Your Spectrum
Issue 18, September 1985 - Extra Z80 Commands
Home Contents KwikPik
If you reckon you know all there is to know about Z80 machine code, prepare for a shock. As well as the documented instructions, there are over a hundred that have been hidden away. David Jones uncovers them and adds the missing info. Now you really can have your chip with everything!



registers diagram
Inside every Spectrum lives a chip - the Z80 created by Zilog - and with it there are nearly seven hundred well- documented instructions for the machine code programmer to play about with. Much more interesting though, are the instructions that Zilog left in the Z80 but never bothered to document. Why? Because they couldn't be guaranteed to work in every chip. In all, there are 102 of them and you'll find that they're being used more and more in many commercial games. You may even have hacked into one such program and just not been able to make any sense of it.
There are two reasons for this increasing popularity with professional programmers. Firstly, these instructions are a very neat way of fooling the hacker. As the only assembler on the market that can cope with any of these instructions is Picturesque's, hackers can have a rough time of it trying to decipher what's going on if they're only armed with a standard assembler. Secondly and even more important, is that these instructions perform operations that can't be carried out anywhere near as easily using the standard instruction set.
There has to be a catch, you're saying. And yes, there is - sort of. As Zilog hasn't provided any official info, a
new version of the Z80 minus some or all these extra commands can come out at any time. It may even be inside your Speccy!


The first ten of these hidden instructions are the result of a Z80 'bug'. In the original specifications for the Z80, Zilog included SLA (Shift Left Arithmetic), SLL (Shift Left Logical) SRA (Shift Right Arithmetic) and SRL (Shift Right Logical). Unfortunately, the SLL instruction didn't work, so rather than re-design the Z80 or admit that there was a non-working instruction, Zilog simply pretended that it just didn't exist. Sneaky, eh? The way that SLL fails to work is pretty simple but it can be put to some use in certain circumstances. It should shift a byte left and set bit zero to 0. In reality, it shifts the byte left and then sets bit zero to 1.
In all there are ten SLL instructions since it can operate on data supplied by various methods. It's doubtful that you'll find any earth- shattering uses for these instructions as the Z80's already supplied with a pretty comprehensive set of 8-bit shifts and rotates. Still, you can now include these 'bug' instructions in the SLS (Shift Left Set) mnemonic.
If you're into scribbling in the margins of your technical
manuals, turn to page 136 of the Spectrum Basic Programming Manual. You can now fill in the space from code 48 with the new mnemonic SLS eight times, followed by the appropriate registers in the same order as they appear for SLA, SRA and SRL. That takes care of eight out of the first ten. The remaining two are the same instructions using data supplied by the index registers. Now, using our new mnemonics, they are SLS(IX+0) and SLS(IY+0).
Speccy speed-freaks are going to find the next chunk of 92 instructions very useful for adding that extra zip to their machine code. If you take a look at the layout of the Z80's internal structure, you'll see that the IX and IY registers are split into four 8-bit registers instead of the normal two 16-bit registers. This split is the basis for the remaining instructions.
Now, the Z80 was designed in such a way that it includes all of the instructions available on the 8080 processor plus its own additional instructions and extra registers. So, amongst the extra features are bit-handling, use of the IX and IY registers and a whole series of 'special' functions, including LDIR. To make use of these new features, the processor has some one-byte 'flag instructions' that perform the following:
Hex Byte Function
CB Tells the Z80 to expect one of the following instructions in the next three bytes: RLC, RRC, RL, SLA, SLS (see above), SRL, BIT, RES or SET.
DD Tells the Z80 to use the IX register instead of the HL for the next instruction.
ED Tells the Z80 to expect a special instruction next. This way it has some quite useful block move and compare instructions.
FD Tells the Z80 to use the IY register instead of HL for the next instruction.
You'll find the secret of the vast majority of these extra instructions is tucked away in the DD and FD bytes. The IX and IY register instructions are simply HL register instructions prefixed with DD or FD and with the ability to include an offset byte. If DD or FD is placed in front of an instruction that uses either the H or L register, then you'll find that in a large percentage of cases the appropriate portion (IXH, IXL, IYH or IYL) of the IX or IY register will be used instead. And in all cases the split index register instructions change the flags in the same way as the equivalent H or L instruction.
As I said before, I can't guarantee that all these instructions will work with every Spectrum but I've yet to find one that won't. If it turns out to be yours, I want to be the first to know.
This is your new found Z80 instruction set. The first ten are the SLL Instruction set.
LD A,IXLDD 7D ..221 125 ...8
LD B,IXHDD 44 ..221 68 ...8
LD B,IXLDD 45 ..221 69 ...8
LD C,IXHDD 4C ..221 76 ...8
LD C,IXLDD 4D ..221 77 ...8
LD D,IXHDD 54 ..221 84 ...8
LD D,IXLDD 55 ..221 85 ...8
LD E,IXHDD 5C ..221 92 ...8
LD E,IXLDD 5D ..221 93 ...8
LD IXH,ADD 67 ..221 103 ...8
LD IXL,ADD 6F ..221 111 ...8
LD IXH,BDD 60 ..221 96 ...8
LD IXL,BDD 68 ..221 104 ...8
LD IXH,CDD 61 ..221 97 ...8
LD IXL,CDD 69 ..221 105 ...8
LD IXH,DDD 62 ..221 98 ...8
LD IXL,DDD 6A ..221 106 ...8
LD IXH,EDD 63 ..221 99 ...8
LD IXL,EDD 6B ..221 107 ...8
LD IXH,IXHDD 64 ..221 100 ...8
LD IXH,IXLDD 65 ..221 101 ...8
LD IXL,IXHDD 6C ..221 108 ...8
LD IXL,IXLDD 6D ..221 109 ...8
LD IXH,XXDD 26 XX221 38 XXX11
OR IXHDD B4 ..221 180 ...8
OR IXLDD B5 ..221 181 ...8
SBC A,IXHDD 9C ..221 156 ...8
SBC A,IXLDD 9D ..221 157 ...8
SUB IXHDD 94 ..221 148 ...8
SUB IXLDD 95 ..221 149 ...8
XOR IXHDD AC ..221 172 ...8
XOR IXLDD AD ..221 173 ...8
SLS ACB 37 .. ..203 55 ... ...8
SLS BCB 30 .. ..203 48 ... ...8
SLS CCB 31 .. ..203 49 ... ...8
SLS DCB 32 .. ..203 50 ... ...8
SLS ECB 33 .. ..203 51 ... ...8
SLS HCB 34 .. ..203 52 ... ...8
SLS LCB 35 .. ..203 53 ... ...8
SLS (HL)CB 36 .. ..203 54 ... ...15
SLS (IX+DIS)DD CB XX 36221 203 DIS 5423
SLS (IY+DIS)FD CB XX 36253 203 DIS 5423
If you want to use the IY register in your own machine code programs, start the instruction with FD instead of DD. You'll also have to avoid most ROM calls and disable the interrupts with DI or you could have a few problems.
ADC A,IXHDD 8C ..221 140 ...8
ADC A,IXLDD 8D ..221 141 ...8
ADD A,IXHDD 84 ..221 132 ...8
ADD A,IXLDD 85 ..221 164 ...8
AND IXHDD A4 ..221 165 ...8
CP IXHDD BC ..221 188 ...8
CP IXLDD BD ..221 189 ...8
DEC IXHDD 25 ..221 37 ...8
DEC IXLDD 2D ..221 45 ...8
INC IXHDD 24 ..221 36 ...8
INC IXLDD 2C ..221 44 ...8
LD A,IXHDD 7C ..221 124 ...8
Home Contents KwikPik