10=20ms, 11=30ms.
So the generic formula to change the stepping rate is to apply all of these patches, making sure to properly determine the FIND and CHG, where the FIND needs to be what your particular DOS may be currently set for, and CHK is the corresponding Floppy Disk Controller code, but with the first two bits changed.
To go from 6ms to 12ms, you would change 0C to 0D, and 1C to 1D
To go from 6ms to 20ms, you would change 0C to 0E, and 1C to 1E
To go from 12ms to 20ms, you would change 0D to 0E, and 1D to 1E
Some of the instuctions have a faster step built in, so there are 3 different tranches: 0C, 1C, and 58; and they should be modified accordingly
The following is set for stock to move to 12ms
PATCH *0 (ADD=42EE,FIND=0C,CHG=0D)
PATCH *0 (ADD=4516,FIND=0C,CHG=0D)
PATCH *0 (ADD=4FE1,FIND=0C,CHG=0D)
PATCH *7 (ADD=580E,FIND=0C,CHG=0D)
PATCH *7 (ADD=5841,FIND=0C,CHG=0D)
PATCH *0 (ADD=4544,FIND=1C,CHG=1D)
PATCH *7 (ADD=5923,FIND=1C,CHG=1D)
PATCH CONVERT/CMD (ADD=5604,FIND=1C,CHG=1D)
PATCH *7 (ADD=5B3C,FIND=58,CHG=59)
The following is set for stock to move to 20ms
PATCH *0 (ADD=42EE,FIND=0C,CHG=0E)
PATCH *0 (ADD=4516,FIND=0C,CHG=0E)
PATCH *0 (ADD=4FE1,FIND=0C,CHG=0E)
PATCH *7 (ADD=580E,FIND=0C,CHG=0E)
PATCH *7 (ADD=5841,FIND=0C,CHG=0E)
PATCH *0 (ADD=4544,FIND=1C,CHG=1E)
PATCH *7 (ADD=5923,FIND=1C,CHG=1E)
PATCH CONVERT/CMD (ADD=5604,FIND=1C,CHG=1E)
PATCH *7 (ADD=5B3C,FIND=58,CHG=5A)
The following is set for stock to move to 30ms
PATCH *0 (ADD=42EE,FIND=0C,CHG=0F)
PATCH *0 (ADD=4516,FIND=0C,CHG=0F)
PATCH *0 (ADD=4FE1,FIND=0C,CHG=0F)
PATCH *7 (ADD=580E,FIND=0C,CHG=0F)
PATCH *7 (ADD=5841,FIND=0C,CHG=0F)
PATCH *0 (ADD=4544,FIND=1C,CHG=1F)
PATCH *7 (ADD=5923,FIND=1C,CHG=1F)
PATCH CONVERT/CMD (ADD=5604,FIND=1C,CHG=1E)
PATCH *7 (ADD=5B3C,FIND=58,CHG=5B)
Alter TRSDOS 1.3 from 40 to 80 tracks
PATCH *0 (ADD=4926,FIND=28,CHG=50)
PATCH *0 (ADD=499B,FIND=28,CHG=50)
PATCH *0 (ADD=4B29,FIND=29,CHG=51)
PATCH *2 (ADD=4F61,FIND=28,CHG=50)
PATCH *6 (ADD=5C06,FIND=28,CHG=50)
PATCH *6 (ADD=5D53,FIND=28,CHG=50)
PATCH *7 (ADD=5203,FIND=28,CHG=50)
PATCH *7 (ADD=53FF,FIND=28,CHG=50)
PATCH *7 (ADD=5504,FIND=28,CHG=50)
PATCH *7 (ADD=5C4F,FIND=28,CHG=50)
PATCH *7 (ADD=5CD4,FIND=28,CHG=50)
PATCH *7 (ADD=0000,FIND=00,CHG=00)
What does this do?
28H is 40, and 50H is 80. What this does is find every location in TRSDOS v1.3 which checks against 40 or otherwise limits a disk to 40 and changes it to 80.
Hint to get 2 more Grans
All TRSDOS 1.3 system disks shipped out of Tandy warehouses have a built-in GAT error. This error appears to be the result of two files being improperly killed, removing the file information from the directory but leaving the sectors allocated in the GAT. This results in 2 grans less available (166) than would normally be (168). This error can be repaired easily with SU+.