I recently read that the Turbo Chameleon 64 Cartridge provides a VGA replica of the VIC-II via clever bus snooping.

Thinking about it for a while it make sense that you can get all the information you need to replicate a VIC-II display by just snooping on the expansion port.

There is however one thing I am curious about: Is it possible for a cardridge to tell whether the IO peripheral space (at d000- dffff) is switched in or out of cpu view?

Without this knowledge a cardridge would not be able to tell whether a write to the region D000-D029 was really meant for a VIC-II register or whether it was meant for the RAM underneath.

Are the writes to the processor port register at $0001 (which seems to do the switching) not also snoopable? Another method would be to trace what instructions were fetched, but that would obviously be much more involved.

Related: The HiDef NES by Kevin Horton, aka kevtris. That is a HDMI mod for the NES, also implemented by snooping the bus. The development was chronicled in a series of videos on YouTube.

That is a good question!

I know that read/writes to memory location 0 and 1 gets deligated to 2 registers living on the 6510 itself.

But can anyone tell if the deaigners of the 6510 actually bothered to disable the adrress bus and databus on the cpu when these two memory locations is accessed?

I've a feeling writes to those two ports do go to RAM (and the values can be read back by some sprite collision trickery)

I have the same feeling. And I'll bet reads also go to RAM, but the value returned is ignored. That's alright, though. It's the writes which would interest you.

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Thanks for the pointers BigEd and Dr Jefyll.

I actually found this post also mentioning the sprite collission trickery:

http://www.lemon64.com/forum/viewtopic. ... 2d4af65bda

Looks like with snooping on the expansion pirt you can indeed detect bank switching

I actually spotted some useful info in Christian Bauer's VIC-II write-up(http://www.zimmers.net/cbmpics/cbm/c64/vic-ii.txt) regarding RAM locations 0 and 1 within a 6510 context.



So you would only see the address on the address bus for writing to memory location 0/1 and not the data to be written to this location.

It is a rather interesting anomaly where RAM locations 0/1 would be populated with the data that the VIC read in the previous cycle if you wrote to locations 0/1.

I wrote a assembly program to test this on the Vice emulator.

I started off by populating the first screen line with A's and then wait till the raster line approaches these A's. With the raster line at this location I do a couple of writes to memory location 1. According to the theory memory location 0 should be populated with an image line of an 'A'.

I then switch the location of screen memory to location 0. This will enable us to see memory locations 0 and 1 as the first 2 characters displayed on the screen.

Here is the assembly:



At the bottom I have attached a screen shot how the screen looks like switching the location of screen memory to 0.

You will see that the second character from the left at the top row is a less than symbol which have the screen code $3C. $3C is the second image line of the character A, which is what we expect since we did the writes at scan line 52.

It would be interesting to know if you get the same result when running on a real C64.

Alright, so it's not quite as Ed and I expected. But of course when they modified the 6502 to create the 6510 they would've done whatever seemed most expedient. It'd be acceptable to allow write data to drive the external bus, or not. What's mandatory is for read data from the external data bus NOT drive the internal data bus.

So, there are two ways they could've done it, equally acceptable (to them, at least ). While arranging to inhibit read data they apparently found it easiest to inhibit write data as well.


Interesting trick about writing to RAM at locations 0 and 1, BTW!

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Interestingly enough, hoglet's intelligent 6502 protocol analyser would be able to tell what value the CPU is writing, even if it doesn't appear on the bus.

This is a very cool project!

Looks like when doing this kind of bus snooping it is unavoidable to have some kind of 6502 emulator available to assist in dissecting the snooped info.

This project have some interesting possibilities. I think with not too much effort, for instance, one should be able to replicate the screen output of your BBC Micro to a window on your computer screen!