acme/docs/Illegals.txt

                                 ACME

         ...the ACME Crossassembler for Multiple Environments

               --- Undocumented ("illegal") opcodes ---


In release 0.87, support for some of the undocumented opcodes of the
6502 processor was added.
In release 0.89, some more were added.
In release 0.94.8, another one was added (lxa).
In release 0.95.3, C64DTV2 support was added, which includes these
opcodes as well.

Here are the mnemonics, addressing modes and generated opcodes:

      |                 addressing  mode                 |
Mnemo |   8    8,x   8,y    16   16,x  16,y  (8,x) (8),y |  performs:
------+--------------------------------------------------+-----------
 slo  |   07    17    --    0f    1f    1b    03    13   |  asl + ora
 rla  |   27    37    --    2f    3f    3b    23    33   |  rol + and
 sre  |   47    57    --    4f    5f    5b    43    53   |  lsr + eor
 rra  |   67    77    --    6f    7f    7b    63    73   |  ror + adc
 sax  |   87    --    97    8f    --    --    83    --   |  stx + sta
 lax  |   a7    --    b7    af    --    bf    a3    b3   |  ldx + lda
 dcp  |   c7    d7    --    cf    df    db    c3    d3   |  dec + cmp
 isc  |   e7    f7    --    ef    ff    fb    e3    f3   |  inc + sbc

      |           addressing mode           |
Mnemo | implied #8    8    8,x    16   16,x |  performs:
------+-------------------------------------+------------------------
 anc  |   --    0b*   --    --    --    --  |  A = A & arg, then C=N
 asr  |   --    4b    --    --    --    --  |  A = A & arg, then lsr
 arr  |   --    6b    --    --    --    --  |  A = A & arg, then ror
 sbx  |   --    cb    --    --    --    --  |  X = (A & X) - arg
 dop  |   80**  80    04    14    --    --  |  skips next byte
 top  |   0c**  --    --    --    0c    1c  |  skips next two bytes
 jam  |   02    --    --    --    --    --  |  crash (wait for reset)
 lxa  |   --    ab*** --    --    --    --  |  A/X = (A | ??) & arg

Example:
		!cpu 6510	; activate additional mnemonics...
		lax (some_zp_label,x)	; ...and use them. No, this
		dcp (other_zp_label),y	; example does not make sense.

*) Up until ACME version 0.95.1, anc#8 generated opcode 0x2b. Since
ACME version 0.95.2, anc#8 generates opcode 0x0b. Both opcodes work
the same way on a 6510. I am told 0x2b does not work on the C64DTV2.

**) Note that "dop" and "top" can be used with implied addressing, but
the generated opcodes are those for immediate and 16-bit absolute
addressing, respectively. Using dop/top with x-indexed addressing
might have its uses when timing is critical (crossing a page border
adds a penalty cycle).

***) This opcode is said to first perform an ORA with an arbitrary(!)
value, then do an AND with the given argument, then do a TAX.
This means it is unstable and therefore useless - unless the given
argument is zero, in which case it reliably clears both A and X.

There is no guarantee that these opcodes actually work on a given 6502
(or 6510, or 8500, or 8502) CPU. But as far as I know, nobody ever
found an unmodified C64/C128 where these illegals didn't work. That's
why I used "6510" as the CPU keyword instead of "6502illegal" or
something like that.

These illegals will definitely *not* work on 65c02 and 65816 CPUs. But
I really should not have to tell you that ;)

Because there are no official mnemonics for these opcodes, different
people use different names for them. I hope my choices are not too
exotic for your taste.

Just for the sake of completeness: Here are all the remaining opcodes
(the ones ACME won't generate even with "6510" cpu):

Opcode|  Description                                          C64DTV2
------+--------------------------------------------------------------
  12  |  same as 02 and others    jam                 CRASH   bra rel
  1a  |  same as (*legal*) ea     nop
  22  |  same as 02 and others    jam                 CRASH
  2b  |  same as 0b               anc #8                      dop
  32  |  same as 02 and others    jam                 CRASH   sac #8
  34  |  same as 14 and others    dop 8,x
  3a  |  same as (*legal*) ea     nop
  3c  |  same as 1c and others    top 16,x
  42  |  same as 02 and others    jam                 CRASH   sir #8
  44  |  same as 04               dop 8
  52  |  same as 02 and others    jam                 CRASH
  54  |  same as 14 and others    dop 8,x
  5a  |  same as (*legal*) ea     nop
  5c  |  same as 1c and others    top 16,x
  62  |  same as 02 and others    jam                 CRASH
  64  |  same as 04               dop 8
  72  |  same as 02 and others    jam                 CRASH
  74  |  same as 14 and others    dop 8,x
  7a  |  same as (*legal*) ea     nop
  7c  |  same as 1c and others    top 16,x
  82  |  same as c2/e2            dop #8, but said to CRASH sometimes
  89  |  same as 80               dop #8
  8b  |    see notes below
  92  |  same as 02 and others    jam                 CRASH
  93  |    see notes below
  9b  |    see notes below
  9c  |    see notes below
  9e  |    see notes below
  9f  |    see notes below
  b2  |  same as 02 and others    jam                 CRASH
  bb  |    see notes below
  c2  |  same as 82/e2            dop #8, but said to CRASH sometimes
  d2  |  same as 02 and others    jam                 CRASH
  d4  |  same as 14 and others    dop 8,x
  da  |  same as (*legal*) ea     nop
  dc  |  same as 1c and others    top 16,x
  e2  |  same as 82/c2            dop #8, but said to CRASH sometimes
  eb  |  same as (*legal*) e9     sbc #8
  f2  |  same as 02 and others    jam                 CRASH
  f4  |  same as 14 and others    dop 8,x
  fa  |  same as (*legal*) ea     nop
  fc  |  same as 1c and others    top 16,x


Concerning opcodes 8b, 93, 9b, 9c, 9e, 9f, bb:

These opcodes are said to be unstable. For more information about what
they do, see these documents:
  John West, Marko Mäkelä. '64doc' file, 1994/06/03.
  Extra Instructions Of The 65XX Series CPU, Adam Vardy, 27 Sept. 1996
  6502 Undocumented Opcodes, by Freddy Offenga, 5/17/1997
  AAY64 (All About Your 64)

I did not see much point in assigning mnemonics for these opcodes. The
reference documents above call them:
  8b: ane, xaa
  93: sha, axa, ahx
  9b: shs, tas, xas
  9c: shy, say, sya
  9e: shx, xas, sxa
  9f: sha, axa, ahx
  bb: las, lar, lae