So, conclusion is that Visor does not have Flash ROM. Can somebody explain how "patching" works with plain ROM? Where are the patches stored?
We learned that Visor is faster than IIIx and V because programmers removed some wait states and optimized code here an there. Actually, that is my concern.
There is a table stored in RAM of all of the ROM entrypoints. All ROM calls are redirected through this table. When a routine is patched the entrypoint address is changed to point to the new patched routine in RAM.
This is a very old technique, I did something like this back in 1978 to patch the keyboard routines of the old TRS-80 Model I. They had a keyboard bounce problem that caused repeated characters when you typed and my routine just had better debouncing logic.