Mirage Imager

An addon that enables you to freeze any program and store it to disc.

The device was also available for the ZX Spectrum, this version was called the "Mirage Microdriver", and could save data either to tape or to Sinclair's "Microdrive"; an external high-speed tape drive.

The initial Spectrum version was released in 1985, although there was a later version released in 1986 (see Crash Issue 25, link below).

The CPC version was released in 1986.

The tool can backup RAM contents (including CPU registers pushed in RAM), but, unlike Multiface II, it cannot backup read-only I/O ports like CRTC (vram address/size) and Gate Array (screen colors) - the included software allows to manipulate that values manually (this would be only required with programs that use nonstandard CRTC value, or that use direct I/O to modify colors).

Now, thanks to Jose Leandro, the hardware specialist of the spectrum, with his famous page :

http://trastero.speccy.org/cosas/JL/JL.htm

We can know more about this hardware.

Pictures

Mirage Imager
PCB
Advertisement of Mirage Imager MKIII

Mirage Imager 300dpi scans by Robcfg

Mirage Imager Layout, Thanks to Jose Leandro
PCB Front
PCB Back
Layout

Technical

The following has been derived from the schematic and the ROM code. The following needs to be confirmed with testing on a real device.

The onboard 8KB Ram is read/written via port FCxx and FDxx with the following address decoding:

1111110aaaaaaaaa

'a' form part of the address for the RAM. The data read/written to the port is from the RAM. NOTE: The order of the data bits are scrambled/remapped. See the schematic.

e.g.

ld a,&55
ld bc,&fc03
out (c),a

ld bc,&fc03
in a,(c)

The other bits are controlled by port FExx with this address decoding:

1111111xxxxxxxxx

Here D3-D0 define the other parts of the RAM address.

e.g.

LD A,3
LD B,&FE
OUT (C),A

NOTE: The addresses to the RAM are also scrambled/remapped. See the schematic. NOTE: It seems the RAM can only be accessed after the red button has been pressed.

The ROM is made visible by pressing the red button which causes an NMI and execution starts at 0066. The ROM is visible at 0000-1fff with a mirror at 2000-ffff. The ROM overrides the internal CPC OS ROM and also disables the RAM where it is mapped (i.e. RAM in the range 0000-3fff is disabled). Therefore writing to RAM under the ROM is not possible.

The ROM state is also toggled by reading an opcode from an address >0x03000 and less than <0x03fff. The ROM itself uses 3FFB which contains a RET instruction. It uses this to transition in and out of the ROM to read the font from the BASIC ROM.

The device listens to writes to GA's rom/ram paging I/O port when it's not enabled (i.e. when the ROM has not been paged in). It looks for the address with:

0xxxxxxxxxxxxxxxxx with bit 7 and 6 of the data as 10xxxxxx.

The reason needs to be confirmed - but it seems to be similar to port FExx operation, perhaps it indirectly detects the ROM state in this way by pre-configuring the address.

The device calls 2016 to return back to the running program. This is a RET in the rom mirror.