### How Novell's BootROM works.
It uses technique described above, saving original vector at 0:300h, and setting word at 0:304h to 6a6eh, which is flag telling that the vectors were changed. Then returns.
When invoked by INT 19h it first attempts to read boot sector from floppy A: - if succeed, it (A) restores original INT 19h vector and invokes it for BIOS to boot the computer as usually.
Next it check for presence of harddisk, and if present it does the following: 1. some video processing - moves cursor to home position, asks for video mode, if 7 assumes mono else sets mode 3 (=CO80) and sets cursor shape according to the mode, finally clears screen (assuming address 0B0000h for mono, 0B8000h for color mode, and usual size); 2. displays a question "Boot from Network (Y or N) ? ", and gets answer (if invalid it repeats the question), on N it displays CRLF and goes to A.
Then the code is moved to segment MemTop-900h, stack is set to 0:0c000h and jump is done to the moved code.
After the jump it initializes video as already described and displays "Novell Netware Remote Program Loader", driver info, and Novell's copyright, then enters boot loop. In the loop it:
- calls driver initialization code (2 procedures, the second may return error - ZF=0 means AX=offset of error message, in such a case it shows the message, displays "Error initializing network interface board" and waits 3 second, then retries)
- sends packet from socket 4A58 to broadcast address with socket 0452 (SAP=Service Advertisement Protocol socket) containing SAP query for nearest fileserver, and reads the reply; an immediate address of replying node will be used to route all requests, destination address net part will be used as net part of own address, and the FS address will be used to access the server
- sends NCP ATTACH request from socket 4A57 (note socket change: it prevents receiving replies to SAP query), and gets from the reply connection id (ATTACH only uses connection id 0FFh)
- sends LOGOUT request, error if no reply or invalid
- sends OPEN requests on the following files: BOOTCONF.SYS (on success it is scanned, using READ requests to get data from it, for line for this W/S, and file specified in it is tried first), then NET$DOS.SYS, IBM$DOS.SYS, first successfull open on image file causes boot to be done from it, error if all opens fail.
- on error a message is displayed, and after 3 second pause the loop is started from begin.
The BOOTCONF.SYS is scanned for 0x,=filename, any of these values can be 0 to match everything, preceding 0-s can be omitted, scanning countinues until first match or read error.
The boot is processed as follows: vectors 0F1h-0F4h are set to 5774:654E ("Netw"

, copy of vector 13h, new vector 13h (it is changed to point to code which reads boot image), and "boot terminate" vector, then a "bootsector" is read from boot image (the most recently opened file), sectors per track and number of heads are took from it, and jump to it is done; then read from floppy is serviced by reading the boot image file
Boot terminate sends DETACH request, and closes the socket used by the boot (see below why).
The boot image is still accessible when IPX driver is loaded by booted system. How? The BootROM contains own "mini-IPX" which on every request checks if real IPX was loaded, and in such a case opens socket (to be able to receive packets), and forwards all requests to the real IPX. This of course works well providing that network adapter will not be accessed until IPX is loaded - true is using IPX.COM containing driver, and usually true if NDIS driver is used - note some NDIS drivers, in spite specification demands they must not do it, initialize adapter when loaded, and cause the boot to fail.
How the Novell's BootROM is made? There is some code from Novell, and there is driver code from the network adapter manufacturer, probably they are two .OBJ-s and usual LINK can be used to produce .EXE, then DCONFIG/ECONFIG can be used to configure it (on image w/o .EXE header offsets would not match), and finally EXE2BIN to produce BootROM image.