Re: [stella] FE Bankswitching

Subject: Re: [stella] FE Bankswitching
From: Adam Wozniak <adam@xxxxxxxxxxxxxxxx>
Date: Wed, 26 Feb 2003 12:36:37 -0800 (PST)
On Wed, 26 Feb 2003, Kroko wrote:
> Lets talk about RTS first. RTS will pull the return adress from the stack.
> first the LO-Byte second the HI-Byte of the return address. So i look
> at the Hi Byte from the Return address. Bit 5 in this Byte will tell me,
> if i have to stay in the same bank, or if i have to switch to the other bank.
> That seems quite clear .. no problem.

RTS is the easiest.  My cartridge dumper only spoofs RTS.

To spoof:
a= $1000, d= $60
a= $01FE, d= $d0 or $f0 (depending on bank)
a= $01FF, d= $d0 or $f0 (depending on bank)

(I write the same value both times because I can't keep my hi/lo
order straight in my head, even though only one is needed).

Note that the first RAM access is from an EVEN address, the second from
an ODD address.  It doesn't work the other way round.

> But lets talk about JSR now. JSR will push the return address to the stack.
> But if I only look at the return address, that won't tell me where to jump, but
> only where to return to if the subroutine was executed. The target adress
> will not be pushed to the stack. So how the hell could a cartridge know,
> where the target adress is, if it cant see bit A13 of the target ?
> If you ask me, looking at Bit 5 from the databus after a double stack hit
> can not tell me where to jump. I have looked at decathlon. It jumps to
> the other bank and within the same bank by using JSR. What am
> I missing ?

Look again at

I suspect you can spoof a JSR by (untested stuff ahead):

a= $1000, d= $20
a= $1001, d= $d0 or $f0 (depending on bank)
a= $01FF, d= $ff (shouldn't matter)
a= $01FE, d= $ff (shouldn't matter)
a= $1002, d= $d0 or $f0 (depending on bank)

Will code for food.


Archives (includes files) at
Unsub & more at

Current Thread