Wednesday, March 4, 2020

Taito Presenter 2000 - part 1

Sometimes people asks to me how did I knew that some bizarre hardware is MSX based or not. Short answer: I don't know until the machine arrives at my house and I open it to see the insides.

Long answer: I buy a lot of old books and magazines, try to read the digitized content, search in auction sites for unknown machines, look for issued patents, follow old rumours, etc.

For Taito Presenter 2000? I saw this video:

I really didn't understand anything. But the graphics in the video looks MSX2-ish to me. That was enough to search for one of this and to buy it.

Sadly my Taito Presenter 2000 hadn't any documentation. It's only the main unit, a remote button and one game card. Even the power supply is missing. So, there wasn't a lot of tests that I could do. I quickly opened it to answer the question that motivated me to buy it: Taito Presenter 2000 is an MSX?

The Taito Presenter 2000 internals

From top-left to bottom-right:
four Texas TMS4464-12NL 4-bits 64K RAMs,
 totalizing 128KB VRAM;
the Yamaha YM2149F sound generator;
the MSX2 VDP Yamaha V9938;
the connector between V9938 and analogic video board
an battery to... I don't know;
an Toshiba TC5565PL-15 1-bit 64K SRAM, 8KB RAM;
two Intel D27256-1 1-bit 256K EPROM, totals 64KB ROM;
video and audio connectors;
first half of the analogic video daughter board.

Again, from top-left to bottom-right:
the card reader connector;
four dip-switches for unknown purposes;
the CPU Zilog Z80A;
an PAL 16L8A-2CN;
the PPI TMP82C55AP-5;
the second half of the analogic video daughter board;
the expansion connector, attached to the PPI.

Looking from the hardware perspective, the answer is close to an "Yes". You can see all the MSX ICs there:

  • Zilog Z8400APS, the Z80A CPU;
  • Yamaha V9938, the MSX2 video chip;
  • Yamaha YM2149F, known as SSG, it's a sound chip compatible with the AY-3-8910 from General Instruments;
  • Toshiba TMP82C55AP-5, an PPI Intel 8255 equivalent.

But a detailed look brings one problem: it have only 8KB RAM!! 8KB is the minimum allowed for the MSX1 standard, but this machine have the MSX2 VDP with 128KB VRAM, usually the few MSX1 with MSX2 VDP had only 16KB VRAM!

I even guess that the MSX2 BIOS can't boot with only 8KB, because the minimal RAM was upgraded to 64KB for the MSX2. Well, it's an dedicated appliance, maybe it uses the MSX-BIOS and the games accesses directly the V9938 capabilities?

This doubt is easy to check as both EPROMs were in sockets and easy to pullout. I took them out and read their contents with an EPROM reader. The resulted files are in this tarball. And reading these files gives few answers and more doubts.

My first step in this kind of analysis is to run "strings" in the ROM files, so I can see if the Microsoft or ASCII copyright notes, or the string "MSX" were in there. If so, it's a good indicator that the ROM is an MSX BIOS with little or no modifications. The A70_01-I doesn't have any "MSX", "Microsoft" or "ASCII", but we can found:



The EPROM labeled with A70_02 have no recognizable strings and looks full of garbage, at first I thought it was encrypted, with the data bits scrambled or even corrupted. To find which of those alternatives is the correct one takes some time, so I go back to the first EPROM and began to disassembly it.

Definetely the A70_01-I isn't an MSX BIOS. There is less than 12KB of code, the last instruction is at 0x2D7E, from 0x2D7F to 0x3FFF it's empty and from 0x4000 to the end looks to be the same garbage of the A70_02 EPROM. This is a strong indicative that the A70_02 isn't scrambled, encrypted or corrupted. Needs to be another alternative. Well, back to the disassembly...

The MSX BIOS begins disabling the interrupts, to do the initialization of devices, memory regions, stack pointer, etc, without have to bother with interruptions breaking the code flow. The first byte in the MSX BIOS is 0xF3, the "DI" instruction. This isn't the case in the Taito Presenter 2000 boot rom, it begin with "c3 4e 01", a jump to the position 0x014e. And what is in the 0x014e position?

di              ;014e   f3     
im 1            ;014f   ed 56  
ld sp,0e000h    ;0151   31 00 e0       
call sub_0802h  ;0154   cd 02 08       
call sub_1481h  ;0157   cd 81 14       
ld hl,0c081h    ;015a   21 81 c0       
ld de,0c082h    ;015d   11 82 c0       
ld bc,00161h    ;0160   01 61 01       
ld (hl),000h    ;0163   36 00  
ldir            ;0165   ed b0

The "DI" instruction! Following the code another strange thing. There is no "OUT" instruction. How this machine initialize the PPI, VDP and PSG?

Without "OUT" or "IN" instructions in the A70_01-I EPROM, it's clear that the Taito Presenter 2000 maps its devices in memory space, not in the I/O ports. AFAIK the memory region used for I/O is from 0xF000 to 0xF00B. With something happening around 0xC1D3. This data were deduced from the disassembled code, like this snippet:

di             ;12fe   f3     
ld a,001h      ;12ff   3e 01  
ld (0c1d3h),a  ;1301   32 d3 c1       
ld a,b         ;1304   78     
ld (0f001h),a  ;1305   32 01 f0       
ld a,c         ;1308   79     
or 080h        ;1309   f6 80  
ld (0f001h),a  ;130b   32 01 f0       
ld a,000h      ;130e   3e 00  
ld (0c1d3h),a  ;1310   32 d3 c1       
ei             ;1313   fb     
ret            ;1314   c9

We compared with this other code, from MSX BIOS:

out     (099H),a
ld      a,c
or      080H
out     (099H),a

The 0xF001 memory address is being the equivalent of I/O port 0x99. But what the accesses to 0xC1D3 does? Did these writes in 0xC1D3 enables/disables the memory mapped window?

And worst, unless the components in this appliance can also answers in the I/O ports expected by the MSX standard, it can't be an MSX based machine by our own definition. Well, there is a lot more to research and test about Taito Presenter 2000.

Maybe it can boot an unmodified MSX BIOS? Maybe those dip switches can change the I/O behavior? Why create an almost MSX but without being an MSX?

We end this post with more mysteries than before.

No comments:

Post a Comment