Retro Fix: Montgomery Ward CyberVision 2001 (Work In Progress)

(This article will serve as a compendium of knowledge about the incredibly elusive Cybervision 2001 system, for which few sites or articles exist online and no prior service manuals, schematics or reference materials have ever been published. This post will serve both as a well-documented exploration of my repair efforts, technical documentation, media details and more.)

I recently acquired the all-but-forgotten Cybervision 2001 (trademark stylized as "CyberVision 2001") , another late-70s attempt at breaching the home TV-hookup computer market. This system was sold exclusively in the Montgomery Ward catalog, and was featured prominently in a two-page opening spread in its 1978 Spring/Summer edition. The set sported the RCA 1802 CPU, 4K RAM and 1K ROM. The one I received is of multiple levels of despair and with little to no information, schematics and materials to go by online I figure I'll start a blog post to chronicle my experience. I will fill in with photos and/or videos in time. Read Full Article

GUIDE: Downgrade Google Suite to Free Edition for Personal Use (November 2022)



Overview

Google caused a lot of controversy when it decided to phase out the free edition of their popular G Suite (Google Suite / Google Workspace), which they had previously grandfathered in for personal users who acquired it when the solution was still free-of-charge. Many relied on the service for custom domain email management using Gmail behind-the-scenes, and others for the Office-like suite of web applications for word processing and spreadsheets (Google Docs, Google Sheets).

In my case I had a couple G Suite accounts tied to my personal blog and portfolio domains, and have had them since the beginning of G Suite. Back in the day, they were offered as a free service by various hosting companies including my personal recommendation of Dreamhost Shared and Dreamhost Dedicated (affiliate links).  This is why it was so unfortunate to see that option phased out many years later. Read Full Article

Retro Fix: Packard Bell Platinum Pro 755 (1996-1997)

The first Windows-based PC I was introduced to in the early-1990s was a Packard Bell Legend 660 or comparable. It had the Microsoft Entertainment Pack 2 bundle featuring Rodent's Revenge and Rattler Race, two games I grew very fond of and would later develop a few games and variants heavily inspired by that. In that era I'd often ride my bike to the local Radio Shack to top the scores on their demonstration computers.

Decades later, I still appreciate that creative age of desktop computing even if these systems are collectively referred to as "Packard Hell" by select groups. At some point in time I found a Packard Bell Platinum Pro 750/755 tower on the curb to giveaway. I brought it back and eventually set it up in another retro corner. Since I planned to use it as an intermediary machine for creating and archiving old floppy media, I swapped out the Iomega zip drive with a 5.25" drive instead, knowing I also have some external ZIP drives if ever needed (although zip disks were short-lived and notoriously prone to click-of-death failure). Read Full Article

Retro Exploration: MDT-870 Mobile Data Terminal (1986-1996)

I recently impulse bought an ElectroCom Communication Systems MDT-870 radio car terminal for $5 at a surplus sale. Never knew much about these sort of computers but learned a lot since, and yet remain largely in the dark about this particular model given the complete absence of any documentation or schematics online.

This model in particular was common in squad cars in the 1980s-1990s. Some metadata extracted from a ROM that I dumped when troubleshooting indicated "COPYRIGHT 1986-1996 ELECTROCOM AUTOMATION INC." and the particular ROM in this unit had a generation date of March 25, 1996. Based on this, the department may well have used it for the better part of a decade before phasing it out in favor of more contemporary solutions.

This exact model appears in an early scene of Terminator 2: Judgment Day, where T-1000 uses it within a police car to query the details of John Connor. Having now used the real device the movie depicts, other than the simulated sound effects in the film the actual on-screen display appears to have been produced and filmed on the actual MDT-870. Of course the one on the set was not wired to actual police databases, but the text on it was typed within one of its free-type interfaces.

Initial Power-up and Short Glimmer of Life

When these were actively used, they had a variety of hookups to police radios, databases and similar. The one I received was barebones aside from some of the wiring that itself appeared cut and severed at various points. It runs on 2A 12V DC power, typically wired to the vehicle's battery/alternator. After a little bit of review I traced the original positive/negative wires and reworked them into a simple AC-DC power converter adapter and spliced a new cord to go along with it, from a typical computer adapter.

I was able to power up the unit and heard some remarkably 80s-sounding beeps as it booted up. It initially read "SIGNOFF ACCEPTED" and then took me to some integrated applications. This included a MEMO WRITER, QUERY DRIVER STATUS, and some others that I can't recall.

Alas, this was a short-lived effort as after typing some keystrokes and photographing the images above, something fizzled out and I lost all display and signs of activity.

Hardware Analysis

Unfortunately, not a single trace of documentation, schematics or ROM dumps for this system exist online. I found very few references to it at all. There were sporadic mentions of it appearing in movies, a fan-made STL model of the device citing Robocop 1, and other users looking for any documentation in hopes of setting one up in their own personal vehicles for nostalgia or show. I found one post from more than 15 years ago where someone did have the full gauntlet of schematics, programming guides, service manuals and even hardware-based interface adapters for PC communication. Alas I wasn't sure how to even approach contacting that user at this point in time.

Disassembly was not too difficult. In fact there exists plastic doors on the back of the unit for direct access and swapping of the CDVR and ROAM ROMs. The entire unit promotes itself as "Proudly Made in the U.S.A." Several of the ICs including all ROMs, CPU (OKI M80C85A-2 x2) and Graphics Controller (Intel P8725) were pre-socketed using machine pin sockets. I know many advocate for such sockets, but when wanting to quickly remove and replace ICs when troubleshooting and testing, I still find the flat leaf-type DIP sockets much easier to work with and less prone to bent and broken pins. That said, I did eventually swap the three machine pin sockets for the ROMs with leaf style to make my own life easier as I was burning and testing all of those ROMs continuously.

To actually get at the core ICs, you have to unscrew the back (and any brackets that may be attached) and carefully separate the two halves. The back half houses the small amber-lit Clinton Electronics 798P1NGLP picture tube and a simple speaker. Underneath this is the video sub-board and on the other side the main logic board. A ribbon cable transmits data from the logic board to the CRT board and ultimately into the display. The front half houses the membrane-based keyboard, LEDs, variable controls for adjusting Sound Volume, Light (Front LEDs) and Display Brightness. A side control also allows you to adjust the keyboard-based light brightness.

The system has two 80C85A CPUs (8085-based, the minor successor to 8080 and comparable to Z80 except with syntax I find to be much more cumbersome to decipher). The CRT is driven by the Intel 8275 (P8275) video controller. It has two banks of Sharp LH5168 CMOS SRAM and oneM81C55-5 CMOS SRAM a variety of other controllers and ICs. It also has a TMP82C55AP CMOS Programmable Peripheral InterfaceI noticed pin one of the uppermost CPU was bent underneath itself when inspecting the chips, but that didn't seem to have any impact.

ROM Summary and Dumps

There are three ROMs installed in the logic board, with only one of them providing a checksum value to compare clean ROM dumps. They are all programmed onto common 27CXX EPROM chips. Through trial and error, I made the following educated conclusions:

  • 502.87003.51 MDT870 CKSMC7B3 MDX-ROAM V2.2 (27C256) - This is the core ROM / OS. It is designed to interface with special frequencies/radios and other input/output devices for querying data, recording memos and otherwise communicating in a pre-mobile, pre-WWW era.
  • 501.64519.51 641.07910.00 V1.1 U4 CHRGEN (27C64)- This is the character generator. Mine wound up corrupt before I was even able to get a proper dump, so I am unaware of the precise layout of the original. However, after experimenting I was able to reconstruct a usable CGROM derived from the HD44780 controller after reversing and reordering them. If this chip is corrupt or removed from the set, the screen displays solid blocks as typical when no character generator exists.
  • 501.64520.51 641.07900.00 U16 V1.1 CDVR (27C64) - Originally I was unclear what CDVR stood for in this context. But it became clear as soon as I removed it from circuit that it is the CRT Driver. With it removed, the CRT cannot render anything but a high-pitch raster or several as if suffering vertical collapse.

I made ROM dumps of all three of these on my vintage EP-1 programmer. I verified the checksum of the ROAM firmware matched, but had no basis to compare the other two in the event they were corrupt. I later concluded the CHRGEN ROM had indeed corrupted for reasons unknown, whereby once I had fixed the display issues itself that chip would show mostly solid blocks and EPROMS I burned from the dump did the same. Trying the original in my more modern TL866-II programmer detected faulty pin(s), and comparing a dump made from it to any on either programmer always yielded errors. However, I'm confident the ROAM and CDVR dumps are functional and precise.

Below is a ZIP file containing the complete collection of ROM dumps I made in various formats (BIN, Intel Hex, Mitsubishi Hex and another format or two). It also includes my usable 2022-created character generator ROM, one variant with underlines and one without.

  • MDT-870 ROM Dumps .zip file (MDX-ROAM, CHRGEN [Corrupted], CDVR, CUSTOM CHRGEN 2022)

Character Generator Woes

After a lot of testing, trial and error I eventually wound up with a semi-bootable MDT-870 again. I believe there was one bad CPU, a few dry solder joints, at least one shorted/dislodged socket, and something astray in an SRAM chip (and am still not convinced the two SHARP chips are not damaged, this will take more testing).

The beep codes were back and the display was, well, showing something or other but basically all corruption.

I recognized even when typing that the glitches correlated to the keys typed, which is usually a sign of bad video RAM or a failed character generator. More testing of the original EPROM proved it to be a problem. I tried a fresh 2764 EPROM with the prior dump and experienced the same symptoms. Peaking into the ROM dump itself and I found almost entirely FFs or 00s, which definitely seemed peculiar compared to other ones I'm familiar with.

Typically character generators define the character sets using 8x8 (or 5x8 or 5x7 or some variant) where each single HEX value depicts one byte-row of character data. So FF would mean "fill in the entire row solid" and 00 would be "keep the entire row blank" but usually you'd see intermediary hex values, such as 3C to indicate "fill only the inner four bits) and this is how basic characters can be defined. Row-by-row. With this in mind, I created a dummy character generator filled with FFs but also randomly changed some values, as an experiment. This yielded the following:

That confirmed to me that the display problem was indeed just a wonky character generator. And, after some additional experimenting with patterns and characters I concluded the CGROM for this set is a pure data dump of constructed characters, it contained no additional logic or coding. This was fortunate as if it intermixed coding and byte data as some do it'd be vastly more difficult to guess the structure going forward.

I then went on a roundabout manner of creating some new character generator that'd at least satisfy the need to see what text is showing up on the screen. As a foundation I used the binary data constructs of the HD44780 and pasted them into a new binary file, repeating the entire set multiple times until padded at 01FF to match the original ROM size. When I tested this new ROM in the machine, I could tell we were headed down the right path.

Seen above was the initial run of a new character dump. I was in some input screen that allowed me to free type. The characters in the middle were me starting with ABC...890. You can see firstly how they are all inverted. This is because the CRT itself is mounted upside down then reflected off a tilted mirror to project through the front of the terminal. The other problem is that one letter gets skipped with each one I press. So A=B, B=D, C=F and so on. This was an immediate clue that the layout of the original CGROM repeated each character twice, AABBCC...889900. Eventually I realized that the most-significant bit (leftmost in a row of 8) determined whether the character would have an underline or not. If padded with "FF" there'd be an underline, otherwise there wouldn't be. This likely explains the need for replicated lines/characters. To my knowledge, lowercase characters were never displayable or included.

To resolve the reflected issue, I passed the binary format into a reverse line script. I then pass that into a binary-to-hex script. This could then be sit out into another binary file to appear the correct orientation when viewed through the terminal's mirrored screen. It was then a matter of comparing keystrokes with what the screen depicted, and swapping around the ordering to ultimately end up with a version depicting all characters successfully. You can see below how the mirror affects the display, both on the raw CRT and when viewed from the front with the redone character set.

It Lives Again, But How To Initialize?

Through the various iterations of it working, not-working then working again, any and all previously preserved data seems to have been wiped clean. Some of that likely happened while I was making contact with various pin-outs of the numerous memory-related ICs.

Before I had a proper character display again, I actually wound up with a different start screen. It would throw the error "NO HOME CHANNEL IN LIST" and then enter an empty typing screen. Periodically it would then interrupt with the error: "CHECK CONNECTIONS TO RADIO" Still, being able to type was interesting itself, at least it was something!

But after the final cleaning of the keyboard and another loss of power, then some more IC tinkering, the new screen is different once more. I'm not stuck at the "INITIALIZE MDT" screen and no characters have any affect.

It is evident based on the text data extracted from the ROM dump (see below) that the ROM has some internal way to define channels and so on. Somewhere in the code lies the string: PRESS "C" TO ENTER RAD. CHANNELS and related ones as well including ENTER RADIO CHANNELS and PRESS "X" TO EXIT. What I'm not sure of is how to achieve this, or if that by itself also requires interfacing with an external system.

If I make any further progress on this, I'll update this post. One interesting discovery worth checking into more thoroughly is the Open Hardware Driver for CRTs. This seems like a promising approach to easily hacking this or similar sets to display typical video output on its crisp amber display. "The driver circuit takes a 0-3.3V analog signal for deflecting the beam along the X and Y axis. The amplifier has enough bandwidth to handle NTSC video, so displaying video along with vector letters and shapes is also a possibility with this circuit."

Extracted Strings from ROM Dump Metadata

As part of the main ROM dump (502.87003.51 MDT870 CKSMC7B3 MDX-ROAM V2.2) I parsed through identified strings. They are included below, as well as their relative memory location at least as laid out in a decompiled Z80-derived version of the 8085 source. The fact that I was unable to find any references to the applications I had initially observed, may indicate that those along with the radio codes and data were still cached in some form of non-volatile memory but ultimately wiped out.

  • 0005: Generated 3/25/96
  • 003F: COPYRIGHT 1986-1996 ELECTROCOM AUTOMATION INC.
  • 0160: INITIALIZE MDT
  • 04D5: WARM
  • 1237: DISPLAYED FORM UPDATED BY HOST
  • 1261: DISPLAYED FORM DELETED BY HOST
  • 1521: H FILE BYTES AVAILABLE.
  • 156F: MD:4
  • 1699: <FORM>
  • 248D: QWERTYUIOP
  • 24BD: @ZXCVBNM,.
  • 24CD: 1234567890
  • 24DD: ASDFGHJKL:
  • 2EF7: 99RESET
  • 2F0A: PRESS "C" TO ENTER RAD. CHANNELS
  • 2F2F: SET ?
  • 2F99: TX LEVEL ADJUST (R49) TEST 2
  • 31C0: ENTER RADIO CHANNELS
  • 31DC: HOME CHANNEL:
  • 31F5: BACKUP CHANNEL:
  • 320D: SECONDARY CHANNEL:
  • 3226: AUTOMATIC XMIT TIME:
  • 3249: (FOR CHANNELS 1-9)
  • 3267: (FOR CHANNELS 10-16)
  • 327E: XMIT TIME IS MINUTES (03-25)
  • 32A4: PRESS "X" TO EXIT
  • 333C: MDT-870
  • 334E: FIRMWARE SERIES 20 V1.2
  • 336E: REV. DATE 3/25/96
  • 3388: AUTO CHANNEL SELECT/CHANGE
  • 33AA: PROM CRCC CHK.
  • 5405: <ERROR>
  • 5415: <PASS>
  • 5420: <TEST>
  • 64F8: LED TABLE
  • 6D57: DISPATCH DELETED BY THE HOST
  • 6E84: NEW DISPATCHES:
  • 6F0E: UPDATED DISPATCHES:
  • 6FD1: ACTIVE DISPATCH:
  • 70C3: STANDBY DISPATCHES:
  • 71F0: EXITING DISPATCH MODE
  • 720A: ACCESSING CLEARANCE FORM
  • 72A4: EXITING DISPATCH MODE
  • 7A27: NO RADIO COVERAGE AREA
  • 7A40: CHECK RADIO
  • 7A50: POOR RADIO COVERAGE AREA
  • 7A6D: NO HOME CHANNEL IN LIST
  • 7A87: "NEED CHANNEL LIST UPDATE"
  • 7AA6: CAN NOT CHANGE RADIO CHANNEL
  • 7AC5: CHECK CONNECTIONS TO RADIO
  • 7AE4: NO RADIO CHANNELS LISTED
  • 7AFF: NEED CHANNEL LIST DATA

Resurrecting Moneta: The Roman Imperial Coin Program (Patching and Cracking Abandonware Software - A Methodology)



Not Into Technical Jargon? Just Want the Download?

The article below was written as an exhaustive technical guide that covers one approach toward patching long-since abandoned and unsupported software products, using freely available tools. I chose to use Moneta: The Roman Imperial Coin Program for the general tutorial — an obscure application from the 1990s that a friend and several hundred others purchased, but with no way to activate it since the business went defunct many years ago.

The original software required a hardware-based activation key, which is no longer possible to obtain. Further, it lacked 64-bit compatibility so would not even install on modern operating systems. I will remedy all of that and more throughout the guide, but those just looking for the fresh installer with everything patched and working happily you can grab it below. Read Full Article