1. Find an old BBC Micro or a ROM image of the operating system.
2. If a BBC Micro, extract the OS ROM (not the BASIC ROM) and read the contents.
3. Look at locations 3C00-3EFF. These are 'dead' space in the ROM, normally hidden by custom hardware.
4.... more