Image: V2_AC_Interleaved_XHE_XHO.bin
(8192 bytes, 0000h–1FFFh)
Firmware: Executive Revision 2.00 (AC) —
VECTOR GRAPHIC SX/5000 [XH]
CPU: Z80 (8086 boot code is not
present in ROM code)
radare2 -a z80 -b 8 -m 0x0000 V2_AC_Interleaved_XHE_XHO.binFor addresses only, use Quick reference.
Reading order for reverse-engineering:
- Overview
- Reset / entry path
- Floppy load path → simple
boot
- Type 21h SYSTEM
FILE → full SYSTEM FILE
- Winchester load
path
- Handoff 13A9 → FF4C + Dual-CPU architecture
Find by task
| I want to… | Go here |
|---|---|
| Understand cold reset → menu | Reset / entry path |
| Boot a custom floppy that prints Hello | How to boot floppy |
| Boot a custom Winchester LBA 0 image | How to boot hard disk |
Follow floppy [F] validation +
simple/JP 2400 |
Floppy load path |
Follow type-21h SYSTEM FILE → JP FF4C |
Type 21h SYSTEM FILE |
Follow Winchester [W] / auto-boot
1072 |
Winchester load path |
| Find HD CHS / geometry constants | Winchester parameters (none fixed in ROM) |
| Understand self-test / menu [T] | Self-test suite |
| Understand type21 handoff + mapper walk | Handoff 13A9 → FF4C |
| Understand Z80 vs 8086 roles | Dual-CPU architecture |
| Look up error message / code | Error codes |
Look up RAM/ports/20xx vars |
Memory map |
| Look up jump table / geometry / strings | Data tables |
| Jump to a known address using radare2 | Quick reference |
| Read linear disassembly | disasm/ |
Find by address entry points
| Address | Topic | Doc |
|---|---|---|
0000 / 0036 |
Cold reset | Reset / entry path |
012B |
Auto-boot | Reset / entry path |
014F |
Main menu | Reset / entry path |
01B2 / 01D2 |
Continuous test / test suite | Self-test suite |
1000 |
Floppy load | Floppy load path |
1066 / 1072 |
Winchester load | Winchester load path |
10B8 |
Type 21h SYSTEM FILE |
Type 21h SYSTEM FILE |
13A9 → FF4C |
Final handoff | Handoff 13A9 → FF4C |
1434 / 14A8 / 1638 |
Disk driver | disasm/05-helpers-disk.asm, Winchester parameters |
2400 |
SYSTEM header buffer | Memory map, load docs |
09AA |
Config id (C8h this dump) |
Data tables, Winchester parameters |
Analysis
| File | Topic |
|---|---|
| Reset / entry path | Cold reset 0000 → menu 014F, auto-boot,
key dispatch |
| Floppy load path | Menu [F] → 1000 (simple + type
branch) |
| Type 21h SYSTEM FILE | Type 21h full SYSTEM FILE → JP 13A9 |
| Winchester load path | Menu [W] → 1066 / helper
1072 |
| Self-test suite | Self-test suite @01D2 (PROM / kbd / disk / memory) |
| Handoff 13A9 → FF4C | Type21 final handoff 13A9 → JP FF4C |
| Dual-CPU architecture | Z80/8086 roles, ports, 8086 scan, transfer model |
Reference
| File | Topic |
|---|---|
| Memory map | ROM/RAM regions, 20xx vars, handoff block, I/O
ports |
| Data tables | Jump table, menu keys, I/O init, floppy geometry, CRTC, config, strings |
| Error codes | Hardware (155D) + system (11C0) +
self-test fault strings |
| Winchester parameters | Full HD/Winchester parameter scan: config keys, unit-0 constants, no fixed CHS |
| Quick reference | radare2 seeks + key addresses + boot decision trees |
How to …
Practical guides
| File | Topic |
|---|---|
| How to boot floppy | Minimal simple-boot floppy → print “Hello. We booted!” |
| How to boot hard disk | Minimal Winchester LBA 0 image (config +0B =
09AA) |
Disassembly
Relative branch targets are fixed (radare2 often prints the offset byte instead of the destination).
| File | Coverage |
|---|---|
| 00-jump-table.asm | 0000–0035 vectors |
| 01-reset-entry.asm | 0036–01D0 cold boot → menu → keys |
| 02-floppy-load.asm | 1000–11BD floppy + type21
orchestration |
| 03-type21-helpers.asm | 11C0–1432 dir / map / load / handoff
setup |
| 04-helpers-console.asm | kbd / print / putchar / bank / stub source |
| 05-helpers-disk.asm | 1434–16DB disk driver |
| 06-winchester-load.asm | 1066 / 1072 + unit-0 paths |
| 07-system-test.asm | 01B2 / 01D2–03BF test
suite |
| 08-handoff-13A9.asm | Handoff 13A9–1432, stub,
0420 |
| type21-outline.asm | Compact type21 annotated outline |
Status
| Area | Status |
|---|---|
| ISA: Z80 Executive (not 8086 boot) | Done |
| Reset / menu / keys F·T·W | Done |
Floppy load + type 21h → JP FF4C |
Done |
Winchester 1066 / 1072 |
Done |
Self-test suite 01D2 |
Done |
Handoff 13A9 setup |
Done (FF4C bytes need real SYSTEM
disk) |
Dual-CPU notes (no 8086 code in ROM; port 02 +
EA@67F0) |
Done |
Real disk image (SYSTEM name / FF4C / 8086 start
hardware) |
Open |
| Fixed Winchester CHS in ROM | None (geometry from media header) |
Conventions used in these docs
- Base address
0000has seen by the Z80 Executive
- Strings often bit-7 terminated (printer
03E4)
- Prefer flow-following; mixed code/data breaks pure linear disasm
