Taito Presenter 2000 - part 3

Now we already knows the Taito Presenter 2000's internals, had the ROMs dumped, and also know a little about its inner workings.

Time to see the unit itself, its exterior is very simple: is a beige box with one side sloped.

Taito Presenter 2000 front view. I guess its made of alumnium.

The front is divided in two halves, the left one have the
name of the equipment and it is a flap door. To open it
you need to press at the center top.

The right half have two buttons. One labeled as "START" and the other as "STOP".

The upper view.

It's uncommon to have something in the upper side of those boxy
machines, which usually have a monitor put over them, but in Taito
Presenter 2000 we have a silver seal with its name.

Side view, right and left looks the same. The sloped side is the front.

Bottom view. The screws to open this unit are inside its feet.
The other screws holds the main board in place.

In the bottom side there is the seal with machine's information.

Plastic of Taito Presenter 2000's cabinet is very thick. The pictures don't show that, but the vent openings are protected with foam in the inside, to filter dust. And, as you can guess, this old foam crumbles every time it's touched.

The back side have a dozen of connectors and switches. For our luck, all of them are labelled, so it can help us to find what this machine built to do.

The back side

There are three sets of audio stereo RCA connectors.
From left to right: Karaoke sound input, External
sound input and finally the sound output. Next is the ground pin.
Then the RGB connector and another video output.
At bottom, a P2 jack, labeled in Japanese as "START / STOP"

From top-left to bottom-right:  video input, a RF channel selector
switch and the RF output. The next is the power supply connector.
The P2 jack at bottom left is labeled as "Credit" and, very interesting,
the A/B mode switch. The screwed door covers the expansion connector.

So, the video that we saw in another post shows the machine doing "something" and a girl dancing after that. Maybe it made sense if I could understand the Japanese talk. Or if I had any documentation about this appliance. But at least I have those silks in the unit itself!

The A/B switch at back is a mode selector. And the modes are labeled in Japanese:

• A: Karaoke (カラオケ) Link Mode;
• B: Lucky Draw (福引き抽選) Mode

Google translates "福引き抽選" to "Lottery Lottery", not so much useful. Putting the words in separated lines I got "Blessing Lottery" as translation, I guess the most common used expression for this is "Lucky Draw".

This is what is happening in the video! The cuisine chef there starts some kind of "slot machine" game (using the START button at front), and then the girl hits the STOP switch and win the lucky draw! Well, in general lines I believe that this is a good interpretation merging the video and the information given by the Taito Presenter 2000 unit.

The START/STOP P2 jack at back is easy to fit in this description too. The Presenter 2000 comes with a wired remote push button who can be plugged in this connector (it's somewhere in my home office, but couldn't find it now). When connected, the remote button have the same use of START/STOP buttons at the front of the unit. With that, the Presenter 2000 main unit can be concealed in a cabinet and people still can play the lucky draw game.

The Karaoke Linked mode puzzles me a bit more. The Presenter 2000 doesn't have a microphone input and, by itself, doesn't have any way to control an external Karaoke machine. Maybe it needs something plugged in expansion port? Maybe we got more clues in other printed texts in the cabinet?

The left half of Taito Presenter 2000's front opens.

And reveals the power switch, a volume knob, two unidentified
switches, a counter and a card slot (with a card inserted).

In the door, a sticker, with the description of all the elements behind it.

The two former unidentified switches are identified in the sticker in the door. The one at top is a mode switch labeled "Lottery" (抽選) or "Configure" (設定), so the administrator can configure the lottery parameters or play it. The other switch is labeled "Lottery" OFF/ON, didn't know yet the relationship the other switches.

Ok, the information helps with the "Lucky Draw Mode". But I still don't know what is the "Karaoke Linked Mode", another mystery for later.

Taito Presenter 2000 - part 2

As I wrote in last post, I don't have the power supply for Taito Presenter 2000 and, while in MSXSP meeting, some friends that know how to handle old electronics found that the machine needs to have its capacitors changed by new ones. So, I can't power on this equipment, which cripples many of the tests that I want to do.

But I still want to explore this machine. So I got to try to understand what is the gibberish inside Taito's EPROMs. Let's see the last 16KB of A70-01-I and the full 32KB of A70-02.

We already know that there isn't any recognizable character string inside those sections of the ROMs. Let's see what we can see in the A70-02 EPROM with "hexdump":

0000000 5555 5555 5555 5555 5555 5555 5555 5555
0000010 5555 5555 5555 5555 5555 5555 5555 5555
0000020 5555 5555 5555 5555 5555 5555 5555 5555
0000030 5555 5555 5555 5555 5555 5555 5555 5555
0000040 5555 5555 5555 5555 5555 5555 5555 5555
0000050 5555 5555 5555 5555 5555 5555 5555 5555
0000060 5555 5555 5555 5555 5555 5555 5555 5555
0000070 5555 5555 cc55 cccc cc5c cccc cccc cccc
0000080 5555 5555 5555 5555 5555 5555 5555 5555
0000090 5555 5555 cccc cccc cccc cccc cccc cccc
00000a0 5555 5555 5555 5555 5555 5555 5555 5555
00000b0 5555 5555 cccc cccc cccc cccc cccc cccc
00000c0 5555 5555 5555 5555 5555 5555 5555 5555
00000d0 5555 5555 cccc cccc cccc cccc cccc cccc
00000e0 5555 5555 5555 5555 5555 5555 5555 5555
00000f0 5555 5555 cccc cccc cccc cccc cccc cccc
0000100 5555 5555 5555 5555 5555 5555 5555 5555

When I saw this output, the 0x5555 got my sight. Changing it to binary it is:

0x5555 = 0101 0101 0101 0101

And if this garbage is some kind of drawing? I already saw a similar output in Kanji-ROMs and in some blogs about reverse engineering of old arcade boards. To find this out, I wrote a small program to read the ROM and give an output that looks like a bitmap. If someone wants to use it for something, the slightly sanitized source code is here:

#include <stdio.h>

int main(int argc, char **argv)
{
    if (argc != 2) {
        printf("Usage: %s FILENAME\n\n", argv[0]);
        return 0;
    }

    FILE *f = fopen(argv[1], "rb");
    if (f == NULL) {
        printf("Error: File '%s' not found!\n\n", argv[1]);
        return 1;
    }
    fseek(f, 0, SEEK_END);
    long lsize = 0, i = 0;
    lsize = ftell(f);
    rewind(f);

    while (i < lsize) {
        short int byte = fgetc(f);
        short int mask = 0x80;
        short int j;

        for (j = 0; j < 8; j++) {
            if ((byte & mask) == 0) {
                printf(" ");
            } else {
                printf("#");
            }
            mask >>= 1;
        }
        i++;
    }

    fclose(f);

    return 0;
}

Now, let's see what is inside the mysterious ROMs:

 ### ### ### ### ### ### ### ###
 ###  #   #  ###  #   #  ### ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
 ###  #   #   #   #   #  ### ###
 ### ###  #   #   #  ### ### ###
 ### ### ###  #  ### ### ### ###
 ### ### ### ### ### ### ### ###
 ### ### ### # # ### ### ### ###
 ### ### # # # # # # ### ### ###
 ### # # # # # # # # # # ### ###
 # # # # # # # # # # # # # # ###
 ### # # # # # # # # # # ### ###
 ### ### # # # # # # ### ### ###
 ### ### ### # # ### ### ### ###
 ### ### ### ### ### ### ### ###
 ###  ##  ## ###  ##  ## ### ###
  ##  ##  ##  ##  ##  ##  ## ###
  ##  ##  ##  ##  ##  ##  ## ###
  ##  ##  ##  ##  ##  ##  ## ###
 ###  ##  ##  ##  ##  ## ### ###
 ### ###  ##  ##  ## ### ### ###
 ### ### ###  ## ### ### ### ###
 ### ### ### ### ### ### ### ###
 ### ### ### #   ### ### ### ###
 ### ### #   #   #   ### ### ###
 ### #   #   #   #   #   ### ###
 #   #   #   #   #   #   #   ###
 ### #   #   #   #   #   ### ###
 ### ### #   #   #   ### ### ###
 ### ### ### #   ### ### ### ###
 ### ### ### ### ### ### ### ###
 ###  #   #  ###  #   #  ### ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
  #   #   #   #   #   #   #  ###
 ###  #   #   #   #   #  ### ###
 ### ###  #   #   #  ### ### ###
 ### ### ###  #  ### ### ### ###

Hey! We got something! There are some diamonds and hearts filled with different patterns. Examining a bit more the output we found more hearts, diamonds and some complex drawings that resemble clouds, and other tiles that needs to be combined to make a real sense. Probably these pictures are the ones that the Taito Presenter plays when it doesn't have any game card loaded.

The 16KB in the A70-01-I ROM even have a banner with the machine name!

   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ### ### ### ##   #   #
   ## ### ##   ## ### ### ##   #
   ## ### ##   #   ## ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ##   #   #
   ## ### ##   #   ## ### ##   #
   ## ### ##   #   #   #   #   #
   #   ## ### ### ### ### ##   #
   #   #   #   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ### ### ### ##   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ##   #   #   ## ### ##
   ## ### ### ##   #   ## ### ##
   ## ### ### ### ##   ## ### ##
   ## ### ### ### ### ### ### ##
   ## ### ##   ## ### ### ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ##   #   #   ## ### ##
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ### ### ##
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   ## ### ##   #   #
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   #   #   #
   ## ### ##   #   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   ## ### ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   ## ### ### ##
   ## ### ### ### ### ##   #   #
   ## ### ##   ## ### ### ##   #
   ## ### ##   #   ## ### ### ##
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ##   #   #
   #   ## ### ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   #   #   #   #   #   #   #
   #   ## ### ### ### ### ##   #
   ## ### ##   #   #   ## ### ##
   #   #   #   #   ## ### ### ##
   #   #   ## ### ### ### ##   #
   #   ## ### ### ### ##   #   #
   ## ### ### ##   #   #   #   #
   ## ### ### ### ### ### ### ##
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #
   #   #   ## ### ### ##   #   #
   #   ## ##   #   ## ### ##   #
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   ## ### ##   #   #   ## ### ##
   #   ## ### ##   #   ## ##   #
   #   #   ## ### ### ##   #   #
   #   #   #   #   #   #   #   #

Well, at least one mystery about the Taito Presenter 2000 was solved!

The showbitmap's source code and the output of both ROMs can be downloaded from here.

And that's all for now!

Taito Presenter 2000 - part 1

Sometimes people asks to me how did I knew that some bizarre hardware is MSX based or not. Short answer: I don't know until the machine arrives at my house and I open it to see the insides.

Long answer: I buy a lot of old books and magazines, try to read the digitized content, search in auction sites for unknown machines, look for issued patents, follow old rumours, etc.

For Taito Presenter 2000? I saw this video:

I really didn't understand anything. But the graphics in the video looks MSX2-ish to me. That was enough to search for one of this and to buy it.

Sadly my Taito Presenter 2000 hadn't any documentation. It's only the main unit, a remote button and one game card. Even the power supply is missing. So, there wasn't a lot of tests that I could do. I quickly opened it to answer the question that motivated me to buy it: Taito Presenter 2000 is an MSX?

The Taito Presenter 2000 internals

From top-left to bottom-right:
four Texas TMS4464-12NL 4-bits 64K RAMs,
 totalizing 128KB VRAM;
the Yamaha YM2149F sound generator;
the MSX2 VDP Yamaha V9938;
the connector between V9938 and analogic video board
an battery to... I don't know;
an Toshiba TC5565PL-15 1-bit 64K SRAM, 8KB RAM;
two Intel D27256-1 1-bit 256K EPROM, totals 64KB ROM;
video and audio connectors;
first half of the analogic video daughter board.

Again, from top-left to bottom-right:
the card reader connector;
four dip-switches for unknown purposes;
the CPU Zilog Z80A;
an PAL 16L8A-2CN;
the PPI TMP82C55AP-5;
the second half of the analogic video daughter board;
the expansion connector, attached to the PPI.

Looking from the hardware perspective, the answer is close to an "Yes". You can see all the MSX ICs there:

• Zilog Z8400APS, the Z80A CPU;
• Yamaha V9938, the MSX2 video chip;
• Yamaha YM2149F, known as SSG, it's a sound chip compatible with the AY-3-8910 from General Instruments;
• Toshiba TMP82C55AP-5, an PPI Intel 8255 equivalent.

But a detailed look brings one problem: it have only 8KB RAM!! 8KB is the minimum allowed for the MSX1 standard, but this machine have the MSX2 VDP with 128KB VRAM, usually the few MSX1 with MSX2 VDP had only 16KB VRAM!

I even guess that the MSX2 BIOS can't boot with only 8KB, because the minimal RAM was upgraded to 64KB for the MSX2. Well, it's an dedicated appliance, maybe it uses the MSX-BIOS and the games accesses directly the V9938 capabilities?

This doubt is easy to check as both EPROMs were in sockets and easy to pullout. I took them out and read their contents with an EPROM reader. The resulted files are in this tarball. And reading these files gives few answers and more doubts.

My first step in this kind of analysis is to run "strings" in the ROM files, so I can see if the Microsoft or ASCII copyright notes, or the string "MSX" were in there. If so, it's a good indicator that the ROM is an MSX BIOS with little or no modifications. The A70_01-I doesn't have any "MSX", "Microsoft" or "ASCII", but we can found:

COPY RIGHT TAITO CORPORATION
...
taito

The EPROM labeled with A70_02 have no recognizable strings and looks full of garbage, at first I thought it was encrypted, with the data bits scrambled or even corrupted. To find which of those alternatives is the correct one takes some time, so I go back to the first EPROM and began to disassembly it.

Definetely the A70_01-I isn't an MSX BIOS. There is less than 12KB of code, the last instruction is at 0x2D7E, from 0x2D7F to 0x3FFF it's empty and from 0x4000 to the end looks to be the same garbage of the A70_02 EPROM. This is a strong indicative that the A70_02 isn't scrambled, encrypted or corrupted. Needs to be another alternative. Well, back to the disassembly...

The MSX BIOS begins disabling the interrupts, to do the initialization of devices, memory regions, stack pointer, etc, without have to bother with interruptions breaking the code flow. The first byte in the MSX BIOS is 0xF3, the "DI" instruction. This isn't the case in the Taito Presenter 2000 boot rom, it begin with "c3 4e 01", a jump to the position 0x014e. And what is in the 0x014e position?

di              ;014e   f3     
im 1            ;014f   ed 56  
ld sp,0e000h    ;0151   31 00 e0       
call sub_0802h  ;0154   cd 02 08       
call sub_1481h  ;0157   cd 81 14       
ld hl,0c081h    ;015a   21 81 c0       
ld de,0c082h    ;015d   11 82 c0       
ld bc,00161h    ;0160   01 61 01       
ld (hl),000h    ;0163   36 00  
ldir            ;0165   ed b0

The "DI" instruction! Following the code another strange thing. There is no "OUT" instruction. How this machine initialize the PPI, VDP and PSG?

Without "OUT" or "IN" instructions in the A70_01-I EPROM, it's clear that the Taito Presenter 2000 maps its devices in memory space, not in the I/O ports. AFAIK the memory region used for I/O is from 0xF000 to 0xF00B. With something happening around 0xC1D3. This data were deduced from the disassembled code, like this snippet:

di             ;12fe   f3     
ld a,001h      ;12ff   3e 01  
ld (0c1d3h),a  ;1301   32 d3 c1       
ld a,b         ;1304   78     
ld (0f001h),a  ;1305   32 01 f0       
ld a,c         ;1308   79     
or 080h        ;1309   f6 80  
ld (0f001h),a  ;130b   32 01 f0       
ld a,000h      ;130e   3e 00  
ld (0c1d3h),a  ;1310   32 d3 c1       
ei             ;1313   fb     
ret            ;1314   c9

We compared with this other code, from MSX BIOS:

di
out     (099H),a
ld      a,c
or      080H
out     (099H),a
ei

The 0xF001 memory address is being the equivalent of I/O port 0x99. But what the accesses to 0xC1D3 does? Did these writes in 0xC1D3 enables/disables the memory mapped window?

And worst, unless the components in this appliance can also answers in the I/O ports expected by the MSX standard, it can't be an MSX based machine by our own definition. Well, there is a lot more to research and test about Taito Presenter 2000.

Maybe it can boot an unmodified MSX BIOS? Maybe those dip switches can change the I/O behavior? Why create an almost MSX but without being an MSX?

We end this post with more mysteries than before.