Disassembling the MICRO-POKEer ROM firmware

The MICRO-POKEer is a Multiface-like device for the unexpanded 48K Spectrum, introduced around 1988-1989 by a Hungarian company, Micro-Studio.

Basically it is useful to cheat games (i.e. poke infinite lives), save snapshots (e.g. save game progress, hack programs, remove copy protections) and save active screen content (e.g. print, game maps).

MICRO-POKEer capabilities:

* Freeze programs (NMI button)
* Load/Save screen content (16384 – 23295, 6.75 KBytes)
* Load/Save the entire RAM (16384 – 65535, total 48 KBytes)
* Turbo Load/Save (double speed)
* Peek/Poke/Jump to memory location
* Warm reset the Spectrum
* Hard reset

I own one device and reverse-engineered it in 2010. Firmware version is 1.6

You can find the download section at the end of this article.

The ROM firmware is credited to V&REW or W&REW software. I’ve never heard of this name before.
I used the Incomplete Spectrum ROM Assembly to resolve certain parts in the ROM.

The POKEer has an 8K ROM (M2764A) and three simple 74xx TTL support logic circuits (two 7432 quad OR-gate and a 7474 dual D Flip-Flop). For comparison, the Multiface has 8K ROM, 8K RAM and nine TTL ICs. It supports Kempston joystick mode, printing and the internal RAM could be used by special programs such as Genie (disassembler) and Lifeguard (analyses programs to cheat) or just as a simple 8K buffer. Multiface peripheral support is more versatile, it supports tape, cartridge, wafer and disc. It compresses saved RAM images rather than using an unreliable turbo option.

My MICRO-POKEer version lacks a through connector so it should be the last in the line of interfaces. It feels cheap like home made units. It’s clearly visible the single sided PCB was etched manually.

The MICRO-POKEer’s freeze operation:

By default the POKEer’s ROM is disabled (/E is high). After pressing the NMI button the device disables the Spectrum’s internal ROM and enables its own ROM (via /ROMCS signal) then the CPU starts processing the POKEer’s NMI routine. Switching back to the internal ROM is done by the firmware. Writing a zero to port 7Fh disables the device’s ROM and enables the ZX’s ROM then the execution resumes where interrupted. Interesting feature is when writing a one to port 7Fh enables the POKEer, but without an NMI it most likely freeze the Spectrum.

The Total RAM save option saves three files: a basic loader, the actual screen and a headerless data containing everything after screen memory. Memory saved up to 65535, so 16K Spectrums would have problems using it.

The Turbo load/save versions use a copy of the original load/save routines with modified timing constants to double the speed. Unfortunately, it is unreliable on an average tape recorder. It is very likely that data cannot be read back. Another problem which renders the turbo option useless is that there is no turbo version of the basic loader.

There is a so called Micro-monitor command to peek/poke memory. Very handy to cheat games. You can navigate an inverted area with Q/A/O/P keys to anywhere in the screen. It uses small characters to conserve the screen. Press the Enter key and fill in memory address in 5-digit decimal format. Immediately it will show the current memory value (peek). You can overwrite this value (poke) or jump to this address (after exiting from MICRO-POKEer). Be aware, since the POKEer has no backup memory, Micro-monitor may corrupt the game’s screen content if it won’t refresh the overwritten area.

The warm reset resumes the execution at $1313 (MAIN-G) in the Spectrum ROM. I assume it’s not correct. The $121C (NMI_VECT) seems more appropriate because there’s a possibility the variables area is messed up. Maybe the best would be to set HL the RAMTOP value and resume at $1219 (RAM-SET). However, the Multiface’s “exit to BASIC” is also crashed when the system variables was altered, according to its documentation.

The cold (hard) reset simply pulls the /RESET line to zero which enables the Spectrum’s ROM and triggers a hard restart of the computer. It’s a bonus, saves a reset button on the Spectrum.

MICRO-POKEer version 1.6 is implemented in an 8K EPROM but the device is able to handle a 16K EPROM chip. Interestingly, more than half of the 8K is unused (54%).

All in all, it’s a nice little device to hack and improve.

Downloadable materials:

* MICRO-POKEer v1.6 ROM image

* Online MICRO-POKEer Assembly File

* MICRO-POKEer Assembly File to compile the ROM image

* MICRO-POKEer Eagle schematic picture

* MICRO-POKEer schematic picture (simple)