== Technical ==
The following has been derived from the schematic and the ROM code. The following needs to be confirmed with testing on a real device.
The onboard 8KB Ram is read/written via port FCxx and FDxx with the following address decoding:
'a' form part of the address for the RAM. The data read/written to the port is from the RAM. NOTE: The order of the data bits are scrambled/remapped. See the schematic.
e.g.
ld a,&55
ld bc,&fc03
out (c),a
ld bc,&fc03
in a,(c)
The other bits are controlled by port FExx with this address decoding:
Here D3-D0 define the other parts of the RAM address.
e.g.
LD A,3
LD B,&FE
OUT (C),A
NOTE: The addresses to the RAM are also scrambled/remapped. See the schematic.
The ROM is made visible by pressing the red button which causes an NMIand execution starts at 0066. It maps the The ROM into location is visible at 0000-1fff with a mirror at 2000-ffff.The ROM replaces overrides the internal CPC OS ROM and also disables the RAM where it is mapped(i.e. RAM in the range 0000-3fff is disabled). Therefore writing to RAM under the ROM is not possible.
The ROM state is also toggled by reading an opcode from an address >0x03000 and less than <0x03fff. The ROM itself uses 3FFB which contains a RET
instruction. It uses this to transition in and out of the ROM to read the font from the BASIC ROM.
The device seems to listen to writes to GA's rom/ram paging I/O port. It looks for the address with:
0xxxxxxxxxxxxxxxxx with bit 7 and 6 of the data as 10xxxxxx.
The reason needs to be confirmed - but it seems to be similar to port FExx operation, perhaps it indirectly detects the ROM state in this way.
== Manual ==