Need help reverse engineering Timex Store Demonstrator ROM file

Discussions about Sinclair ZX80 and ZX81 Hardware
David G
Posts: 387
Joined: Thu Jul 17, 2014 7:58 am
Location: 21 North, 156 West

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by David G »

RECIPE seems to have a bug. If you enter "4" it doesn't work right
RECIPE.jpg
POWER3.jpg
POWER3.jpg (7.64 KiB) Viewed 2256 times
David G
Posts: 387
Joined: Thu Jul 17, 2014 7:58 am
Location: 21 North, 156 West

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by David G »

This will run in the EightyOne emulator
* with modified ZX81.rom (change one byte)
* with 2k or more
* with "Enable RAM in 8k-16k" (only needed so we can load StoreDemo here)
* with "Load Memory Block", StoreDemo.rom at 8192
For more details, see below


Next, has anyone figured out how the BASIC program in ROM is auto-started? As I understand it, auto-load is done via NXTLIN (at 4029H) pointing to the address of the line to start next (and is set to 0 when not running). NXTLIN is included in the BASIC program loaded from tape, thus when you SAVE a running program, it will continue running when you LOAD it. But StoreDemo doesn't have a NXTLIN


"StoreDemo.rom" has this data:

Code: Select all

---------------------------------------------------
$0000-$007C $FF all (255 decimal)
Corresponds to:
$4000-$407C System Variables

$007D-$1FE4 BASIC program
($407D is where a normal BASIC program resides)

$1FE5       $76 extra byte
$1FE6-$1FFF $FF all (filler/padding to fill out 8K)
---------------------------------------------------
The ROM has no other data or code


The program is supposed at auto-run:
EPROM contains a BASIC demonstration program that starts on power up.

https://www.timexsinclair.com/product/e ... onstrator/
EPROM demonstrators ... plug them onto the edge card connector of your TS1000 and then power up your computer. Instantly the program comes up running with some nifty graphics and human interactive computer excercises.

DETAILS to running StoreDemo in the EightyOne emulator
(tested with EightyOne version 1.21)
  • modify the standard ZX81 ROM file. I used "HxD" to do that. Change byte offset 09DB from 40 to 20 (see below for why)
  • Start EightyOne
  • On the Options menu, click Hardware
  • change "RAM Pack" to 2k
  • Click the "Advanced Settings" tab
  • For "ROM File", click "..."
  • Select the ZX81_changed.rom file and click Open
  • Put a check in "Enable RAM in 8k-16k"
  • Click OK. The screen may fill with garbage
  • On the File menu, click "Load Memory Block"
  • Click "...", select the StoreDemo.rom file, type 8192 in the Address box, click "Load File"
  • Reset the emulator: Press F2 (or, on the Control menu, click "Soft Reset"). The StoreDemo listing appears
  • RUN

Why change one byte from 40 to 20? How the machine looks for the BASIC program in the new ROM was provided earlier by Mark:
1024MAK wrote: Sat Mar 05, 2022 10:07 am So the hardware replaces the pointer for where the BASIC program starts (the byte in the ZX81/TS1000 ROM at 0x09DB which is 0x40 is replaced with 0x20). Thus the BASIC ROM now looks for the BASIC program in the extra ROM at address 0x207D (8317) instead of in RAM at 0x407D (16509).[/b]
i was confused by that. Searching The ROM disassembly by Logan & O'Hara for 09DB shows:

Code: Select all

CALL	09DB,LINE-ADDR
however it is a mistake, because they also show a different address for LINE-ADDR:

Code: Select all

09D8 LINE-ADDR	PUSH	HL
i checked an actual Improved Rom 649 and it's actually 0x09D8. So what is 0x9DB?

0x09DB part of this line:
[09D9] 21 7D 40 LD HL,+PROGRAM
0x09DB is this:
[09DB] 40

09DB hexadecimal = 2523 decimal
(PRINT PEEK 2523 should return 64 with standard ROM, but 32 with modded ROM)


PROGRAM=7D40
PROGRAM is where the BASIC program lives (see ZX81 manual chapter 27)

So this is good. There Store Demonstrator add-on board has a hardware circuit to change the 407D to 207D, and so the normal ROM will then look for a program found at 207D (which is in the StoreDemo ROM)
jdfan1000
Posts: 81
Joined: Tue Aug 02, 2016 8:06 pm
Location: Buffalo, NY
Contact:

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by jdfan1000 »

David G wrote: Wed May 25, 2022 1:53 am The StoreDemo BASIC program can be made to run on standard hardware, so I was thinking of why it was put into a ROM package. This is my speculation:

* no need for a cassette tape to load the program
* no need for RAM packs
This make it fairly easy for a store manager to set up. If the power goes out, the program is still in ROM. Just start it back up.


About RAM usage, the program needs less than 1K RAM for the display file. And it needs RAM for the BASIC variables, the stack and other WORKSPACE use. I'm sure it will run with the standard built-in 2K that all Timex/Sinclair TS1000 had
The demo came "built-in" to the TS 1000 merchandising display unit:
https://archive.org/details/timex-compu ... 5/mode/2up

See under "Features:".

A stock TS 1000 and this module were pretty much guaranteed to be stable. Just plug the display unit in, turn it on and walk away :)
My archive.org collection, containing many Timex/Sinclair related publications.

TimexSinclair.com, my website about Sinclair computers in the US.
User avatar
XavSnap
Posts: 1940
Joined: Sat May 10, 2008 4:23 pm
Location: 'Zx81 France' Fb group.

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by XavSnap »

Hi,
It was the ancestor of phishing by email.
A lie because the computer was not equipped with 8k and wasn't the real preview of the computer.
:twisted:
Xavier ...on the Facebook groupe : "Zx81 France"(fr)
User avatar
XavSnap
Posts: 1940
Joined: Sat May 10, 2008 4:23 pm
Location: 'Zx81 France' Fb group.

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by XavSnap »

Hi David,
Thanks !

In fact, the card feed only one byte, located in $9DB in ROM... PEEK (2523) = 32 !

StoreDemo.jpg
Xavier ...on the Facebook groupe : "Zx81 France"(fr)
David G
Posts: 387
Joined: Thu Jul 17, 2014 7:58 am
Location: 21 North, 156 West

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by David G »

I used to be quick to understand this stuff but since my stroke i need to write it all out. From looking at Schema.jpg from your Kicad/Gerber attachment in the earlier post, i'm understanding it as follows

First i worked out the ROM SELECT CIRCUIT (see below)

Then, i noticed your above JPG already cut out a different part of the schema.jpg diagram that include the 74HC244 chip

Oh well, i was not understanding that part of it anyways. The 74HC244 chip is an "Octal 3-State Noninverting Buffer/Line Driver/Line Receiver". Is that overriding all the data lines of the ZX81?


ROM SELECT CIRCUIT
ROM SELECT CIRCUIT.jpg
When the 2764 chip _CE is low the EPROM is enabled (CHIP ENABLE)
When U1A (NOT) output is low, the EPROM is enabled
When U2B output is high, the EPROM is enabled

U2B: NOR (meaning output is high when all inputs are low)
inputs
* _MREQ (low when CPU is requesting memory)
* GND (low by definition)
* U1B output
important part: EPROM enabled when U1B output is low

U1B: NOT output is low when input is high

U2A: EPROM is enabled when output is high
NOR output is high when all inputs are low
inputs
* A15
* A14
* _A13
This means any address of the form 001xxxx
The '1' is in the 8K place
in other words the 8K-16K block
POSSIBLE 8K BLOCKS

Code: Select all

-----------------------------------
* 000 0K (where the ZX81 ROM lives)
* 001 8K
* 010 16K (where the RAM starts)
* 011 24K
* 100 32K
* 101 40K
* 111 48K
-----------------------------------
U2A determines which 8K block from three address bits. In the case of StoreDemo, it is configured to select on 0010 addresses (0x020, which is the $2000 range of memory). So the Store Demonstrator EPROM is mapped into $2000
User avatar
XavSnap
Posts: 1940
Joined: Sat May 10, 2008 4:23 pm
Location: 'Zx81 France' Fb group.

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by XavSnap »

Hi David,

You right...
There is no mystery in this card.
There is a standard 8k ROM.

But what is smart is to deceive the basic by telling it (force the data bus to read) that the Basic Start address is at the address $20D7 and not at $40D7.
The Basic will read the first line in $20D7.

The part of my diagram decodes the address $9DB and each time the Basic will read this address on the ROM 0-8k, it will read the address given by the card, i.e. $20, which replaces the original value $40 .

It's simple and very clever.

Original ROM, without card: ($9DB>$40 )
storedemo3.JPG

With the 1 byte ROM patch:($9DB>$20 )
storedemo4.JPG
Xavier ...on the Facebook groupe : "Zx81 France"(fr)
David G
Posts: 387
Joined: Thu Jul 17, 2014 7:58 am
Location: 21 North, 156 West

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by David G »

im curious as to why there is a voltage regulator on the ROM card


Here is a version that runs on a standard ZX81 or TS1000 with 16K. Runs on ZX81 at either 50hz or 60hz

StoreDemo_4000_16K.p
(8.77 KiB) Downloaded 86 times

and the Assembly Language for it. To make to the code address-relocatable, it needed the usual "change literal addresses to labels", ditto for PEEK and POKE

And in this case:
* move the variables to a new area
* skip the part that changes the Display File
Attachments
StoreDemo_4000or2000_16K.asm
(21.8 KiB) Downloaded 79 times
dessony
Posts: 342
Joined: Tue Oct 29, 2013 2:26 pm
Location: Indiana, USA

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by dessony »

I decided to order five Timex Store Demonstrator printed circuit boards. Please let me know whether you want this board, please PM me.
Thank you very much in advance.

Cheers,
DesSony
dessony
Posts: 342
Joined: Tue Oct 29, 2013 2:26 pm
Location: Indiana, USA

Re: Need help reverse engineering Timex Store Demonstrator ROM file

Post by dessony »

I anticipated a TSD PCB order by preparing components for it. I received the PCB order 2 days ago (9/30/'22). After assembling the board, I checked the voltage reading before putting ICs on the board. As I expected, the 5 ICs had top left holes 5-volts readings with the 6 Silkprinted notches on its left side. One IC had a bottom right hole 5-volt reading. :?: Does this one make sense? :?: XavSnap, can you post pictures of the top and bottom sides of the "copper traces" of the particular board here? Check the 74LS133 area.

Thank you.

Regards,
DesSony
Post Reply