I'm still studying the ROM to have a good information source for z88dk. I think I'm close to get a common source which will assemble to a byte-exact rom image of either the M100 and the KC85. The M10 is close to the Kyocera, so it will follow soon.
I was able to edit the ROM and alter the M100 ROM already but there's a surprising code portion at $725E which is probably unmovable: (...) (.. LD DE,KYRDBF+2) KYREAD_0: DEC C defb $FA ; JP M,KYREAD_1 ; Used by the routine at EI_NORM. L7260: LD L,C LD (HL),D LD A,(DE) LD (HL),A INC HL INC DE JP KYREAD_0 KYREAD_1: POP AF ; Enable interrupts as normal (nothing destroyed) ; ; Used by the routine at KYREAD. EI_NORM: PUSH AF LD A,$09 JR NC,L7260 RET As you see EI_NORM jumps in the middle of a conditional "JP M,nnnn", where the 2 bytes defining the address of KYREAD_1 are executed as MC opcodes. It means that shifting KYREAD_1 would alter its address and thus the opcodes to be eventually executed by EI_NORM. To me il looks rather like a protection than an optimization ;) Stefano
