acme/docs/Illegals.txt

                                 ACME

         ...the ACME Crossassembler for Multiple Environments

               --- Undocumented ("illegal") opcodes ---


In release 0.87, support for some of the undocumented opcodes of the
NMOS 6502 processor was added.
In release 0.89, some more were added.
In release 0.94.8, another one was added (lxa).
In release 0.95.3, C64DTV2 support was added, which includes these
opcodes as well.
In release 0.95.4, the remaining seven were added.
In release 0.95.6, "ANC" was removed from C64DTV2 mode.

Here are the new mnemonics, possible addressing modes and generated
opcodes (mnemonics in parentheses are used by other sources):

                |           addressing  mode           |
 mnemonic       |  8  8,x 8,y 16 16,x 16,y (8,x) (8),y | performs:
----------------+--------------------------------------+-----------
 slo (aso)      | 07  17      0f  1f   1b   03    13   | asl + ora
 rla (rln)      | 27  37      2f  3f   3b   23    33   | rol + and
 sre (lse)      | 47  57      4f  5f   5b   43    53   | lsr + eor
 rra (rrd)      | 67  77      6f  7f   7b   63    73   | ror + adc
 sax (axs, aax) | 87      97  8f            83         | stx + sta
 lax            | a7      b7  af       bf   a3    b3   | ldx + lda
 dcp (dcm)      | c7  d7      cf  df   db   c3    d3   | dec + cmp
 isc (isb, ins) | e7  f7      ef  ff   fb   e3    f3   | inc + sbc
 las (lar, lae) |                      bb              | A,X,S = {addr} & S
 tas (shs, xas) |                      9b              | S = A & X    {addr} = A&X& {H+1}
 sha (axa, ahx) |                      9f         93   | {addr} = A & X & {H+1}
 shx (xas, sxa) |                      9e              | {addr} = X & {H+1}
 shy (say, sya) |                 9c                   | {addr} = Y & {H+1}

                |         addressing mode         |
 mnemonic       | implied #8    8   8,x  16  16,x | performs:
----------------+---------------------------------+-----------------------
 anc (ana, anb) |         0b*                     | A = A & arg, then C=N
 alr/asr        |         4b                      | A = A & arg, then lsr
 arr            |         6b                      | A = A & arg, then ror
 sbx (axs, sax) |         cb                      | X = (A & X) - arg
 dop (nop, skb) |   80**  80   04   14            | skips next byte
 top (nop, skw) |   0c**                 0c   1c  | skips next two bytes
 nop (skb, skw) |   ea    80   04   14   0c   1c  | see the two lines above
 jam (kil, hlt) |   02                            | crash (wait for reset)
These two are somewhat unstable, because they involve an arbitrary value:
 ane (xaa, axm) |         8b***                   | A = (A | ??) & X & arg
 lxa (lax, atx) |         ab***                   | A,X = (A | ??) & arg

Example:
		!cpu nmos6502	; activate additional mnemonics...
		lax (some_zp_label,x)	; ...and use them. No, this
		dcp (other_zp_label),y	; example does not make sense.

*) Up until ACME version 0.95.1, anc#8 generated opcode 0x2b. Since
ACME version 0.95.2, anc#8 generates opcode 0x0b. Both opcodes work
the same way on a real NMOS 6502 CPU, but they do not work on the
C64DTV2.
Using the "--dialect" CLI switch does not change the generated opcode!

**) Note that DOP ("double nop") and TOP ("triple nop") can be used
with implied addressing, but the generated opcodes are those for
immediate and 16-bit absolute addressing, respectively, This way DOP
and TOP can be used to skip the following one- or two-byte
instruction.
Using DOP/TOP with x-indexed addressing might have its uses when
timing is critical (crossing a page border adds a penalty cycle).
Unless using implied addressing, DOP/TOP can also be written as NOP.

***) ANE and LXA first perform an ORA with an arbitrary(!) value and
then perform an AND with the given argument. So they are unstable and
therefore useless - unless the given argument is zero:
ANE #0 reliably clears A - which is still useless; just use LDA #0.
LXA #0 reliably clears both A and X.
ACME will output a warning if these opcodes get assembled with a
nonzero argument.

There is no guarantee that these opcodes actually work on a given 6502
(or 6510, or 8500, or 8501, or 8502) CPU. But as far as I know, nobody
ever found an unmodified C64/C128 where these illegals didn't work.

These illegals will definitely *not* work on 65c02 and 65816 CPUs. But
I really should not have to tell you that ;)

Because there are no official mnemonics for these opcodes, different
people use different names for them. I hope my choices are not too
exotic for your taste.

Just for the sake of completeness: Here are all the remaining opcodes
(the ones ACME won't generate even with "nmos6502" cpu chosen):

Opcode|  Description                                          C64DTV2
------+--------------------------------------------------------------
  12  |  same as 02 and others    jam                 CRASH   bra rel
  1a  |  same as (*legal*) ea     nop
  22  |  same as 02 and others    jam                 CRASH
  2b  |  same as 0b               anc #8                      dop
  32  |  same as 02 and others    jam                 CRASH   sac #8
  34  |  same as 14 and others    dop 8,x
  3a  |  same as (*legal*) ea     nop
  3c  |  same as 1c and others    top 16,x
  42  |  same as 02 and others    jam                 CRASH   sir #8
  44  |  same as 04               dop 8
  52  |  same as 02 and others    jam                 CRASH
  54  |  same as 14 and others    dop 8,x
  5a  |  same as (*legal*) ea     nop
  5c  |  same as 1c and others    top 16,x
  62  |  same as 02 and others    jam                 CRASH
  64  |  same as 04               dop 8
  72  |  same as 02 and others    jam                 CRASH
  74  |  same as 14 and others    dop 8,x
  7a  |  same as (*legal*) ea     nop
  7c  |  same as 1c and others    top 16,x
  82  |  same as c2/e2            dop #8, but said to CRASH sometimes
  89  |  same as 80               dop #8
  92  |  same as 02 and others    jam                 CRASH
  b2  |  same as 02 and others    jam                 CRASH
  c2  |  same as 82/e2            dop #8, but said to CRASH sometimes
  d2  |  same as 02 and others    jam                 CRASH
  d4  |  same as 14 and others    dop 8,x
  da  |  same as (*legal*) ea     nop
  dc  |  same as 1c and others    top 16,x
  e2  |  same as 82/c2            dop #8, but said to CRASH sometimes
  eb  |  same as (*legal*) e9     sbc #8
  f2  |  same as 02 and others    jam                 CRASH
  f4  |  same as 14 and others    dop 8,x
  fa  |  same as (*legal*) ea     nop
  fc  |  same as 1c and others    top 16,x

For more information about what these opcodes do, see these documents:
  John West, Marko Mäkelä. '64doc' file, 1994/06/03.
  Extra Instructions Of The 65XX Series CPU, Adam Vardy, 27 Sept. 1996
  6502 Undocumented Opcodes, by Freddy Offenga, 5/17/1997
  AAY64 (All About Your 64)

...but the most comprehensive work is:

    "No More Secrets - NMOS 6510 Unintended Opcodes"

Download it from    https://csdb.dk/release/?id=185341
or ask google for the latest version.