From WikiTI
Jump to: navigation, search

ROM Page 1B / 3B / 7B

This page contains at the start a list of 3-byte vectors for ROM calls. This is then used by the B_CALL routine to determine what address on what page each ROM call resides. This is page 1B for the TI-83 Plus, 3B for the TI-84 Plus and 7B for the TI-83 Plus Silver Edition & the TI-84 Plus Silver Edition.


Each 3-byte vector contains an address and a page number. The address comes first, stored in little-endian format, followed by the page number.

Example Vector Table
Address Common Name LSB Addr. Ptr. MSB Addr. Ptr. Page Number
4000 JErrorNo C7 25 00
4003 FontHook A3 77 7B
4006 LocalizeHook 44 77 7B

Note: The preceding values were obtained from TI-OS v1.15. Values on other OSs are most likely to differ.

In this manner, TI can change the address pointer and page of the actual routine on a different OS version (e.g. they needed to update a section of code) and the B_CALL routine would still point to the correct page and address.

See Also

ROM Page 1F / 3F / 7F

Boot Code page. Hardware-specific. Currently know Boot Code page versions are 1.00 and 1.02.

  • This page contains a list of 3-byte vectors for ROM calls, starting at $4018.
  • There appears to be a partial Large Font table starting at 1.00:$6D81 / 1.02:$7184 (Boot Code version:address) containing $F1 characters, excluding the null. (Meaning that at that address, you will find the character whose ASCII code is $01 instead of $00). Each table entry (which corresponds with each character sprite) is in the form: width, 7-byte right-aligned sprite.
  • A null-terminated string representation of the current Boot Code version is at $400F. E.g. "1.02 "
  • The vector at address $4084 points to the following pseudocode routine:
 ld hl,0
 ld (844B),hl
 ld hl,pointer->.db "BOOT Code ",0
 call PutS
 ld hl,pointer->.db "1.0X ",0
 call PutS
Knowing this, you can find the pointer to the string "BOOT Code ", which is the first entry of the following series of null-terminated strings:
"BOOT Code ", "FLASH", "RAM", "ID", "OK", " FAILED", "Testing flash", "Waiting...", "Please Install", "operating", "system now."
You can also find the pointer to the Boot Code's version of PutS.
  • 1.00:$5EB3 / 1.02:$5EF7 contains the following series of null-terminated strings:
"Receiving...", "Operating", "System", "ERROR!", "Press any key to", "turn unit off.", "Then turn unit", "back on.", "Validation Error", "Validating...", "your batteries", "are low.", "Battery", "change is", "required."
In version 1.02, this series is immediately followed by the null-terminated string "Version Error ".

ROM Page 34 / 74

Contains exclusively USB-related routines.

ROM Page 35 / 75

(highly likely) also contains USB-related routines.

ROM Page 36 / 76

Is the bulk of the DUSB protocol code.

ROM Page 37 / 77

Contains a bunch of app related utility routines (like the ones to parse for the openlib/usb app headers) and had about 6KB of free space in 2.30


Special Thanks