The Briel Replica 1 plus uses a 27c128 EPROM for its firmware. I have tested doubling the firmware, to a 27c256, and adding a SPDT to pull A14 high/low. You can actually put the firmware in the upper half (or both halves) of a 27c256 without modifcation to the briel, as pin 27 is held high (+5) on the PCB. But by lifting pin 27 (A14) of the 27c256 out of socket, and tying it to that SPDT with gnd/5v (low/high), I am effectively doubling the ROM space available on my machine. Problem is, I could use some guidance on positioning and formatting of the data.
Right now, were I to "black box" it and just guess, I would literally dump the whole memory 0000.FFFF and then correlate the chunks to the EPROM dump. The manual for the R1+ shows a memory location reference, but, I need to correlate the memory ranges as the CPU sees them to the location and format of data within the EPROM.
One curious thing, looking at the schematic of the R1, is it seems the jumper for integer vs applesoft basic is a jumper to ground out A13 from its pull-up resistor. To me this implies the ROM should be cut in half, and the only difference should be integer vs applesoft lite BASIC, but this isn't the case from what I see. Krusader is in the ROM dump in what appears to be little endian format, but it's only in there once. I just enabled applesoft basic via jumper and Krusader isn't available, so it's possible the rom is doubled (i.e. this jumper already selects high/low half of the existing EPROM), but I don't see much or anything repeating. So either I'm mis-reading the schmeatic, there is some other trick going on there, or both.
When I first did the bank switch experiment with A14 on the 27c256 I had P-LAB (Claudio) change the initialization vector to the address for the SD OS. Functionally this would have given a switch that changes the reset button to also launch back into the SD OS instead of woz mon. The problem is that the PIA doesn't get initialized if you jump straight to another program. Uncle Bernie told me via email recently "The PIA initialization in the Apple-1 relies on an undocumented feature / bug in the PIA. I don't remember exactly how that goes. But if you copy exactly the same code as in the beginning of the Wozmon then it will be properly initialized. The trick seems to work only if this exact sequence comes after the RESET (which the PIA sees via its !RES pin) before any other thing is done to the PIA."
I foresee a couple things if we can easily reconstruct an image for the 2nd region of the ROM. first, a modified image which still uses wozmon on reset, but replaces the assembler with a dissassembler or some other tool, and/or otherwise reallocaes space used for things like CFFA1. Alternately depending on how the ROM is read, an entire 16K of other data (Or 2 additional 8K banks changeable by the Applesoft jumper). If reset is issued on the normal firmware, and then the bank switched, could you not execute machine code on the EPROMs other region then? It's a dirty trick, but I have to ask :) Cleaner of course would be to find the code Uncle Bernie referenced and prepend it to whatever program you want the EPROM to have available, and set the start point in the ROM, as then, the reset button might actually work.