Revision as of 00:34, 30 March 2025

To unlock the ASIC, a 17-byte "unlock" sequence must be sent to the CRTC's selection port (&BC00) : RQ00, 0, 255, 119, 179, 81, 168, 212, 98, 57, 156, 70, 43, 21, 138, STATE, <ACQ>

• RQ00 must be different from the value 0.
• STATE=205 for UNLOCK otherwise another value for LOCK.
• ACQ represents sending any value if STATE=205 (not needed otherwise).

Note: the ASIC is already unlocked after the STATE phase, before ACQ. So ACQ is actually never needed.

Once the ASIC is unlocked, we get access to a new Gate Array register called RMR2. It is accessible in the same way as other Gate Array registers.

BASIC version

10 RESTORE 
20 FOR x=0 TO 16:READ a:OUT &BC00,a:NEXT 
30 DATA 255,0,255,119,179,81,168,212,98,57,156,70,43,21,138,205,238 
40 PRINT"ASIC unlocked!"

Z80 Assembler version

;; This example shows how to unlock the ASIC
;;
;; This example is designed for CPC+ only and will
;; not work on CPC or KC Compact.
;;
;; This example will compile with the MAXAM assembler
;; or the built-in assembler of WinAPE32.

org &8000

;;--------------------------------------------------
;; Unlock CPC+ additional features

di
ld b,&bc
ld hl,sequence
ld e,17

.seq 
ld a,(hl)
out (c),a
inc hl
dec e
jr nz,seq

ei
ret

;;----------------------------------------------------------
;; this is the sequence to unlock the ASIC extra features
.sequence
defb &ff,&00,&ff,&77,&b3,&51,&a8,&d4,&62,&39,&9c,&46,&2b,&15,&8a,&cd,&ee

Optimized versions

The unlocking sequence can be reconstituted from simple bit operations instead of being stored in memory.

Madram version

There are still some magic numbers used in this version.

In Z80 Assembler:

UnlockAsic
di
ld bc,#BCFF
out (c),c
out (c),0
ld hl,%1001000011101010

.loop
out (c),c
ld a,h:rlca:ld h,l:ld l,a
srl c
xor c:and #88:xor c
ld c,a
cp #4D
jr nz,.loop

ld a,#CD      ; a=#CD for unlock, another value for lock
out (c),a:out (c),a
ei
ret

In Python:

def unlock_asic():
    b, c, h, l = 0xBC, 0xFF, 0x90, 0xEA  # Initialize registers
    out(b, c)
    out(b, 0)

    while c != 0x4D:
        out(b, c)
        h, l = l, ((h << 1) | (h >> 7)) & 0xFF  # Rotate h and swap h,l
        c = ((c >> 1) & ~(1 << 3)) | (l & 0x88)  # Modify c

    out(b, 0xCD)
    out(b, 0xCD)

def out(port, value):
    print(f"Port: {hex(port)}xx Out: {hex(value)}")

unlock_asic()

Urusergi version

In Z80 Assembler:

di			; v2.0 -> 31 bytes!
ld bc,#BCFF
out (c),c
out (c),0
ld a,c

.loop
out (c),a
ld h,a			; H = 7654 3210
rra			; A = *765 4321
add hl,hl		; H = 6543 210-
push af			; Carry flag (bit 7) preserved
add hl,hl		; H = 5432 10--
add hl,hl		; H = 4321 0---
pop af			; Carry flag (bit 7) recovered
ld l,a			; L = *765 4321
ld a,h			; A = 4321 0---
rra			; A = 7432 10--
xor h			; A = (7 xor 4)*** (1 xor 0)***
xor l:and #88:xor l	; A = (7 xor 4)765 (1 xor 0)321
cp c
jr nz,.loop

ei
ret

In Python:

def unlock_asic():
    b, c = 0xBC, 0xFF
    out(b, c)
    out(b, 0)
    a = c
    
    while True:
        out(b, a)
        d = a
        a = (((a << 2 | a >> 6) ^ d) & 0x7F) ^ d
        d = (d >> 1 | d << 7) & 0xFF
        a = ((((a << 1 | a >> 7) ^ a) ^ d) & 0x88) ^ d
        if a == c: break

def out(port, value):
    print(f"Port: {hex(port)}xx Out: {hex(value)}")

unlock_asic()

Visual representation

As one may see, the nybbles in the sequence are based on two 4bit shift registers.

Visual by Hwikaa

Patent

For one reason or another, Amstrad has patented the verification mechanism (GB2243701A).

The patent seems to focus on verifying (rather than on sending) the sequence, so its legal use is a bit unclear.

On the Original Arnold V Specs - Issue 1.5 - 10th April 1990, it is precised at §2.11 "Locking of enhanced features": it should be noted that unauthorised use of this mechanism may infringe Amstrad's patent.