Jump to content
Sign in to follow this  
retroclouds

Bypass V2.2 console protection

Recommended Posts

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.

Basically the TI selection screen doesn't scan ROM banks anymore.

 

From the TI-INTERN book;

 

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                         /
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                         /
020D : INCT @>8372                           /
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                           / the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?               /
021C : DST @>8358,@>0000(@>8358)             /
0222 : BR GROM@>0209                         /

 

 

So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.

These are the options I'm thinking about

 

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.

I think the Milton-Bradley games do that.

Is that possible without adding any extra hardware to the cartridge ?

Does the DSR scan routine also check the cartridge space. Would that help?

 

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.

Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.

EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.

Probably some extra chip on the cartridge ?

 

 

3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.

You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.

No, that's not an option :rolling:

 

 

 

Any ideas ?

Share this post


Link to post
Share on other sites

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.

Basically the TI selection screen doesn't scan ROM banks anymore.

 

From the TI-INTERN book;

 

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                     	/
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                     	/
020D : INCT @>8372                       	/
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                       	/ the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?           	/
021C : DST @>8358,@>0000(@>8358)         	/
0222 : BR GROM@>0209                     	/

 

 

So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.

These are the options I'm thinking about

 

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.

I think the Milton-Bradley games do that.

Is that possible without adding any extra hardware to the cartridge ?

Does the DSR scan routine also check the cartridge space. Would that help?

 

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.

Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.

EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.

Probably some extra chip on the cartridge ?

 

 

3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.

You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.

No, that's not an option :rolling:

 

 

 

Any ideas ?

 

Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME

or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.

Or you could use a Powerup header and upon start up it just goes into that cartridge.

 

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.

Share this post


Link to post
Share on other sites

Arcturus (sidecar) did that. When I dumped it, I found it actually lived in the Powerup DSR space and in the >A000 memory expansion space. The power up DSR took over at the title screen.

 

Tursi helped with converting it into an EA/5 executable which we dumped in a module with the "copy to >A000 RAM and run routine". I think it helped that it was already coded to run in >A000. :)

 

Attached is the original dump, including the >4000-5FFF DSR ROM. Maybe it'll have something you could use.

arcturus-dump.zip

  • Like 2

Share this post


Link to post
Share on other sites

TI-Invaders has a GROM in it. Actually, a good chuck of the game is GPL. One GROM and one 4K ROM.

 

I don't think you can hook a power-on DSR from the cartridge port, only the expansion (side) port. I think your only option is to wait for one of us to get a GROM board done. :-(

 

You can call to your game in to ROM if you can somehow get the assembly code to do that into the machine. I wonder if there are any tricks in stock BASIC to cause it to jump to a specified address?

Share this post


Link to post
Share on other sites

Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME

or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.

Or you could use a Powerup header and upon start up it just goes into that cartridge.

 

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.

 

I checked Thierrys' page. Unfortunately it will only work if there is a GROM involved. For ROM only cartridges it won't work on a V2.2 console.

Share this post


Link to post
Share on other sites

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. :) I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

 

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

 

 DST @>8300,>6026  * start address in ROM is >6026
 XML >F0           * execute it

 

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.

Share this post


Link to post
Share on other sites

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. :) I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

 

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

 

 DST @>8300,>6026  * start address in ROM is >6026
 XML >F0   		* execute it

 

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.

 

Included with RXB version 1005 are two program POWERUP and NOPOWERUP all these did was to load the normal start up of RXB program into the Power up bytes. I just tested it on Classic99 and it works fine. Even in V2.2 the power up GROM works, did not test the ROM version so maybe you were talking only ROM, if that is the case nevermind.

MyZipFile.zip

Edited by RXB

Share this post


Link to post
Share on other sites

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

Edited by Ksarul

Share this post


Link to post
Share on other sites
Can a dead 99/4A non 2.2 console have the GROM0 taken out of it and put in the V2.2 one?

 

It should work based on testing with emulation. My comparisons showed GROMs 1 and 2 (TI BASIC) are the same on the 2.2 console. And MPD shows the reverse works (a 2.2 GROM0 in a non-2.2 console).

Share this post


Link to post
Share on other sites
Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

 

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

Share this post


Link to post
Share on other sites
Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

 

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

 

I think they eventually were licensed to use GROMs (were they the only "official" one other than Parker Brothers?) Lobster Bay and some of their non released games are in GROM format (not ROM) - I tried putting some of these in a ROM cart, that's why I know. :)

 

They did include this letter with some games, which makes me wonder if they re-did some games to run from GROM: http://www.videogamehouse.net/funwarenotice.jpg

Share this post


Link to post
Share on other sites

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.

  • Like 1

Share this post


Link to post
Share on other sites

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.

 

Why?

 

Because it's there!

 

"It is I, Arthur, son of Uther Pendragon, from the castle of Camelot. King of the Britons, defeater of the Saxons, Sovereign of all England!"

 

I didn't vote for him!

Share this post


Link to post
Share on other sites

I may have to crack my GROM Buster open to see what kind of circuitry they used to get around the issue. Since it connected to the side port, it probably used the >4000 memory space trick to usurp the power up routine though.

Share this post


Link to post
Share on other sites

Found this on Power up Header, bypass everything and executes after service of DSRs.

 

 

If you use the DSR header and a CRU that gets serviced first it will bypass everything.

post-29031-0-52143300-1311586556_thumb.png

Edited by RXB

Share this post


Link to post
Share on other sites

Here is a way to run ROM cartridges on a V2.2 console. Plug in the cartridge, then go to TI BASIC (your only choice) and run the attached program. There is embedded code in this so cut and paste will not work. This is a simple assembly program that uses the playground loader. It sets the VDP registers to the values used at the cartridge menu screen, then looks into the cartridge, finds the startup address of the first program in the list and runs the code. This has been tested on Classic99 and seems to work. It's a good first step - it could benefit from a fancier menu, especially if there is more than one option in the cartridge.

gallery_34177_1071_352589.gif

v22rom.zip

Edited by senior_falcon
  • Like 10

Share this post


Link to post
Share on other sites

 

Any ideas ?

 

 

The non-programmers solution: Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.

Share this post


Link to post
Share on other sites

 

The non-programmers solution: Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.

 

There is always the option I took: find beige consoles on eBay and examine the pictures for the correct expansion port grounding finger colors. Profit. So far as I know, this QI board works with everything the original metal console does.

  • Like 1

Share this post


Link to post
Share on other sites

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

 

Is this question still open? I have a couple of Funware carts that I think I can get open without ruining the label. There is an auction for Ambulance on eBay, but I am not feeling the $44 asking price.

  • Like 1

Share this post


Link to post
Share on other sites

There is one of those dreaded consoles up for sale on eBay right now.

It's nice to see the seller is being honest and advertising it as such. :)

 

It is, indeed. Though, to be fair, I suspect a LARGE number of people selling these are completely oblivious to the difference between the QI and the 2.2 console.

  • Like 1

Share this post


Link to post
Share on other sites

That is a neat escape-from-the-sandbox trick--and it eliminates the need for a GROM Buster! It is probably one of the neatest short utility programs for the TI that I've ever seen. Many thanks for having taken the time to write it! The more you experiment with the broken sandbox, the more useful it becomes.

  • Like 2

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...