Difference between revisions of "Snapshot"
(→ROMS (Winape)) |
(→DSCA,DSCB (Winape and ACE)) |
||
| Line 552: | Line 552: | ||
This option must be enabled in Winape for this chunk to be saved. | This option must be enabled in Winape for this chunk to be saved. | ||
| + | |||
| + | This option must be enabled in ACE for this chunk to be loaded and saved. | ||
| + | |||
| + | == TAPE (ACE) == | ||
| + | |||
| + | The TAPE block contains the filename of the tape image inserted. The filename is stored as 8-bit ASCII (any Unicode characters with codes 0x100 or above will be translated to ? and therefore filenames with these characters can't be stored in Snapshots). The length of the block is the length of the filename in bytes. | ||
This option must be enabled in ACE for this chunk to be loaded and saved. | This option must be enabled in ACE for this chunk to be loaded and saved. | ||
Revision as of 04:50, 24 April 2021
Contents
- 1 Snapshot (.SNA) file format
- 2 Version 1
- 3 Changes and additions in Version 2 from Version 1
- 4 Changes and additions in Version 3 from Version 2
- 5 Version 3 Chunks
- 6 Links
Snapshot (.SNA) file format
The format was first defined for the CPCEMU emulator but is now widely supported. The format was originally defined by Marco Vieth. Version 3 was defined by Ulrich Doewich, Martin Korth, Richard Wilson and Kevin Thacker.
There are 3 versions defined in this document. Version 3 is the most recent and is currently supported by a few of the most recent emulators.
Snapshots produced with CPCE appears to be the most compatible and will run correctly using any emulator.
Abbreviations:
- GA = "Gate Array"
- CRTC = "6845 Cathode Ray Tube Controller"
- PPI = "Intel 8255 Programmable Peripheral Interface"
- PSG = "AY-3-8912 Programmable Sound Generator"
Version 1
| Offset (Hex) | Count | Description |
| 00-07 | 8 | The identification string "MV - SNA". This must exist for the snapshot to be valid. |
| 08-0f | 8 | (not used; set to 0) |
| 10 | 1 | snapshot version (1) |
| 11 | 1 | Z80 register F |
| 12 | 1 | Z80 register A |
| 13 | 1 | Z80 register C |
| 14 | 1 | Z80 register B |
| 15 | 1 | Z80 register E |
| 16 | 1 | Z80 register D |
| 17 | 1 | Z80 register L |
| 18 | 1 | Z80 register H |
| 19 | 1 | Z80 register R |
| 1a | 1 | Z80 register I |
| 1b | 1 | Z80 interrupt flip-flop IFF0 (note 2) |
| 1c | 1 | Z80 interrupt flip-flop IFF1 (note 2) |
| 1d | 1 | Z80 register IX (low) (note 5) |
| 1e | 1 | Z80 register IX (high) (note 5) |
| 1f | 1 | Z80 register IY (low) (note 5) |
| 20 | 1 | Z80 register IY (high) (note 5) |
| 21 | 1 | Z80 register SP (low) (note 5) |
| 22 | 1 | Z80 register SP (high) (note 5) |
| 23 | 1 | Z80 register PC (low) (note 5) |
| 24 | 1 | Z80 register PC (high) (note 5) |
| 25 | 1 | Z80 interrupt mode (0,1,2) (note 3) |
| 26 | 1 | Z80 register F' (note 4) |
| 27 | 1 | Z80 register A' (note 4) |
| 28 | 1 | Z80 register C' (note 4) |
| 29 | 1 | Z80 register B' (note 4) |
| 2a | 1 | Z80 register E' (note 4) |
| 2b | 1 | Z80 register D' (note 4) |
| 2c | 1 | Z80 register L' (note 4) |
| 2d | 1 | Z80 register H' (note 4) |
| 2e | 1 | GA: index of selected pen (note 10) |
| 2f-3f | 1 | GA: current palette (note 12) |
| 40 | 1 | GA: multi configuration (note 11) |
| 41 | 1 | current RAM configuration (note 13) |
| 42 | 1 | CRTC: index of selected register (note 14) |
| 43-54 | 1 | CRTC: register data (0..17) (note 15) |
| 55 | 1 | current ROM selection (note 16) |
| 56 | 1 | PPI: port A (note 6) |
| 57 | 1 | PPI: port B (note 7) |
| 58 | 1 | PPI: port C (note 8) |
| 59 | 1 | PPI: control port (note 9) |
| 5a | 1 | PSG: index of selected register (note 17) |
| 5b-6a | 1 | PSG: register data (0,1,....15) |
| 6b | 2 | memory dump size in Kilobytes (e.g. 64 for 64K, 128 for 128k) (note 18) |
| 6d-ff | 1 | not used set to 0 |
| 100-... | 1 | memory dump |
Notes
1. All multi-byte values are stored in little-endian format (low byte followed by higher bytes).
2. "IFF0" reflects the state of the maskable interrupt (INT). "IFF1" is used to store the state of IFF0 when a non-maskable interrupt (NMI) is executed. Bit 0 of these bytes is significant. For CPCEMU compatibility, these bytes should be set to "1" when the IFF flip-flop is "1" and "0" when the flip-flop is "0". For compatibility with other emulators, bits 7-1 should be set to "0". When bit 0 of "IFF0" is "0" maskable interrupts will be ignored. When bit 0 of "IFF1" is "1" maskable interrupts will be acknowledged and executed. See the document about the Z80 for more information.
3. This byte will be 0, 1 or 2 for the interrupt modes 0, 1 or 2. The interrupt mode is set using the "IM x" instructions. See the document about the Z80 for more information.
4. These registers are from the alternate register set of the Z80.
5. These registers are 16-bit. "low" indicates bits 7..0, "high"indicates bits 15..8.
6. This byte represents the inputs to PPI port A regardless of the input/output setting of this port.
7. This byte represents the inputs to PPI port B regardless of the input/output setting of this port.
8. This byte represents the outputs from port C regardless of the input/output setting of this port.
9. This byte represents the PPI control byte which defines the input/output and mode of each port and not the last value written to this port. For CPCEMU compatibility bit 7 of this byte must be set to "1".
10. This byte in the snapshot represents the selected pen register of the Gate-Array. This byte is the last value written to this port. Bit 7,6,5 should be set to "0".
11. This byte in the snapshot represents the multi-configuration register of the Gate-Array. This byte is the last byte written to this register. For CPCEMU compatibility, bit 7 should be set to "1" and bit 6 and bit 5 set to "0".
12. These bytes are the current palette. For CPCEMU compatibility, these bytes should have bit 7=bit 6=bit 5="0". Bits 4..0 define the colour using the hardware colour code. The colours are stored in the order pen 0, pen1, pen 2,...,pen 15 followed by border colour.
13. This byte represents a ram configuration for a Dk'Tronics/Dobbertin/Amstrad compatible RAM expansion, or the built in RAM expansion of the CPC6128 and CPC6128+. Bits 5..0 define the ram expansion code. For CPCEMU compatibility, bit 7 and bit 6 of this byte should be set to "0".
14. This byte in the snapshot represents the index of the currently selected CRTC register. For compatibility with CPCEMU this value should be in the range 0-31.
15. These bytes represent the data of the CRTC's registers.
16. This byte in the snapshot represents the last byte written to the "ROM select" I/O port.
17. This byte in the snapshot represents the index of the currently selected PSG register. For CPCEMU compatibility, this byte should be in the range 0-15.
18. the memory dump can have size 0 in version 3 and in this case all RAM is described in additional blocks (MEM0-MEM8). If a memory dump has a non-zero size, then it is uncompressed and describes the main 64KB ram immediately followed by the second 64KB ram (if present) (this ram is inside 128KB machines or machines with 64KB from a Dk'Tronics/Dobbertin/Amstrad compatible RAM expansion. Note that CPCEMU can only write a 64K or 128K snapshot.
19. JavaCPC uses e0-ff to store an emulator ID (see snapshot V3 for more details)
Changes and additions in Version 2 from Version 1
| Offset (Hex) | Count | Description |
| 10 | 1 | snapshot version (2) |
| 6d | 1 | CPC Type:
|
| 6e | 1 | interrupt number (0..5) (note 1a) |
| 6f-74 | 6 | 6 multimode bytes (note 1b) |
| 75-ff | x | (not used) |
Notes
1. If standard CPC raster interrupts are used, interrupts are acknowledged and "executed" at the time they are requested, then there will be 6 interrupts executed per screen update cycle.
- CPCEMU uses a simple system to emulate the interrupts. It is assumed there are exactly 6 interrupts per screen update cycle (the interrupts are assumed to occur at a frequency of 300Hz). This byte records the interrupt number in the current screen update cycle. More accurate emulators use the correct interrupt generation method and may ignore this byte. For CPCEMU compatibility, these emulators should set this byte to "0".
- CPCEMU uses a simple system to emulate the screen display. It allows the mode to be changed in each of the 6 interrupts that occur during a single 50Hz/60Hz period. These bytes represent the mode in each of these sections, i.e. the screen modes (0,1 or 2) for the interrupts 0..5. More accurate emulators support changing of the screen mode at any point supported by the Amstrad hardware, these emulators should write "0" for all these bytes.
2. A version 2 snapshot describes Dk'Tronics/Dobbertin compatible RAM in addition to the 64KB base ram. This is a type of RAM expansion which uses the same port and paging mechanism as the extra 64KB inside the 6128. However, the RAM *MUST* be continuous, therefore it's limited to 64KB, 256KB or 512KB additional RAM. The Dk'Tronics silicon disk can't be described on it's own because it's RAM configurations do not start at C4.
The following configurations can be described:
- 64KB base + 64KB extra RAM (e.g. Dk'Tronics 64KB RAM Expansion)
- 64KB base + 256KB extra RAM (e.g. Dk'Tronics 256KB RAM Expansion)
- 64KB base + 512KB extra RAM (e.g. Dk'Tronics 256KB RAM Expansion & Dk'Tronics 256KB Silicon Disk OR X-MEM OR Symbiface 2 OR other device which provides 512KB)
JavaCPC uses this value to store up to 4MB of RAM. (e.g. CPC4MB). This type of ram is Dk'Tronics compatible and has multiple banks of 512KB. This value could be used to describe a 1MB or 2MB expansion as long as it is fully Dk'tronics compatible (e.g. rpalmer's 2MB).
3. JavaCPC uses e0-ff to store an emulator ID (see snapshot V3 for more details)
Changes and additions in Version 3 from Version 2
| Offset (Hex) | Count | Description | ||||||||||||||
| 10 | 1 | snapshot version (3) | ||||||||||||||
| 6d | 1 | CPC Type:
| ||||||||||||||
| 75 | n | Disc drive A filename (No$CPC only) | ||||||||||||||
| 99 | 1 | Monitor VHold Value (-45 to +85) | ||||||||||||||
| 9a | 1 | Memory Expansion Enable (when Bit 7 is set)
| ||||||||||||||
| 9b | 1 | Fast Disc emulation mode (0=off, 1=on) (WinAPE) | ||||||||||||||
| 9c | 1 | FDD motor drive state (0=off, 1=on) | ||||||||||||||
| 9d-a0 | 4 | FDD current physical track (note 15) | ||||||||||||||
| a1 | 1 | Printer Data/Strobe Register (note 1) | ||||||||||||||
| a2-a3 | 2 | Current frame scan line since monitor retrace (note16) | ||||||||||||||
| a4 | 1 | CRTC type:
| ||||||||||||||
| a9 | 1 | CRTC horizontal character counter register (note 11) | ||||||||||||||
| aa | 1 | unused (0) | ||||||||||||||
| ab | 1 | CRTC character-line counter register (note 2) | ||||||||||||||
| ac | 1 | CRTC raster-line counter register (note 3) | ||||||||||||||
| ad | 1 | CRTC vertical total adjust counter register (note 4) | ||||||||||||||
| ae | 1 | CRTC horizontal sync width counter (note 5) | ||||||||||||||
| af | 1 | CRTC vertical sync width counter (note 6) | ||||||||||||||
| b0-b1 | 1 |
| ||||||||||||||
| b2 | 1 | GA vsync delay counter (note 14) | ||||||||||||||
| b3 | 1 | GA interrupt scanline counter (note 12) | ||||||||||||||
| b4 | 1 | interrupt request flag (0=no interrupt requested, 1=interrupt requested) (note 13) | ||||||||||||||
| b5 | 1 | Interrupt Control Status Register (WinAPE) (note 17) | ||||||||||||||
| b6 | 1 | Plus features disabled (0=enabled, 1=disabled) | ||||||||||||||
| b7 | 1 | Plus PPI Emulation (0=Standard 8255 emulation, 1=Plus PPI emulation) | ||||||||||||||
| b8-df | 28 | unused (0) | ||||||||||||||
| e0 | 20 | Emulator ID String |
Notes
1. This byte in the snapshot represents the last byte written to the printer I/O port (this byte does not include the automatic inversion of the strobe caused by the Amstrad hardware).
2. This register is internal to the CRTC and counts the number of character-lines. The counter counts up. This value is in the range 0-127. (This counter is compared against CRTC register 4).
3. This register is internal to the CRTC and counts the number of raster-lines. The counter counts up. This value is in the range 0-31. (This counter is compared against CRTC register 9).
4. This register is internal to the CRTC and counts the number of raster-lines during vertical adjust. The counter counts up. This value is in the range 0-31. This should be ignored if the CRTC is not "executing" vertical. adjust.(This counter is compared against CRTC register 5).
5. This register is internal to the CRTC and counts the number of characters during horizontal sync. This counter counts up. This value is in the range 0-16. This should be ignored if the CRTC is not "executing" horizontal sync. (This counter is compared against CRTC register 3).
6. This register is internal to the CRTC and counts the number of scan-lines during vertical sync. This counter counts up. This value is in the range 0-16. This should be ignored if the CRTC is not "executing" vertical sync. (This counter is compared against CRTC register 3).
7. These bytes define the internal state of the CRTC. Each bit in these bytes represents a state.
8. When VSYNC is active, the CRTC is "executing" vertical sync, and the vertical sync width counter in the snapshot is used.
9. When HSYNC is active, the CRTC is "executing" horizontal sync width counter in the snapshot is used.
10. When Vertical total adjust is active, the CRTC is "executing" vertical total adjust and the vertical total adjust counter in the snapshot is used.
11. This register is internal to the CRTC and counts the number of characters. This counter counts up. This value is in the range 0-255. (This counter is compared against CRTC register 0).
12. This counter is internal to the GA and counts the number of HSYNCs. This counter is used to generate CPC raster interrupts. This counter counts up. This value is in the range 0-51.
13. This flag is "1" if a interrupt request has been sent to the Z80 and it has not yet been acknowledged by the Z80. (A interrupt request is sent by the GA for standard CPC raster interrupts or by the ASIC for raster or dma interrupts).
14. This is a counter internal to the GA and counts the number of HSYNCs since the start of the VSYNC and it is used to reset the interrupt counter to synchronise interrupts with the VSYNC. This counter counts up. This value is between 0 and 2. If this value is 0, the counter is inactive. If this counter is 1 or 2 the counter is active.
15. This is the current cylinder for each of 4 drives.
16. In WinAPE this counter is reset if a VSYNC occurs which causes the monitor to retrace vertically. This occurs if the VSYNC signal is active and this counter is greater than a threshold set by the V-Hold (normally 295 when V-Hold is 0), or if the counter reaches the maximum value (normally 351 when V-Hold is 0).
17. Since Plus emulation requires more information than simply whether an interrupt is active, this value (as used internally by WinAPE) contains:
- Bit 7 - Gate Array (or PRI) interrupt.
- Bit 6 - DMA Channel 0 interrupt.
- Bit 5 - DMA Channel 1 interrupt.
- Bit 4 - DMA Channel 2 interrupt.
It can be a combination of all or any interrupt sources. Interrupts are executed in the order raster, DMA 2, DMA 1, DMA 0.
Immediately following the memory dump there is optional data which is separated into chunks.
Each chunk of data has a header and this is followed by the data in the chunk. The header has the following format:
| Offset (Hex) | Count | Description |
| 0 | 4 | Chunk name (note 1) |
| 4 | 4 | Chunk data length (note 2) |
Notes:
1. The chunks are defined with 4-byte character codes. (e.g. "CPC+"). In this example, the 4-byte character code would be stored in the file as 'C' then 'P' then 'C' then '+'.
2. The "Chunk data length" defines the length of data following the header and does not include the size of the header. This number is stored in little endian format.
3. If a emulator finds a chunk which it does not support then it should skip the chunk and continue with the next chunk in the file. Therefore an emulator author may add emulator specific chunks to the file and it will not prevent the snapshot from being used with other emulators that do not recognise the added chunks.
4. There is not a terminator chunk. The snapshot reader should determine if there are more chunks based on the size of data remaining to be read from the file.
Version 3 Chunks
The following chunks are currently defined:
DSCA,DSCB (Winape and ACE)
The DSCA block contains the filename of the disc image inserted into drive A. The filename is stored as 8-bit ASCII (any Unicode characters with codes 0x100 or above will be translated to ? and therefore filenames with these characters can't be stored in Snapshots). The length of the block is the length of the filename in bytes.
DSCB is similar to DSCA but stores the filename of the disc image inserted into drive B.
This option must be enabled in Winape for this chunk to be saved.
This option must be enabled in ACE for this chunk to be loaded and saved.
TAPE (ACE)
The TAPE block contains the filename of the tape image inserted. The filename is stored as 8-bit ASCII (any Unicode characters with codes 0x100 or above will be translated to ? and therefore filenames with these characters can't be stored in Snapshots). The length of the block is the length of the filename in bytes.
This option must be enabled in ACE for this chunk to be loaded and saved.
ROMS (Winape and ACE)
This block contains a list of filenames for each ROM (and cartridge) that is defined. The length of the block is the length for all strings.
If a ROM is not defined, a single NUL (0) byte is present, otherwise there is a null terminated 8-bit ASCII string.
First in the list is the filename (or internal name) for the cartridge (prefixed with a 'A' character), followed by lower rom and then upper roms 0-31 (WinAPE) or 0-255 (ACE).
Internal ROMs are listed by their internal name (the name listed in the drop down when you configure the roms) (e.g. OS464).
This option must be enabled in Winape for this chunk to be saved.
This option must be enabled in ACE for this chunk to be loaded and saved.
NOTE: The selected Multiface ROM is not saved in the snapshot.
INFO Chunk (No$CPC)
This chunk is written by No$CPC. It contains an 8-bit ASCII string with the version information for No$CPC.
MEM0-8 Chunk
The MEM0-8 chunks contain at most 64KB of data. The data may be compressed or stored uncompressed. If the size is exactly 65536 bytes the data is uncompressed, otherwise it is compressed. Up to 512KB additional RAM can be stored in a snapshot.
The compression scheme is RLE with 0x0e5 as the control byte.
Data is encoded as:
- <byte> for a single occurrence of a byte (not 0x0e5) (e.g. 0x013)
- 0x0e5,<count>,<byte> for multiple occurances of a byte (e. 0x0e5,0x04,0x013 for 0x013 repeated 4 times)
- 0x0e5,0 for a single 0x0e5 byte (e.g. 0x0e5)
The blocks are:
- MEM0 - main 64KB ram
- MEM1 - c4,c5,c6,c7 configurations (extra 64KB ram in 128KB machines) (256KB Dk'Tronics RAM, X-MEM)
- MEM2 - cc,cd,ce,cf configurations (256KB Dk'Tronics RAM, X-MEM)
- MEM3 - d4,d5,d6,d7 configurations (256KB Dk'Tronics RAM, X-MEM)
- MEM4 - dc,dd,de,df configurations (256KB Dk'Tronics RAM, X-MEM)
- MEM5 - e4,e5,e6,e7 configurations (256KB Dk'Tronics Silicon Disk, X-MEM)
- MEM6 - ec,ed,ee,ef configurations (256KB Dk'Tronics Silicon Disk, X-MEM)
- MEM7 - f4,f5,f6,f7 configurations (256KB Dk'Tronics Silicon Disk, X-MEM)
- MEM8 - fc,fd,fe,ff configurations (256KB Dk'Tronics Silicon Disk, X-MEM)
Notes
1. A snapshot may contain a mix of "standard" memory data (e.g. the data follows the header and is uncompressed) and additional MEM blocks as required.
2. If the snapshot is not compressed, then up to 128KB will be stored as "standard" memory data, the additional RAM stored in MEM2-MEM8 blocks.
3. If the snapshot is compressed, then the "standard" memory data will have 0 size and there will be a MEM0 in addition to the additional memory blocks.
4. Version 3 doesn't require memory to be continuous. A Dk'tronics silicon disk on it's own can be described with this version.
5. Winape allows a 4MB RAM expansion to be enabled but doesn't save the additional RAM in the snapshot.
MX09-40 Chunk (ACE)
MX?? chunks allow snapshots to store up to 4160KB ram.
MX?? chunks are following MEM0-8 chunks. They are numbered from 09 to 40 (hexadecimal numbering). Information are stored compressed like in MEM0-8 chunks.
BRKC Chunk (ACE)
This chunk is written by ACE when some breakpoints are set. When loading a snapshot, the breakpoints found in this chunk are added to the one already installed. The number of stored breakpoints in the chunk is given by the chunk size divided by 216 (the size on one breakpoint data structure).
| Offset (Hex) | Length | Description |
| 00 | 1 | Breakpoint type (0:Execution, 1:Memory, 2:I/O port) |
| 01 | 1 | Memory access mode (0:R/W, 1:R/O, 2:W/O) |
| 02 | 1 | Breakpoint runtime mode (0:Break, 1:Watch) |
| 03 | 1 | Reserved |
| 04 | 2 | Breakable memory/port (MSB first) |
| 06 | 2 | Breakable memory/port mask (MSB first) |
| 08 | 1 | Match value |
| 09 | 1 | Match value mask |
| 0A | 2 | Breakable memory size (MSB first) |
| 0C | 4 | Breakpoint activation step (MSB first) |
| 10 | 128 | Breakpoint condition to match (NULL terminated string) (note 1) |
| 90 | 64 | Breakpoint user name (NULL terminated string) |
| D0 | 8 | Reserved |
| D8 | ... | Same sequence repeated for each breakpoint |
Notes
1. The condition is expressed using ACE syntax (similar to BASIC with AND/OR/XOR/NOT/+/-/=...). Allowed additional syntaxes are:
- &, # or 0x for a hexadecimal number.
- % or &x for a binary number.
- AF, BC, HL, IX... for a 16-bit Z80 register.
- A, B, D, IXh, IXl... for an 8-bit Z80 register.
- FlagC, FlagNC, FlagM... for a Z80 flag.
- LineCount for the line number.
- LineCycle for the µs count on the current line.
- MemPage for the 64K expansion memory page (0-63).
- MemBankMode for the 16K expansion memory bank paging mode (0-7).
- UpperROMOn for the paging state of the upper ROM.
- UpperROMNum for the selected upper ROM number.
- LowerROMOn for the paging state of the lower ROM.
- LowerROMNum for the selected lower ROM number.
- ASICPageOn for the paging state of the I/O ASIC registers page.
Example : FlagC AND (HL=DE OR HL=&5000)
SYMB Chunk (ACE)
This chunk is written by ACE when some symbols are declared. When loading a snapshot, the symbols found in this chunk are added to the alreading existing ones.
| Offset (Hex) | Length | Description |
| 00 | 1 | Length on the symbol name (n). 0 is an invalid value. |
| 01 | n | Symbol name (note 1) |
| n+1 | 6 | Reserved for future usage, always 0 for now. |
| n+7 | 2 | Address of the symbol (MSB first). |
| ... | Same sequence repeated until the end of the chunk is reached. |
Notes
1. Symbol are (obviously) limited to 255 characters, cannot begin with a number (0-9), and only a limited set of ASCII char is allowed (a-z, A-Z, 0-9, _).
CPC+ Chunk
This chunk is supported by Arnold, Winape, No$CPC and ACE. Arnold, Winape and ACE will save the block when Plus configuration enabled. No$CPC will save the block if the Plus features have been unlocked.
| Offset (Hex) | Length | Addr in ASIC register-ram | Description |
| 000-7FF | 800 | 4000-4FFF | Sprite Bitmaps (note 1) |
| 800-87F | 8*16 | 6000-607F | Sprite Attributes (see below) (note 2) |
| 880-8BF | 32*2 | 6400-643F | Palettes (note 3) |
| 8C0 | 1 | 6800 | Programmable Raster Interrupt (note 4) |
| 8C1 | 1 | 6801 | Screen split scan-line (note 4) |
| 8C2 | 2 | 6802-6803 | Screen split secondary screen-address (note 4) |
| 8C4 | 1 | 6804 | Soft scroll control register (note 4) |
| 8C5 | 1 | 6805 | Interrupt vector (note 4) |
| 8C6 | 1 | Internal | gate array A0 register value (note 8a) |
| 8C6-8C7 | 1 | - | unused (0) |
| 8C8-8CF | 8 | 6808-680f | Analogue input channels 0-7 (note 5) |
| 8D0-8DB | 3*4 | 6C00-6C0B | Sound DMA channel attributes 0-2 (see below) (note 6) |
| 8DC-8DE | 3 | - | unused (0) |
| 8DF | 1 | 6C0F | DMA Control/Status (note 4) |
| 8E0-8F4 | 3*7 | Internal | DMA channel 0-2 internal registers (see below) (note 7) |
| 8F5 | 1 | Internal | gate array A0 register value (note 8b) |
| 8F6 | 1 | Internal | gate array A0 lock: 0 -> locked, !=0 -> unlocked (note 9) |
| 8F7 | 1 | Internal | ASIC unlock sequence state (note 10) |
Notes
1. The sprite data is packed, with two sprite pixels per byte. Bits 7..4 define the first pixel and bits 3..0 define the second pixel.
2. The attributes for each sprite take 8 bytes. Each attribute block has the following format:
| Offset (Hex) | Length | Description |
| 0 | 2 | Sprite X (see note) |
| 2 | 2 | Sprite Y (see note) |
| 4 | 1 | Sprite Magnification (see note) |
| 5-7 | 3 | unused (0) |
Note: the Sprite X, Y and magnification are in the same order as the ASIC registers
3. This is a direct copy of the palette in CPC+ ASIC Ram. There are 32 colours each with 2-bytes per colour.
4. These bytes in the snapshot represent the last value written to these ASIC registers.
5. These bytes represent the inputs to the analogue channels.
6. The attributes for each DMA channel take 4 bytes. Each attribute block has the following format:
| Offset (Hex) | Length | Description |
| 0 | 2 | DMA Channel address (see note) |
| 2 | 1 | DMA Channel prescalar (see note) |
| 3 | 1 | unused (0) |
Note: the DMA address and prescalar are in the same order as the ASIC registers.
7 These registers are internal to the CPC+ and define the current DMA operation:
| Offset (Hex) | Length | Description |
| 0 | 2 | loop counter (note a) |
| 2 | 2 | loop address (note b) |
| 4 | 2 | pause count (note c) |
| 6 | 1 | pause prescalar count (note d) |
a. This value represents the number of loops remaining. 0 = none. This count is between 0..0FFF. This counter counts down.
b. This is the Amstrad memory address to loop back to. It is a pointer to the DMA instruction after the last REPEAT instruction.
c. This value represents the pause count and the count is between 0...0FFF. (TO BE CHECKED: down counter? what exactly does it represent)
d. This value represents the pause prescalar count and the count is between 0..FF. (TO BE CHECKED: down counter? what exactly does it represent)
8. This value represents the last value written to this I/O port. Winape uses 8a and not 8b. This value has bits 7,6,5 set to 1,0 and 1 respectively. 8b is in the original specification and is written by both ACE and No$CPC.
9. This value represents the lock status of RMR2. If locked, RMR2 can't be accessed otherwise it can.
10. This value represents the current unlock sequence state.
| State ID | Synchronised State | Note |
| 0 | Not synchronised | ASIC is waiting for first non-zero byte to be written, this is the first synchronisation byte required |
| 1 | Not synchronised | ASIC is waiting for zero byte to be written, this is the second synchronisation byte required |
| 2..10 | synchronised | ASIC is waiting for byte from unlock sequence. e.g. if "2", ASIC is waiting for &FF, the first byte of the unlock sequence. if "3" ASIC is waiting for &77, the second byte of the unlock sequence. |
WABP Chunk (Winape)
This chunk is written by Winape when some breakpoints are set. The exact details are begin worked out.
It seems to be:
4 bytes - number of user breakpoints
Each user breakpoint:
type, 4 byte address
Then, 4 bytes - number of memory breakpoints
Each memory breakpoint:
Then, 4 bytes - number of i/o breakpoints:
Each i/o breakpoint:
2 bytes flags? (6000 read, a400 write) 2 bytes port addr mask 2 bytes port addr 4 bytes counter 4 bytes condition string length, followed by condition string (not null terminated)
DARS Chunk (Winape)
This chunk is written by Winape when some data areas are set.
The number of stored data areas in the chunk is given by the chunk size divided by 10 (the size of one data area data structure).
| Offset (Hex) | Length | Description |
| 00 | 4 | Address (LSB first) (note 1) |
| 04 | 4 | Area size (LSB first) |
| 08 | 1 | Data type (0=byte,1=word) |
| 09 | 1 | Labels (1=marked by user as having labels) |
Notes
1. Winape's addressing scheme is 4 bytes. The upper 16-bits effectively define the internal 64KB pages it uses.
