Sometimes people asks to me how did I knew that some bizarre hardware is MSX based or not. Short answer: I don't know until the machine arrives at my house and I open it to see the insides.
Long answer: I buy a lot of old books and magazines, try to read the digitized content, search in auction sites for unknown machines, look for issued patents, follow old rumours, etc.
For Taito Presenter 2000? I saw this video:
I really didn't understand anything. But the graphics in the video looks MSX2-ish to me. That was enough to search for one of this and to buy it.
Sadly my Taito Presenter 2000 hadn't any documentation. It's only the main unit, a remote button and one game card. Even the power supply is missing. So, there wasn't a lot of tests that I could do. I quickly opened it to answer the question that motivated me to buy it: Taito Presenter 2000 is an MSX?
 |
| The Taito Presenter 2000 internals |
 |
| From top-left to bottom-right: four Texas TMS4464-12NL 4-bits 64K RAMs, totalizing 128KB VRAM; the Yamaha YM2149F sound generator; the MSX2 VDP Yamaha V9938; the connector between V9938 and analogic video board an battery to... I don't know; an Toshiba TC5565PL-15 1-bit 64K SRAM, 8KB RAM; two Intel D27256-1 1-bit 256K EPROM, totals 64KB ROM; video and audio connectors; first half of the analogic video daughter board. |
 |
| Again, from top-left to bottom-right: the card reader connector; four dip-switches for unknown purposes; the CPU Zilog Z80A; an PAL 16L8A-2CN; the PPI TMP82C55AP-5; the second half of the analogic video daughter board; the expansion connector, attached to the PPI. |
Looking from the hardware perspective, the answer is close to an "Yes". You can see all the MSX ICs there:
- Zilog Z8400APS, the Z80A CPU;
- Yamaha V9938, the MSX2 video chip;
- Yamaha YM2149F, known as SSG, it's a sound chip compatible with the AY-3-8910 from General Instruments;
- Toshiba TMP82C55AP-5, an PPI Intel 8255 equivalent.
But a detailed look brings one problem: it have only 8KB RAM!! 8KB is the minimum allowed for the MSX1 standard, but this machine have the MSX2 VDP with 128KB VRAM, usually the few MSX1 with MSX2 VDP had only 16KB VRAM!
I even guess that the MSX2 BIOS can't boot with only 8KB, because the minimal RAM was upgraded to 64KB for the MSX2. Well, it's an dedicated appliance, maybe it uses the MSX-BIOS and the games accesses directly the V9938 capabilities?
This doubt is easy to check as both EPROMs were in sockets and easy to pullout. I took them out and read their contents with an EPROM reader. The resulted files are in this tarball. And reading these files gives few answers and more doubts.
My first step in this kind of analysis is to run "strings" in the ROM files, so I can see if the Microsoft or ASCII copyright notes, or the string "MSX" were in there. If so, it's a good indicator that the ROM is an MSX BIOS with little or no modifications. The A70_01-I doesn't have any "MSX", "Microsoft" or "ASCII", but we can found:
COPY RIGHT TAITO CORPORATION
...
taito
The EPROM labeled with A70_02 have no recognizable strings and looks full of garbage, at first I thought it was encrypted, with the data bits scrambled or even corrupted. To find which of those alternatives is the correct one takes some time, so I go back to the first EPROM and began to disassembly it.
Definetely the A70_01-I isn't an MSX BIOS. There is less than 12KB of code, the last instruction is at 0x2D7E, from 0x2D7F to 0x3FFF it's empty and from 0x4000 to the end looks to be the same garbage of the A70_02 EPROM. This is a strong indicative that the A70_02 isn't scrambled, encrypted or corrupted. Needs to be another alternative. Well, back to the disassembly...
The MSX BIOS begins disabling the interrupts, to do the initialization of devices, memory regions, stack pointer, etc, without have to bother with interruptions breaking the code flow. The first byte in the MSX BIOS is 0xF3, the "DI" instruction. This isn't the case in the Taito Presenter 2000 boot rom, it begin with "c3 4e 01", a jump to the position 0x014e. And what is in the 0x014e position?
di ;014e f3
im 1 ;014f ed 56
ld sp,0e000h ;0151 31 00 e0
call sub_0802h ;0154 cd 02 08
call sub_1481h ;0157 cd 81 14
ld hl,0c081h ;015a 21 81 c0
ld de,0c082h ;015d 11 82 c0
ld bc,00161h ;0160 01 61 01
ld (hl),000h ;0163 36 00
ldir ;0165 ed b0
The "DI" instruction! Following the code another strange thing. There is no "OUT" instruction. How this machine initialize the PPI, VDP and PSG?
Without "OUT" or "IN" instructions in the A70_01-I EPROM, it's clear that the Taito Presenter 2000 maps its devices in memory space, not in the I/O ports. AFAIK the memory region used for I/O is from 0xF000 to 0xF00B. With something happening around 0xC1D3. This data were deduced from the disassembled code, like this snippet:
di ;12fe f3
ld a,001h ;12ff 3e 01
ld (0c1d3h),a ;1301 32 d3 c1
ld a,b ;1304 78
ld (0f001h),a ;1305 32 01 f0
ld a,c ;1308 79
or 080h ;1309 f6 80
ld (0f001h),a ;130b 32 01 f0
ld a,000h ;130e 3e 00
ld (0c1d3h),a ;1310 32 d3 c1
ei ;1313 fb
ret ;1314 c9
We compared with this other code, from MSX BIOS:
di
out (099H),a
ld a,c
or 080H
out (099H),a
ei
The 0xF001 memory address is being the equivalent of I/O port 0x99. But what the accesses to 0xC1D3 does? Did these writes in 0xC1D3 enables/disables the memory mapped window?
And worst, unless the components in this appliance can also answers in the I/O ports expected by the MSX standard, it can't be an MSX based machine by our own definition. Well, there is a lot more to research and test about Taito Presenter 2000.
Maybe it can boot an unmodified MSX BIOS? Maybe those dip switches can change the I/O behavior? Why create an almost MSX but without being an MSX?
We end this post with more mysteries than before.
No comments:
Post a Comment