Computers

Peek & Poke

 

Rijeka is home to quite a large computer museum (as these things go, and measured in number of computers, not floor space). You will find the expected Apple / Atari / Commodore / IBM PC and clones… but those don’t interest me so much. What is interesting is the cold war East Bloc stuff that we never got to see or experience in the West.

Unfortunately a lot of the exhibits are behind glass and don’t photograph well.

This is an Ivel Ultra, a Croatian Apple II compatible computer designed by Branimir Makanec and developed by Ivasim Elektronika (in Ivanic Grad close to Zagreb) around 1984. It has a Z-80 (for CP/M) onboard like Franklin did with the Ace 1200.

The Robik is a Soviet ZX Spectrum clone produced between 1989 and 1994 in the Ukraine.

Spica Ines: A decent keyboard for your ZX Spectrum. And a bare PCB would be easier to import as “washing machine parts” than the whole computer…

Much more interesting (and also an unavoidable self-portrait) is the Galaksija.

In 1983, Voja Antonić designed the Galaksija, using a Z-80 processor, some interesting hardware and some hectic software to render the screen directly from memory using interrupts and code that does nothing in a very specific way while using the Z-80 RAM refresh function to pipe the scan lines to the monitor.

The design was published in the October 1983 issue of Galaksija magazine (hence the name) and at least 8000 of these things were built. At least.

Several versions of the PCB has now been recreated, and there’s even a way to get graphics if you have enough memory.

Then there are the commercial “home” computers. The Galeb (“Seagull”, codename YU101) was an 8-bit computer developed by the PEL Varaždin company in the early 1980s. Only 250 were produced by the end of the summer of 1984, before being replaced by the Orao. It’s a 6502 machine “inspired by the Compukit UK101” but if this Ferguson Big Board “(C) Mikro Slovenija” is an indication, it might have been very similar indeed.

One of the Galeb prototypes.

The Orao (“Eagle”) replaced the Orao. Still 6502 based, it was developed by PEL Varaždin in 1984. It was used as a standard primary and secondary school computer from 1985 to 1991.

The Pecom 32  and Pecom 64 were 1802-based educational/home computers developed by Elektronska Industrija Niš of Serbia in 1985. Both had 32k RAM and 16k ROM, but the Pecom 64 supported colour while the Pecom 32 was B&W, as far as I can tell.

These used the standard 1802 (CDP1869 + CDP1870) VIS display system.

The GETI 3220 is an AY-3-8500-based pong game made by Gorenje, who is better known for their household appliances (our fridge in Globoka is a Gorenje).

They also have calculators.

Lots of calculators.

I have a Triumph/Adler 108T, that Triumph looks like an 81S.

I also have the exact same Tvornica Računskih Strojeva TRS612 calculator, although mine is missing a few pieces. Made in Zagreb in the seventies.

They also have TVs, and audio equipment, and cameras, and test equipment. And I have the exact same Philips PM2421 Nixie-tube multimeter (top center of pic).

They cram a lot into 300 square meters.

I knew there was a camera, but I never knew there was a printer for the Game Boy. You could take a picture, print it out (in glorious monochrome) — the electronic version of Polaroid.

A bit more modern but still historically significant — the badge for the Hackaday Conference in Belgrade, 2018.

The website mentions that they’re looking for bigger premises. I will have to go back someday.

 

 

 

IBM PC (x86) emulator

If you’re looking for a small, simple, light-weight x86 emulator, 8086tiny might be a good call.

The main problem with it is that it was written by a dude who writes code for the Obfuscated C Contest (as a matter of fact, the obfuscated version of 8086tiny won in 2013*) — and it shows. The “documented, commented, maintainable version” (his words) is written in a way… let’s just say that if you were a programme manager and one of the team members wrote code like this you would be a very worried person. Like DJ Bernstein’s daemontools or qmail, it’s clearly written by someone who Has Clue, but should not be approached by someone who doesn’t.

For example, the code comes with a BIOS. The BIOS also includes the instruction lookup table, which is obviously a critical part of the code, and has nothing to do with the BIOS…

Anyway, I managed to import the BIOS for the NEC APC into the memory space (the standard BIOS lives at 0xF0100 (F000:0100)  – 0xF1Ef2 while the NEC BIOS lives at 0xFE000 (FE00:0000) – 0xFFFFF).  There are clashes, the 8086tiny BIOS actually writes its own reset vectors to what would normally be part of the BIOS EPROM at 0xFFFF0, overwriting the NEC vectors, and it puts the stack at 0xFF000 (F000:F000) which is in the middle of the NEC BIOS — but I can fire up the emulator and use debug to look at the NEC BIOS so I guess it’s a matter of time before I maybe modify this thing to emulate the APC and not a PC XT.

Or not. Round ‘tuits are scare sometimes.

* Look, I’ll give him a lot of points for style, but I feel making the BIOS blob a critical part of your code and then not counting its size is kind of… cheating. But hey. It _is_ beautiful to look at.

Logic Probe

There’s a kid around the corner who is building a Z-80 computer on veroboard.

This is not his story.

But in helping him I realised he needed a logic probe. This is that story.

I built this logic probe a … long … time … ago. Late seventies, I think. You can see where I cut it down the middle to fit in a pill bottle, but I straightened it again later.

And I could lay my hands on it when I needed to, a week ago. Yea, I don’t throw stuff away. Especially not useful stuff, and a logic probe counts as useful. I had to replace the 7400 which is now in a socket, back when I built it a socket would have been a luxury.

I have no idea where I got the original schematic from, but this is it, except that my R2 is 1k and my capacitors are higher-value tantalums that I recycled from something else.

And when we built one for Z-80 boy the other day, we found that R2 should indeed be 1k, because otherwise it doesn’t work right.

I also added a diode for reverse-voltage protection which is not a bad idea.

There are of course many other, better designs out there (electronicsforu.comelechelp.com, circuitfee…), including one in Everyday Electronics of September 1980*. But this one is simple and it works.

* I “subscribed” (in that my parents would give me the money every month and I would walk down to the CNA on Voortrekker Road and buy a copy, which they reserved for me) to Everyday Electronics from September 1978, or at least, that’s the earliest cover I remember.

Sometimes it’s better to remain quiet.

None of these answers is useful. I’m fully expecting the next comment to be a warning not to solder without adequate ventilation.

(For the record, 105 = 10 and 5 zeroes, just like a resistor, so 1000000 pF = 1 uF. And yes, 15 is the voltage. Also, google “what is the value of a capacitor marked 105” gives the correct answer straight off the bat. People. Feh).

Digital Necromancy

As mentioned before, back in the late eighties I built a 68000-based computer. Last time I messed with it was probably in 1991, 30 years or so ago.

Well, it still lives. It runs a hacked version of MVME101bug, and I also have Gordon Brandly’s Tiny Basic along with a bit of code to copy it to RAM at 0x002000 and run it there.

But I have given up trying to hack MVME101bug any further. These days I have the source for the Motorola MC68000 ECB TUTOR monitor, and I know how to compile it, and it’s basically the same thing*, so that’s where I’m going next.

* In addition to the TUTORNEW commands, MVME101Bug has BI (initialise block of memory), BD, BH, BO (bootstrap from floppy), and IOP, IOT (disk I/O). It takes up aroung 22k of EPROM space, while TUTOR had to fit in 16k. I will worry about that when I get there.

Memories

Played my first game of Castle Wolfenstein in … 25 years? tonight. Got to the third floor. I am not as good as I used to be.

Also played a game of Lode Runner. Yup, not nearly as good as I used to be.

Then again, I played Lode Runner to the point where I went to bed with a book and was trying to find paths between the words and sentences on the page… yea, I was a bit obsessed.

Rude Websites

Most if not all second-hand car dealers in Slovenia work through www.avto.net (The letter V after a vowel becomes a W, similar to the English U. So awe-too.net). However, from South Africa, www.avto.net gives you a nice ERR_CONNECTION_TIMED_OUT.

Others are less subtle. www.offerup.com gives

The owner of this website (offerup.com) has banned the country
or region your IP address is in (ZA) from accessing this website.

So what is a geek to do? Assuming Windows (7, in my case), go to http://www.freeproxylists.net/eu.html , pick an IP / port combination that suits,  Start / Control Panel / Network and Sharing Center / Internet Options at the bottom left, Connections tab at the top, LAN settings button at the lower right, tick Proxy server and put the address and port in the relevant blocks.

185.26.226.241 / 36012 gives me access to www.avto.net but I had to go find a proxy in USA to make www.offerup.com work. And the first three or four I tried didn’t work (I ended up using 35.240.29.142 / 3128). These guys are paranoid lemme tellya.

(And for the record, paypal.me uses similar fuckery, don’t ask me why. All it does is redirect you to paypal.com anyway).

 

PC Partner motherboard

Being the caring gentleperson that I am, I had to rescue the motherboard and power supply from this ex-PC.

P1140193r

Yea, I guess someone used it for a step, then lied to the boss and told him it had fried.

Because there’s nothing wrong with the motherboard, the PSU, or the memory DIMM that was kicking around loose inside the box.

This looks like a nice little motherboard for someone like me. It’s old enough to still have floppy drive support and new enough to have USB. It has an RS-232 serial port* as well.

But nowhere on this motherboard is there a part number of any type.

The BIOS is also not at all useful. CLE266-8235/M-6A6LUPREC-00 tells me the motherboard uses a Via Technologies CLE266 North Bridge and a VT8235 South Bridge, but this is not a Via motherboard, it’s a PC Partner. So with some more googling, turns out it’s a CLE266M-A68M800 (download the manual).

* The manual claims that there are two serial ports. On this motherboard, the RS-232 line driver and the header for COM2 is not fitted, so you’re out of luck there.

Reading mask PROMs

So I’m messing around with a Burroughs TD831 terminal which uses a 6800 processor, 8 kilobytes of DRAM and 16 kilobytes of mask PROM.

The PROMs are fairly typical of the era, in that the chip select lines are also programmable. So you program the first one in a bank of four to have two active low chip selects, the middle two ones to have an active low and an active high, as well as the reverse, and the fourth one to have two active high chip selects. That way you can run address lines into the chip selects and four PROMs act like one PROM four times the size, effectively.

How I figured this out: the PROMs have 24 pins, the largest 24 pin PROM is a 2732. Told my EXPRO that’s what they were, not much joy. Went down to 2716s, and that gave data out of one of each bank of four PROMs. I figured that this means the devices are similar to for example the 82S191. So it was time to write some code.

I was lazy and just told the code that the three potential chip select lines were address lines. This gave me a 16 kilobyte per PROM dump, three quarters of which is blank Looking at how the banks were located in the 16 kilobyte address space makes it look like pin 21 (A10 on the 82S191) is an active high Chip Select, while pin 20 is A10 and pins 19 and 18 are the programmable Chip Selects.

I suppose I can rewrite my code to map things that way, but I should be able to paste my dumps together into something that can be disassembled. If ever I am arsed to do that.

But if you are here on a quest to restore one of these things to life, I think I have given you everything you need in order to be enlightened.

Edit: You might notice that I did change the code and re-dump the ROMs in nice neat 2k binaries.

Infocom copy protection

The first copy protection scheme I cracked on my Apple ][ was that of Zork. It wasn’t that difficult, the data prologue bits were changed from D5 AA AD to D5 AA BC. Copying the disk involved patching the standard copy program COPYA and then editing the disk so that it could read itself.

But today I’m interested in the IBM PC version of Zork. Like the Apple ][ version, the disk could not be copied by the standard tool (in this case diskcopy) but Copy II PC worked just fine. Interestingly, the disk allowed you to make one copy of the game for backup purposes.

The weak point of copy protected disks is that the standard BIOS must be able to read the first bit of the disk. This code is then executed to read the “uncopyable” part of the disk. Anyone can read the first sector, disassemble it, and work out how to read the rest of the disk. Granted, this process is sometimes extremely difficult. Not so in the case of Zork.

On the IBM PC, the BIOS reads track 0 sector 1 into segment 0, offset 7C00 and jumps to it.

0000:7C00 FA     CLI                   Disable interrupts

The first thing after disabling the interrupts (which is pretty standard) is to change the pointer (at 0000:0078) to the disk controller parameter block to point at the first location after this actual code, 0000:7C79.

0000:7C01 2BC0   SUB AX,AX             AX=0
0000:7C03 8ED8   MOV DS,AX             DS=AX=0
0000:7C05 BB7800 MOV BX,0078           DISK_POINTER, points to parameter block
0000:7C08 B97900 MOV CX,0079
0000:7C0B BAC007 MOV DX,07C0
0000:7C0E 8B37   MOV SI,[BX]           Save current pointer at 0000:0078 in SI
0000:7C10 8B7F02 MOV DI,[BX+02]        Save current pointer at 0000:007A in DI
0000:7C13 890F   MOV [BX],CX           0000:0078 = 0079
0000:7C15 895702 MOV [BX+02],DX        0000:007A = 07C0

0000:7C18 8CC8   MOV AX,CS
0000:7C1A 8ED8   MOV DS,AX             Set DS = CS

; Set stack to 0000:7C00               Fairly standard
0000:7C1C BA0000 MOV DX,0000
0000:7C1F 8ED2   MOV SS,DX
0000:7C21 BB007C MOV BX,7C00
0000:7C24 8BE3   MOV SP,BX

0000:7C26 FB     STI                   Enable interrupts
0000:7C27 B86000 MOV AX,0060
0000:7C2A 8ED8   MOV DS,AX             Set DS and ES to 0x0060
0000:7C2C 8EC0   MOV ES,AX

; Reset disk drive (AH=0)
0000:7C2E 2BC0   SUB AX,AX AX=0
0000:7C30 2BD2   SUB DX,DX DX=0
0000:7C32 CD13   INT 13

0000:7C34 BA0300 MOV DX,0003           DX=3
0000:7C37 2BDB   SUB BX,BX             BX=0
0000:7C39 B501   MOV CH,01             CH=1
0000:7C3B 52     PUSH DX               Save DX
0000:7C3C B101   MOV CL,01             CL=1
0000:7C3E 51     PUSH CX               Save CX (= 0101)
0000:7C3F 2BD2   SUB DX,DX             DX=0
0000:7C41 B80402 MOV AX,0204           AH=2, AL=4
0000:7C44 CD13   INT 13

INT 13 with AH=2 reads AL (=4) sectors from cylinder CH (=1), sector CL (=1) of head/drive DX (0/0) into ES:BX (0060:0000). This read uses the new parameter block further down, which differs from the standard parameter block in that it specifies 1024 byte sectors, four sectors per track.

0000:7C46 721C   JB 7C64               If INT13 returns error, print "ILL" and halt
0000:7C48 59     POP CX                Restore CX (I don't think INT13 corrupts CX, so I don't know why)
0000:7C49 FEC5   INC CH                Next cylinder
0000:7C4B 81C30010 ADD BX,1000         Move data pointer 4 kb ahead
0000:7C4F 5A     POP DX                Track (cylinder) counter, started at 3...
0000:7C50 4A     DEC DX                ...2...1...
0000:7C51 75E8   JNZ 7C3B              Loop back unless 0

So we have now read three tracks of four sectors of 1024 bytes each into 0060:0000, 0060:1000 and 0060:2000.

; Restore disk controller parameter block pointer
0000:7C53 2BC0   SUB AX,AX               AX=0
0000:7C55 8ED8   MOV DS,AX               DX=0
0000:7C57 BB7800 MOV BX,0078             BX=0078
0000:7C5A 8937   MOV [BX],SI
0000:7C5C 897F02 MOV [BX+02],DI
0000:7C5F 06     PUSH ES
0000:7C60 2BC0   SUB AX,AX
0000:7C62 50     PUSH AX
0000:7C63 CB     RETF                    POP IP = 0, POP CS = ES

RETF pulls an instruction pointer and code segment from the stack, and execution moves there (0060:0000).

; ERROR
0000:7C64 2BDB   SUB BX,BX               BX=0
0000:7C66 B049   MOV AL,49
0000:7C68 B40E   MOV AH,0E
0000:7C6A CD10   INT 10                  AH=0E, teletype output, 49 "I"
0000:7C6C B04C   MOV AL,4C
0000:7C6E B40E   MOV AH,0E
0000:7C70 CD10   INT 10                  "L"
0000:7C72 B04C   MOV AL,4C
0000:7C74 B40E   MOV AH,0E
0000:7C76 CD10   INT 10                  "L"
0000:7C78 F4     HLT

0000:7C79 CF 02 25 03 04 2A FF 50 F6 19 04

This is the modified parameter block, 03 = 1024 bytes/sector (normally 2 = 512 bytes/sector) , 04 = 4 sectors per track (normally 8).
Of course MSDOS diskcopy barfs at 1024 byte sectors and there’s your copy protection.

ZORKTOOLS will rewrite the 4×1024 byte sectors to 8×512 byte sectors and patch the bootloader to match.