Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I tend to agree with simzy on this one.

My impression has always been that MAME tends to go out of its way to preserve hardware bugs. I would argue that given the LCD/VFD being such a critical component of these games - they're not like arcade machines where you can hook them up to any monitor - accurately preserving printing errors and the like is important.

With part of the value of MAME being in its dispassionate documentation of history, a manufacturing defect is practically the textbook definition of the sort of thing that it should preserve. Games didn't exist in a vacuum, poor manufacturing tolerances or standards is an important thing not to varnish over.

If these printing/manufacturing defects are so relatively few and far between, how much additional workload would it be to provide a "fixed" set of artwork as a separate artwork file, while keeping the SVG within the ROMset itself as accurate as possible to the source material?

There's always going to be some level of variation, as the SVG is being done by a human manually tracing over photos, and this is exacerbated when it comes to VFD games due to the grating that sits between the segments and the camera. But in my belief, things like asymmetry, or visually bridged segments, should be the presentation given to users so as to preserve an accurate first impression of a title.

Correct... clones will always use the parent set if available. For Judge, we would just need a second view with a purple case, instead of the green one.

Side note to that... recent update to MAME that Vas added... if there is an artwork set for a clone name, it will ignore the parent artwork set, and only use the artwork view(s) in the clone artwork. (See invaddlx for current example of this... all other clones of Space Invaders will use all views in the parent set; invaddlx will only use views in the invaddlx set).

Ok, good. I updated the artwork to have both the Purple (default) and Green views.

Below stuff will be on its way to Sean, as soon as Skate or Die arrives here.

• The one with no label is TMNT 2
• The yellow is JPN version of Bottom of the Ninth

Little bummed, as I had also won a bid for Antarctic Adventure, then seller said it wasn't working, then pulled it, and couldn't get a hold of him again.

Anyway... putting this here, just to make sure no one accidentally double-dips.

Has anybody tried to apply TEMPEST sidechannel attacks on those chips?

https://en.wikipedia.org/wiki/TEMPEST

It may be easiest to do for such simple 4-bit stuff to decipher the HF radiation from antennas (e.g. wires taped on top of the chip package) in several directions to conclude internal ROM data being accessed. A digital 4 channel oscilloscope may be sufficient to sample the signals. You will likely need to place the device under test inside a faraday box to eliminate external RF interferences. On eBay you can buy Chinese shielding adhesive tape woven from very fine metal fabric and (unlike property store aluminium tape) fully conductive glue side. The stuff is great; glue it e.g. on window sealing foam rubber strip to make an elastic HF seal. (I shielded e.g. the PC case doors of my Colani bigtower with it.) Only be very careful to properly cut (never tear!) this tape, else it can spill tiny conductive wire lints everywhere, those are hell stuff even nastier than zinc whiskers in data centers.

I experimented in my youth with radios and wires scotchtaped on top of chips to produce strange sounds (kind of circuit bending) but had no hardware to decrypt what is actually going on inside. When demodulated by signals from the clock quartz it may be possible to leak the bits being read out of the rom. Another known sidechannel method is to put a resistor in the power supply line to the chip and observe voltage spikes by varying power consumption. But it is likely hard to distinguish the individual bits on a parallel bus read from the rom.

I have >100 old LCD games (from fleamarkets when they were still 2EUR each) and particularly tons of that dread McDonalds HappyMeal obsolescence trash (usually bought for each 20ct or such - many are doublets with torn paper label waiting for experiments). At least I gutted out their unremovable button cell, which else for sure would corrode itself through the COB or LCD over time.

Just tracing out the silicon die and finding out if there's an undocumented test mode is a lot more straightforward than your MKUltra-addled ramblings.

I collect and have repaired many Sharp talking clocks, (rebranded) watches and calculators. The CT-660 exists in a German (CT-660G), an English (CT-660) and a Japanese language version. Strange is that on eBay the German version is much more common than the English one, while I never saw the Japanese model at all (see youtube example, front is labelled "ELSI QUARTZ" instead of "TALKING TIME"), so it may have been a prototype. I love the way the alarm starts with a 5-note jingle, then announces the time and then plays a longer squarewave melody ending with a trill (a bit like a ringtone). When waiting 5 minutes, it repeats the alarm and says "please hurry" or something like that (German version "Bitte beeilen!"). The German version rolls the "R" in a funny way and so e.g. pronounces 11 as "Errlf" instead of "Elf".

Talking Clock CT-660, 1979 from SHARP (rare Japanese version)


The Sharp CT-660 was the world first digital talking alarm clock and initially very expensive (200 US$ or such). It has a volume knob and some models have a little silicone rubber plug at the left case site. When poked out (be careful - the material rips easily apart) it reveals 2 pins wired parallel to the speech button (keyboard matrix), so it could be installed in contraptions to automatically announce time or act as a stop clock, or connect a bigger button for impaired people. (The yellow one on top is IMO too small for an alarm clock, and only switches to slumber instead of proper "alarm off", so it keeps repeating until using the slide switch in the lid at case bottom.)

The Sharp CT-665 has simpler functions (no stopwatch etc.), different melody (very shortened "Sah ein Kab ein Röslein stehn", less nicely made) and operation is optimized for the blind (i.e. different sounds guide through clock set modes instead of all those slide switches). The 1980th "Vox Clock 2" contains the same hardware without LCD and has a lovely male robot voice, which despite graininess is well understandable. It only has a little speech glitch that pronounces 12 as something like "thrown" or "throne" instead of "twelve" (like when the wavetable algorithm fails to say "two" and "one" at the same time). The 1990th "Vox Clock 2" has an additional LCD but uses a sample based chip with English female voice and only 4 beeps instead of melody.

The CT-660 hardware is quite complex, containing a clock CPU (32KHz) on the front PCB, a separate speech CPU (4.1MHz), a DAC (or sound?) chip and audio amplifier. Most of the PCB is occupied by a quite big discrete stepup converter to increase the 3V battery voltage (2x AA cells) to about 5.5V(?) for louder speech output.

I later bought a broken specimen that instead of the external DAC chip has a hybrid resistor ladder DAC with thinner sounding voice. (Only the LCD worked no speech and some buttons failed because traces were corroded by battery and someone drowned it in oil - yuck!)

The Sharp EL-640 talking calculator even has 2 speech CPUs (or an additional ROM?) because it speaks more words (for clock and calculator) and runs on 4 AA cells. The simpler EL-620 (no clock) is slimmer and so depends on 2 unusual thick button cells.

Sharp voice synthesizer things use a grainy but nice sounding kind of wavetable speech hardware. Like Speak&Spell, when shitshot by power glitch (battery wiggling) they make plenty of freakish noises. E.g. the chip can playback speech at half speed or interprete the same data either as speech or musical notes (squarewave with linear decay envelope varying with note length). Even the EL-620 does this despite it has no melody.

- Sharp talking clock/calculator repair

Sharp voice synthesizer things like CT-660 have a particular design flaw that often makes them fail. When the reset capacitor (100nF ceramic, located to the left on the front PCB) turns slightly conductive over time (still >20 megohm). Because the internal pullup resistor of the clock CPU is way too weak (likely designed to minimize power consumption for button cell operation) it hence stays stuck in reset with some pale random LCD segments visible. To repair this, replace the capacitor. The bug reappeared 2 times in the clock I regularly use, so it may be more effective to install an external pullup/pulldown resistor to make the reset pin less sensitive. One screw gets visible by unhinging the button compartment door. Do not peel off the top sheetmetal; there is no screw. The whole case top can be carefully pryed upward with screws removed. Be careful not to confuse screws of wrong length; I broke the volume pot end switch by this. (The switch is not needed but only slightly reduces battery waste when speaking with volume set to zero.)

A similar reset bug exists in the 1980th "Vox Clock 2", where it is a ceramic SMD capacitor somewhere on the right half of the PCB. Mine kept failing during humid season (made a pop noise instead of speaking) but worked well when dry. Resoldering that cap (which heat recrystalizes the ceramics) was sufficient to fix this (if I remember well), but the PCB design is such excessively moisture sensitive that even exhaling on it makes it fail for several minutes until the breathe moisture evaporates. Currently my Sharp EL-640 talking calculator has the same bug (pop instead of speech).

Talking watches with Sharp speech chips (e.g. by Trafalgar, Omni VoiceMaster, Micronta VoxWatch, MeisterAnker) use similar technology with smaller COB chips. Loose solder joints at SMD parts and broken PCB traces are typical issues Instead of lithium they unfortunately use strange thick alkaline button cells those are prone to leak forgotten inside.


Despite many talking clock brands, only few speech engines exist. In 1980th beside Sharp only Seiko made their own speech synth chips. Seiko (WristTalk A964, A965, A966) watches use grainy lofi male samples and have a big COB containing 3 silicon dies, which has user selectable English and one other language. The Seiko world time clocks (World Time Voice Alarm DA716K) speaks English and seems to use grainy female wavetable voice. The pyramid alarm clocks (PyramidTalk) use a very different chip for each language and have female voice. English and Japan version have calendar with date and day display (LCD layouts differ). The German issue has none and the user interface differs (hold up/down buttons to set time). 1990th Seiko watches have a higher resolution female sample voice.

Most other 1990th talking watches and alarm clocks use Holtek COB chips, those are sample based and can be recognized by the rooster (cockadoodledoo) alarm (often also cuckoo and some others) and typically female sample voice.

Also Casio made very few talking alarm clocks and calculators using own SMD speech chips (grainy wavetable like Sharp, but female voice).

- speech rom dumping?

It is unknown if these roms can be read without destruction. The Sharp clocks use a strange chip package that looks like a square COB bonded on a thin rectangular plastic sheet with many small SMD pins at all sides sealed under black resin/paint. The bits send to the DAC and serial communication with clock CPU certainly can be recorded. If I remember well, in EL-640 calculator the 2 SMD speech chips have accessible pins.

I experimented a lot with the Casio TA-1000 speech CPU "Hitachi HD61912 C02, 3M13" (60 pin SMD) which communicates with a main CPU that is likely a "NEC D1864G" variant (64 pin SMD) like in Casio ML-81, ML-90 and such. I desoldered various pins and examined the behaviour. I also found test pins in Casio calculators and VL-Tone, those display strange counting numbers on LCD and output data (rom contents?) on keyboard matrix pins.

Watches generally use COB chips, so nondestructive dump will likely need TEMPEST technology unless LCD pins are used by test mode.

Hey tinfoilhat, TEMPEST methodology is common knowlege to people those cracked pay-tv cards and such things. It is a (although complicated to use) standard technology to decode EM signals from data bearing systems.

Here in Germany in 1980th the Deutsche Bundespost (national telecom and mail organisation) used vans with directional antennas to locate non-paying TV users by picking up signals of CRT TV sets. This may be also the reason why the wifi transmitter in modern smart TVs keeps transmitting pulses when wifi is disabled in the user menu, to make it possible to still identify non-paying viewers in some countries.

https://de.wikipedia.org/wiki/Funkmesswagen_(Fernmeldewesen)

And these things have absolutely nothing to do with MkUltra - except that active scans involving strong directional radar microwaves (intended to scan foreign computers, not their user) can have the unintended side effect of brain damage.

https://en.wikipedia.org/wiki/Havana_syndrome

This risk is nothing obscure but very well officially documented, so the USA even made the "HAVANA Act" to compensate neurological damage of diplomats as a special job hazard.

What JD was asking is that you stop your conspiracy theory postings here.

the exact article you link to as "proof" literally states that this was never possible nor intended. so please stop with that conspiracy crap

As someone who has successfully carried out TEMPEST-style attacks against various kinds of devices and transmission lines for fun and profit, right up to reproducing the image from an LCD monitor in a different room, you have no clue what you’re talking about. For reasons that would take too long to explain here if you don’t already understand, it’s not going to let you read the ROM out of a microcontroller.

TV detector vans actually did exist, at least in the UK, although I don’t know whether they were used in Germany. CRTs radiate a lot of electromagnetic energy, and older CRTs produced detectable amounts of X-ray radiation as well (the electron beam(s) striking the anode have high enough energy to produce X-rays, but newer CRTs use materials that provide better shielding). Big active matrix LCDs actually radiate even more energy than CRTs – the transparent conductive grid used to drive the pixels acts like a big radiating antenna, and there’s usually nothing in front of it providing significant attenuation. Surreptitiously recreating the image displayed on a monitor by detecting the electromagnetic emissions is generally referred to as Van Eck phreaking, after Wim van Eck, who demonstrated it in the mid ’80s.

Radar detector detectors are real as well, and work by detecting electromagnetic emissions from the RF downconverters in the radar detectors. Newer radar detectors have far lower emissions, so they’re a lot harder to detect than the older ones were.