News | Documentation | Hardware | Software | Books | Links

Model 100
Hackers Guide


complied and converted to html by Andy Diller for Web100 1996

Detailed Study of Model 100 ROM Hooks

Copyright 1986 by Bob Andersen, Micro Analog Associates. Monroe, CT. 06468

Routine RST 7 calls the nth 2-byte address specified in the HOOK table located in RAM, starting at 64218, where 2N is the value of the byte that follows the RST 7 instruction.

This study details the location and nature of all RST 7 instructions within a Model 100 ROM.

Default indicates the action installed by a cold start. Address 32755 is installed in the HOOK table for RET and 2267 is installed for FC ERROR.

Hook         Addr  2N     Addr         Default        In Function                (Addr)        
             RST 7                                                                            


64218         0         16643         RET             CLEAR                     16633        
64220         2          7592         RET             MAX(RAM)                  7579         
64222         4          4820         RET             CHGET                     4811         
64224         6          5102         RET             CHSNS                     5083         
64226         8         17175         RET             LCD                       19268        
64228         10         5232         RET             PNOTAB                    5232         
64230         12        19656         RET             INPUT$                    20110        
64232         14        20101         RET             INPUT$(NM ERROR)          20110        
64234         16        20194         RET             INPUT$                    20110        
64236         18        20510         RET             LINE(NM ERROR)            3141         
64238         20        19796         RET             CLOSE(IE ERROR)           20008        
64240         22        19944         RET             SAVE                      19919        
64242         24        19727         RET             OPEN                      19659        
64244         26        19851         RET             LOAD                      19824        
64246         28        19751         RET             OPEN                      19659        
64248         30        19625         RET             EOF(IE ERROR)             6281         
64250         32        20064         RET             LCD(NM ERROR)             19268        
64252         34        19992         RET             SAVE(NM ERROR)            19919        
64254         36        19997         RET             LOAD(NM ERROR)            19824        
64256         38        6281          RET             EOF                       6281         
64258         40        20597         RET             OPEN                      19659        
64260         42        20627         RET             OPEN                      19659        
64262         44        20643         RET             OPEN(NM ERROR)            19659        
64264         46        20630         RET             OPEN(NM ERROR)            19659        
64266         48        20771         RET             OPEN                      19659        
64268         50        21789         RET             TELCOM(TERM-F6)           20806        
64270         52        21792         RET             TELCOM(TERM-F7)           20806        
64272         54        22064         RET             TELCOM(TERM-UP)           20806        
64274         56        24673         RET             TEXT                      24046        
64276         58         7619         FC ERROR        WIDTH                     7619         
64278         60        17226         FC ERROR        LCD                       19268        
64280         62        7760          FC ERROR        SCREEN                    7714         
64282         64        NOT IN ROM    FC ERROR        NonemTHROUGH                           
64294         76        NOT IN ROM    FC ERROR        None                                   
64296         78        20587         FC ERROR        LOF                       20587        
64298         80        20589         FC ERROR        LOC                       20589        
64300         82        20591         FC ERROR        LFILES                    20591        
64302         84        20595         FC ERROR        DSKI$                     20595        
64304         86        20593         FC ERROR        DSK0$                     20593        
64306         88        8095          FC ERROR        KILL                      8081         
64308         90        8272          FC ERROR        NAME                      8247         
64310         92        8923          FC ERROR        SAVEM                     8908         
64312         94        9381          FC ERROR        LOADM,RUNM                9361         
64314         96                      NOT IN ROM      (zeroed)                  None         
64328                   NOT IN ROM    (zeroed)        None                      110          

Bob Anderson (70526,1233) kindly provided a compendium of RAM hooks in the Model 100 actuated by means of RST 7. Here are a few hooks to add to his list.

FB1A CRT open
FB1E CRT put
FB20 WAND open
FB22 WAND close
FB24 WAND get
FB26 WAND other

Machine Language Files Explained

There is a lot of mystery surrounding CO programs because of the way they are loaded into the Model 100, what you should know first is that who ever designed its software evidently did so with Text files and Basic programs in mind were as Machine language programs were an after thought. You see file management is done automatically for Text files and Basic programs, their file type, starting address and name are recorded directly into the file directory in machine memory (63930-64138) when they are created. As old files are deleted and new ones created the remaining files are moved up and down in RAM and as their locations change their starting addresses are automatically updated in the file directory.

Machine language or CO programs on the other hand often times cannot be moved because of address specific routines within the program so they are given a fixed address and here's were things get sticky for this is not compatible with the operations of the file manager. To accommodate CO programs a modification had to be made, instead of going directly to the program from the address found in the file directory the machine goes to a pseudo file which contains a 6 byte table with the address information for the the location of the programs code. In this way the file manager can move the pseudo file but not the real CO program.

When you create a Text file or Basic program in the Model 100 you do so through the built-in programs TEXT and BASIC which use the file manager but when you create a CO program you must first load it from a Text file (the file may be in decimal, hexadecimal or ASCII characters) to its end location in RAM. This is done using a "loader" which converts the file from what ever form it's in to single bytes, it may even be tailored for that specific program saving you any further work. If the loader wasn't tailored for that program or the file was loaded from tape you must enter the programs name and address information so that the file directory can CALL the program, this is done in two steps:

First go to BASIC and set the HIMEM pointer to the very first address of the CO programs code, this is done with the CLEAR command and keeps the machine from using that area as the RAM fills up.

Second you have to enter the programs name and address information with the SAVEM routine, this puts the 6 byte address table in the pseudo file which is automatically recorded in the file directory as the CO program. The SAVEM routine incorporates many of the functions of the file manager but you control it manually.

If the CO program is loaded from a Tandy Disk Drive the SAVEM operation is automatically done for you but you still have to set HIMEM.

If you do not know the addresses for either the first or the second step just type RUNM "program name" (the "CO" extension is not needed) and you will get the "Top","End","Exe" addresses followed by a "OM Error".

If you should accidentally KILL a CO program from the Menu and find that you have to get back into it you can still run the program by CALLing its Execution address, if it is the lowest CO program or the only one in RAM and its Top address and Execution address are the same (they usually are) you can CALL HIMEM.

M100 Tricks and Tips

There are 36 bytes of RAM from 62982 to 63017 which can effectively be rendered invisible if an optional ROM is not installed. Whatever you poke into those 36 bytes will stay there regardless of any BASIC or M/L programs that you may run.

The original routine from 62981 to 63011 checks for the existence of an optional ROM every time you power up, if one is present the value 255 is stored at 63018 and the name of that ROM is stored from 64164 to 64171. Addresses 63012 to 63017 are used when selecting the optional ROM from the Menu.

POKE 62981,201: RET, which effectively makes your 100 think that an optional ROM is installed.

POKE 63018,255: To prevent a cold-start on power-up, the remaining 36 bytes are now free to poke in anything you want.


Interested in more free space to poke stuff into? TELCOM uses 64704 to 65023 as a buffer for its previous screen function, it is also used by the Lucid ROM when it is installed and for some Menu functions which begin at 64904. There are 320 bytes, the first 200 of which are perfectly safe. The remaining 120 bytes may be used as long as the program using that area doesn't use the Menu's date and time routine while running.

Addresses 63109 to 63362 are reserved for the INPUT buffer, the later part of which has been used to store short M/L routines while leaving enough space for normal buffer operations.

The MDM & COM buffer from 65350 to 65413 can be used as long as it is not being accessed for input or output operations, there are 64 more bytes.

CALL 20806 Enter TELCOM with modem on.

CALL 21172 Connect telephone line.

CALL 21179 Disconnect telephone line.

CALL 21795 Prev screen (64704-65023).

CALL 21608:

POKE to restore the built-in modem:

FOR A=63067 TO 63071:READ Z:POKE A,Z:NEXT:DATA 77,55,73,49,69

POKES for the F6 and F7 in TELCOM:

Bytes Free message: 64268,172

Clear Screen: 64270,49

Stop Scrolling: 64268,63

Start Scrolling: 64270,68


Disable LABEL key: 64173,0
Enable LABEL key: 64173,1
Enable by returning to the Menu

Address 64228 is the place to intercept the print routine just before it prints a character, PCSG and others use that location to add line feeds.

Disable printer port: 64228,136


Enable printer port: 64228,243


If you wish to test the printer port to determine the status of the printer use one of these two routines:

10 CLS
30 IF (INP(187)AND6)=2 THEN PRINT@137,"ONLINE"

10 CLS

These addresses return memory locations in a two address jump:

64192 Lowest address of installed RAM.
64430 Start of DO files.
64432 Start of index for CO files.
64434 Start of Variable table.
64436 Start of Array table.
64438 The first available byte in RAM. 


Address 65451 returns a non ASCII value for the last key pressed and it is also first address in the type-ahead buffer which uses the odd addresses from 65451 to 65493.


ureturn.gif (2080 bytes)

Return to: | Documents | M100 | M200 | M102 | DVI |