├── README.md ├── ibm_5150 ├── ZEROPAGE.BIN ├── ibm5150_821027.idb └── ibm5150_821027.lst ├── ibm_8530-286 ├── 27f4092-e0000-fffff.bin ├── 27f4092-e0000-fffff.idb ├── ibm-8530-61x3940-f000-ffff.bin ├── ibm-8530-61x3940-f000-ffff.idb └── odd_even.py ├── ibm_pcjr ├── README.md ├── bios-f0000-fffff.idb ├── ibm_pcjr-bios.lst └── zeropage.bin ├── roms ├── ibm-5150-821027-fe000-fffff.bin ├── ibm-pcjr-f0000-fffff.bin ├── tandy-1000-fc000-fffff.bin ├── tandy-1000a-fc000-fffff.bin └── tandy-1000hx-fc000-fffff.bin ├── tandy_1000 ├── README.md ├── tandy-1000-fc000-fffff.idb ├── tandy-1000-fc000-fffff.lst └── zeropage.bin ├── tandy_1000a └── tandy-1000a-fc000-fffff.idb └── tandy_1000hx ├── README.md ├── int_vector_0000_0400.bin ├── misc ├── tandy_1000_hx_charset.bin └── tandy_1000_hx_charset.vchar64proj ├── tandy_1000_hx_fc000-fffff.idb └── tandy_1000_hx_fc000-fffff.lst /README.md: -------------------------------------------------------------------------------- 1 | # Disassembled BIOS from 8088 machines 2 | 3 | * Tandy 1000 4 | * Tandy 1000a 5 | * Tandy 1000 HX 6 | * IBM PCjr 7 | * IBM PC 5150 8 | 9 | 10 | Looking BIOS roms for: 11 | 12 | * Tandy 1000 HD 13 | * Tandy 1000 EX 14 | 15 | 16 | ## ROMS + disassembly 17 | 18 | * Original ROMS are in the `roms` folder. 19 | * Disassembly in the subfolders. Created using [IDA PRO freeware version][1]. Direct link [idafree50.exe][2] 20 | 21 | 22 | 23 | [1]: https://www.scummvm.org/news/20180331/ 24 | [2]: https://downloads.scummvm.org/frs/extras/IDA/idafree50.exe 25 | 26 | -------------------------------------------------------------------------------- /ibm_5150/ZEROPAGE.BIN: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_5150/ZEROPAGE.BIN -------------------------------------------------------------------------------- /ibm_5150/ibm5150_821027.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_5150/ibm5150_821027.idb -------------------------------------------------------------------------------- /ibm_5150/ibm5150_821027.lst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_5150/ibm5150_821027.lst -------------------------------------------------------------------------------- /ibm_8530-286/27f4092-e0000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_8530-286/27f4092-e0000-fffff.bin -------------------------------------------------------------------------------- /ibm_8530-286/27f4092-e0000-fffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_8530-286/27f4092-e0000-fffff.idb -------------------------------------------------------------------------------- /ibm_8530-286/ibm-8530-61x3940-f000-ffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_8530-286/ibm-8530-61x3940-f000-ffff.bin -------------------------------------------------------------------------------- /ibm_8530-286/ibm-8530-61x3940-f000-ffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_8530-286/ibm-8530-61x3940-f000-ffff.idb -------------------------------------------------------------------------------- /ibm_8530-286/odd_even.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # ---------------------------------------------------------------------------- 3 | # converts .sid to .exo (crunched exomizer) 4 | # ---------------------------------------------------------------------------- 5 | ''' 6 | Little tool to display SID info 7 | ''' 8 | import sys 9 | import os 10 | import struct 11 | import subprocess 12 | 13 | 14 | __docformat__ = 'restructuredtext' 15 | 16 | 17 | def run(odd_filename, even_filename): 18 | even_buf = None 19 | odd_buf = None 20 | 21 | with open(even_filename, "rb") as fd: 22 | even_buf = fd.read() 23 | 24 | with open(odd_filename, "rb") as fd: 25 | odd_buf = fd.read() 26 | 27 | print(type(even_buf)) 28 | print(dir(even_buf)) 29 | 30 | with open('output.bin', "wb") as fd: 31 | for i in range(len(even_buf)): 32 | b = even_buf[i:i+1] 33 | fd.write(b) 34 | b = odd_buf[i:i+1] 35 | fd.write(b) 36 | 37 | 38 | def help(): 39 | print("%s v0.1 - Utility tha converts .sid to .exo (crunched exomizer) files\n" % os.path.basename(sys.argv[0])) 40 | print("Example:\n%s *.sid" % os.path.basename(sys.argv[0])) 41 | sys.exit(-1) 42 | 43 | 44 | if __name__ == "__main__": 45 | if len(sys.argv) != 3: 46 | help() 47 | 48 | run(sys.argv[1], sys.argv[2]) 49 | -------------------------------------------------------------------------------- /ibm_pcjr/README.md: -------------------------------------------------------------------------------- 1 | # IBM PCjr BIOS 2 | 3 | ![IBM PCjr BIOS dump](https://lh3.googleusercontent.com/QwPdCQFbS4grTTTnEg0aZ1cxE2p2RzSpIH14RtQnXLq9mvLWZoXWBrOtN_WNUs10ocaQ-gvGGSAkjTsx78_RBw0NoiBoYXTEu6hV8MJ68vxkkysJznNz7yVmCDFmdc5h3xHmy23HnPM) 4 | 5 | 6 | Comments were taken from the [IBM PCjr Technical Reference Guide][0]. 7 | Only the comments between brackets and the comments in the BASIC section are from my own. 8 | 9 | Includes the the code located from `f000:0000` to `f000:ffff`. 10 | 11 | This is WIP. Far from complete. I do it in a _let's see how this code works_ basis. 12 | 13 | Using [IDA PRO freeware version][1] 14 | 15 | ## Hidden diagnostic modes 16 | 17 | Detailed description: 18 | 19 | * [IBM PCjr zero-day vulnerability report][2] 20 | 21 | TL;DR;: 22 | 23 | * Connect two joysticks 24 | * Press `Ctrl` + `Alt` + `Insert` keys to enter into diagnostics mode 25 | * Immediately after that, do: 26 | * Press: Joy 1 button B, and Joy 2 buttons A & B for Manufacturing burn-in mode: enters diag loop mode without the diag screen 27 | * Press: Joy 1 button A, and Joy 2 buttons A & B for Manufacturing system test mode: enters boot loop. Keeps booting 28 | * Press: Joy 1 buttons A & B, and Joy 2 button B for Service loop-post mode: displays all diagnostics options, even if the hardware is not present 29 | * Press: Joy 1 buttons A & B, and Joy 2 button A for Service system-test mode 30 | * Press: Joy 1 buttons A & B, and joy 2 buttons A & B: enters boot loop with sound test 31 | 32 | 33 | [0]: https://archive.org/details/IbmPcjrTechnicalReference 34 | [1]: https://www.hex-rays.com/products/ida/support/download_freeware.shtml 35 | [2]: https://retro.moe/2018/01/15/ibm-pcjr-zero-day-data-destroy-vulnerability/ 36 | -------------------------------------------------------------------------------- /ibm_pcjr/bios-f0000-fffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_pcjr/bios-f0000-fffff.idb -------------------------------------------------------------------------------- /ibm_pcjr/ibm_pcjr-bios.lst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_pcjr/ibm_pcjr-bios.lst -------------------------------------------------------------------------------- /ibm_pcjr/zeropage.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/ibm_pcjr/zeropage.bin -------------------------------------------------------------------------------- /roms/ibm-5150-821027-fe000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/roms/ibm-5150-821027-fe000-fffff.bin -------------------------------------------------------------------------------- /roms/ibm-pcjr-f0000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/roms/ibm-pcjr-f0000-fffff.bin -------------------------------------------------------------------------------- /roms/tandy-1000-fc000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/roms/tandy-1000-fc000-fffff.bin -------------------------------------------------------------------------------- /roms/tandy-1000a-fc000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/roms/tandy-1000a-fc000-fffff.bin -------------------------------------------------------------------------------- /roms/tandy-1000hx-fc000-fffff.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/roms/tandy-1000hx-fc000-fffff.bin -------------------------------------------------------------------------------- /tandy_1000/README.md: -------------------------------------------------------------------------------- 1 | # Tandy 1000 BIOS disassembly 2 | 3 | Work in progress 4 | -------------------------------------------------------------------------------- /tandy_1000/tandy-1000-fc000-fffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000/tandy-1000-fc000-fffff.idb -------------------------------------------------------------------------------- /tandy_1000/tandy-1000-fc000-fffff.lst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000/tandy-1000-fc000-fffff.lst -------------------------------------------------------------------------------- /tandy_1000/zeropage.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000/zeropage.bin -------------------------------------------------------------------------------- /tandy_1000a/tandy-1000a-fc000-fffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000a/tandy-1000a-fc000-fffff.idb -------------------------------------------------------------------------------- /tandy_1000hx/README.md: -------------------------------------------------------------------------------- 1 | # Tandy 1000HX BIOS 2 | 3 | ## What is this 4 | 5 | The Tandy 1000hx BIOS disassembled. 6 | 7 | This is still WIP. 8 | 9 | ## TODO: 10 | 11 | - Finish analyzing graphics code 12 | - Finish analyzing EEPROM code 13 | - Finish analyzing keyboard code 14 | - Analyze all the floppy disk handler 15 | - And analyze what's left 16 | - Review IDA Pro autogenerated comments. Some of them are not valid for the Tandy 17 | - And probably much more 18 | 19 | 20 | ## How to read it 21 | 22 | - Open the [.lst file][5] with a text editor 23 | - Or open the [.idb][6] file with [IDA Pro][3] (I used the [freeware version][4]) 24 | 25 | 26 | ## EEPROM 27 | 28 | There are 4 words (1 word == 2 bytes) to store data. 29 | 30 | word 0 31 | 32 | 15: 33 | 14: 34 | 13: 35 | 12: 36 | 11: 37 | 10: 38 | 9: 39 | 8: 40 | 7: 41 | 6: 42 | 5: 43 | 4: 44 | 3: 0=7.16 Mhz. 1=4.77 Mhz. 45 | 2: Should be 0, otherwise "word_1019f" is 0xffff 46 | 1: Drive B: 0=3 1/2, 1=5 1/4 (or the other way round?) 47 | 0: Drive A: 0=3 1/2, 1=5 1/4 (or the other way round?) 48 | 49 | word 1 50 | 51 | 15: 52 | 14: 53 | 13: 54 | 12: 55 | 11: 56 | 10: 57 | 9: 58 | 8: 59 | 7: 60 | 6: 61 | 5: 62 | 4: 63 | 3: 64 | 2: 65 | 1: 66 | 0: video card: 0=color, 1=monochrome 67 | 68 | word 2 69 | 70 | 15: 71 | 14: 72 | 13: 73 | 12: 74 | 11: 75 | 10: 76 | 9: 77 | 8: 78 | 7: 79 | 6: 80 | 5: 81 | 4: 82 | 3: 83 | 2: 84 | 0,1: number of diskettes installed minus 1 85 | 86 | 87 | word 3 88 | 89 | 15: 90 | 14: 91 | 13: 92 | 12: 93 | 11: 94 | 10: 95 | 9: 96 | 8: 97 | 7: 98 | 6: 99 | 5: 100 | 4: 101 | 3: 102 | 2: 103 | 1: 104 | 0: 105 | 106 | 107 | ## References 108 | 109 | - [Tandy 1000 HX Technical Rerefence Manual][0] 110 | - [x86 Instruction Set Reference][1] 111 | - [Assembly Language - Norton Guide][2] 112 | 113 | 114 | [0]: http://bit.ly/2vZjZEO 115 | [1]: https://c9x.me/x86/ 116 | [2]: http://www.ousob.com/ng/asm/index.php 117 | [3]: https://www.hex-rays.com/products/ida 118 | [4]: https://www.hex-rays.com/products/ida/support/download_freeware.shtml 119 | [5]: https://github.com/ricardoquesada/tandy1000hx-bios/blob/master/tandy_1000_hx_fc000-fffff.lst 120 | [6]: https://github.com/ricardoquesada/tandy1000hx-bios/blob/master/tandy_1000_hx_fc000-fffff.idb 121 | -------------------------------------------------------------------------------- /tandy_1000hx/int_vector_0000_0400.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000hx/int_vector_0000_0400.bin -------------------------------------------------------------------------------- /tandy_1000hx/misc/tandy_1000_hx_charset.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000hx/misc/tandy_1000_hx_charset.bin -------------------------------------------------------------------------------- /tandy_1000hx/misc/tandy_1000_hx_charset.vchar64proj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000hx/misc/tandy_1000_hx_charset.vchar64proj -------------------------------------------------------------------------------- /tandy_1000hx/tandy_1000_hx_fc000-fffff.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000hx/tandy_1000_hx_fc000-fffff.idb -------------------------------------------------------------------------------- /tandy_1000hx/tandy_1000_hx_fc000-fffff.lst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ricardoquesada/bios-8088/6dc405d3db57b9bb7042aabdd2428400195d3547/tandy_1000hx/tandy_1000_hx_fc000-fffff.lst --------------------------------------------------------------------------------