Changes

Jump to: navigation, search

Z80 - undocumented opcodes

82 bytes added, 10:11, 10 September 2008
The [[Z80|Z80]] CPU contains several undocumented opcodes, which can be quite helpful sometimes. The most useful undocumented opcodes are probably these ones, which split up the 16bit index registers IX and IY in 8bit registers called IXL,IXH,IYL and IYH.
Please note, that many Z80 successors like the Z180 are NOT able to execute some of the following opcodes properly.
This is just an overview. Parts of this article have been copied from the [http://www.robsy.net/z80undoc.pdf "The Undocumented Z80 Documented" originally by Sean Young]and currently maintained by Jan Wilmans, which is one of the most comprehensive descriptiondescriptions around.
== CB prefix ==
The following commands set the lowest bit to 1 instead to 0:<pre>CB30 SLL B
CB31 SLL C
CB32 SLL D
CB36 SLL (HL)
CB37 SLL A
</pre>== DD and FD prefixes ==
== The DD and /FD prefixes ==replace the registers L, H or HL with IXL/IYL, IXH/IYH or IX/IY. <pre>DB #DD:LD H,A -&gt; LD IXH,ADB #FD:LD B,L -&gt; LD B,IYL</pre> Note: These registers are called LX, LY, HX and HY in the WinAPE assembler.
The DD/FD prefixes replace the registers L, H or HL with IXL/IYL, IXH/IYH or IX/IY.<pre>DB #DD:LD H,A -> LD IXH,ADB #FD:LD B,L -> LD B,IYL</pre>== ED prefix ==
Note: These registers There are called LXa number of undocumented EDxx instructions, LY, HX and HY in the WinAPE assemblerof which most are duplicates of documented instructions. Any instruction not listed has no effect (same behaviour as 2 NOP instructions).
== ED prefix == There are a number of undocumented EDxx instructions, of which most are duplicates of documented instructions. Any instruction not listed has no effect (same behaviour as 2 NOP instructions). The complete list except for the block instructions:<pre>ED40 IN B,(C) ED60 IN H,(C)
ED41 OUT (C),B ED61 OUT (C),H
ED42 SBC HL,BC ED62 SBC HL,HL
ED5F LD A,R ED7F NOP *
* = undocumented opcodes
</pre>== DDCB prefix ==
== DDCB prefix == The undocumented DDCB instructions store the result (if any) of the operation in one of the seven all-purpose registers, which one depends on the lower 3 bits of the last byte of the opcode (not operand, so not the offset). <pre>000 B
001 C
010 D
110 (none: documented opcode)
111 A
</pre> The documented DDCB0106 is RLC (IX+01h). So, clear the lower three bits (DDCB0100) and something is done to register B. The result of the RLC (which is stored in (IX+01h)) is now also stored in register B. Effectively, it does the following:<pre>LD B,(IX+01h)
RLC B
LD (IX+01h),B
</pre>So you get double value for money. The result is stored in B and (IX+01h). The most common notation is: RLC (IX+01h),B
I’ve once seen this notation:<pre>RLC (IX+01h)
LD B,(IX+01h)
</pre>That’s not correct: B contains the rotated value, even if (IX+01h) points to ROM. The DDCB SET and RES instructions do the same thing as the shift/rotate instructions:<pre>DDCB10C0 SET 0,(IX+10h),B
DDCB10C1 SET 0,(IX+10h),C
DDCB10C2 SET 0,(IX+10h),D
DDCB10C6 SET 0,(IX+10h) - documented instruction
DDCB10C7 SET 0,(IX+10h),A
</pre>So for example with the last instruction, the value of (IX+10h) with bit 0 set is also stored in register A.
So for example with the last instruction, the value of (IX+10h) with bit 0 set is also stored in register A. The DDCB BIT instructions do not store any value; they merely test a bit. That’s why the undocumented DDCB BIT instructions are no different from the official ones: <pre>DDCB d 78 BIT 7,(IX+d)
DDCB d 79 BIT 7,(IX+d)
DDCB d 7A BIT 7,(IX+d)
DDCB d 7E BIT 7,(IX+d) - documented instruction
DDCB d 7F BIT 7,(IX+d)
</pre> == FDCB prefix ==
Same as for the DDCB prefix, though IY is used instead of IX.
== Web links ==
* [http://www.robsy.net/z80undoc.pdf "The Undocumented Z80 Documented" by Sean Young at Robsy's MSX Workshop]* [http://www.raww.org/index.php?name=News&file=article&sid=2226 Short information about the internal "MEMPTR" 16bit register of the Z80 and its influence on the F-Register]
[[Category:Programming]]
2
edits