Jump to content

Photo

Bypass V2.2 console protection


48 replies to this topic

#1 retroclouds OFFLINE  

retroclouds

    Stargunner

  • 1,523 posts
  • Location:Germany

Posted Fri Jul 8, 2011 4:24 AM

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.
Basically the TI selection screen doesn't scan ROM banks anymore.

From the TI-INTERN book;

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                         /
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                         /
020D : INCT @>8372                           /
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                           / the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?               /
021C : DST @>8358,@>0000(@>8358)             /
0222 : BR GROM@>0209                         /


So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.
These are the options I'm thinking about

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.
I think the Milton-Bradley games do that.
Is that possible without adding any extra hardware to the cartridge ?
Does the DSR scan routine also check the cartridge space. Would that help?

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.
Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.
EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.
Probably some extra chip on the cartridge ?


3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.
You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.
No, that's not an option :rolling:



Any ideas ?

#2 RXB OFFLINE  

RXB

    River Patroller

  • 2,655 posts
  • Location:Vancouver, Washington, USA

Posted Fri Jul 8, 2011 5:31 AM

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.
Basically the TI selection screen doesn't scan ROM banks anymore.

From the TI-INTERN book;

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                     	/
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                     	/
020D : INCT @>8372                       	/
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                       	/ the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?           	/
021C : DST @>8358,@>0000(@>8358)         	/
0222 : BR GROM@>0209                     	/


So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.
These are the options I'm thinking about

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.
I think the Milton-Bradley games do that.
Is that possible without adding any extra hardware to the cartridge ?
Does the DSR scan routine also check the cartridge space. Would that help?

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.
Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.
EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.
Probably some extra chip on the cartridge ?


3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.
You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.
No, that's not an option :rolling:



Any ideas ?


Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME
or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.
Or you could use a Powerup header and upon start up it just goes into that cartridge.

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.

#3 acadiel OFFLINE  

acadiel

    Dragonstomper

  • 910 posts
  • www.hexbus.com
  • Location:USA

Posted Fri Jul 8, 2011 6:00 AM

Arcturus (sidecar) did that. When I dumped it, I found it actually lived in the Powerup DSR space and in the >A000 memory expansion space. The power up DSR took over at the title screen.

Tursi helped with converting it into an EA/5 executable which we dumped in a module with the "copy to >A000 RAM and run routine". I think it helped that it was already coded to run in >A000. :)

Attached is the original dump, including the >4000-5FFF DSR ROM. Maybe it'll have something you could use.

Attached Files



#4 matthew180 OFFLINE  

matthew180

    River Patroller

  • 2,375 posts
  • Location:Castaic, California

Posted Fri Jul 8, 2011 7:39 AM

TI-Invaders has a GROM in it. Actually, a good chuck of the game is GPL. One GROM and one 4K ROM.

I don't think you can hook a power-on DSR from the cartridge port, only the expansion (side) port. I think your only option is to wait for one of us to get a GROM board done. :-(

You can call to your game in to ROM if you can somehow get the assembly code to do that into the machine. I wonder if there are any tricks in stock BASIC to cause it to jump to a specified address?

#5 retroclouds OFFLINE  

retroclouds

    Stargunner

  • Topic Starter
  • 1,523 posts
  • Location:Germany

Posted Fri Jul 8, 2011 12:21 PM

Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME
or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.
Or you could use a Powerup header and upon start up it just goes into that cartridge.

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.


I checked Thierrys' page. Unfortunately it will only work if there is a GROM involved. For ROM only cartridges it won't work on a V2.2 console.

#6 Tursi OFFLINE  

Tursi

    River Patroller

  • 4,691 posts
  • Location:BUR

Posted Fri Jul 8, 2011 1:05 PM

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. :) I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

  DST @>8300,>6026  * start address in ROM is >6026
  XML >F0           * execute it

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.

#7 retroclouds OFFLINE  

retroclouds

    Stargunner

  • Topic Starter
  • 1,523 posts
  • Location:Germany

Posted Fri Jul 8, 2011 1:12 PM

ok. Thanks for the update. Too bad we haven't found a way to break out of the TI basic sandbox :)

#8 RXB OFFLINE  

RXB

    River Patroller

  • 2,655 posts
  • Location:Vancouver, Washington, USA

Posted Fri Jul 8, 2011 3:30 PM

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. :) I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

  DST @>8300,>6026  * start address in ROM is >6026
  XML >F0   		* execute it

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.


Included with RXB version 1005 are two program POWERUP and NOPOWERUP all these did was to load the normal start up of RXB program into the Power up bytes. I just tested it on Classic99 and it works fine. Even in V2.2 the power up GROM works, did not test the ROM version so maybe you were talking only ROM, if that is the case nevermind.

Attached Files


Edited by RXB, Fri Jul 8, 2011 3:35 PM.


#9 acadiel OFFLINE  

acadiel

    Dragonstomper

  • 910 posts
  • www.hexbus.com
  • Location:USA

Posted Sat Jul 9, 2011 8:59 PM

Can a dead 99/4A non 2.2 console have the GROM0 taken out of it and put in the V2.2 one?

#10 Ksarul ONLINE  

Ksarul

    River Patroller

  • 4,052 posts

Posted Sun Jul 10, 2011 9:19 AM

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

Edited by Ksarul, Sun Jul 10, 2011 9:20 AM.


#11 Tursi OFFLINE  

Tursi

    River Patroller

  • 4,691 posts
  • Location:BUR

Posted Sun Jul 10, 2011 11:02 AM

Can a dead 99/4A non 2.2 console have the GROM0 taken out of it and put in the V2.2 one?


It should work based on testing with emulation. My comparisons showed GROMs 1 and 2 (TI BASIC) are the same on the 2.2 console. And MPD shows the reverse works (a 2.2 GROM0 in a non-2.2 console).

#12 Tursi OFFLINE  

Tursi

    River Patroller

  • 4,691 posts
  • Location:BUR

Posted Sun Jul 10, 2011 11:08 AM

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.


They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

#13 acadiel OFFLINE  

acadiel

    Dragonstomper

  • 910 posts
  • www.hexbus.com
  • Location:USA

Posted Sun Jul 10, 2011 11:45 AM

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.


They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?


I think they eventually were licensed to use GROMs (were they the only "official" one other than Parker Brothers?) Lobster Bay and some of their non released games are in GROM format (not ROM) - I tried putting some of these in a ROM cart, that's why I know. :)

They did include this letter with some games, which makes me wonder if they re-did some games to run from GROM: http://www.videogame...nwarenotice.jpg

#14 Willsy OFFLINE  

Willsy

    River Patroller

  • 2,996 posts
  • Location:Uzbekistan (no, really!)

Posted Sun Jul 10, 2011 11:53 AM

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.

#15 OLD CS1 OFFLINE  

OLD CS1

    River Patroller

  • 3,822 posts
  • Technology Samurai
  • Location:Tallahassee, FL

Posted Sun Jul 10, 2011 10:23 PM

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.


Why?

Because it's there!

"It is I, Arthur, son of Uther Pendragon, from the castle of Camelot. King of the Britons, defeater of the Saxons, Sovereign of all England!"


I didn't vote for him!

#16 Ksarul ONLINE  

Ksarul

    River Patroller

  • 4,052 posts

Posted Sun Jul 24, 2011 1:55 PM

I may have to crack my GROM Buster open to see what kind of circuitry they used to get around the issue. Since it connected to the side port, it probably used the >4000 memory space trick to usurp the power up routine though.

#17 RXB OFFLINE  

RXB

    River Patroller

  • 2,655 posts
  • Location:Vancouver, Washington, USA

Posted Mon Jul 25, 2011 3:36 AM

Found this on Power up Header, bypass everything and executes after service of DSRs.


If you use the DSR header and a CRU that gets serviced first it will bypass everything.

Attached Files


Edited by RXB, Mon Jul 25, 2011 3:38 AM.


#18 senior_falcon OFFLINE  

senior_falcon

    Dragonstomper

  • 867 posts
  • Location:Lansing, NY, USA

Posted Sun Feb 9, 2014 9:58 AM

Here is a way to run ROM cartridges on a V2.2 console. Plug in the cartridge, then go to TI BASIC (your only choice) and run the attached program. There is embedded code in this so cut and paste will not work. This is a simple assembly program that uses the playground loader.   It sets the VDP registers to the values used at the cartridge menu screen, then looks into the cartridge, finds the startup address of the first program in the list and runs the code. This has been tested on Classic99 and seems to work.  It's a good first step - it could benefit from a fancier menu, especially if there is more than one option in the cartridge.

gallery_34177_1071_352589.gif

Attached Files


Edited by senior_falcon, Sun Feb 9, 2014 8:52 PM.


#19 --- Ω --- OFFLINE  

--- Ω ---

    --- Ω ---

  • 10,195 posts
  • TI-99/4A Fanatic
  • Location:In the den playing with my FinalGROM 99!

Posted Sun Feb 9, 2014 9:59 AM

 

Any ideas ?

 

 

The non-programmers solution:  Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.



#20 OLD CS1 OFFLINE  

OLD CS1

    River Patroller

  • 3,822 posts
  • Technology Samurai
  • Location:Tallahassee, FL

Posted Sun Feb 9, 2014 10:08 AM

 

The non-programmers solution:  Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.

 

There is always the option I took: find beige consoles on eBay and examine the pictures for the correct expansion port grounding finger colors.  Profit.  So far as I know, this QI board works with everything the original metal console does.



#21 OLD CS1 OFFLINE  

OLD CS1

    River Patroller

  • 3,822 posts
  • Technology Samurai
  • Location:Tallahassee, FL

Posted Sun Feb 9, 2014 10:11 AM

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

 

Is this question still open?  I have a couple of Funware carts that I think I can get open without ruining the label. There is an auction for Ambulance on eBay, but I am not feeling the $44 asking price.



#22 --- Ω --- OFFLINE  

--- Ω ---

    --- Ω ---

  • 10,195 posts
  • TI-99/4A Fanatic
  • Location:In the den playing with my FinalGROM 99!

Posted Sun Feb 9, 2014 10:51 AM

There is one of those dreaded consoles up for sale on eBay right now.

It's nice to see the seller is being honest and advertising it as such.  :)

$_57.JPG



#23 OLD CS1 OFFLINE  

OLD CS1

    River Patroller

  • 3,822 posts
  • Technology Samurai
  • Location:Tallahassee, FL

Posted Sun Feb 9, 2014 2:13 PM

There is one of those dreaded consoles up for sale on eBay right now.

It's nice to see the seller is being honest and advertising it as such.  :)

 

It is, indeed.  Though, to be fair, I suspect a LARGE number of people selling these are completely oblivious to the difference between the QI and the 2.2 console.



#24 Ksarul ONLINE  

Ksarul

    River Patroller

  • 4,052 posts

Posted Sun Feb 9, 2014 7:15 PM

That is a neat escape-from-the-sandbox trick--and it eliminates the need for a GROM Buster!  It is probably one of the neatest short utility programs for the TI that I've ever seen.  Many thanks for having taken the time to write it!  The more you experiment with the broken sandbox, the more useful it becomes.



#25 --- Ω --- OFFLINE  

--- Ω ---

    --- Ω ---

  • 10,195 posts
  • TI-99/4A Fanatic
  • Location:In the den playing with my FinalGROM 99!

Posted Sun Feb 9, 2014 10:22 PM

 

gallery_34177_1071_352589.gif

 

TRUE WIZARDRY SIR!






0 user(s) are browsing this forum

0 members, 0 guests, 0 anonymous users