SkoolKit

Spectrum game disassembly toolkit

Let's talk about PZX

SkoolKit 9.3 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

As if introducing support for RZX files in SkoolKit 9.2 wasn’t enough, 9.3 continues on the new file format bandwagon by introducing support for PZX files. In case you’re not aware, PZX is a tape file format that’s much simpler than TZX, and leaves no room for ambiguity about where one pulse ends and the next begins. Which is quite important for a computer whose tape-loading routines are all about those ‘edges’ between pulses (and in some cases about whether those pulses are high or low, another topic on which PZX is unambiguous).

So now that you are aware, you will no doubt want to convert your entire collection of TAP and TZX files to PZX format. And you can do that safe in the knowledge that SkoolKit 9.3 has you covered: tapinfo.py can show information on the blocks in a PZX file, and tap2sna.py can LOAD that same PZX file. On top of that, bin2tap.py can now write PZX files too.

In other news, sna2skool.py has finally gained the ability to disassemble some of the more obscure ‘undocumented’ instructions in the Z80 assembly language, such as ‘IN F,(C)’, ‘OUT (C),0’ and ‘RLC (IX+d),B’. It can also now disassemble ED6B0000 to ‘LD HL,(0)’ if you want it to, along with a batch of other variant opcode sequences, such as ED4E to ‘IM 0’, or ED4C to ‘NEG’. This new feature is disabled by default, though, for good reasons. One is that your assembler might not recognise some of these instructions, which will be a problem if you want to run it on the output of skool2asm.py. Another is that your assembler probably won’t assemble instructions with variant opcode sequences back to the original byte values.

But if you want to enable this feature despite these dangers, you can set the Opcodes configuration parameter for sna2skool.py to one or more of the following values in a comma-separated list:

  • ED63 - LD (nn),HL
  • ED6B - LD HL,(nn)
  • ED70 - IN F,(C)
  • ED71 - OUT (C),0
  • IM - IM 0/1/2 variants
  • NEG - NEG variants
  • RETN - RETN variants
  • XYCB - RLC (IX+d),B etc.
  • ALL - all of the above

One other potential danger with instructions that have variant opcode sequences is that skool2asm.py and skool2html.py won’t assemble them back to their original byte values, thus creating a discrepancy between the internal memory snapshot derived from the skool file and the snapshot that was used to create the disassembly. To work around this, the new @bytes directive can be used to remove any ambiguity. Whenever sna2skool.py encounters an instruction with a variant opcode sequence, it will automatically insert a @bytes directive. For example:

@bytes=$ED,$4E
 $8000 NEG     ; This assembles to ED4E (not ED44)

On a completely different note (pun intended), trace.py can now write a WAV file after code execution has completed. This means, for example, that you could create a WAV file of the Fairlight theme tune like this:

$ tap2sna.py https://worldofspectrum.net/pub/sinclair/games/f/Fairlight48V1.tzx.zip fairlight.z80
$ trace.py --stop 49217 fairlight.z80 fairlight.wav

And that’s just some of the news. Information on the the other new features and bug fixes in SkoolKit 9.3 can be found in the changelog. After you’re done reading that, grab a copy of 9.3 and unleash it on your new collection of PZX files.

Let's talk about RZX

SkoolKit 9.2 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

Back in SkoolKit 3.3, I added the -M option to sna2skool.py, which could be used to read a code execution map produced by an emulator, and thus generate a more accurate control file than is possible by default. That -M option on sna2skool.py later became the -m option on sna2ctl.py, which is still there to this day. That’s all well and good, but one thing that has bugged me all this time is the need to use an external tool (external to SkoolKit, that is) to produce the code execution map. Which is why I’m pleased to announce, 11 years later, that SkoolKit 9.2 includes its very own map-producing tool: rzxplay.py.

As the name suggests, rzxplay.py plays RZX files. It can draw a screen if you want to watch the playback, but this is not its intended purpose. Instead, I would expect the dedicated reverse engineer to use the --map option (in conjunction with the --no-screen option, to maximise playback speed), and feed the resultant code execution map file to sna2ctl.py. Naturally, in this release sna2ctl.py has gained the ability to read map files produced by rzxplay.py.

In the initial stages of development, rzxplay.py could only play RZX files that were recorded in plain 48K or 128K mode. However, there are many RZX files out there that, for reasons unknown, were recorded in +2 mode or above (even for 16K Spectrum games). So, in order to increase compatibility with existing RZX files, I added support for +2 mode to rzxplay.py. As a consequence, trace.py gains the ability to execute code in +2 snapshots for free, as it were. You are welcome.

Barging in alongside rzxplay.py in this release is its sibling, rzxinfo.py. This tool can be used to show the contents of an RZX file (down to individual frames), and extract the snapshots from an RZX file. In the past I’ve made the mistake of adding support to SkoolKit for a particular file format without providing a tool to dump the contents of such files. (For example, tap2sna.py arrived in SkoolKit 3.5, but tapinfo.py had to wait until 5.0.) Not this time, though, thank goodness.

One thing that became clear during the development of rzxplay.py is that, for RZX files more than a few minutes long, producing a map file is a rather time-consuming process. In other (less kind) words, SkoolKit’s pure Python Z80 simulator is, frankly, way too slow. To address this, SkoolKit 9.2 includes a new Z80 simulator implemented in C, which is quite a bit faster than its predecessor. But rzxplay.py is not the only beneficiary of this speed boost: tap2sna.py, trace.py, #AUDIO, #SIM and #TSTATES will also use the new simulator if it’s available.

So for old times’ sake, let’s look at the improvement in speed the new Z80 simulator brings. Tradition requires that I include loading the Skool Daze TZX in such comparisons, so I will do that. I’ll also look at running Patrik Rak’s z80doc test suite, and using #AUDIO to generate a WAV file for the Fairlight theme tune. These are the relevant timings on my PC:

  • 19.6s (Python) v. 1.3s (C) - tap2sna.py skooldaze.tzx
  • 54.4s (Python) v. 1.2s (C) - z80doc tests
  • 12.0s (Python) v. 1.9s (C) - #AUDIO12(fairlight.wav)(49164,49217)

And that’s all the news. More information on the the new features and bug fixes in SkoolKit 9.2 can be found in the changelog. After you’re finished there, grab a copy of 9.2 and a few RZX files, and start cranking out some code execution maps.

Zone of contention

SkoolKit 9.1 has been released. To get a copy, please head over to the download page, the Python Package Index, or GitHub.

Continuing the theme of “more 128K support” that started in 9.0, this release does indeed bring more 128K support. Specifically, bin2sna.py can now create 128K snapshots, bin2tap.py can create 128K TAP files, skool2bin.py can create 128K binary files, snapmod.py can modify 128K snapshots, and skool files can create internal 128K memory snapshots.

I think most of that was self-explanatory, but perhaps the internal 128K memory snapshots in skool files need a little more explanation. The new @bank directive either specifies the RAM bank mapped to 49152 (0xC000), or loads the contents of another skool file into a 128K RAM bank - and converts the snapshot to 128K at the same time. When that happens, the 128K ROM is loaded as well. After that, how do you actually access all the extra memory? Enter the new #BANK macro, which switches the RAM bank that is mapped to 49152. Got a sprite in RAM bank 4 you’d like to create an image of? Do a quick #BANK4 and you’re ready to go.

One other thing about snapmod.py: not only can it now modify 128K snapshots, but it can also modify SZX snapshots. That brings it up to par with its friends bin2sna.py, tap2sna.py and trace.py, which gained the ability to write SZX snapshots in the previous release.

In other news, SkoolKit’s Z80 instruction set simulator has gained the ability to simulate memory and I/O contention. It’s much slower when this feature is enabled, but it can be useful for various reasons. For example, there are a few game tapes out there that require it in order to LOAD correctly (the original release of Gold Mine being the quintessential example), so tap2sna.py can certainly benefit from it. For another example, the sound created by routines running in contended memory can now be captured precisely by the #AUDIO macro (instead of being approximated in post-processing). And finally, the #TSTATES macro can now do its job accurately when presented with code that’s subject to contention.

On the subject of #AUDIO and #TSTATES, those two macros can also now simulate the execution of interrupt routines, for extra faithfulness to the behaviour of the original hardware. In the case of #AUDIO, this means its two post-processing options (approximating contention and interrupt delays) are now redundant when simulating code execution.

In case you were wondering, yes, of course the #SIM macro has not been left out when it comes to memory and I/O contention and interrupts. It also now has parameters for specifying the value of the simulator’s clock, the interrupt mode, and whether interrupts are enabled. In addition, if the stop parameter is omitted, all other parameters are evaluated, but no code is executed. This technique can be used to prepare the simulator with the required initial register values and hardware state for later use by #AUDIO or #TSTATES.

And that’s about it. Anyone wanting more information on the the new features and bug fixes in SkoolKit 9.1 should pop over to the changelog. After that, go and get your copy of 9.1 and enjoy contending memory and switching RAM banks until the cows come home.