Commodore 64 Hacking

Various bits and pieces of C=64 related hacking info.

Flattr this

Table of Contents

1 Instruction Set

MnemonicDescription
ADCAdd Memory to Accumulator with Carry
AND"AND" Memory with Accumulator
ASLShift Left One Bit (Memory or Accumulator)
BCCBranch on Carry Clear
BCSBranch on Carry Set
BEQBranch on Result Zero
BITTest Bits in Memory with Accumulator
BMIBranch on Result Minus
BNEBranch on Result not Zero
BPLBranch on Result Plus
BRKForce Break
BVCBranch on Overflow Clear
BVSBranch on Overflow Set
CLCClear Carry Flag
CLDClear Decimal Mode
CLIClear interrupt Disable Bit
CLVClear Overflow Flag
CMPCompare Memory and Accumulator
CPXCompare Memory and Index X
CPYCompare Memory and Index Y
DECDecrement Memory by One
DEXDecrement Index X by One
DEYDecrement Index Y by One
EOR"Exclusive-Or" Memory with Accumulator
INCIncrement Memory by One
INXIncrement Index X by One
INYIncrement Index Y by One
JMPJump to New Location
JSRJump to New Location Saving Return Address
LDALoad Accumulator with Memory
LDXLoad Index X with Memory
LDYLoad Index Y with Memory
LSRShift Right One Bit (Memory or Accumulator)
NOPNo Operation
ORA"OR" Memory with Accumulator
PHAPush Accumulator on Stack
PHPPush Processor Status on Stack
PLAPull Accumulator from Stack
PLPPull Processor Status from Stack
ROLRotate One Bit Left (Memory or Accumulator)
RORRotate One Bit Right (Memory or Accumulator)
RTIReturn from Interrupt
RTSReturn from Subroutine
SBCSubtract Memory from Accumulator with Borrow
SECSet Carry Flag
SEDSet Decimal Mode
SEISet Interrupt Disable Status
STAStore Accumulator in Memory
STXStore Index X in Memory
STYStore Index Y in Memory
TAXTransfer Accumulator to Index X
TAYTransfer Accumulator to Index Y
TSXTransfer Stack Pointer to Index X
TXATransfer Index X to Accumulator
TXSTransfer Index X to Stack Pointer
TYATransfer Index Y to Accumulator
Source: MCS6510 Microprocessor Instruction Set

2 KERNAL Jump Table

AddressNameAXYFDescriptionVidSysSer
FF47/128SPINSPOUT*Initializes I/O for fast serial***
FF4A/128CLOSEALL***Close all files on a device***
FF4D/128C64MODESwitches to C=64 mode***
FF50/128DMACALL**Send DMA command to REU***
FF53/128BOOTCALL***Attempts to run boot sector******
FF56/128PHOENIX***Initalizes external/internal cartri.***
FF59/128LKUPLA****Looks up logical device #******
FF5C/128LKUPSA****Looks up for secondary address******
FF5F/128SWAPPER***Switches betten 40 / 80 column screen***
FF62/128DLCHAR***Initializes 80 column character set***
FF65/128PFKEY****Installs a function key definition***
FF68/128SETBNKSets bank for any I/O operations******
FF6B/128GETCFG*Get MMU configuration for a given bank***
FF6E/128JSRFARJumps to a subroutine in another bank***
FF71/128JMPFARStarts executing code in another bank***
FF74/128INDFET***Execute a LDA(fetvec),Y from a bank***
FF77/128INDSTA**Stores a value indirectly in a bank***
FF7A/128INDCMP**Compares a value indirectly in a bank***
FF7D/128PRIMMOutputs null-terminated string******
FF81CINT***Setup VIC,screen values, 8563…***
FF84IOINIT***Initialize VIC,SID,8563,CIA for system******
FF87RAMTAS***Initialize ram.***
FF8DVECTOR**Reads or Writes to Kernal RAM Vectors***
FF90SETMSGSets Kernal Messages On/Off.***
FF93SECND*Sends secondary address after LISTN******
FF96TKSA*Sends secondary address after TALK******
FF99MEMTOP**Read or set the top of system RAM.***
FF9CMEMBOT**Read or set the bottom of system RAM.***
FF9FKEYScans Keyboard***
FFA2SETMO– Unimplemented Subroutine in All –
FFA5ACPTR*Grabs byte from current talker******
FFA8CIOUT*Output byte to current listener******
FFABUNTLK*Commands device to stop talking******
FFAEUNLSN*Commands device to stop listening******
FFB1LISTN*Commands device to begin listening******
FFB4TALK*Commands device to begin talking******
FFB7READSS*Returns I/O status byte***
FFBASETLFSSets logical #, device #, secondary #***
FFBDSETNAMSets pointer to filename.***
FFC0OPEN****Opens up a logical file.***
FFC3CLOSE****Closes a logical file.***
FFC6CHKIN****Set input channel***
FFC9CHKOUT****Set output channel***
FFCCCLRCH**Restore default channels***
FFCFBASIN**Input from channel***
FFD2BSOUT**Output to channel (aka CHROUT)******
FFD5LOAD****Load data from file***
FFD8SAVE****Save data to file***
FFDBSETTIMSets internal (TI\() clock***
FFDERDTIM***Reads internal (TI\)) clock***
FFE1STOP**Scans and check for STOP key***
FFE4GETIN****Reads buffered data from file***
FFE7CLALL**Close all open files and channels***
FFEAUDTIM**Updates internal (TI$) clock***
FFEDSCRORG***Returns current window/screen size***
FFF0PLOT***Read or set cursor position***
FFF3IOBASE**Read base of I/O block***
Source: C=Hacking Issue 3

3 Memory Map

LabelHex AddressDec. LocationDescription
D6510000006510 On-Chip Data-Direction Register
R6510000116510 On-Chip 8-Bit Input/Output Register
00022Unused
ADRAY10003-00043-4Jump Vector: Convert Floating-Integer
ADRAY20005-00065-6Jump Vector: Convert Integer–Floating
CHARAC00077Search Character
ENDCHR00088Flag: Scan for Quote at End of String
TRMPOS00099Screen Column From Last TAB
VERCK000A10Flag: 0 = Load, 1 = Verify
COUNT000B11Input Buffer Pointer / No. of Subscripts
DIMFLG000C12Flag: Default Array DiMension
VALTYP000D13Data Type: $FF = String, $00 = Numeric
INTFLG000E14Data Type: $80 = Integer, $00 = Floating
GARBFL000F15Flag: DATA scan/LIST quote/Garbage Coll
SUBFLG001016Flag: Subscript Ref / User Function Call
INPFLG001117Flag: $00 = INPUT, $40 = GET, $98 = READ
TANSGN001218Flag TAN sign / Comparison Result
001319Flag: INPUT Prompt
LINNUM0014-001520-21Temp: Integer Value
TEMPPT001622Pointer Temporary String
LASTPT0017-001823-24Last Temp String Address
TEMPST0019-002125-33Stack for Temporary Strings
INDEX0022-002534-37Utility Pointer Area
RESHO0026-002A38-42Floating-Point Product of Multiply
TXTTAB002B-002C43-44Pointer: Start of BASIC Text
VARTAB002D-002E45-46Pointer: Start of BASIC Variables
ARYTAB002F-003047-48Pointer: Start of BASIC Arrays
STREND0031-003249-50Pointer End of BASIC Arrays (+1)
FRETOP0033-003451-52Pointer: Bottom of String Storage
FRESPC0035-003653-54Utility String Pointer
MEMSIZ0037-003855-56Pointer: Highest Address Used by BASIC
CURLIN0039-003A57-58Current BASIC Line Number
OLDLIN003B-003C59-60Previous BASIC Line Number
OLDTXT003D-003E61-62Pointer: BASIC Statement for CONT
DATLIN003F-004063-64Current DATA Line Number
DATPTR0041-004265-66Pointer: Current DATA Item Address
INPPTR0043-004467-68Vector: INPUT Routine
VARNAM0045-004669-70Current BASIC Variable Name
VARPNT0047-004871-72Pointer: Current BASIC Variable Data
FORPNT0049-004A73-74Pointer: Index Variable for FOR/NEXT
004B-006075-96Temp Pointer / Data Area
FACEXP006197Floating-Point Accumulator #1: Exponent
FACHO0062-006598-101Floating Accum. #1: Mantissa
FACSGN0066102Floating Accum. #1: Sign
SGNFLG0067103Pointer: Series Evaluation Constant
BITS0068104Floating Accum. #1: Overflow Digit
ARGEXP0069105Floating-Point Accumulator #2: Exponent
ARGHO006A-006D106-109Floating Accum. #2: Mantissa
ARGSGN006E110Floating Accum. #2: Sign
ARISGN006F111Sign Comparison Result: Accum. # 1 vs #2
FACOV0070112Floating Accum. #1. Low-Order (Rounding)
FBUFPT0071-0072113-114Pointer: Cassette Buffer
CHRGET0073-008A115-138Subroutine: Get Next Byte of BASIC Text
CHRGOT0079121Entry to Get Same Byte of Text Again
TXTPTR007A-007B122-123Pointer: Current Byte of BASIC Text
RNDX008B-008F139-143Floating RND Function Seed Value
STATUS0090144Kernal I/O Status Word: ST
STKEY0091145Flag: STOP key / RVS key
SVXT0092146Timing Constant for Tape
VERCK0093147Flag: 0 = Load, 1 = Verify
C3PO0094148Flag: Serial Bus-Output Char. Buffered
BSOUR0095149Buffered Character for Serial Bus
SYNO0096150Cassette Sync No.
0097151Temp Data Area
LDTND0098152No. of Open Files / Index to File Table
DFLTN0099153Default Input Device (0)
DFLTO009A154Default Output (CMD) Device (3)
PRTY009B155Tape Character Parity
DPSW009C156Flag: Tape Byte-Received
MSGFLG009D157Flag: $80 = Direct Mode, $00 = Program
PTR1009E158Tape Pass 1 Error Log
PTR2009F159Tape Pass 2 Error Log
TIME00A0-00A2160-162Real-Time Jiffy Clock (approx) 1/60 Sec
00A3-00A4163-164Temp Data Area
CNTDN00A5165Cassette Sync Countdown
BUFPNT00A6166Pointer: Tape I/O Buffer
INBIT00A7167RS-232 Input Bits / Cassette Temp
BITCI00A8168RS-232 Input Bit Count / Cassette Temp
RINONE00A9169RS-232 Flag: Check for Start Bit
RIDATA00AA170RS-232 Input Byte Buffer/Cassette Temp
RIPRTY00AB171RS-232 Input Parity / Cassette Short Cnt
SAL00AC-00AD172-173Pointer: Tape Buffer/ Screen Scrolling
EAL00AE-00AF174-175Tape End Addresses/End of Program
CMP000B0-00B1176-177Tape Timing Constants
TAPE100B2-00B3178-179Pointer: Start of Tape Buffer
BITTS00B4180RS-232 Out Bit Count / Cassette Temp
NXTBIT00B5181RS-232 Next Bit to Send/ Tape EOT Flag
RODATA00B6182RS-232 Out Byte Buffer
FNLEN00B7183Length of Current File Name
LA00B8184Current Logical File Number
SA00B9185Current Secondary Address
FA00BA186Current Device Number
FNADR00BB-00BC187-188Pointer: Current File Name
ROPRTY00BD189RS-232 Out Parity / Cassette Temp
FSBLK00BE190Cassette Read / Write Block Count
MYCH00BF191Serial Word Buffer
CAS100C0192Tape Motor Interlock
STAL00C1-00C2193-194I/O Start Address
MEMUSS00C3-00C4195-196Tape Load Temps
LSTX00C5197Current Key Pressed: CHR$(n) 0 = No Key
NDX00C6198No. of Chars. in Keyboard Buffer (Queue)
RVS00C7199Flag: Reverse Chars. - 1=Yes, 0=No Used
INDX00C8200Pointer: End of Logical Line for INPUT
LXSP00C9-00CA201-202Cursor X-Y Pos. at Start of INPUT
SFDX00CB203Flag: Print Shifted Chars.
BLNSW00CC204Cursor Blink enable: 0 = Flash Cursor
BLNCT00CD205Timer: Countdown to Toggle Cursor
GDBLN00CE206Character Under Cursor
BLNON00CF207Flag: Last Cursor Blink On/Off
CRSW00D0208Flag: INPUT or GET from Keyboard
PNT00D1-00D2209-210Pointer: Current Screen Line Address
PNTR00D3211Cursor Column on Current Line
QTSW00D4212Flag: Editor in Quote Mode, $00 = NO
LNMX00D5213Physical Screen Line Length
TBLX00D6214Current Cursor Physical Line Number
00D7215Temp Data Area
INSRT00D8216Flag: Insert Mode, >0 = # INSTs
LDTB100D9-00F2217-242Screen Line Link Table / Editor Temps
USER00F3-00F4243-244Pointer: Current Screen Color RAM loc.
KEYTAB00F5-00F6245-246Vector Keyboard Decode Table
RIBUF00F7-00F8247-248RS-232 Input Buffer Pointer
ROBUF00F9-00FA249-250RS-232 Output Buffer Pointer
FREKZP00FB-00FE251-254Free 0-Page Space for User Programs
BASZPT00FF255BASIC Temp Data Area
0100-01FF256-511Micro-Processor System Stack Area
0100-010A256-266Floating to String Work Area
BAD0100-013E256-318Tape Input Error Log
BUF0200-02S8512-600System INPUT Buffer
LAT0259-0262601-610KERNAL Table: Active Logical File No's.
FAT0263-026C611-620KERNAL Table: Device No. for Each File
SAT026D-0276621-630KERNAL Table: Second Address Each File
KEYD0277-0280631-640Keyboard Buffer Queue (FIFO)
MEMSTR0281-0282641-642Pointer: Bottom of Memory for O.S.
MEMSIZ0283-0284643-644Pointer: Top of Memory for O.S.
TIMOUT0285645Flag: Kernal Variable for IEEE Timeout
COLOR0286646Current Character Color Code
GDCOL0287647Background Color Under Cursor
HIBASE0288648Top of Screen Memory (Page)
XMAX0289649Size of Keyboard Buffer
RPTFLG028A650Flag: REPEAT Key Used, $80 = Repeat
KOUNT028B651Repeat Speed Counter
DELAY028C652Repeat Delay Counter
SHFLAG028D653Flag: Keyboard SHIFT Key/CTRL Key/C= Key
LSTSHF028E654Last Keyboard Shift Pattern
KEYLOG028F-0290655-656Vector: Keyboard Table Setup
MODE0291657Flag: $00=Disable SHIFT Keys, $80=Enable
AUTODN0292658Flag: Auto Scroll Down, 0 = ON
M51CTR0293659RS-232: 6551 Control Register Image
MS1CDR0294660RS-232: 6551 Command Register Image
M51AJB0295-0296661-662RS-232 Non-Standard BPS (Time/2-100) USA
RSSTAT0297663RS-232: 6551 Status Register Image
BITNUM0298664RS-232 Number of Bits Left to Send
BAUDOF0299-029A665-666RS-232 Baud Rate: Full Bit Time (us)
RIDBE029B667RS-232 Index to End of Input Buffer
RIDBS029C668RS-232 Start of Input Buffer (Page)
RODBS029D669RS-232 Start of Output Buffer (Page)
RODBE029E670RS-232 Index to End of Output Buffer
IRQTMP029F-02A0671-672Holds IRQ Vector During Tape I/O
ENABL02A1673RS-232 Enables
02A2674TOD Sense During Cassette I/O
02A3675Temp Storage For Cassette Read
02A4676Temp D1 IRQ Indicator For Cassette Read
02A5677Temp For Line Index
02A6678PAL/NTSC Flag, 0= NTSC, 1 = PAL
02A7-02FF679-767Unused
IERROR0300-0301768-769Vector: Print BASIC Error Message
IMAIN0302-0303770-771Vector: BASIC Warm Start
ICRNCH0304-0305772-773Vector: Tokenize BASIC Text
IQPLOP0306-0307774-775Vector: BASIC Text LIST
IGONE0308-0309776-777Vector: BASIC Char. Dispatch
IEVAL030A-030B778-779Vector: BASIC Token Evaluation
SAREG030C780Storage for 6502 .A Register
SXREG030D781Storage for 5502 .X Register
SYREG030E782Storage for 6502 .Y Register
SPREG030F783Storage for 6502 .SP Register
USRPOK0310784USR Function Jump Instr (4C)
USRADD0311-0312785-786USR Address Low Byte / High Byte
0313787Unused
CINV0314-0315788-789Vector: Hardware Interrupt
CBINV0316-0317790-791Vector: BRK Instr. Interrupt
NMINV0318-0319792-793Vector: Non-Maskable Interrupt
IOPEN031A-031B794-795KERNAL OPEN Routine Vector
ICLOSE031C-031D796-797KERNAL CLOSE Routine Vector
ICHKIN031E-031F798-799KERNAL CHKIN Routine
ICKOUT0320-0321800-801KERNAL CHKOUT Routine
ICLRCH0322-0323802-803KERNAL CLRCHN Routine Vector
IBASIN0324-0325804-805KERNAL CHRIN Routine
IBSOUT0326-0327806-807KERNAL CHROUT Routine
ISTOP0328-0329808-809KERNAL STOP Routine Vector
IGETIN032A-032B810-811KERNAL GETIN Routine
ICLALL032C-032D812-813KERNAL CLALL Routine Vector
USRCMD032E-032F814-815User-Defined Vector
ILOAD0330-0331813-817KERNAL LOAD Routine
ISAVE0332-0333818-819KERNAL SAVE Routine Vector
&nsbp;0334-033B820-827Unused
TBUFFR033C-03FB828-1019Tape I/O Buffer
03FC-03FF1020-1023Unused
VICSCN0400-07FF1024-20471024 Byte Screen Memory Area
0400-07E71024-2023Video Matrix: 25 Lines X 40 Columns
07F8-07FF2040-2047Sprite Data Pointers
0800-9FFF2048-40959Normal BASIC Program Space
8000-9FFF32768-40959VSP Cartridge ROM - 8192 Bytes
A000-BFFF40960-49151BASIC ROM - 8192 Bytes (or 8K RAM)
C000-CFFF49152-53247RAM - 4096 Bytes
D000-DFFF53248-57343Input/Output Devices and Color RAM or Character Generator ROM or RAM - 4096 Bytes
E000-FFFF57344-65535KERNAL ROM - 8192 Bytes (or 8K RAM)
Source: Commodore 64 Memory Map

Date: 2012-01-17 20:34:28 CET

Author: Michael Kohl

Org version 7.7 with Emacs version 24

Validate XHTML 1.0