Close
0%
0%

V-Tech Genius Leader / PreComputer Hacking

Turning a toy into a hardware tinkering platform

Similar projects worth following
Those childhood learning computers can be turned into pretty nice Z80 hacking stations!

This project describes a journey into vintage Z80 based learning computers manufactured by "V-Tech" in the 80s and 90s. Starting with some reverse engineering information, PCBs for interfacing the cartridge port and software development notes.

Currently, there is proof-of-concept support for enabling MIDI in/out, or using it as a terminal for a Raspberry Pi, interfacing a PC using FTDI and the printer port, and even some DOS or CP/M like functionality using a SD card and an Arduino.

The goal of this project is to create a set of hardware and software tools to "hack" the 1000/2000/4000 and 6000 series of VTech 8-bit learning computers ("PreComputer").

Current status:

  • The hardware is well understood: Z80 CPU, HD44780 LCD controller, keyboard matrix, printer port, bank switching, sound, LED, ROM, RAM and cartridge port.
  • The firmware has been reverse engineered to a degree that allows writing custom system ROMs, as well as compiling ROM images that are recognized as cartridges and run by unmodified systems.
  • Software can be compiled using SDCC and emulated using MAME.
  • The printer port can be retrofitted to systems that don't natively have one.
  • Cartridge PCBs have been designed to allow using (E)EPROMs and memory mapped I/O.
  • By using "bit banging", the printer port can be used as a 9600 baud serial port without any hardware modifications.
  • Using a small hardware modification (soldering wires to ChipSelect pins) it is even possible to run a proof-of-concept CP/M system!
  • A dedicated VGLDK (VTech Genius LEADER Development Kit) is currently being developed, to provide a low barrier for developing own programs for the system.

VGL_CPM_0.0.7_WIP_20191202.zip

Minimal CP/M operating system implementation that can actually run ZORK. Work in progress!

Zip Archive - 60.83 kB - 12/03/2019 at 00:18

Download

VTech_SDCC_20190803_headers-includes.zip

All files needed to develop your own cartridge ROMS using the SDCC compiler. Using stock firmware hooks.

Zip Archive - 269.29 kB - 08/03/2019 at 15:44

Download

VTechCartridge_RevD_20190731_KiCAD-Gerber.zip

KiCAD design files for the "BusF###er" cartridge. Rev D. Work in progress!

Zip Archive - 305.44 kB - 08/03/2019 at 15:42

Download

  • 1 × EEPROM 8kB AT28C64B
  • 1 × Arduino UNO

  • Factoid: Guess where ZiLOG is located...

    Bernhard "HotKey" Slawik10/08/2020 at 17:43 0 comments

    While skimming through the local business register I stumbled upon the entry "ZiLOG International Ltd."...

    ZiLOG —the Californian company that created the Z80 processor used in all the VTechs— is now part of Littelfuse and IXYS which in turn is c/o AVNET (big electronics distributor) which is literally around the corner of my house!

    But so far I seem to be the only Z80 nerd around here (that I know of).

    🌈 *The more you know!* 🌠

  • But does it run Doom?

    Bernhard "HotKey" Slawik09/30/2020 at 22:43 0 comments

    well... sort of... ;-)

    Crappy Raycaster Demo
    Crappy Raycaster Demo running on an emulated GL6000SL

    ...and if you don't have a graphical LCD:

    Raycaster on Genius Leader 4000
    Raycaster in 20x4 text mode

    There is also no game logic whatsoever, tho. Just a proof of concept.

    Check it out at https://github.com/hotkeymuc/vgldk/tree/master/examples/raycast

  • ParallelBuddy: DIY periphery add-on for everyone!

    Bernhard "HotKey" Slawik09/06/2020 at 21:31 3 comments

    I've been using the past months to get a new focus for the project.

    Hardware hacking is fine and dandy, but the practical use for the "average Joe/Jane" is quite limited. After all, manufacturing PCBs, sourcing 74-series logic and debugging everything is not for the faint of heart.

    So I came up with a new goal: Lowering the entry bar for anyone trying to run own code on an old V-Tech computer. That means: allowing unmodified C programs to just work on the VTech without hassle. Just "make" to compile, "make emu" to simulate and "make burn" to burn a finished EEPROM.

    There is no easy way of sticking your own EEPROM into the computer, yet. For now you have to "sacrifice" a working cartridge and properly attach your own EEPROM to it. But it's very doable.

    EEPROM Adaptor
    Custom EEPROM attached to a stock ROM cartridge using a piece of proto board and a ZIF socket

    After having done this, you should be able to simply compile, test, burn and run your code on a 2000, 4000 or 6000 series V-Tech computer. This is already working fine using the latest version of the VGLDK.

    So far, so good. But then what?

    It would be soooo nice to have just a little bit more periphery to play with, like "real files", network, LEDs etc.

    Following the same direction as my older "BusFicker" cartridge, I thought of the simplest way to extend the periphery by using just an Arduino. This time, instead of doctoring around with the Z80 bus, I re-visited my "Software Serial" code, completely re-wrote it in C and optimized the crap out of it. Not only is the new "Software UART" smaller than its assembly predecessor (C optimization ftw), it can even handle serial speeds of up to 19200 baud now!

    Throw in an Arduino, an SD card and some wires and —voilá— say hello to the Parallel Buddy!

    Parallel Buddy
    Just connect 3 wires from the printer port to an Arduino for a world of endless possibilities!

    What can it do? Well, I'm glad you asked☺In theory it can do whatever an Arduino can do. But to keep things neat and extendable, I opted to create the concept of file systems and mounts inside the VGLDK. So with the usual "fopen()" syntax, you can now access files baked into your ROM as well as accessing any remote file system mounted on the ParallelBuddy Arduino (the Arduino sketch actually uses the same source code for its own local file system).

    So: Connect the Arduino, fire up the "monitor" ROM, "cd" into the ParallelBuddy mount, and from there into the SD card or anything else you decide to put in. Your monitor can simply "cat" or "run" files directly from there! "fopen()" doesn't know the difference! ☺

    Browsing file systems
    Running a program from an SD card connected to an Arduino. There are actually 4 different file system drivers in action to allow this.

    I also added a rudimentary Ethernet file system through the use of a standard Ethernet shield. Just fopen("/pb/eth/google.com") and you're golden!

    Be warned that the ParallelBuddy code is quite big, so you'll have to disable some other functionality to make the monitor program fit a standard 8KB / 64 Kb EEPROM. The makefile will warn you if you run out of space.

    Oh, uploading files from a computer to the monitor still works as before: After power-up the ParallelBuddy Arduino sketch will stay in "bootloader mode" for some seconds, simply passing all data between the VTech and your computer, before switching over to "ParallelBuddy mode". So you can also use the Arduino as a USB-serial converter.

    So: Head over to the VGLDK GitHub and give it a try! You'll find the Arduino sketch "VTechParallelBuddy.zip" inside the "tools" folder.

    Cheeeeeers!

  • Prestige!

    Bernhard "HotKey" Slawik05/16/2020 at 21:35 1 comment

    The other day, I decided to do something "completely different" for a change. So I went to my wall of VTech Genius Notebooks and grabbed a random one from the pile that had the same cartridge port as the 4000, but a larger screen.

    My pick: the Genius Leader 6000SL aka. Genius PreComputer Prestige.

    This time around I wanted to cheat a bit, since I didn't want to spend another 2 years analyzing it (as I did with the 1000/2000/4000 series). Instead of building a debugging cartridge and finding all the memory and port mappings myself, I just searched for some emulation source. And I found a driver in the trusty old MAME repository (src/mame/drivers/prestige.cpp). It is missing some functions (printer port, sound), but the basic stuff is there.

    First thing that sparked my interest: The machine seemed to use a DMA based LCD (240x100, graphical), so there is no need for weird LCD initialization code and software frame buffer stuff. It's as simple as poking bitmap data into memory at 0xE000-0xEBB8 and it gets drawn on the screen automagically!

    The keyboard is also pretty straight forward (matrix at ports 0x40, 0x41, 0x42) and didn't take much effort to get working. And even the mouse (yes, it has an external mouse!) is directly mapped to ports 0x04 and 0x05 for the X and Y positions. Nice!

    I must say, I am quite impressed about how much easier it is to work with the 6000 compared to the 1000/2000 and 4000 series. It took just one day to write my first "Hello World" from scratch (including custom font rendering). I would call that an "instant gratification" :-)

    The bank switching / memory mapping in the Prestige is also quite nice: It allows for the cartridge to be mapped to lower memory at address 0x0000. This means that a CP/M style system could run on that machine without any hardware modifications (i.e. no "Chip Select hack" needed)!

    So maybe I'll just give it a try and create a Plug & Play CP/M cartridge for that machine!

    Stay healthy!

    Update: I have updated the VGLDK Github repository to allow compilation against the new "gl6000sl" target. Cheers!

  • VGLDK

    Bernhard "HotKey" Slawik01/24/2020 at 22:46 0 comments

    Just a little status update:

    With CP/M working as a proof-of-concept, an important personal milestone has been reached.

    While doing so, a lot of new interesting ideas came up. That's why I am now spending a little time incorporating all the development so far into a VTech Genius LEADER Development Kit - the VGLDK.

    Even though I would very much appreciate it, if the VGL support for the Z88DK would improve, I feel like it is a little bit too over-engineered and complicated for the rather "simple things" I try to accomplish. Those being: Enabling everyone to develop software for the system quickly and hassle free.

    So I created a Github repo at https://github.com/hotkeymuc/vgldk and started filling it with some initial content. My current focus lies on smooth portability between the 1000, 2000 and 4000 series. (Series 3000, 5000, 6000, 7000 and 8000 may follow eventually.) Additionally, the build process must allow compiling programs for use in a cartridge ROM, as system replacement ROMs, and also for runtime-linking (e.g. when using CP/M or some sort of DOS). I might also migrate the VGL CP/M project right into the VGLDK.

  • "You are standing in an open field..."

    Bernhard "HotKey" Slawik12/02/2019 at 22:22 3 comments

    I had the feeling that I was going around in circles: Adjusting some assembly code, compiling, burning an EEPROM, inserting it, bootstrapping the RAM cartridge for CP/M, switching from ROM to RAM, booting CP/M, loading a .COM-file over serial, running it, ... and crashing.

    This became very tiresome quickly, as you can imagine.

    "Emulation to the rescue!", I thought. So I took a deep dive into the MAME source code and patched the PC2000 emulator: I changed the memory banks to be write enabled to simulate the RAM-switching hardware mod needed for running CP/M. I also added a debug port that allows sending and receiving data to/from MAME via stdin/stdout.

    That worked like a breeze. Now it's only one click to compile and pack the CP/M ROM, fire up MAME, load CP/M and open a data channel between the emulated CP/M machine and a python "host" script. This really speeds up the process of loading and altering code for debugging. I also added a TRAP function to BDOS, which allows stopping the program flow at a desired address, dumping registers+stack, and continuing with the execution.

    Having these tools at hand, I quickly identified a bank-switching bug and an error when reading records from files.

    I crossed my fingers, uploaded "ZORK1" to the emulated CP/M and gave it a try...

    ...it opened the "ZORK1.DAT" file...

    ...read some records...

    ...then some more...

    ...and even more...

    ...and more...

    ...until finally:

    ZORK - on a VTech Genius Leader 4000 running CP/M inside MAME
    ZORK - On a VTech Genius Leader 4000 running CP/M inside MAME

    Yeeeeha! I've never felt better, standing in an open field on a cold night like this :-D

    Don't get too excited, yet, because I immediately ran into the next 2-3 bugs with the keyboard handler. So it is not really playable at the moment. But this has been a really big milestone.

    Update: It's usable!

    A little fix in memory layout here, a change in keyboard layout there and...

    ZORK on a toy computer, anyone?
    ZORK on a toy computer, anyone?

    Christmas may come! :-)

  • >RUN

    Bernhard "HotKey" Slawik11/15/2019 at 12:07 3 comments

    Yesterday night I pulled out my oscilloscope and tweaked the timings used by the software serial implementation. I noticed some bits getting lost and tracked it down to the "edge delay" used to sync up with the start bit.

    Now data transmission is much more reliable than before. Nonetheless, it is recommended to employ a protocol with checksums and re-transmit to ensure binary proof data transmission.

    So, what should we do with it?

    Maybe... allow the CP/M BDOS to load files via serial from a computer?

    >python bdos_companion.py /dev/ttyUSB0 ZORK1.COM
    Ready.

    ...and then on the Genius Leader 4000: 

    32K VGL CP/M 0.0.4
    2019-11-14 by HotKey
    
    >SERIALLOAD
    LOADING...
    OK
    
    >RUN
    
    ZORK1 on VGL CP/M
    ZORK starts up! I think we need to implement proper virtual disk access next!

    Oooooooohhhhh!

    I think we're on-track to playing ZORK during the holidays! :-)

  • CP/M on V-Tech Genius Leader 4000: It... works!!!

    Bernhard "HotKey" Slawik11/05/2019 at 15:26 0 comments

    This is worth another project log...

    Since I got "boot from RAM" working yesterday, I eagerly started implementing the basic BIOS/BDOS functions of CP/M 2.2. No disk access, yet, but just the standard console input/output and housekeeping functions.

    Fortunately, CP/M is well documented and there aren't actually that many functions that need to be implemented for a basic system.

    So, I fixed my broken LCD DDRAM mapping and optimized the keyboard handler a little and added the most important CP/M BDOS functions.

    Then I took a small .COM file (SYSGEN), placed it into RAM and jumped to it...

    First CP/M program running on a Genius Leader 4000
    Houston, we have a code execution!

    I was greeted by the program banner! It works!

    That was really unexpectedly simple! The next 1-2 weeks will be used to implement a simple file system and all the necessary open/close/read/write functions, so we all can play ZORK before the year is over! :-)

    Stay tuned!

  • CP/M on VGL: Issues and Solutions (Updated!)

    Bernhard "HotKey" Slawik11/04/2019 at 10:46 1 comment

    Most of the inner workings of the V-Tech Genius Leader / PreComputer have been discovered. Even some lesser known functionality, which is hidden inside a proprietary silicon, is understood. Especially, how the LCD, the keyboard matrix, printer port and most of bank switching works.

    Now for the philosophical question: What should we do with it?

    When talking to people, most of them agree that getting an own operating system to work is priority 1. But on which OS to focus on is not fully clear. Personally, I would prefer CP/M, since it is the Z80 operating system with the most impact and support.

    There are two problems with CP/M on this "toy hardware":

    1. CP/M requires a disk drive. The V-Tech computers don't have one. But since we do have a cartridge port and proof-of-concept memory-mapped I/O, as well as a working serial port, getting some sort of SD card reader or serial storage medium to work should not be a big problem. In the meantime we can use bank-switched ROM/PROMS/SRAM or load software from the serial port (already working!)
    2. CP/M requires RAM to start at memory address 0x0000, since this is how CP/M programs interface with the BIOS/BDOS drivers. See: http://www.primrosebank.net/computers/cpm/cpm_structure.htm

    The latter problem is a bit more tricky. See, on power-up the Z80 CPU jumps to address 0x0000 and starts executing the instructions located there. That's why there is a big system ROM located at that address.

    Bank switching the system ROM

    After thinking long and hard, I decided to leave the "non-invasive" route and add a little hardware modification to my beloved Genius Leader 4000 Quadro. I opened it up and put wires to the "Chip Select" lines of the ROM, the RAM and the cartridge port. Fortunately, these 3 lines are conveniently located on one corner of the PCB (near the cartridge port) and each go through a wire bridge. It is really simple to cut these bridges and add some wires, so they can be connected/disconnected at will:

    V-Tech hardware mod
    "Chip Select break out" connector (upper right) allows disconnecting the internal ROM at will. A simple "Bus Doubler" (bottom) allows inserting two cartridges at once. You'll see why.

    On its own, this is not a very helpful mod :)

    But now you can insert a ROM cartridge and use a different "Chip Select" pin (the new "internal ROM ~CS" instead of the default "cartridge ~CS" on Pin 35). A slight modification in your code (segment now needs to be 0x0000 instead of 0x8000) and your external ROM cartridge can now act as the internal system ROM! That means: Now we have a full 32kB of additional address space without de-soldering the internal ROM!

    But be aware that the internal system ROM also contains crucial hardware initialization functions which now need to be done in our own ROM. This includes the LCD initialization sequence, resetting all the MUXes and bank switchers and -most importantly- reacting to interrupts and polling the keyboard matrix.

    My current implementation works fine in the MAME gl4000 emulator, but still has some issues with the LCD (one line is not showing - using a non-standard DDRAM mapping) and the keyboard is not working reliably. This still needs some more research to get right. But enough to continue with some more experiments...

    Booting from RAM

    But now for the really tricky part: As I said, CP/M needs RAM to be at 0x0000. But since RAM is -usually- volatile, we can not simply solder in a SRAM IC and call it a day. It won't boot, since it is empty.

    My current idea is to use the battery backed SRAM cartridge VTech Super Speicher 32KB for that. It contains a 32 kilobyte SRAM IC, as well as a coin cell battery and a few transistors (to invert signals and switch from internal to external power).

    It should be possible to boot from a custom system ROM (mapped to 0x0000) while having the SRAM connected to the cartridge slot (mapped to 0x8000). Then, prepare/bootstrap the RAM contents to contain the initial jump instructions....

    Read more »

  • A Strong Community!

    Bernhard "HotKey" Slawik11/04/2019 at 09:58 1 comment

    Wow! Since hackaday published an article about this project ( https://hackaday.com/2019/10/14/repurposing-a-toy-computer-from-the-1990s/ ), messages come pouring in from all over the world! And it fills me with joy, how many people like this project and have even already done amazing research in the same direction.

    Worth mentioning is the work done by @Alex Rider about the french "YENO Compusavant". which seems similar to the "Genius Leader 6000 SL".  Check out his website for more info: http://alexandre.botzung.fr/

    I think I will be setting up a Github repository to merge all findings in an "(Unofficial) V-Tech 8-Bit DevKit".

    So: Stay tuned and stay curious!

    Bernhard

View all 15 project logs

Enjoy this project?

Share

Discussions

Val Polyakh wrote 02/20/2021 at 06:36 point

I've just got a PreComputer Prestige (in addition to my PreComputer 1000)

Wanted to do a proper teardown but it's "child-proofed" by gluing many components to the case so I couldn't even see what's on the board. Do you have any information on CPU/RAM/ROM parameters for PreComputer Prestige
It looks like it's significantly more advanced than 1000 (graphical display, voice support, many applications, more advanced BASIC, printer port), I wonder what hardware they used and how to make a "jailbreak" cartridge that would allow to use it as a more general purpose computer with access to memory, etc.

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 03/03/2021 at 17:01 point

Hi Val! The Prestige looks like a "Genius Leader 6000SL" for which I actually do have support for in the VGL! No sound, yet, but the LCD works!
See: https://github.com/hotkeymuc/vgldk/tree/master/include/arch/gl6000sl

  Are you sure? yes | no

nemoskull wrote 07/11/2020 at 08:21 point

working on a precomputer 1000. link to what i got. working on a hardware schematic first.

https://www.reddit.com/r/Z80/comments/hnbrux/precomputer_1000_reverse_engineering/

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 09/08/2020 at 19:12 point

Nice work! Have a look at my thingiverse and the "BusFicker" KiCad-Project. The PinOut of the PreComputer 1000 and GL 2000 are pretty similar. But I am still not 100% sure about the outer most pins, as they seem to do completely different things between the models, although some cartridges work on all of them... Quite weird...
Have you found a Pin that corresponds to the Z80 "port access" pin? (My guess is that they mask it with their custom PCB somehow)

  Are you sure? yes | no

pulppure wrote 11/23/2019 at 10:00 point

Would something in the idea of the chipwhisperer be of any help to understand the innards of our little machines ? It is pretty expensive for our aims, so maybe we could build something cheap with arduino or raspi... https://hackaday.io/project/956-chipwhisperer-security-research Also I will try to see what peek and poke commands do in the basic. (edit : they are not available :( )

  Are you sure? yes | no

Evan Allen wrote 11/25/2019 at 15:44 point

I'm working on restoring peek and poke commands to the roms, if you can get your french rom out and dump it that would be the easy way, but I think I can manage a cartridge that you can plug in and it will either dump the internal rom to a serial port or dump it to an SD card.  

  Are you sure? yes | no

pulppure wrote 11/23/2019 at 09:41 point

Hello, yesterday I dug out my french Vtech Genius 4000. I bought it at french salvation army back in 2011 for two euros while picking up some toys for a circuit bending workshop. Later decided that it would not bend properly and was put into storage after the workshop, First, I managed to make it run from nimh batteries, but found some activity buttons did not respond. So I opened it and had a look at the motherboard. I found some insulating cardboard which might be albestos (pretty sad for a kid toys, but if you don't tear it, it doesn't release that much particules) between the battery holder and the MB, so I will replace that, there are also some underneath. There is a little battery leakage, that hopefully did not touch the MB, and I will have to resolder the corroded battery holder. After taking it apart, I did not find the z80 inside, just a Winbond 8ko memory, a Vtech chip, and a bulb chip stuck onto a larger chip like pcb soldered in the middle of  the MB (maybe the z80). Everything is neatly stuck with hot glue the old chinese way, so it's not easy to take pictures (maybe later). Anyway it looks a lot like yours. After putting all back together it no longer powered from batteries, so I dug out a wallwart. Then it still refused to power on, so I had to add some pencil graphite to the traces of the keyboard activity menbrane, that has the power on button. Then it worked, and I also recovered the missing activity buttons on the way. I've tried some basic programming. I've found that it's not compatible with some of the examples I've found on basic learning websites. Anyways I'm amazed at all the progress you've made so far. I'm not much of a hardware tinkerer myself, but I will look forward to try a cartridge, and I will soon provide pictures of  my model's MB.

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 10/22/2019 at 15:09 point

@Evan Allen CollapseOS looks EXACTLY like the thing we were looking for! It seems we can save A LOT of work by "just" trying to get CollapseOS to work on the GL! Thank you for the hint! The community already paid off! :-D

  Are you sure? yes | no

Evan Allen wrote 10/23/2019 at 02:47 point

I wonder about having a section of memory that's re-writable and bootable, it would be in the spirit of Collapse OS to have it assemble the operating system and then just boot that.  Maybe a flash rom that doesn't need funky programming voltages.  

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 10/28/2019 at 19:16 point

Yes, that would be great. Wither using FRAM or by somehow setting the Z80's "WAIT" / "MEMREQ" / "BUSREQ" pins to slow it down far enough that an Arduino can inject the boot code....? Hmmmm.... Help is greatly appreciated!

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 10/22/2019 at 14:53 point

@Evan Allen yes, the missing DIP20 is a "DM 74LS244N". @olsen also wanted to give the retro-fit a try! FYI: The port is not a fully working parallel port. It only offers 8-bit output and 1-bit input. Enough for printing and for a "bit banged" serial connection (which I have successfully working at 9600 baud)

  Are you sure? yes | no

Evan Allen wrote 10/23/2019 at 02:40 point

when I'm back from my business trip I'll want to know values of passives I'm missing.  Here's my board's top side, can you help me fill in the blanks? https://imgur.com/a/Smgf1ar

I'm planning on modifying the power section so I can switch between alkaline batteries and NiMHs and the barrel jack on the back either switching over power or charging the rechargables, also making sure the rom is in MAME

  Are you sure? yes | no

Bernhard "HotKey" Slawik wrote 10/28/2019 at 19:17 point

Thanx for the photo! I have created a "project log" containing a list of the missing components. I hope I haven't forgotten any - let me know if so!

  Are you sure? yes | no

Evan Allen wrote 10/20/2019 at 15:22 point

is the dip20 a 74ls244? My american equivalent is missing that, the parallel port, and some passives/transistors in that circuit and I want to restore the functionality

  Are you sure? yes | no

Evan Allen wrote 10/16/2019 at 15:34 point

I have a precomputer power pad on the way, I think it's the same model you're working with, just available in the United States.  I want to see this thing run CollapseOS

  Are you sure? yes | no

Tom Nardi wrote 08/05/2019 at 02:07 point

Very interesting project. I had several computers like this when I was young, though none nice enough to have the mouse or printer (not for lack of me asking every Christmas, though). Never even occurred to me that they could potentially be put to use.

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates