The 5.21E ROM works file with the current board, but the 7.11A ROM uses a different pin for the vertical sync signal. This can be fixed, but then the 5.21E ROM results in no display. Rather than fixing the hardware (with a jumper to be changed when the ROM is changed), an attempt to patch the 7.11A ROM is attempted first. And as a first step, the 5.21E ROM is disassembled. It is smaller, only 8 kByte large, of which 3.6 kByte are the drivers.

One part of the problem is finding the configuration of the TGS Register in the EF9345 where the sync configuration is set.

Another problem is the ROM checksum. This is the part calculating the checksum:       

        ; summate all bytes $8000-$9FFF into B
Z8D3C   CLRA                             ;8D3C: 4F             'O'   ; A zerooed
        CLRB                             ;8D3D: 5F             '_'   ; B zeroed
        LDX     #M8000                   ;8D3E: CE 80 00       '...' ; ROM start address
LOOP    ADDB    ,X                       ;8D41: EB 00          '..'  ; [X] + B -> B
        ADCA    #$00                     ;8D43: 89 00          '..'  ; A + [$00] + C -> A
        INX                              ;8D45: 08             '.'   ; I++
        CPX     #MA000                   ;8D46: 8C A0 00       '...' ; ROM end address + 1
        BNE     LOOP                     ;8D49: 26 F6          '&.'  ; loop
        
        LDX     #M9FFC                   ;8D4B: CE 9F FC       '...' ; [9FFC] -> X  ; NMI handler ? (43 F5)
        SUBB    ,X                       ;8D4E: E0 00          '..'  ; B - [X] -> B
        SBCA    #$00                     ;8D50: 82 00          '..'  ; A - [$00] - C -> A
        SUBB    $01,X                    ;8D52: E0 01          '..'  ; B - [[$01]+X] -> B
        SBCA    #$00                     ;8D54: 82 00          '..'  ; A - [$00] - C -> A
        SUBD    ,X                       ;8D56: A3 00          '..'  ; D - M:M + 1 -> D
        BEQ     CHKOK                    ;8D58: 27 06          ''.'  ; branch when Checksum is ok
        LDX     #Z8FB6                   ;8D5A: CE 8F B6       '...' ; load Checksum error message pointer
        JSR     PRTMSG                   ;8D5D: BD 8C 2F       '../' ; print 0 terminated message on screen

The sum over the original 8kByte ROM is 0x0C452D.

When the 0x9FFC and 0x9FFD bytes are zeroed, the sum value of the ROM
(0x8000 - 0x9FF) is 0x43F5. This matches the original values at 0x8000 - 0x9FF.

Reversing this for a patched ROM:

• set 0x9FFC and 0x9FFD bytes to zero,
• add all byte values,
• insert the lowest two bytes in 0x9FFC and 0x9FFD.

The crude perl program for getting the checksum (which matches that of the Eprom programmer):

#!/usr/bin/perl

use strict;

my $byte;
my $byteStr;
my $address = 0;
my $sum = 0;
my $count = 0;

if ($ARGV[0] eq '') { die "Usage: perl binsum.pl <file.bin>"}

open BFH, "<$ARGV[0]" or die "binsum.pl cannot open file \'$ARGV[0]\'";;
binmode BFH;

while ( read BFH, $byte, 1 ) {
    my $byteVal = unpack("W", $byte);
    $sum = $sum + $byteVal;
    $count++;
#    print (sprintf("%06X", $sum) . "+" . $byteVal . " ");
}

close BFH;

print ("Count: ");
print (sprintf("0x%0X", $count) . "\n");
print ("Sum: ");
print (sprintf("0x%06X", $sum) . "\n");