Bypass V2.2 console protection

[+retroclouds]

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.

Basically the TI selection screen doesn't scan ROM banks anymore.

 

From the TI-INTERN book;

 

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                         /
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                         /
020D : INCT @>8372                           /
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                           / the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?               /
021C : DST @>8358,@>0000(@>8358)             /
0222 : BR GROM@>0209                         /

 

 

So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.

These are the options I'm thinking about

 

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.

I think the Milton-Bradley games do that.

Is that possible without adding any extra hardware to the cartridge ?

Does the DSR scan routine also check the cartridge space. Would that help?

 

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.

Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.

EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.

Probably some extra chip on the cartridge ?

 

 

3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.

You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.

No, that's not an option

 

 

 

Any ideas ?

[+RXB]

I want my cartridge game to run on a V2.2 console. Now we know that with the V2.2 consoles ROM-only modules no longer work.

Basically the TI selection screen doesn't scan ROM banks anymore.

 

From the TI-INTERN book;

 

01FD : CEQ @>6000,>AA ROM Header? OH!!!      / Not at GROM V2.2
0202 : BR GROM@>0224                     	/
0204 : DST @>8358,@>6006 Next program start  / The other shifted
0209 : DCZ @>8358                            / accordingly
020B : BS GROM@>0224                     	/
020D : INCT @>8372                       	/
020F : DST *>8372,>FFFF Flag on stack        / This change eliminates
0214 : INCT @>8372                       	/ the ROM moduls
0216 : DST *>8372,@>8358 Address on stack    /
021A : INC @>836C 2nd program?           	/
021C : DST @>8358,@>0000(@>8358)         	/
0222 : BR GROM@>0209                     	/

 

 

So I'm trying to find a way how to start my game on an (unexpanded) V2.2 TI-99/4A anyway.

These are the options I'm thinking about

 

1) Bypass the TI-Title screen and start the game right away. There are couple of game modules out there that do that.

I think the Milton-Bradley games do that.

Is that possible without adding any extra hardware to the cartridge ?

Does the DSR scan routine also check the cartridge space. Would that help?

 

2) Add a "CALL GAME" command to TI-Basic that branches to the game in the cartridge space.

Don't think that's possible without GROM on the cartridge. If we have GROM, then the game is scanned anyway.

EDIT: How do they do it with Munchman and TI-Invaders? These are ROM only games, and I suppose they work on v2.2 consoles.

Probably some extra chip on the cartridge ?

 

 

3) Write a fake VDP header on cassette tape to fool the GPL interpreter and start the game.

You basically have the cartridge and a cassette tape. You load from the cassette tape to trigger the cartridge.

No, that's not an option

 

 

 

Any ideas ?

 

Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME

or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.

Or you could use a Powerup header and upon start up it just goes into that cartridge.

 

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.

[+acadiel]

Arcturus (sidecar) did that. When I dumped it, I found it actually lived in the Powerup DSR space and in the >A000 memory expansion space. The power up DSR took over at the title screen.

 

Tursi helped with converting it into an EA/5 executable which we dumped in a module with the "copy to >A000 RAM and run routine". I think it helped that it was already coded to run in >A000.

 

Attached is the original dump, including the >4000-5FFF DSR ROM. Maybe it'll have something you could use.

arcturus-dump.zip

[matthew180]

TI-Invaders has a GROM in it. Actually, a good chuck of the game is GPL. One GROM and one 4K ROM.

 

I don't think you can hook a power-on DSR from the cartridge port, only the expansion (side) port. I think your only option is to wait for one of us to get a GROM board done. :-(

 

You can call to your game in to ROM if you can somehow get the assembly code to do that into the machine. I wonder if there are any tricks in stock BASIC to cause it to jump to a specified address?

[+retroclouds]

Yea easy way to do it is Power up or DSR header. Using a Assembly GPLDSRLINK written in Assembly with a Header on the cart from TI Basic you could just enter: OLD NAME

or from any DSR Access input like OLD or SAVE or LIST and then the name of the device. My RXB uses V40 as a fake DSR device that is a 40 column viewer.

Or you could use a Powerup header and upon start up it just goes into that cartridge.

 

Both of these are the easy way and require little work to make work. They also require very little code even in Assembly.

 

I checked Thierrys' page. Unfortunately it will only work if there is a GROM involved. For ROM only cartridges it won't work on a V2.2 console.

[Tursi]

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

 

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

 

 DST @>8300,>6026  * start address in ROM is >6026
 XML >F0           * execute it

 

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.

[+retroclouds]

ok. Thanks for the update. Too bad we haven't found a way to break out of the TI basic sandbox

[+RXB]

As said twice already, my investigation has not revealed any way to get around it on a 2.2 console, either. Use the GROM simulator to provide a loader. I have some GPL code in with Classic99's samples that launch a ROM cart (look in MODS\mmshared at DummyG.bin - the MegaMan sample cartridge uses this with the 'Boot Rom cart' entry).

 

All you have to do is load the ROM-based start address at >8300, then XML >F0, and GPL will branch to ROM code. DummyG uses a hard coded address, but you could read it from ROM too:

 

 DST @>8300,>6026  * start address in ROM is >6026
 XML >F0   		* execute it

 

Unfortunately, as far as we know all solutions require extra hardware. There are no powerup vectors scanned on the cartridge port.

 

Included with RXB version 1005 are two program POWERUP and NOPOWERUP all these did was to load the normal start up of RXB program into the Power up bytes. I just tested it on Classic99 and it works fine. Even in V2.2 the power up GROM works, did not test the ROM version so maybe you were talking only ROM, if that is the case nevermind.

MyZipFile.zip

Edited July 8, 2011 by RXB

[+acadiel]

Can a dead 99/4A non 2.2 console have the GROM0 taken out of it and put in the V2.2 one?

[+Ksarul]

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

Edited July 10, 2011 by Ksarul

[Tursi]

Can a dead 99/4A non 2.2 console have the GROM0 taken out of it and put in the V2.2 one?

 

It should work based on testing with emulation. My comparisons showed GROMs 1 and 2 (TI BASIC) are the same on the 2.2 console. And MPD shows the reverse works (a 2.2 GROM0 in a non-2.2 console).

[Tursi]

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

 

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

[+acadiel]

Actually, you might want to take the code from one of the old Funware carts apart and see how they got around the issue--they didn't have GROMs, but they did work on a V2.2 console. . .much to TI's dismay.

 

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

 

I think they eventually were licensed to use GROMs (were they the only "official" one other than Parker Brothers?) Lobster Bay and some of their non released games are in GROM format (not ROM) - I tried putting some of these in a ROM cart, that's why I know.

 

They did include this letter with some games, which makes me wonder if they re-did some games to run from GROM: http://www.videogamehouse.net/funwarenotice.jpg

[Willsy]

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.

[+OLD CS1]

From what I understand, there are so few V2.2 consoles around that it's just not worth expending any energy on.

 

Why?

 

Because it's there!

 

"It is I, Arthur, son of Uther Pendragon, from the castle of Camelot. King of the Britons, defeater of the Saxons, Sovereign of all England!"

 

I didn't vote for him!

[+Ksarul]

I may have to crack my GROM Buster open to see what kind of circuitry they used to get around the issue. Since it connected to the side port, it probably used the >4000 memory space trick to usurp the power up routine though.

[+RXB]

Found this on Power up Header, bypass everything and executes after service of DSRs.

 

 

If you use the DSR header and a CRU that gets serviced first it will bypass everything.

Edited July 25, 2011 by RXB

[senior_falcon]

Here is a way to run ROM cartridges on a V2.2 console. Plug in the cartridge, then go to TI BASIC (your only choice) and run the attached program. There is embedded code in this so cut and paste will not work. This is a simple assembly program that uses the playground loader. It sets the VDP registers to the values used at the cartridge menu screen, then looks into the cartridge, finds the startup address of the first program in the list and runs the code. This has been tested on Classic99 and seems to work. It's a good first step - it could benefit from a fancier menu, especially if there is more than one option in the cartridge.

v22rom.zip

Edited February 10, 2014 by senior_falcon

[Omega-TI]

 

Any ideas ?

 

 

The non-programmers solution: Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.

[+OLD CS1]

 

The non-programmers solution: Find an old TI with a thrashed case, get it for next to nothing, put the guts in the pretty beige case and call it a day, no more problems with incompatibility, ever.

 

There is always the option I took: find beige consoles on eBay and examine the pictures for the correct expansion port grounding finger colors. Profit. So far as I know, this QI board works with everything the original metal console does.

[+OLD CS1]

They don't show under emulation (I tried Ambulance), suggesting it's not a pure software approach. Does anyone have pictures of inside one of these carts?

 

Is this question still open? I have a couple of Funware carts that I think I can get open without ruining the label. There is an auction for Ambulance on eBay, but I am not feeling the $44 asking price.

[Omega-TI]

There is one of those dreaded consoles up for sale on eBay right now.

It's nice to see the seller is being honest and advertising it as such.

[+OLD CS1]

There is one of those dreaded consoles up for sale on eBay right now.

It's nice to see the seller is being honest and advertising it as such.

 

It is, indeed. Though, to be fair, I suspect a LARGE number of people selling these are completely oblivious to the difference between the QI and the 2.2 console.

[+Ksarul]

That is a neat escape-from-the-sandbox trick--and it eliminates the need for a GROM Buster! It is probably one of the neatest short utility programs for the TI that I've ever seen. Many thanks for having taken the time to write it! The more you experiment with the broken sandbox, the more useful it becomes.

[Omega-TI]

 

 

TRUE WIZARDRY SIR!