Assuming that it's loaded with a 6502 program, I'd be a bit surprised if you couldn't find a way to dump the ROM contents directly from an Apple II that it is plugged into.  The I/O memory space is 2k, so if there is a larger ROM on board, you would have find a way to page through it.

regards,

Mike Willegal

[quote=grimakis]

Does anyone know if this ROM has been dumped already?

[/quote]

Not here:

http://mirrors.apple2.org.za/Apple%20II%20Documentation%20Project/Interface%20Cards/Serial/AE%20Serial%20Pro/

My Serial Pro has version 1.4:

www.ralf-kiefer.de/A2/AE_Serial_Pro_1.4.BIN

Regards

Ralf

[quote=Mike WIllegal]

Assuming that it's loaded with a 6502 program, I'd be a bit surprised if you couldn't find a way to dump the ROM contents directly from an Apple II that it is plugged into.  The I/O memory space is 2k, so if there is a larger ROM on board, you would have find a way to page through it.

regards,

Mike Willegal

[/quote]

You can use the monitor to relocate the ROM image from $C800-$Cfff down to somewhere like $2000 and then BSAVE it to disk.

I know this is a bit of a necro, but I just recently aquired an AE Serial Pro.  ROM images don't seem to be existent anywhere (even the above link for v1.4 is dead).  So I dumped my v2.0 using my backbit chiptester.  If it matters, the EEPROM ins a AM27C64.

AE Serial Pro 2.0.bin_.zip

On a sidenote, whats the best way to replace the presumably dead nicad pack on this?  I haven't actually tried the card out yet, and probably won't have a chance for a little bit.

Varta still makes this 'Mempac' style of rechargeable battery. Even though the cells are NiMH instead of NiCd, they promote them as being trickle-charge compatible as a result of a special electrode design.

See Varta 55615-703-012 (the last six digits match the old NiCd pack on the Serial Pro)

The old pack may or may not be dead. Usually what causes NiCd cells to die are dendrites that puncture the separator and form a short circuit between the electrodes. There are plenty of ideas online of ways to "zap" the dendrites using high voltages (obviously it must be done out of circuit)

Oh, nice. Thanks for the tip on the NiMH varta packs. 

You can make a poor-man's version of this card by installing a Dallas No-Slot-Clock (with a couple of pin modifications described in the manual) underneath the ROM chip of the Super Serial card.  Works beautifully.

As mentioned in my troubleshooting thread, here is the 1.4v ROM dump form the 2nd card I picked up.  If anyone is curious and smart enough to decompile and look through the differences, I'd be interested in hearing them.

AE Serial Pro 1.4.bin_.zip

Also, not sure if it's useful, but I dumped the PAL as well.  On the v1.4 ROM card, the PAL was stamped SP1A.  But on the 2.0 ROM card, it was stamped SP1A-Q.  But the resulting dumps of both using my backbit seem to be identical.  I have no idea if they are of use, but here they both are as well (even though they seem identical).

AE Serial Pro PAL.zip

• I have a quick disassebly of the AE Serial Pro 1.4, but I need to see a way how I can publish it on this forum in a readable format.  This WYSIWYG editor drives me nuts.

I attached both source codes with insightful labels and inline comments. And did it for both v1.4 and v2.0 firmware versions. Note that v2.0 essentially supports 'newer' printers.    

AE_SERIAL_PRO_1_4_STRUCTURED.TXT

AE_SERIAL_PRO_2_0_STRUCTURED.TXT

• I'm using the following assembler to turn it back into byte code:

 https://retroapplejs.github.io/#tab2

Inside the Applied Engineering Serial Pro: three ROM Banks, seven slot ROMs, in one clever 27C64 EPROM

The Applied Engineering Serial Pro looks, at first glance, like a fairly conventional Apple II serial card: a serial controller, a clock chip, some configuration switches, and an EPROM carrying the firmware. Once the firmware is dumped and followed across the Apple II memory map, however, the design turns out to be much more interesting.

My key discovery is that the large EPROM on the card is not a 2 KB ROM dedicated only to the Apple II expansion-ROM window. It is a 27C64, an 8 KB device, and Applied Engineering uses almost the entire image as one carefully organized firmware system.  It was a tedious disassembly exercise as I had to glue together many bits and pieces, even learning from a photo's , memory dumps on a real Apple II and a ROM readout I got from nick3092 (Thanks mate!).  Long story short, here's a manifest and the result of a long disassembly:

AE_SERIAL_PRO_2_0_STRUCTURED_SOURCE_MANIFEST.txt

All sources here below can be compiled using the following online assembler https://retroapplejs.github.io/#tab2

AE_SERIAL_PRO_2_0_SLOTROM_GENERIC_EXACT.S.txt

AE_SERIAL_PRO_2_0_BANK0_STRUCTURED_EXACT.S.txt

AE_SERIAL_PRO_2_0_BANK1_STRUCTURED_EXACT.S.txt

AE_SERIAL_PRO_2_0_BANK2_STRUCTURED_EXACT.S.txt

AE_SERIAL_PRO_2_0_EPROM_8K_PHYSICAL_EXACT.S.txt

One EPROM, two Apple II ROM windows

An Apple II peripheral can have a small slot-specific firmware page at $Cn00-$CnFF and can also use the shared expansion-ROM window at $C800-$CFFF. On a Serial Pro in slot 2, these become $C200-$C2FF and $C800-$CFFF.

Initially it was tempting to think that the 256-byte slot page might live in another ROM or in programmable logic. The full 8 KB dump settles the question: both firmware regions come from the same 27C64.  Other serial cards seem to use the same concept, but this card exposes 4 banks (3 banks exposed in I/O range $C800-$CFFF and one slot-dependent bank exposed in I/O range $Cs00-$CsFF, where 's' means slot number) 

The slot-2 page sits physically at $1A00-$1AFF. Slot 1 uses $1900, slot 3 uses $1B00, and so on through slot 7 at $1F00.

Those seven pages are not identical. Applied Engineering patched the absolute slot addresses, the slot I/O offset, and the slot-page high byte into each copy. A generic assembly source can therefore reproduce all seven versions simply by changing a SLOT constant.

The 256-byte SlotROM is much more than an ID block

The Serial Pro manual documents BASIC and Pascal entry points in the slot page. The recovered bytes show how compactly these were implemented.

At $Cs05, the byte $38 is both the Pascal 1.0 identification byte and the 6502 instruction SEC. Two bytes later, $18 is both the second Pascal identification byte and, when entered directly at $Cs07, the instruction CLC.

The Pascal 1.1 bytes are equally elegant. The four values 2E 34 3A 40 are offsets from $Cs00, and they point exactly to real initialization, read, write and status stubs at $Cs2E, $Cs34, $Cs3A and $Cs40.

The slot page also contains a common context routine that releases the current Apple II expansion-ROM owner, clears the Serial Pro bank state, restores the slot-specific I/O offset, and then allows execution to continue in the larger HostROM.

The fixed SlotROM is effectively the safe landing strip from which the card can change the larger $C800-$CFFF firmware underneath itself.

Three different ROMs all live at the same CPU addresses

The three 2 KB HostROM banks are all assembled to execute at $C800-$CFFF. Physically they occupy different parts of the EPROM, but the bank register decides which one the CPU sees.

Bank 0 contains the resident serial core: BASIC and Pascal I/O, 6551 handling, flow control, character translation, command parsing, delays and the bank-switch wrapper.

Bank 1 contains the configuration system. Its strings immediately reveal its role: DEVICE TYPE, BAUD RATE, DATA BITS, STOP BITS, PARITY, LINE LENGTH, and a list of graphics printers.

Bank 2 contains the more specialized code: clock formatting, high-resolution graphics printing, 40-column screen printing, 80-column screen printing and printer-specific raster tables.

The bank number is also an operation number

The bank register does something more subtle than select Bank 0, 1 or 2. Values such as $01, $09, $39, $1A and $2A are written to the register. The selected bank then keeps the original value in the 6502 X register and uses its higher bits to choose a routine from a dispatch table.

This produces meaningful selectors such as:

• $01 — initialize battery-backed configuration RAM
• $09 — open the control panel
• $39 — set baud rate
• $41 — set parity
• $49 — set the data format
• $1A — print Apple II high-resolution graphics
• $22 — print the 40-column screen
• $2A — print the 80-column screen
• $12 — BASIC-facing clock service

So the selector is simultaneously a hardware bank selector and a software operation selector. It is an economical way to turn a small EPROM and a handful of latch/PAL logic into a much larger logical firmware interface.

A cross-reference trick: calling SlotROM with RTS

The firmware also uses a calling convention that makes ordinary static disassembly easy to get wrong. Instead of always using JSR, HostROM code sometimes pushes a synthetic return address on the 6502 stack and executes RTS.

For example, pushing the slot-page high byte and then $83 makes RTS continue at $Cn84, because the 6502 increments the stacked address on return.

This revealed several private SlotROM services:

• $Cn68 — Apple display/vector bridge
• $Cn84 — clock/RAM write helper
• $Cn8C — final 6551 transmit-data write
• $Cn90 and $Cn94 — graphics-control-byte helpers
• $CnA9 — safe clock-image update
• $CnC7 — cross-slot expansion-ROM access and bank restoration

This is why a cross-reference pass over all three banks was essential. Several routines that looked orphaned from one bank were directly called from another through synthesized RTS entries.

The clock routine becomes clear when the raw EPROM wins

The first slot-page dump was dictated from Apple monitor photographs. It was remarkably accurate, but the complete EPROM corrected four visually ambiguous bytes. Three of them changed apparent STA instructions into LDA instructions, making the documented clock routine at $CsA9 immediately coherent.

The code waits for the 6818 clock's update-in-progress state to clear, reads clock registers $09 down through $00, and stores them into battery RAM $19 down through $10.

That gives software a stable clock image without racing the RTC while it updates its live time registers.

The strangest three bytes were real code after all

Another corrected byte changed an apparent JSR $0038 into JSR $003A. That initially looked too strange to be executable code. Bank 2 provided the missing context.

It temporarily installs a tiny routine at zero page $003A that releases the current expansion ROM, touches slot 3, reads from its $C800-$CFFF ROM, and returns. The Serial Pro SlotROM then restores its own context and reselects Bank 2.

This mechanism is used by the 80-column/screen-related code. It is a good illustration of how the Serial Pro cooperates with another Apple II peripheral while keeping control of its own banked firmware.

The printer support is a real multi-model graphics layer

The manual lists several supported graphics printers, and Bank 2 shows exactly how this was implemented. Battery-backed RAM location $29 selects a printer profile. The firmware contains command sequences for Epson, NEC/C. Itoh, Anadex, IDS, Okidata, ImageWriter and Mannesmann Tally families.

The graphics engine uses five phases: initialization, row setup, graphics-data prefix, row end and finish. Epson, for example, uses ESC K as its graphics-data prefix, while other printers receive entirely different sequences.

A second table contains printer-specific encodings for four raster widths:

Epson-style profiles use binary counts, while NEC and ImageWriter profiles use ASCII decimal widths. The ROM is therefore not just forwarding a bitmap: it contains a printer abstraction layer designed around the command languages of multiple 1980s serial printers.

And what about the DIP switches?

The board's switches are important, but they solve a different problem from the printer-profile tables.

The handshaking switches beside the PRINTER connector choose which physical DB-25 signal is treated as the printer-ready/flow-control line: RTS on pin 4, pin 11, secondary RTS on pin 19, or DTR on pin 20. With the switches open, DTR is the normal monitored line.

A second switch block controls whether interrupt outputs from the 6551 serial chip and the clock device are routed to IRQ or NMI.

The switches do not appear to choose the Epson, ImageWriter or Okidata firmware profile. That choice is stored in battery RAM and drives the Bank 2 command tables. The switches handle electrical compatibility; the ROM handles command-language compatibility.

While this is beyond the scope of this topic, but still a useful feedback about the Serial Pro v2.0 ROM capture:

I'm underway making this ROMs work on an emulator, at least I started with the easiest part, which is the RTC.

I've given the Serial Pro peripheral card default slot #2. The BASIC routine here below proves it works

10 FM$=":"

20 CALL 49911,FM$,TM$

30 PRINT TM$ 

Check it out at github.com/RetroAppleJS/RetroAppleJS.github.i

Next step will be to get a serial communication up and running, the firmware menu and all the different settings

Here's a demo I made for the Serial Pro RTC.

This demo was only tested on an emulator, so I'd be glad the owner of a Serial Pro card (in slot #2) can send me a screenshot

• Want to run it on an emulator?    github.com/RetroAppleJS/RetroAppleJS.github.io
• ProntoDOS disk containing the executable:  SERIAL_PRO_CLOCK.dsk
• Assembler source code: SERIALPRO_RTC_CLOCK.S

In the 'time' being, enjoy!

Screenshot 2026-08-20 at 10.33.43.png