The CPM2.2 serial number appears to be stored on the disc. This is the number that is in the box on the label. Not the one with "serial number" next to it.
It's a 6 byte number stored after 'USER' (in CCP) on the discand before BDOS in memory. D0 seems to be Amstrad's manufacturer code. ==== TPA ==== The top address of TPA can be found by reading the byte at 0006 (which is the top byte of the BDOS JP). This is the start of BDOS. CCP lives below this. If you wish to include CCP subtract &A from this. e.g. 0005 JP &8C06 0006 is &8C. So up to &8C00 can be used. Subtract &A to include CCP. &8C-&0A = &82. So up to &8200 can be used.
==== MOVCPM ====