Thursday, March 19, 2020

Panasonic Video Titler VW-KT300 - part 3


As I stated in a previous post, this blog was returning after a large pause. After showing a new device and a bit of history, nothing is more appropriate than summon an old and forgotten loose thread. And here we are.

Back in 2016, we take a look in Panasonic VW-KT300. We saw that it's a MSX2+ without a MSX-BIOS. The machine have a different BIOS, almost made from scratch. The disassembly of this BIOS confirmed to us that:

  • The NEC gate-array is some kind of MSX-Engine;
  • 64KB of RAM is a Memory Mapper;
  • There are routines to initialize PPI and PSG;
  • MSX's slots and pages structure is present;
  • VW-KT300 is an MSX based hardware.

With this information, Alexandre Tabajara from Tabalabs boots the Video Titler using a MSX1 BIOS, The video with this experience even shows the MSX Basic prompt. Further try outs to boot it, now as a MSX2+, proved to be very frustrating and eventually, I give up and did go to the next archaeological excavation.

Now and then I take the disassembled SYSTEM0 code, understand and comment a few lines, and put it back in the drawer. This week I toke the code to read again and, suddenly, saw something very obvious: the machine, hardware wise, is a Panasonic MSX2+, what the MSX2+ from Panasonic has in slot 3.3?

The Panasonic Mapper.

Sometimes the information is just in front of our eyes. In the 2016's post I wrote, frustrated:
The layout of SLOT3.3, with all pages mapped to EDIT0, is a clue that there is a custom mapper that needs to be configured somehow. 

"There is a custom mapper"... why not try the Panasonic one in a Panasonic machine?

For those unfamiliar with the Panasonic Mapper, it is used with few modifications in all MSX2+ and TurboR from Panasonic. It merges all MSX address spaces (RAM, ROMs, SRAM) in a big set with 512 segments of 8KB each. AFAIK this mapper is only present in the firmware slot: 3.3.

To select which segments are in each of the slot 3.3's pages, you need to write the desired segment number in a specific memory address for each page. To select which segments are in each of the slot 3.3's pages, you need to write the desired segment number in a specific memory address for each page, as you can see in the table below:

        +-------------+-------SEGMENT-SELECTION-------+
        |   ADDRESS   |  7FF8h  |    WRITE    | READ  |
+-------+-------------+---R/W---+-------------+-------+
| PAGE0 | 0000h~1FFFh |  bit 0  | 6000h~63FFh | 7FF0h |
|       | 2000h~3FFFh |  bit 1  | 6400h~67FFh | 7FF1h |
+-------+-------------+---------+-------------+-------+
| PAGE1 | 4000h~5FFFh |  bit 2  | 6800h~6BFFh | 7FF2h |
|       | 6000h~7FFFh |  bit 3  | 6C00h~6FFFh | 7FF3h |
+-------+-------------+---------+-------------+-------+
| PAGE2 | 8000h~9FFFh |  bit 4  | 7000h~73FFh | 7FF4h |
|       | A000h~BFFFh |  bit 5  | 7800h~7BFFh | 7FF5h |
+-------+-------------+---------+-------------+-------+
| PAGE3 | C000h~DFFFh |  bit 6  | 7400h~77FFh | 7FF6h |
|       | E000h~FFFFh |  bit 7  | 7C00h~7FEFh | 7FF7h |
+-------+-------------+---------+-------------+-------+
        | (1) Segment number have 9 bits (1+8)        |
        |      - most significant bit r/w from 7FF8h  |
        |      - last 8 bits from memory specified    |
        |        memory addresses for read and write  |
        | (2) 7FF9h is a control register:            |
        |     000bbb00                                |
        |        ||+---> enable reading 7FF0h~7FF7h   |
        |        |+----> enable reading 7FF9h         |
        |        +-----> enable read/write 7FF8h      |
        +---------------------------------------------+

Having the VW-KT300's slot 3.3 using a Panasonic Mapper seems to be a good guess. Now we just need to check if our hypothesis is correct. And it's is easy to do, we only need to take a look at the SYSTEM0 disassembled code. Search for something like this:

di
ld a,0ffh
out (0a8h),a
ld a,00fh
ld (0ffffh),a
ld a,(0edf4h)
ld (06000h),a
inc a
ld (06400h),a
ret

The snippet above is part of the "shuffling around pages" code that puzzled me. If you want to check it yourself, it's from position 0641h in the VW_SYSTEM0.ROM file. The code does the following:

  1. Disables interruptions
  2. Activates pages 0 to 3 in primary slot 3
  3. Activates pages 0 and 1 in secondary slot 3.3
  4. Activates pages 2 and 3 in secondary slot 3.0
  5. Reads an arbitrary data from 0edf4h
  6. Writes the data in address 6000h
  7. Increases data by one
  8. Writes the increased data in address 6400h
  9. Returns

It's a safe assumption that the "arbitrary data" in 0edf4h is the segment number. Then, by the addresses 6000h and 6400h, two consecutive segments were wrote on Page 0. Nice. I still find the big picture code around this one very confusing, but it's clear that it's using the Panasonic Mapper to select the data to be visible in slot 3.3

We can also see the similarities between the labels inside the FS-VA1.ROM and the full A1WSX firmware. They are even in similar offsets!

+---------+----------+----------+
| OFFSET  | FS-A1WSX | VW-KT300 |
+---------+----------+----------+
|00000010 |WSXSEG00P1|EDIT0     |
|00004010 |WSXSEG01P0|EDIT1     |
|00008010 |WSXSEG02P2|EDIT2     |
|0000c010 |WSXSEG03P0|SYSTEM1   |
|00010010 |WSXSEG04P1|VA1DATA   |
|00014010 |WSXSEG05P2|DESIGN    |
|00018010 |          |          |
|0001c010 |          |          |
|00020010 |WSXSEG06P1|          |
|00024010 |WSXSEG07P2|          |
|00028010 |WSXSEG08P1|DEMO      |
|0002c010 |WSXSEG09P0|          |
|00030010 |WSXSEG10P2|SYSTEM0   |
|00034010 |WSXSEG11P0|SAMPLE0   |
|00038010 |WSXSEG12P1|SAMPLE1   |
|...      |...       |----------+
|00170010 |WSXSEG30P1|
+---------+----------+

And what we can do with this information? Well, we still have lot of gaps in our knowledge about the Panasonic Video Titler VW-KT300, and some of them can only be filled if we can probe while the machine is running. Specially the convoluted page mapping code. Being the VW-KT300 very similar with the other Panasonic's MSX2+, and since these MSX2+ were emulated by OpenMSX, we can probably put the code from VW-KT300 to run in OpenMSX, too!

The first step is to create a machine definition in OpenMSX. A good idea is to use another MSX2+ from Panasonic as VW-KT300 base, we chose the FS-A1WSX. When a MSX turns on, it began to read the code from address 0000h in slot 0 (or 0.0), so the VW_SYSTEM0.ROM needs to be mapped there:

sha1: a321510f66f89413d18454c2cdcfd11dddd86536

We knew by the already disassembled initialization code, that the slot 3 is the only one which is expanded. So the VW_SYSTEM0.ROM is in slot 0, the other sub-slots were removed from the machine definition. Another change is the ROM size, we change to 0x4000, because VW_SYSTEM0.ROM is a 16KB ROM.

What else we know?

The slot 3.0 is the 64KB Memory Mapper, and the 3.3 is the Panasonic Mapper. The ROM file for the Panasonic Mapper needs to be a complete one. So we put the FS-VA1.ROM there:

sha1: f2def2d1f8be9c34e67e4e42675204a51aeae650

And let's start the machine!

Ok, that doesn't look right.

Black screen. Using the MSX debug, the machine was trapped in a loop in the interruption handler, it goes to 0038h, which jumps to EE15h, and there we have an FFh which calls the interruption code in 0038h. Why this is happening??

The OpenMSX console helps a lot the debugging process.

Our emulation try gives the first fruit: we find a difference between the usual MSX hardware and the PPI implemented in NEC gate-array. The SYSTEM0 didn't have the code to initialize the PPI ports. It starts just writing the slot configuration to I/O port A8h without first setting the PPI ports directions by writing in I/O port ABh.

Without writing the slot configuration in A8h, the pages 2 and 3 were kept in slot 0, which have nothing from 4000h to FFFFh. And "nothing" is a area full of FFh, that's why EE15h have FFh (rst 38h), goes back to 0038h and there returns to EE15h. We need to initialize the PPI ports configuration, then the A8h write will work as expected.

To be able to use the VW-KT300's code unmodified, I put an watchpoint at address 0001h which executes the proper PPI ports initialization when triggered. And then:

Japanese text says "Children's Day"

Japanese text says "Sport's Day"

Japanese text says "Presentation" or "Recital"

Great! It's working! I guess those screens are some kind of examples of what can be done with this Video Titler. But the splash screen is missing. Also there's a lot of empty squares were should be characters.

We still  need to debug and tune this machine definition, but that is for our next post!

Sunday, March 15, 2020

The Plastic Cards Era


FIG. 1 is a front elevational view of a memory card for a
computer showing our new design;
FIG. 2 is a rear elevational view thereof;
FIG. 3 is a top plan view thereof;
FIG. 4 is a bottom plan view thereof;
FIG. 5 is a left side elevational view thereof;
FIG. 6 is a right side elevational view thereof; and
FIG. 7 is a top plan view thereof, the shutter shown in
the open position after it has been slid in the direction of A.

The picture and text above are an excerpt of a design patent granted in 1990 for Mitsubishi, the inventors are Toshinobu Banjo and Shigeo Onoda. This one and a lot of other IC Card related patents were filled by Mitsubishi in 1987, maybe some products using this cards were near to be or just been released in the US market. While those patents were filled in 1987, it's known that the Mitsubishi produced such IC Cards for different companies a few years before.

A Mitsubishi Rewritable Bee Card
Source: SACHEN - Japanese Wikipedia, Public Domain, Link

In 1984, Sega releases a new media to distribute its games. This new media is called "My Card", with 32KB of capacity, the size of a credit card and 2 milimeters thick, built by Mitsubishi Plastics.

As the the first SG-1000 models, the SC-3000 home computer and the compatible machines from other licensed manufacturers like Tsukuda or Pioneer, didn't have a dedicated card slot built in, Sega provided special cartridges with a IC card connector. With this adapter the "My Card" could be used by all SG-1000 installed base.

A Sega SG-1000 with the Card Catcher and a "My Card" game inserted.
Source: Nintendo Sega Japan!

Sega's ambitious plan was to convert the existent library and release all the new games in this new format. It did belief that shrinking the cartridges to a credit card size would be a trend, and the users would like to have huge game collections using less storage footprint. Therefore, when the Sega Mark III was released it came with a card slot, ready to play the "My Card" games without any adapter.

Sega propaganda of SG-1000 II and Sega Mark III featuring the "My Card"
Source: Sega Mag

But the users don't wanted shrinked cartridges, instead, they wanted to have most complex games with more graphics and sounds, to do that, the game's media needed to grow in capacity. The "My Card" couldn't cope with that in time, and the newer and better games began to be released in cartridges. And, being the cartridges the dominant media, even the smaller games abandoned the IC card and goes back to cartridges.

In 1987, Sega releases the last new games in "My Card" format, but continues to sell Sega Master System with a card slot until 1990, when released the Master System II, without "My Card" support built-in. The Sega's history with the credit card size form factor ends here.

The obscure Sega AI Computer also used the IC cards
Source: SMS Power!

The black card have the copyright from 1986, Sega AI announce date.
The white card's copyright is from 1989, so Sega continued releasing
Sega AI Cards at least until this date.
Source: SMS Power!

Back to 1985, with Sega still investing in the "My Card", Hudson Soft developed the "Bee Cards" for MSX, also built by Mitsubishi Plastics. The main selling point were its size, you could have a huge games collection, put all in a binder and brought them anywhere.

Who needs a binder? You can put your
Hudson "Bee Cards" in your wallet!
Source: MSX Magazine - September 1985

Differently than Sega which determined the media, created the games and built the game consoles, the Hudson Soft was mostly a software developer. While we can imagine an alternate reality in which Hudson built an MSX, in the real world no official MSX computer have a built in card reader, every MSX user that wants to use a "Bee Card" needs to by a card adapter cartridge, like the owners of first model Sega SG-1000 to use the "My Card".

Bee Card Adapter for MSX

The adapter was provided by Hudson Soft itself: the Hudson Bee Pack BP-0001, it was sold stand alone or bundled with a game card.



These three are all games in "Bee Card" format from
MSX Magazine 1986 Software Catalog





And with these other three from MSX Magazine 1987 Software
Catalog, we have almost all the "Bee Cards" released for
MSX in Japan. Only Bomber Man Special is missing.

But the smaller form factor media didn't catch traction with the software houses other than Hudson Soft itself. With few titles available, the users didn't want to pay for the Bee Pack, with few Bee Packs, the software houses didn't wants to release their games in this format, in a Catch-22 situation. By 1986, when the format died, less than ten software titles were released in "Bee Cards".

In parallel, also in 1985 and for MSX, Astron releases other IC Card, this model is called SoftCard (a very original name for a card to distribute software). Again, no official MSX came with a built in SoftCard reader, so to use an Astron SoftCard it's needed an card adapter cartridge.

Astron SoftCard ad, highlighting the instantaneous loading
of a ROM software over the cassete slowness.
Source: What MSX? Volume 01 Number 04 - 1985 Winter

Even with Astron SoftCard being Japanese, the two known MSX's card readers for this format are from European companies: Electric Software from UK and Cameron from France. With the readers released only on Europe, all the software cards were also distributed only there. Besides UK and France, MSX users in Spain also got games in SoftCard format, through SERMA, who licensed it from Electric Software.

The SoftCards released by SERMA in Spain. In this advertisement,
it says that when buying some specific games (1x2, Loto or QH)
you get the card reader, for free.
Source: MSX Club de Programas - Especial Software

Probably by the same reasons of "Bee Card" failure, by "all" software cards, you can count fourteen or fifteen. Very disappointing, but in amount of titles, better than "Bee Card". The SoftCard's adventure ends in 1986 with the main media option for European games still being the audio cassettes.

Later, Hudson had a better luck when partners with NEC to develop and release a new IC card model: the HuCard, for NEC's PC Engine game console. HuCards are, by far, the most successful game IC Card. While those are the most relevant examples to the "retro" community, it's important to know that many other companies and appliances besides game consoles and home computers used some kind of IC card as storage media.

IC Cards for Korg synthesizers

The Mitsubishi process and patents covers a circuit embedded in a plastic substance, molded in a flat form, with metallic terminals in one of this sides, placed close to one of the card's edge. How will be the circuit inside? Nothing. How many terminals? Nothing. Terminals pinout? Nothing. Only the industrial process is covered here.

And what are the results? Each card model have their own pinout and limitations. Cards of each company, Sega, Hudson, Astron, NEC, were incompatible physically (different amount or arrangement of pins) and logically (different signals placed in the same pins).

Some of the different pin arrangements

Of course that in the MSX scene, with cards from Astron and Hudson, the two cards formats available would be incompatible: the Astron cards can't use the card readers from Hudson Soft and vice-versa. If both were available in the same markets, the users would need to buy two different card readers.

Which card reader the MSX users from UK should buy?
Well, between the two standards, they chose neither.
Source: What MSX? Volume 01 Numbers 03 and 04 - 1985

For our archeology purposes, these many different formats didn't help. When an unknown card from a new brand is discovered, we can't only connect it to an reader and use it. We need to first find the card's pinout, and them find an way to connect it somewhere and read it.

And what about this one?

Saturday, March 7, 2020

Taito Presenter 2000 - part 3


Now we already knows the Taito Presenter 2000's internals, had the ROMs dumped, and also know a little about its inner workings.

Time to see the unit itself, its exterior is very simple: is a beige box with one side sloped.

Taito Presenter 2000 front view. I guess its made of alumnium.

The front is divided in two halves, the left one have the
name of the equipment and it is a flap door. To open it
you need to press at the center top.

The right half have two buttons. One labeled as "START" and the other as "STOP".

The upper view.

It's uncommon to have something in the upper side of those boxy
machines, which usually have a monitor put over them, but in Taito
Presenter 2000 we have a silver seal with its name.

Side view, right and left looks the same. The sloped side is the front.

Bottom view. The screws to open this unit are inside its feet.
The other screws holds the main board in place.

In the bottom side there is the seal with machine's information.

Plastic of Taito Presenter 2000's cabinet is very thick. The pictures don't show that, but the vent openings are protected with foam in the inside, to filter dust. And, as you can guess, this old foam crumbles every time it's touched.

The back side have a dozen of connectors and switches. For our luck, all of them are labelled, so it can help us to find what this machine built to do.


The back side

There are three sets of audio stereo RCA connectors.
From left to right: Karaoke sound input, External
sound input and finally the sound output. Next is the ground pin.
Then the RGB connector and another video output.
At bottom, a P2 jack, labeled in Japanese as "START / STOP"


From top-left to bottom-right:  video input, a RF channel selector
switch and the RF output. The next is the power supply connector.
The P2 jack at bottom left is labeled as "Credit" and, very interesting,
the A/B mode switch. The screwed door covers the expansion connector.

So, the video that we saw in another post shows the machine doing "something" and a girl dancing after that. Maybe it made sense if I could understand the Japanese talk. Or if I had any documentation about this appliance. But at least I have those silks in the unit itself!

The A/B switch at back is a mode selector. And the modes are labeled in Japanese:

  • A: Karaoke (カラオケ) Link Mode;
  • B: Lucky Draw (福引き抽選) Mode

Google translates "福引き抽選" to "Lottery Lottery", not so much useful. Putting the words in separated lines I got "Blessing Lottery" as translation, I guess the most common used expression for this is "Lucky Draw".

This is what is happening in the video! The cuisine chef there starts some kind of "slot machine" game (using the START button at front), and then the girl hits the STOP switch and win the lucky draw! Well, in general lines I believe that this is a good interpretation merging the video and the information given by the Taito Presenter 2000 unit.

The START/STOP P2 jack at back is easy to fit in this description too. The Presenter 2000 comes with a wired remote push button who can be plugged in this connector (it's somewhere in my home office, but couldn't find it now). When connected, the remote button have the same use of START/STOP buttons at the front of the unit. With that, the Presenter 2000 main unit can be concealed in a cabinet and people still can play the lucky draw game.

The Karaoke Linked mode puzzles me a bit more. The Presenter 2000 doesn't have a microphone input and, by itself, doesn't have any way to control an external Karaoke machine. Maybe it needs something plugged in expansion port? Maybe we got more clues in other printed texts in the cabinet?

The left half of Taito Presenter 2000's front opens.

And reveals the power switch, a volume knob, two unidentified
switches, a counter and a card slot (with a card inserted).

In the door, a sticker, with the description of all the elements behind it.

The two former unidentified switches are identified in the sticker in the door. The one at top is a mode switch labeled "Lottery" (抽選) or "Configure" (設定), so the administrator can configure the lottery parameters or play it. The other switch is labeled "Lottery" OFF/ON, didn't know yet the relationship the other switches.

Ok, the information helps with the "Lucky Draw Mode". But I still don't know what is the "Karaoke Linked Mode", another mystery for later.


Thursday, March 5, 2020

Taito Presenter 2000 - part 2

As I wrote in last post, I don't have the power supply for Taito Presenter 2000 and, while in MSXSP meeting, some friends that know how to handle old electronics found that the machine needs to have its capacitors changed by new ones. So, I can't power on this equipment, which cripples many of the tests that I want to do.

But I still want to explore this machine. So I got to try to understand what is the gibberish inside Taito's EPROMs. Let's see the last 16KB of A70-01-I and the full 32KB of A70-02.

We already know that there isn't any recognizable character string inside those sections of the ROMs. Let's see what we can see in the A70-02 EPROM with "hexdump":

0000000 5555 5555 5555 5555 5555 5555 5555 5555
0000010 5555 5555 5555 5555 5555 5555 5555 5555
0000020 5555 5555 5555 5555 5555 5555 5555 5555
0000030 5555 5555 5555 5555 5555 5555 5555 5555
0000040 5555 5555 5555 5555 5555 5555 5555 5555
0000050 5555 5555 5555 5555 5555 5555 5555 5555
0000060 5555 5555 5555 5555 5555 5555 5555 5555
0000070 5555 5555 cc55 cccc cc5c cccc cccc cccc
0000080 5555 5555 5555 5555 5555 5555 5555 5555
0000090 5555 5555 cccc cccc cccc cccc cccc cccc
00000a0 5555 5555 5555 5555 5555 5555 5555 5555
00000b0 5555 5555 cccc cccc cccc cccc cccc cccc
00000c0 5555 5555 5555 5555 5555 5555 5555 5555
00000d0 5555 5555 cccc cccc cccc cccc cccc cccc
00000e0 5555 5555 5555 5555 5555 5555 5555 5555
00000f0 5555 5555 cccc cccc cccc cccc cccc cccc
0000100 5555 5555 5555 5555 5555 5555 5555 5555

When I saw this output, the 0x5555 got my sight. Changing it to binary it is:

0x5555 = 0101 0101 0101 0101

And if this garbage is some kind of drawing? I already saw a similar output in Kanji-ROMs and in some blogs about reverse engineering of old arcade boards. To find this out, I wrote a small program to read the ROM and give an output that looks like a bitmap. If someone wants to use it for something, the slightly sanitized source code is here:

#include <stdio.h>

int main(int argc, char **argv)
{
    if (argc != 2) {
        printf("Usage: %s FILENAME\n\n", argv[0]);
        return 0;
    }

    FILE *f = fopen(argv[1], "rb");
    if (f == NULL) {
        printf("Error: File '%s' not found!\n\n", argv[1]);
        return 1;
    }
    fseek(f, 0, SEEK_END);
    long lsize = 0, i = 0;
    lsize = ftell(f);
    rewind(f);

    while (i < lsize) {
        short int byte = fgetc(f);
        short int mask = 0x80;
        short int j;

        for (j = 0; j < 8; j++) {
            if ((byte & mask) == 0) {
                printf(" ");
            } else {
                printf("#");
            }
            mask >>= 1;
        }
        i++;
    }

    fclose(f);

    return 0;
}

Now, let's see what is inside the mysterious ROMs:

 ### ### ### ### ### ### ### ###
 ###  #   #  ###  #   #  ### ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
 ###  #   #   #   #   #  ### ###
 ### ###  #   #   #  ### ### ###
 ### ### ###  #  ### ### ### ###
 ### ### ### ### ### ### ### ###
 ### ### ### # # ### ### ### ###
 ### ### # # # # # # ### ### ###
 ### # # # # # # # # # # ### ###
 # # # # # # # # # # # # # # ###
 ### # # # # # # # # # # ### ###
 ### ### # # # # # # ### ### ###
 ### ### ### # # ### ### ### ###
 ### ### ### ### ### ### ### ###
 ###  ##  ## ###  ##  ## ### ###
  ##  ##  ##  ##  ##  ##  ## ###
  ##  ##  ##  ##  ##  ##  ## ###
  ##  ##  ##  ##  ##  ##  ## ###
 ###  ##  ##  ##  ##  ## ### ###
 ### ###  ##  ##  ## ### ### ###
 ### ### ###  ## ### ### ### ###
 ### ### ### ### ### ### ### ###
 ### ### ### #   ### ### ### ###
 ### ### #   #   #   ### ### ###
 ### #   #   #   #   #   ### ###
 #   #   #   #   #   #   #   ###
 ### #   #   #   #   #   ### ###
 ### ### #   #   #   ### ### ###
 ### ### ### #   ### ### ### ###
 ### ### ### ### ### ### ### ###
 ###  #   #  ###  #   #  ### ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
 ###  #   #   #   #   #  ### ###
 ### ###  #   #   #  ### ### ###
 ### ### ###  #  ### ### ### ###

Hey! We got something! There are some diamonds and hearts filled with different patterns. Examining a bit more the output we found more hearts, diamonds and some complex drawings that resemble clouds, and other tiles that needs to be combined to make a real sense. Probably these pictures are the ones that the Taito Presenter plays when it doesn't have any game card loaded.

The 16KB in the A70-01-I ROM even have a banner with the machine name!
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ### ### ### ##   #   #
   ## ### ##   ## ### ### ##   #
   ## ### ##   #   ## ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ##   #   #
   ## ### ##   #   ## ### ##   #
   ## ### ##   #   #   #   #   #
   #   ## ### ### ### ### ##   #
   #   #   #   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ### ### ### ##   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ##   #   #   ## ### ##
   ## ### ### ##   #   ## ### ##
   ## ### ### ### ##   ## ### ##
   ## ### ### ### ### ### ### ##
   ## ### ##   ## ### ### ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ##   #   #   ## ### ##
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ### ### ##
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ### ### ### ##   #   #
   ## ### ##   ## ### ### ##   #
   ## ### ##   #   ## ### ### ##
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ##   #   #
   #   ## ### ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   #   #   #   #   ## ### ### ##
   #   #   ## ### ### ### ##   #
   #   ## ### ### ### ##   #   #
   ## ### ### ##   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #

Well, at least one mystery about the Taito Presenter 2000 was solved!

The showbitmap's source code and the output of both ROMs can be downloaded from here.

And that's all for now!

Wednesday, March 4, 2020

Taito Presenter 2000 - part 1


Sometimes people asks to me how did I knew that some bizarre hardware is MSX based or not. Short answer: I don't know until the machine arrives at my house and I open it to see the insides.

Long answer: I buy a lot of old books and magazines, try to read the digitized content, search in auction sites for unknown machines, look for issued patents, follow old rumours, etc.

For Taito Presenter 2000? I saw this video:




I really didn't understand anything. But the graphics in the video looks MSX2-ish to me. That was enough to search for one of this and to buy it.

Sadly my Taito Presenter 2000 hadn't any documentation. It's only the main unit, a remote button and one game card. Even the power supply is missing. So, there wasn't a lot of tests that I could do. I quickly opened it to answer the question that motivated me to buy it: Taito Presenter 2000 is an MSX?


The Taito Presenter 2000 internals

From top-left to bottom-right:
four Texas TMS4464-12NL 4-bits 64K RAMs,
 totalizing 128KB VRAM;
the Yamaha YM2149F sound generator;
the MSX2 VDP Yamaha V9938;
the connector between V9938 and analogic video board
an battery to... I don't know;
an Toshiba TC5565PL-15 1-bit 64K SRAM, 8KB RAM;
two Intel D27256-1 1-bit 256K EPROM, totals 64KB ROM;
video and audio connectors;
first half of the analogic video daughter board.

Again, from top-left to bottom-right:
the card reader connector;
four dip-switches for unknown purposes;
the CPU Zilog Z80A;
an PAL 16L8A-2CN;
the PPI TMP82C55AP-5;
the second half of the analogic video daughter board;
the expansion connector, attached to the PPI.

Looking from the hardware perspective, the answer is close to an "Yes". You can see all the MSX ICs there:

  • Zilog Z8400APS, the Z80A CPU;
  • Yamaha V9938, the MSX2 video chip;
  • Yamaha YM2149F, known as SSG, it's a sound chip compatible with the AY-3-8910 from General Instruments;
  • Toshiba TMP82C55AP-5, an PPI Intel 8255 equivalent.

But a detailed look brings one problem: it have only 8KB RAM!! 8KB is the minimum allowed for the MSX1 standard, but this machine have the MSX2 VDP with 128KB VRAM, usually the few MSX1 with MSX2 VDP had only 16KB VRAM!

I even guess that the MSX2 BIOS can't boot with only 8KB, because the minimal RAM was upgraded to 64KB for the MSX2. Well, it's an dedicated appliance, maybe it uses the MSX-BIOS and the games accesses directly the V9938 capabilities?

This doubt is easy to check as both EPROMs were in sockets and easy to pullout. I took them out and read their contents with an EPROM reader. The resulted files are in this tarball. And reading these files gives few answers and more doubts.

My first step in this kind of analysis is to run "strings" in the ROM files, so I can see if the Microsoft or ASCII copyright notes, or the string "MSX" were in there. If so, it's a good indicator that the ROM is an MSX BIOS with little or no modifications. The A70_01-I doesn't have any "MSX", "Microsoft" or "ASCII", but we can found:

COPY RIGHT TAITO CORPORATION
...

taito

The EPROM labeled with A70_02 have no recognizable strings and looks full of garbage, at first I thought it was encrypted, with the data bits scrambled or even corrupted. To find which of those alternatives is the correct one takes some time, so I go back to the first EPROM and began to disassembly it.

Definetely the A70_01-I isn't an MSX BIOS. There is less than 12KB of code, the last instruction is at 0x2D7E, from 0x2D7F to 0x3FFF it's empty and from 0x4000 to the end looks to be the same garbage of the A70_02 EPROM. This is a strong indicative that the A70_02 isn't scrambled, encrypted or corrupted. Needs to be another alternative. Well, back to the disassembly...

The MSX BIOS begins disabling the interrupts, to do the initialization of devices, memory regions, stack pointer, etc, without have to bother with interruptions breaking the code flow. The first byte in the MSX BIOS is 0xF3, the "DI" instruction. This isn't the case in the Taito Presenter 2000 boot rom, it begin with "c3 4e 01", a jump to the position 0x014e. And what is in the 0x014e position?

di              ;014e   f3     
im 1            ;014f   ed 56  
ld sp,0e000h    ;0151   31 00 e0       
call sub_0802h  ;0154   cd 02 08       
call sub_1481h  ;0157   cd 81 14       
ld hl,0c081h    ;015a   21 81 c0       
ld de,0c082h    ;015d   11 82 c0       
ld bc,00161h    ;0160   01 61 01       
ld (hl),000h    ;0163   36 00  
ldir            ;0165   ed b0

The "DI" instruction! Following the code another strange thing. There is no "OUT" instruction. How this machine initialize the PPI, VDP and PSG?

Without "OUT" or "IN" instructions in the A70_01-I EPROM, it's clear that the Taito Presenter 2000 maps its devices in memory space, not in the I/O ports. AFAIK the memory region used for I/O is from 0xF000 to 0xF00B. With something happening around 0xC1D3. This data were deduced from the disassembled code, like this snippet:

di             ;12fe   f3     
ld a,001h      ;12ff   3e 01  
ld (0c1d3h),a  ;1301   32 d3 c1       
ld a,b         ;1304   78     
ld (0f001h),a  ;1305   32 01 f0       
ld a,c         ;1308   79     
or 080h        ;1309   f6 80  
ld (0f001h),a  ;130b   32 01 f0       
ld a,000h      ;130e   3e 00  
ld (0c1d3h),a  ;1310   32 d3 c1       
ei             ;1313   fb     
ret            ;1314   c9

We compared with this other code, from MSX BIOS:

di
out     (099H),a
ld      a,c
or      080H
out     (099H),a
ei

The 0xF001 memory address is being the equivalent of I/O port 0x99. But what the accesses to 0xC1D3 does? Did these writes in 0xC1D3 enables/disables the memory mapped window?

And worst, unless the components in this appliance can also answers in the I/O ports expected by the MSX standard, it can't be an MSX based machine by our own definition. Well, there is a lot more to research and test about Taito Presenter 2000.

Maybe it can boot an unmodified MSX BIOS? Maybe those dip switches can change the I/O behavior? Why create an almost MSX but without being an MSX?

We end this post with more mysteries than before.


We're back!

Ok, long time without any update in this blog. But in these silent years I kept searching and found more hidden MSXs and showed some of them in Brazilian MSX meetings, like MSX Jaú and MSXSP.

Even with them don't being news for some people, I guess that write about these equipment, dump a few ROMs, take some pictures and have the information indexed by the search engines is good for everyone.


I guessed this picture might get your attention

More posts soon!

Not "soon". If you want to know a bit more about the Taito machine in the picture above, you can read our first post about it  here.