Revision as of 06:45, 5 January 2025

To unlock the ASIC, a 17-byte "unlock" sequence must be sent to the CRTC's selection port (&BC00) : RQ00, 0, 255, 119, 179, 81, 168, 212, 98, 57, 156, 70, 43, 21, 138, STATE, <ACQ>

• RQ00 must be different from the value 0.
• STATE=205 for UNLOCK otherwise another value for LOCK.
• ACQ represents sending any value if STATE=205 (not needed otherwise).

Note: the ASIC is already unlocked after the STATE phase, before ACQ. So ACQ is actually never needed.

Once the ASIC is unlocked, we get access to a new Gate Array register called RMR2. It is accessible in the same way as other Gate Array registers.

BASIC version

10 RESTORE 
20 FOR x=0 TO 16:READ a:OUT &BC00,a:NEXT 
30 DATA 255,0,255,119,179,81,168,212,98,57,156,70,43,21,138,205,238 
40 PRINT"ASIC unlocked!"

Z80 Assembler version

;; This example shows how to unlock the ASIC
;;
;; This example is designed for CPC+ only and will
;; not work on CPC or KC Compact.
;;
;; This example will compile with the MAXAM assembler
;; or the built-in assembler of WinAPE32.

org &8000

;;--------------------------------------------------
;; Unlock CPC+ additional features

di
ld b,&bc
ld hl,sequence
ld e,17
.seq 
ld a,(hl)
out (c),a
inc hl
dec e
jr nz,seq
ei
ret

;;----------------------------------------------------------
;; this is the sequence to unlock the ASIC extra features
.sequence
defb &ff,&00,&ff,&77,&b3,&51,&a8,&d4,&62,&39,&9c,&46,&2b,&15,&8a,&cd,&ee

Optimized version

In Z80 Assembler

The unlocking sequence can be reconstituted from simple bit operations instead of being stored in memory.

This allowed Madram to create this optimized unlock routine:

UnlockAsic
ld bc,#BCFF
out (c),c
out (c),0
ld hl,%1001000011101010
.loop
out (c),c
ld a,h:rlca:ld h,l:ld l,a
srl c:res 3,c
and #88
or c
ld c,a
cp #4D
jr nz,.loop
ld a,#CD
out (c),a : out (c),a
ret

In Python

def unlock_asic():
    b, c, h, l = 0xBC, 0xFF, 0x90, 0xEA  # Initialize registers
    port_out(b, c)
    port_out(b, 0)

    while c != 0x4D:
        port_out(b, c)
        h, l = l, ((h << 1) | (h >> 7)) & 0xFF  # Rotate h and swap h, l
        c = ((c >> 1) & ~(1 << 3)) | (l & 0x88)  # Modify c

    port_out(b, 0xCD)
    port_out(b, 0xCD)

def port_out(port, value):
    print(f"Port: {hex(port)}xx Out: {hex(value)}")

unlock_asic()

Visual representation

As one may see, the nybbles in the sequence are based on two 4bit shift registers.

Visual by Hwikaa

Patent

For one reason or another, Amstrad has patented the verification mechanism (GB2243701A).

The patent seems to focus on verifying (rather than on sending) the sequence, so its legal use is a bit unclear.