# The ZX Spectrum sound chip hidden in a 1992 DOS game's Tandy driver > Source: > Published: 2026-09-02 00:22:50+00:00 In 1992, if you had a Tandy computer and the DOS version of a British strategy game called Utopia, the music you heard was played by a machine that did not exist. The Tandy sound driver programs a chip the Tandy does not have. It writes to the sound chip of a ZX Spectrum 128, a British home computer this game never shipped on. The driver keeps the chip's registers in memory and writes to them through the Spectrum's own port numbers, 0xFFFD and 0xBFFD. Those numbers mean nothing on a PC. Fifty times a second a converter reads those registers and rewrites the values for the chip the machine actually has. I went looking for prior documentation and found none: the music-format wikis have a two-sentence stub for this game, and the composer's interviews in print never mention the Tandy version. The find itself came out of Claude agents working inside Anthropic's Claude Code, reading the shipped executable byte by byte. So we settled it. We took the register stream the DOS driver computes and played a two-minute stretch of it on an emulated Spectrum 128, through the real ports, on the chip family the code was written for. There is a video of the Spectrum doing it below. ## Three fingerprints How do you tell translated code from code written by someone who just liked Spectrums? Same way you spot a translated sentence. The original grammar shows through. This player has three tells. Port numbers travel in the CX register, which is Z80 grammar; native PC code all but always uses a different one. Saving and restoring registers takes four instructions where the Z80 habit it copies took two. Multiplication and division run as slow hand-built loops on a processor with multiply and divide in silicon. The Z80 had neither. The workaround got carried over to a machine that never needed it. There is an obvious objection. Utopia also shipped on the Atari ST, whose sound chip is the AY's licensed twin, so the Spectrum flavor might be nothing more than ST code carried over to the PC. We read the ST's player. It is native 68000. It reads the sound chip back through the address the hardware sits at, which the DOS driver cannot do because its chip is thirteen bytes of RAM, and it multiplies with the 68000's own instruction where the DOS driver runs the Z80's loop. Two different programs playing one score. Wherever the DOS driver's Z80 came from, it was not the ST's player. Translation tools were real products of the microcomputer era. WordStar, the era's best-known word processor, reached the PC as machine-translated code. A game shipping this way is a different matter. Every catalog and wiki we could query has no second case. The big forums block guest search, so that half of the record is unchecked, and maybe others are out there. This is openly disclosed reverse engineering of a game that is still commercially licensed today. Nothing from the original ships with anything we made, and all of it is useless without your own copy. ## Anatomy of a phantom The phantom is a small block of driver memory laid out like the Spectrum chip's register file: three tone pitches, a noise pitch, a mixer, three volumes, an envelope timer. The music engine writes it as if the chip were really there. Every tick, the converter translates the result for the Tandy's actual chip, which has different registers, a different pitch formula and two fewer bits of range. While proving the replay, we ran the original driver under a CPU emulator and read its memory as it worked. That run corrected our own records by one byte. The register file holds thirteen bytes; the chip's datasheet promises fourteen. The fourteenth slot, the envelope-shape register, has no storage behind it at all. Its address lands on the first instruction of the driver's own write routine. If the music ever wrote that register, the driver would overwrite its own code. It never does. What remains of the envelope machinery: two period bytes of real storage no tune ever touches, and a shape register with none. ## The scar in the bass The Spectrum chip counts pitch in twelve bits, the Tandy's in ten. The 1992 fix was blunt. The lowest thirteen notes of the pitch table are pinned to the deepest note the Tandy chip can reach, and the pinned table shipped inside the game. Thirteen different bass notes, one pitch. Across full runs of all four tunes, the music lands in that dead zone 53 times. The scar does not heal on the Spectrum either. The pinning is baked into the shipped data, so the phantom's own chip, which could reach those notes, never gets them. The videos below play what shipped. ## What the bug found Every earlier reading of the Tandy music had quietly stopped at 120 seconds. That was a capture default in one of our own tools, and nobody had questioned it. The tell was four dumps measuring exactly the same length. Captured in full, the fourth Tandy music file runs 65% longer than the tune it was filed under, and if it recomposes anything in the known score, it does so beyond recognition. Tandy owners got a fifth piece of music, one no other DOS soundtrack carries. When I finally heard it end to end, I recognized it. It is the Atari ST version's fourth tune, surviving in the Tandy build under another tune's file number. That is my ear talking; the measurement that will confirm or refute it is queued. The file itself has no title field, and no one had listened past two minutes. It has been on every Tandy install since 1992, unnamed. There is nowhere in the format to write a name. Below is the whole piece, performed on an emulated Spectrum 128. ## Watch it Proving "a Spectrum can really play this" needed a chain with no weak links. Every link has a script and a log behind it in the record. We ran the original driver, unmodified, under CPU emulation. The register stream it computes in its own memory is byte-identical to our export, tick for tick, over every byte of register storage it possesses, across full runs of all four tunes. On the Spectrum side there is a 95-byte program we wrote, a dumb pipe that knows nothing about music. It delivers a 118-second window of the first tune through the real ports at the original speed. A logging tap inside the emulated machine recorded every register write arriving: 17,396 of them, zero mismatches, every write in exactly the frame it belonged to. The captured audio was pitch-checked against the Spectrum chip's clock. All 84 checkpoints landed within ten cents of the predicted note; 82 also passed the stricter dominance and onset tests the criteria demanded. The control run, the same stream with its frames shuffled, was delivered just as perfectly and scored zero. The rig follows the house rules. Pass criteria went into a file before the emulator was installed, and the run had a control that was required to fail. The emulator and ROMs are stock and hash-checked, and the player was never modified; what plays on the Spectrum is the DOS driver's own output, carried across. The video build adds eyes. The title card and the volume meters are drawn by the Spectrum itself, live, from the same register values it is playing, and its delivery was re-checked on its own: 17,091 writes over a 115-second window, zero mismatches. Thirty-four years, and the chip family this player was written for has finally performed what it computes. ## What stays open We do not know which Spectrum program this player came from. The translation is provable; the donor is not identified, and finding it means comparing against other people's Spectrum-era code, which is a step we take deliberately or not at all. The sound-effects half of the driver remains unread. Real hardware remains untested; our Spectrum is MAME's, an emulator that shares no code with any tool of ours. One binary is one binary; we can prove the specimen, not a practice. If you shipped DOS games in the early nineties and this sounds like something your studio did on a Friday, the comment box below is a primary source. ## What I'd steal from this Three things about working with AI agents, all learned on this one strand. Trace, don't watch: an instrument that watches a window of memory reports what happened near your target. One that traces every read to the instruction that made it reports what actually happened. A number is only worth quoting at the second level. Have every number derived twice, independently. Anthropic's guidance for these tools says review should be done fresh, "so the agent doing the work isn't the one grading it." We ran that as law: our own reconstruction and the shipped driver were executed side by side and had to agree byte for byte before any of this counted. Separate contexts are where the confidence comes from. Tool defaults hide findings. A 120-second capture limit, questioned once, produced a lost piece of music. The most useful question on this whole project is still: what is the tool quietly deciding for me? The phantom chip played for thirty-four years inside a machine that could not hear it. It took a translator nobody credited, a pitch table nobody documented, and a bug nobody noticed, and all of it worked, every day, on every Tandy that booted the game. Nobody found it sooner because finding it meant reading a dead sound driver instruction by instruction, and that attention was never worth the cost for a forgotten Tandy option. Now it is. Claude agents inside Anthropic's Claude Code read the music half of this driver end to end, and the replay proof, from pre-registered criteria to an emulated Spectrum performing the driver's own output, ran in one day. The rest of that era's software is the same: decisions, workarounds and accidents nobody wrote down, sitting in binaries nobody reads. Reading them just became affordable. The record is catching up.