Jump to content

Tomy Tutor ROM - Community attempt to disassemble the System Rom

Recommended Posts

Hi and thanks for this subforum!

The Tomy Tutor is that similar to the TI-99 home computers, not just hardware wise, but especially software wise.

How similar? Let's find out.

At least to my knowledge there are no internal documents, specs or source codes for the Tomy computers available.

The only option we have would be starting from a ROM dump of the system software and disassemble that.


There is a nice disassembler from mizapf within TiImageTool, you right click on a file within an open disk image and it can start.



The ROM for the US Tomy Tutor consists of a 32 KByte ROM0 and a 16 KByte ROM1.

I have created a TI DiskImage containing both dump files to allow easy disassembling.



The ROM0 is named TUTOR1_BIN (memory location >0000, length >8000, no file offset)

The ROM1 is named TUTOR2_BIN (memory location >8000, length >4000, no file offset)


There are many options in the Disassembling Dialog, for now I didn't add any disassembly hints.




It should be only the starting point for a discussion. Might make sense to commit those files and improve them over time with dedicated commits by defining locations of data and text statements.

Also showing the original dumps with a Character offset of 96 (>60) might reveal Text nicely.

Also please tell if there are other tools also fitting the job.

  • Like 3
Link to comment
Share on other sites

I have had several disassembly tasks in the past done on my own. If there are several people who are interested in analyzing the code, maybe one could do that on a collaboration platform where you can edit in parallel. The results should be stored at some well-accessible position, Ninerpedia, WHTech, etc.

Link to comment
Share on other sites

Thank you a lot Michael. Also for programming the disassembly option and showing how to use it on the TI Treff.


After some comparison of code lines from that source code with available source code for the TI-99 i found the first identical section.


ROM1 (US Tomy Tutor, BASIC, 16K ROM chip that gets memory location >8000-BFFF):

9FB8:     C    *R6+,*R6+                                  8DB6
9FBA:     MOV  R2,R3                                      C0C2
9FBC:     MOV  R0,R4                                      C100
9FBE:     BL   @>B926                                     06A0 B926
9FC2:     BL   @>93DE                                     06A0 93DE
9FC6:     DEC  R3                                         0603
9FC8:     DEC  R4                                         0604
9FCA:     DEC  R6                                         0606
9FCC:     JGT  >9FBE                                      15F8
9FCE:     ANDI R4,>3FFF                                   0244 3FFF
9FD2:     MOV  R4,R0                                      C004
9FD4:     INC  R4                                         0584
9FD6:     MOV  R4,R3                                      C0C4
9FD8:     BL   @>9BF4                                     06A0 9BF4
9FDC:     MOV  R3,R6                                      C183
9FDE:     AI   R6,>0003                                   0226 0003
9FE2:     BL   @>B95C                                     06A0 B95C
9FE6:     JMP  >9F8E                                      10D3

XBROM1/strings.txt (TI Extended Basic, ROM chip 1/2, >7412)

*        R0 - is where the sting will end
*        R6 - # of bytes to be moved(does not)
*             include lengths and backpointer
*        R2 - points at trailing length byte of string
*             to be moved
*              VDP(R0-R6) moving backwards i.e. the last
*              byte of the entry is moved first, then the
*              next to the last byte...
       C    *R6+,*R6+         INCR by 4 to include overhead
       MOV  R2,R3             Restore ptr to end of string
       MOV  R0,R4             Get ptr to end of string space
COMP10 BL   @GETV1            Read a byte
       BL   @PUTV1            Write a byte
       DEC  R3                Decrement source pointer
       DEC  R4                Decrement destination pointer
       DEC  R6                Decrement the counter
       JGT  COMP10            Loop if not finished
       ANDI R4,>3FFF          Delete VDP write-enable & reg
       MOV  R4,R0             Set new free space pointer
       INC  R4                Point at backpointer just moved
       MOV  R4,R3             Copy pointer to read it
       BL   @GET1             Get the backpointer
* R1 now contains the address of the forward pointer
       MOV  R3,R6             Address of the string entry
       AI   R6,3              Point at the string itself
* R6 now contains the address of the string
       BL   @STVDP            Reset the forward pointer
       JMP  COMP03            Loop for next string


The compiled rom compares like this, only difference within that section were some target of pointers, which is normal since the memory layout is different.


TI Extended Basic (>7412):

8D B6 C0 C2 C1 00 06 A0 18 80 06 A0 64 22 06 03 06 04 06 06 15 F8 02 44 3F FF C0 04 05 84 C0 C4 06 A0 6C 9E C1 83 02 26 00 03 06 A0 18 AE 10 D3

Tomy Tutor (>9FB8):

8D B6 C0 C2 C1 00 06 A0 B9 26 06 A0 93 DE 06 03 06 04 06 06 15 F8 02 44 3F FF C0 04 05 84 C0 C4 06 A0 9B F4 C1 83 02 26 00 03 06 A0 B9 5C 10 D3

The sections before and afterwards that function also look very similar.

This highly indicates that Tomy used TI-XB for their BASIC, be it with a license or without.


  • Like 1
Link to comment
Share on other sites

Michael, do you still have your original disassembly hints for the files?

Basically the whole STRINGS file is identical. Now i found the first matching section in the XB rom file FORNEXTS.


Which tool can I use to compile the source code files (should be tms 9995 capable)? When changing anything (replacing lines to be DATA or TEXT statements, or naming EQUATES like TI does it, or adding the comments from the TI source code) then I would like to verify the compiled output is still identical.


Link to comment
Share on other sites

TOMY using Texas Instruments XB Source Files:

>9C2C - >9C83	>0058				CIFS
>9E74 - >A037	>01C4				STRINGS
>A140 - >A3DF	>02A0				FORNEXTS
>A7E4 - >AB12	>0330				CNS359
>AB13 - >AC71	>015E				CNS3592
>AC72 - >B345	>06D4				TRINSICS,TRINSICS2
>B4E0 - >B8F1+	>0412 +				CRUNCHS (last data bytes not identical, hard to specify last byte)


Link to comment
Share on other sites

I wrote a disassembler for this purpose, to eventually get at a fully annotated tomy tutor ROM source... 




It outputs a listing, which you can then edit, adding EQU, labels, and comments to the listing. Subsequent re-execution of the dis-assembler with the same listing file, will honor the labels and EQU and comments, preserving and applying them to generating a new listing. 


You can also mark words as DATA, so that they won't be disassembled. 


The resulting, incrementally edited listing should be a good candidate for merging in github. 


  • Like 4
Link to comment
Share on other sites

Thanks for your help jedimatt42! Can you share the commands on how to compile your tools sourcecode to an executable? I mean the python compilation of the tool.


Just made a big milestone. I was able to compile the original XB Rom Sourcecode for both rom banks using xdt99 into their binaries that were released on Module as TI Extended Basic (v1.10). The compiled version matches the Module dumps in all 16384 bytes. :)

I had to adapt the original XB rom source code (thanks to RXB) only minimally. xdt99 doesn't seem to accept the character $ within the labelname, however this was widely used.

Three lines had to get an additional space before their comment to not be treated as an operand. And the two control files that COPY all other files from the same rom got their TI device reference (COPY "DSK6.EQUATES") changed to reference the PC device filepath (COPY "equates.asm") instead. That was it.


Now that I know how to compile these source codes I can adapt the AORGs to compile them towards their Tomy Tutor locations to verify all above statements.

  • Like 2
Link to comment
Share on other sites

I don't know how to compile python to an executable. That isn't something normally desired or necessary. 

I have updated the README.md with notes on setting up the prerequisite python libraries using pipenv. 


I've used this on small things to verify it works. If you all aren't python savvy, probably not the best tool for you then...


My personal effort to work on the Tomy tutor is still years away. 

Link to comment
Share on other sites

Just to share the current state.

The XB source code files were adapted to compile towards their Tomy Tutor location, as far as I discovered their locations.

Here is the list with their currently assumed AORGs

       COPY "xml359.asm"        * >90A4
       COPY "cpt.asm"           * >9136
       COPY "bassups.asm"       * >9176
       COPY "parses.asm"        * >9416
       COPY "parses2.asm"       * 
       COPY "getputs.asm"       * >9BF0
       COPY "cifs.asm"          * >9C2C
       COPY "nud359.asm"        * >9C84
       COPY "strings.asm"       * >9E74
       COPY "speeds.asm"        * >A03A
       COPY "fornexts.asm"      * >A140
       COPY "scrolls.asm"       * >A3E0
       COPY "scans.asm"         * >A5C6
       COPY "delreps.asm"       * >A748
       COPY "mvdns.asm"         * >A7AA
       COPY "cns359.asm"        * >A7E4
       COPY "cns3592.asm"       * 
       COPY "trinsics.asm"      * >AC70
       COPY "trinsics2.asm"     * 
       COPY "crunchs.asm"       * >B4E0
       COPY "ref359.asm"        * >B9EE

ERAM (short for expansion ram I assume) related source code I couldn't find in the Tomy Tutor ROM1.

I therefore removed "mvups.asm", "greads.asm", "gwrites.asm", "vgwites.asm", "gvwites.asm" from compiling, also all instructions to cover ERAM were typically skipped in the ROM1, so removing those same lines from the XB source code files made the compiled output with more matching bytes.

Also I didn't find yet the rather big "subprogs.asm", "subprogs2.asm" in the Tomy Tutor ROM1, there is no CALL support in its BASIC (or let's say done differently), so maybe it is not in there at all.

The scratchpad RAM seems to be at F000-F0FF instead of 8300-83FF.

I only did work on ROM1 so far, which is known to contain BASIC.

ROM1 is from >8000 to >BFFF.


I didn't find any matching ASSEMBLY in >8000->8FFF yet, maybe there is the GPL, so the visual comparison starts from >9000.

White parts are matching on binary level, yellow parts are wrong or only at the wrong location.



The more white you see in the visual diff, the more bytes from the Tomy Tutor ROM1 have the same value at the same location as the compiled binary of this XB Source code.

Some parts are already very white.

Even in the almost white parts there are jumps towards other addresses, those target locations are referred via their LABEL name in the XB assembly source code, not via absolute addresses. If the LABEL is still defined at another location, then the instruction to jump to that LABEL at the moment still contains another absolute address in its compiled form.


Matching content, but at different locations still shows as yellow. So if a whole 1Kilobyte block is off by two bytes, but matching, it never the less shows yellow.


The binary length of some compiled source code files might extend the actual length in ROM1, making some parts in memory being overlapped.

Such things will solve, once the individual files are adapted to the Tomy Tutor version.

Remember any instructions to read GROM or wait for GROM are not necessary in the Tomy world and were removed, so I need to find them and repeat the developers activities from 40 years back.


In short, yellow color doesn't mean, that the Tomy Tutor Basic is different from XB Basic and was not coming from it, only that my version of the XB source code is not yet binary matching in those segments. There might be some instructions missing or too much or sorted different to fix the length of things.


>9000 - >947F



>9480 - >98FF



>9900 - >9DFF



>9D80 - A1FF



>A200 - >A67F



>A680 - AAFF



>AB00 - AF7F



>AF80 - B3FF



>B400 - B87F



>B880 - BCFF



  • Like 1
Link to comment
Share on other sites

On 10/16/2020 at 6:41 PM, jedimatt42 said:

I don't know how to compile python to an executable. That isn't something normally desired or necessary. 

I have updated the README.md with notes on setting up the prerequisite python libraries using pipenv. 


I've used this on small things to verify it works. If you all aren't python savvy, probably not the best tool for you then...


My personal effort to work on the Tomy tutor is still years away. 


Perhaps Pyinstaller is an option https://pyinstaller.readthedocs.io/en/stable/index.html 

But if on Windows I’d instead use WSL2 for getting a linux environment.

  • Like 1
Link to comment
Share on other sites

To help understanding:

Left side is the Tomy Tutor ROM1 dump.

Right side is the binary that is generated by using an TMS9900 assembler (XDT99 by @ralphb) on the TI Extended Basic ROM Source code files (thanks to @RXB for their preservation).

The TI Extended Basic ROM Source code files did get minimally adapted, but there is no other sources involved in generating the binary on the right side.

The goal is to have a binary identical output across the whole thing to prove that Tomy Tutor BASIC comes from the TI Extended Basic ROM.

  • Like 3
Link to comment
Share on other sites

last state before ending the weekend. big work week ahead. so don't expect too many updates.

it is astounding how much percentage of the Tomy Tutor ROM1 is covered by xb source code, originating from Texas Instruments.


>9000 - >947F



>9480 - >98FF



>9900 - >9DFF



>9D80 - A1FF



>A200 - >A67F



>A680 - AAFF



>AB00 - AF7F



>AF80 - B3FF



>B400 - B87F



>B880 - BCFF



  • Like 1
Link to comment
Share on other sites

On 10/20/2020 at 10:04 PM, acadiel said:

Hey Klaus - do you know where the Pyuuta ROM0 is?  I'd like to do something similar with the Pyuuta ROM0 and the Tutor ROM0.


Hi, ROM0 might be different between a japanese Tomy Pyuta and an american Tomy Tutor. Afaik there are only dumps available for the American Tomy Tutor.

There are japanese emulators that somehow must have those ROMS integrated (extra files or integrated within their executable like Classic99).


Link to comment
Share on other sites

The yellow parts are mostly not defined, because I didn't find matching source code files.

There is still some uglyness, but we are getting there.


>9000 - >947F



>9480 - >98FF



>9900 - >9DFF



>9D80 - A1FF



>A200 - >A67F



>A680 - AAFF



>AB00 - AF7F



>AF80 - B3FF



>B400 - B87F



>B880 - BCFF (longer now, therefore more yellow than earlier)





  • Like 2
Link to comment
Share on other sites

>9000 - >947F


initial header at >9000 was not found yet. the part from >9050 to >9093 is a list of data words defining the XML Table.

i will fix those missing pieces once I completed the issues in the known matching memory areas.


>9480 - >98FF



>9900 - >9DFF



>9D80 - A1FF



>A200 - >A67F


here we have still a missing piece, therefore at this stage all empty ("00") on the compiled side.

again, once all known matching memory locations are without any differences I can start searching for this piece again.


>A680 - AAFF



>AB00 - AF7F



>AF80 - B3FF


this memory area is still is work in progress. the non matching parts are within trinsics2.asm, but its length is already correct.

here we have another missing piece from >B348 to >B4DD.


>B400 - B87F


the big yellow part is the continued missing piece from the last page.

some inconsistencies within crunchs.asm.


>B880 - BCFF


mostly empty still.




  • Like 1
Link to comment
Share on other sites

Okay, we got into the state, where it makes sense to publish the files.



Compare it with TI Extended Basic (also commited):



Here is an extract from the commited readme that I added with the Tomy Tutor Files:

The Rom2 chip content is an english BASIC version named Tomy Tutor BASIC.
The Rom2 chip is a 16 Kilobyte chip, that sits in the US Tomy Tutor, and only that US model came with an english BASIC, and therefore with a Rom2 chip.
The japanese models did not come with that chip or its content, but there were external upgrades to get this english BASIC implementation. One was a cartridge for the cartridge slot for the the Tomy Pyūta (ぴゅう太) MkII console.
Another was the Tomy Pyūta (ぴゅう太) BASIC1 interface for the extension port of a Tomy Pyūta (ぴゅう太) console.
To this date there is no known dump of those japanese cartridges. This would be helpful to verify its content (including its header) is identical to the Rom2 chip. Since it is always the english Tomy Tutor BASIC with the same manual, this is supposed until then. If you have such a cart please help here verify by providing a dump.
The Rom2 chip is wired up to be in the memory location >8000 - >BFFF of the 64Kbyte CPU memory.
This BASIC implementation always felt similar to the BASIC versions released for the TI-99, and developed by TI.
Even tokens were identified to be used similary, and many more similarities were found.
In late 2020 an attempt by Klaus Lukaschek was made to find the origin of the Rom2 assembly code within known source code for TI computers. This revealed that the Tomy Tutor BASIC is infact a minimally modified TI Extended BASIC. The TI community has the preserved source code files of TI Extended BASIC with their full comments by the actual TI software developers.
See this section in github for its Rom Sourcecode Files:
The mentioned set of files was changed to assemble towards their identified memory locations from the Tomy computer. Single code lines or passages, that were not found in the Rom2, were also removed from the adapted source code files to generate the same binary Rom2 content.
The attempt of being able to generate the binary of Rom2 solely from the TI Extended Basic Source code files was mostly succeeded.
At the beginning and and at the end of the chip is still data or code not yet mapped. Moving the project towards this repository hopefully completes the attempt.
Rom2 content:
>8000 - >9028 unknown (might be GPL)
>9029 - >B90F identical output (all coming from assembly source code files from TI Extended BASIC)
>B910 - >BFFF unknown
10.5 Kilobyte of continued memory is fully known.
The remaining 1.5 Kilobyte of Extended Basic are not found in the Rom2 binary.
The original TI Extended Basic is using two Rom banks, each with 8 Kilobyte. The banks have the first 4 Kilobyte identical, ending up with 12 Kilobyte of actual assembly Rom code. But in addition to work Extended Basic is using 4 Grom Banks a 6 Kilobyte each, making 24 Kilobyte of GPL code, GPL is a TI invented programming language. The Tomy is known to use GPL, but not by getting the data from Grom chips. So the required GPL code has to be, at least mostly, in Rom1.
Changes from the original TI Extended Basic Source code files were done with least possible changes.
Each changed line was documented with a "*TOMY*" comment field at the end of the line, starting at position 75 to stay within the 80 character line limit.
It is recommend to use a diff tool to compare the referred set of TI Extended Basic Source code files with this set.
For Windows I can recommend WinMerge.
Sometimes whole files got excluded because they were not found to be included in the Rom2 binary. Excluded files covered the ERAM (External RAM) and/or GROM handling. In addition subprogs.asm and subprogs2.asm were not found to be in the Rom2 binary. Any excludes might be identified to be a mistake but time will tell.
Most times the only changes that differ Tomy BASIC from TI Extended Basic were some lines or whole sections to not include. Then there are commented sections in the TI Extended Basic code (to document old revisions) that got uncommented (to be included) in the Tomy BASIC.
Having a continued binary match across 10 Kilobyte proves that Tomy Tutor BASIC copied the code from TI Extended Basic. Doing this without a license means a big copyright violation. If you have any info about license talks or even an agreement in the 80s, please get in touch with the community.
Working from the original TI Sourcecode files brings the following BIG advantages:
- no need to disassemble binary content any more, with lots of guessing and question marks.
- the basic implementation is now well documented with their original variables, labels, comments, structure, sorting and all developer notes.
- able to understand and document the limits
- reveal undocumented features
- nail down bugs of this implementation
- able to fix discovered bugs and release updated versions with ease.
- adding assembly language execution from BASIC, similar to how TI Extended Basic does it.
- allow integration of drivers for hardware projects

- having this ressource is tremendous useful for emulator developers to analyze and overcome nasty emulation bugs


>9000 - >947F


>9480 - >98FF


>9900 - >9DFF


>9D80 - A1FF


>A200 - >A67F


>A680 - AAFF


>AB00 - AF7F


>AF80 - B3FF


>B400 - B87F


>B880 - BCFF



  • Like 2
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...