Profile picture
foone @Foone
, 135 tweets, 36 min read Read on Twitter
Last night's project: Pulling apart this MDT-9100-386 terminal to get it working properly again. I bought it in supposedly working condition but it won't power on.
It's still got the radio unit on it, which I don't need (and can't use). time to pull that off.
It uses a custom connector, which is odd. I'd have expected it to be just serial or something.
It's got a surprising number of connectors on the bottom.
SCSI(!), dual serial, parallel, and what looks like a joystick port? That's got to be something else.
It's basically 3 parts, not counting the radio.
The keyboard, the PC under the keyboard, and the monitor which attaches behind it.
Under the keyboard is another metal panel. This thing was clearly designed to be STURDY with no weight limit.
The back of the CRT unit. There's a bit of what looks like light water damage all over this thing.
Although it's worse on this fan.
under the metal panel, we see the first main PCB board!
Let's pull it out.
It's designed as a sandwich: two main PCBs, with an interconnect along one side.
More water (acid?) damage.
The top of the bottom board. There's this annoying plastic spacer holding them apart: annoying because it's clearly not meant to be removed, which makes it a pain to deal with.
You can stick more RAM in here!
There's actually a 3rd little board in between the two. Dunno what this one does.
The top board is mainly IO and power stuff, the bottom one is CPU/RAM/firmware/flash. this one seems to have a bunch of motorola chips, maybe it's some part of the radio protocol?
The bottom board with that plastic spacer finally yanked out.
Some close ups. The main CPU is a 386 SX-25. Remember with 386s, SX just means "16-bit databus". So it had less performance and it also limited your total RAM to 16mb, which is not a limitation anyone ran into in reality.
An Intel chip next to the AMD chip! This is a PCMCIA controller.
A Chips and Technologies F82C450 is the graphics chip: it's a VGA controller.
C&T is now owned by Intel, btw.
Some more Intel, but in this case, they're flash chips.
Each of these Intel TE28F008SA-100 chips is a full megabyte.
This thing has no conventional hard drive, so this is what the OS is stored on.
This thing has a LOT of discrete transistors. I'm guessing they're power transistors for something?
In any case, at this point I've run out of stuff inside to look at, so I decide to put it back together and do some more testing... and manage to boot it!
Here's a video of it starting from reboot, cause the screen warms up really slowly and you'd miss most of it.
The surprising part:
This is a monochrome 25mhz 386 running windows 3.x, running software from 1998?

REALLY? I know embedded stuff is behind desktops, but wow.
In any case, you can just alt-tab over to Program Manager!
But sadly they somehow disabled the command prompt. boooo.
File manager works just fine, though.
Apparently this system marks C: write-only at boot, and makes a ramdrive on D: which it runs off of.
You can change files on the system, though. You have to hold down left-alt + shift at boot, and it puts it into an updater mode. Now you can modify D: (the ramdisk), then run SYNC to upload those changes to the flash.
It's got a standard BIOS, ish.
Sadly, no floppy controller. BOOOOOO
control panel has this Speaker option I've not seen before. You can mute the PC speaker from here.
if you try to update any files on the C: drive to get out of windows, it doesn't work
So yeah, to get it out of windows mode you have to get into flash mode (which drops you in plain DOS) and modify the autoexec.bat file.
Here I am doing that.
I pulled the keyboard back apart. the down key wasn't working very well, it was failing to register quite often.
It's a membrane keyboard. I cleaned it off a bit, it seems to have helped.
It does have PCMCIA slots but so far I've failed to get any cards to work in it.
All I've tried are CF2PCMCIA adapters, but supposedly they work just fine with it.
Maybe they're fried.
So the radio unit on the bottom is a big piece of metal, a thick enclosure with some connectors, and a little metal box. Let's investigate.
Inside that little box is... another metal box!
but this one has a bunch of adjustment points on it.
Inside that metal box is... some stuff!
some stuff above my pay grade.
And that bit with the connectors has another PCB, but with very little on it.
There's a spot for a chip but it's empty.
So I'm guessing most of the radio smarts was in that smaller box.
So, my current plan is to image the flash that's already on it. I want to pull all these files off before I go around overwriting them to do any further hackery.
Not sure how I'm going to do that, though.
CF adapters seemed to be the easiest option, but it didn't work.
I tried using a serial connection, but that didn't work, possibly just because I didn't have a good way of doing it and was using the wrong connectors and it was 4am.
so other options: different sorts of PCMCIA adapters? I could stick a network card in it... but then I can't load drivers for it.
Maybe different cables + interlnk/laplink/fastlynx?
it's also got a SCSI adapter on it. Maybe I can just hook up a SCSI hard drive and copy onto that?
It run some version of interlnk/intersvr at boot, btw. presumably that's how they would update it in the field: have some tech go out with a laptop, plug in a null modem cable, then copy over new files.
one of the pages about this thing mentions their one having some PCMCIA drivers in X:\cardsoft, but mine has no X:

batlabs.com/mdt.html
it sounds like these were customized for each police department that used them, so presumably they were in a bunch of different setups.
Also, check out @qrs's page on theirs:
trmm.net/MDT9100

They went down a completely different track than I did, which is part of what inspired me to look for one of these. They basically gutted it and figured out how to talk to the CRT & keyboard directly.
it's neat and means you can use it for all kinds of crazy stuff that this thing couldn't do back in the day, but personally I'm more interested in the idea of just using the 386 already inside it! that's a plenty capable machine for cool old DOS stuff.
so like one thing I want to do with it is play Doom.
@qrs already did that, but they did it by using it as a display panel on some moderner computer. this thing should be able to play doom natively.
So the screen is in "ok" shape. it's got one big scratch on it and some scuffles, but I'm pretty sure this is just on a plastic protective layer above the glass. I'll need to pull that off (and replace it?)
It's also got some burn-in, which I can't fix.
I also need to figure out a better way to power it. my bench power supply can do the 12v ~1.7a just fine, but the connector is way too tall.
so it won't lie flat. it's very annoying.
So it's got two dials on the side. I figured, being a monochrome display, that they'd be brightness/contrast. NOPE! the left/close one is brightness, yes, but the right/far one is actually backlight brightness, just not for the screen.
See, the buttons to the right of the display are lit, and also there's two lights under the CRT, so you can see the keyboard in the dark.
Very cute.
I need to buy a police interceptor from the 80s and mount this in it...
Also I've seen references to this thing running Windows 3.0.
Maybe some do, but not mine. Windows 3.1!
Note that it's only seeing 1.1mb of ram: the rest is the RAM drive, I guess.
Here's some pictures of these (or similar ones) in-car.
also, one very important goal for this thing:
it's a computer designed for police cars.
what else should you play on this but POLICE QUEST?
I'm at a very annoying point with this machine. I want to try dumping a lot of software on it and playing with it, but at the same time I don't want to change it too much because I want a clean image of what's on it.
One final thing I forgot to photograph: it has a little metal box that mounts on the underside, which turns out to contain a rather large battery pack.
This is the backup battery.
I assume it's so large because it doesn't just keep the CMOS clock running, it also keeps the ramdisk alive.
(but that's just a guess, I haven't tested yet)
fun fact about it from the crypto museum: Motorola sold these to various police departments as "encrypted radio", but around 1996 it was discovered that they're trivially snoopable, as they just use a bit-interleaving scheme to obscure the data.

cryptomuseum.com/crypto/motorol…
current step: jamming random PCMCIA cards into it until one works or it melts.
yeah, I don't think any of these are gonna do anything without drivers, which I can't really load right now.
and now my USB2serial device isn't working.
COMPUTERS ARE TERRIBLE
the best way to test null modem cables: put two USB2serial adapters in one computer and try talking to yourself
I was able to do this cause I'm the kind of person that owns at least 4 USB2serial adapters.

Don't tell me what kind of person that it is. it'd be unkind.
ok now the keyboard is failing.
I'm not able to type E, Z, period, left square bracket, or 0.
shit.
grave accent and 2 are also gone.
I suspect these are all on one shared pin.
also, @atomicthumbs figured out what that add-on board is. and yep, it's a radio-related board.
and ah-ha! @qrs figured out the keyboard matrix, and yep: all the keys that are not working are on the same pin.
continuity-tested the ribbon cable. it seems to be fine!
that's good, cause I couldn't really repair this shit.
but that also means there's something else wrong
yeah sure, switch to Torx for the CRT unit, that makes sense.
CONSISTENCY IS FOR LOSERS
Here's that plastic protector. It did its job, I guess. the tube looks clean.
but man is it dark.

the tube itself. clean, but the burn-in is even more obvious now.
back together, and hey! we've got working E! god knows why. presumably something was mis-seated.
and it's nice and bright now.
I saw this connector for the CRT, and I was trying to see if it's just an antenna.
NOPE! no display if you unplug it. This must be the analog video connector.
the system.ini
some special drivers here, C&T_SVGA.DRV and "nw_sound.drv", and kbdtime.scr?
nomouse.drv, is that normal?
there's no windows setup binary, so I can't change this from the GUI
So while putting it back together I adjusted where the power comes out. Now it's coming out of the slot where the radio connected, so I can put the connector sideways and it's not as unbalanced.
It's still not perfect cause the cable still needs to come out, but I figure if I stick some rubberized feet on it, it'll sit bitter.
Like these. These are probably too short, though.
yeah I don't think the serial ports work.
the closest thing I got to having them be functional is that if I tried to use lpt1 while hooked up to a serial port, it'd send one character of jibberish to the serial port.
interlnk or fastlynx, nothing. just raw redirection, nothing.
I set the baudrate and params with mode first, too.
So I looked through the BIOS setup, no serial-port related options either.
ok so I followed a guide to send some data.
and something went through.
but it's wrong, and confusing. something weird is happening here.
I made typos in setup! it's working now, I think
yeah, I can successfully send single bytes back and forth manually.
so why isn't this working with anything more fancy?
mmm, fun. laplink 3 crashes when you attempt the remote bootstrap, probably cause my PC is too fast.
ugh I am running out of desk space, I can't have TWO DOS MACHINES on this table
mmm, dosbox worked more but despite following the instructions, nothing.
@Xiatian just made me realize something that should have been obvious: this computer has an interlnk TSR running! I can't talk to it, sure, but the fact it's running may be fucking up my serial ports.
a fresh boot and a properly configured com1 and still nothing with laplink.
and same for fastlynx. ugh, I'm gonna have to dig out a real second DOS machine to try to talk to this.
yeah I'm thinking there's still something fucking with my serial ports.
"write fault error writing device com1" and com2, even with interlnk disabled.
I can write to the parallel port, though... if I can find a parallel port modem cable, I might be able to get another DOS machine and do parallel-port interlnk/intersvr.
and I've got a functioning debug, so I can create (small) programs if I need to, by simply typing them in using hex.
ugh, I may have to try the SCSI.
So here's the plan: SCSI2SD with a couple adapters, internal termination, hopefully repartitioned to a small enough size...
shit, I don't think they included fdisk. I'm gonna need a second machine to repartition this.
wait, I can tell the SCSI2SD to act like a floppy drive. floppy drives don't need partitioning.
that might be enough for me to at least confirm the SCSI works.
no luck with SCSI, either in floppy or hard drive mode.
next step: seeing if any of these cables are wired right to use as a parallel port null modem cable
nope. OK NEXT STEP: trying to write a program to copy serial stuff over with the broken serial support I have.
I'll just compile it on my main PC, then copy it over as hex codes into debug.exe
then I can use it to bootstrap bigger stuff over.
XPHPD[0GG0G,0G51G31GB'(G+(G:u'0g?(G>(GE1G@arwIV_F*=US@<1|_,5wXNg-7muTu(41m0ss1k260s@3G1g360@3G0i7t2g3A1g350@3G2E1=0C1g350@3T2M0^\1g3>0@3T=1s2g0T1g3;0@3ToN2g391g0t@3G0^F1k0s2?0@3T4
fun fact: that's a program that can read from the serial port and output to stdout, binary-clean.
from here: ftp://kermit.columbia.edu/kermit/a/tcomtxt.asm
did I make any mistakes typing it? cause it doesn't work.
WRONG
ALSO WRONG
MORE WRONGS
seems to be working! first thing I'm gonna copy is a CRC utility, so I can confirm that it (and my CRC utility) are not corrupt.
copying files at the amazing speed of 300 baud
something weird is going on here.
this 09 in the file transferred as 4 20s.
wait, 4 20s? IS MY SERIAL CABLE BLAZING IT?
wait... 09 is a tab. 20 is space.
a tab is 4 spaces?
AM I SOMEHOW SENDING FILES AS ASCII?
yeah I think it's because I'm redirecting. I need to stop doing that... but I don't have any tool I can use instead yet, and I have to copy it with the one that doesn't work!
AH-HA!
fun fact: debug refuses to write exe files
by which I mean if your filename ends with .exe, it says NO
so you have to rename it to something else first.
but it works! I finally have a working CRC program to confirm my CRC program isn't corrupt.
ugh, I can't copy laplink directly, because it's 300k in debug.txt form, and I don't have that much free space.
so I'm copying uudecode instead
I upgraded to 2400 baud but it's still slooow
9 minutes to copy 126kb
and I gotta do it again. the line endings seem to have gotten corupted in transit
well, I re-sent it. and it unencodes now
and it's the right size
but the crc doesn't match :(
I copied over a different decoder and tried sending a different sort of file, and NOPE! still corrupt.
ok maybe here's what I do. I seem to be having problems with big files:
maybe I split laplink into like 8 16k pieces, then send them all over separately and CRC them.
then I can resend chunks separately until I get a good copy.
file one SENT! and CRCed! that's 1/9th of the way
part 2: GOOD
part 3: CORRUPT!
resending.
it was corrupt again, and finally GOOD!
this is going to take a while.
copied and combined and CRC matches!
now I'm syncing to flash just in case it crashes...
sigh.

maybe it doesn't like talking to a modern computer with a usb-serial connector. maybe a real PC would work better.
I'll have to try that tomorrow.
oh hey, by using virtualbox instead of dosbox, it worked, partially.
I switched to a real com port on a real computer and naturally it Just Works.
Apparently one of the keyboard lights burnt out. A shame, I'll have to see if I can replace those.
A full transfer of the hard drive is running. I'll of course upload it when I'm done.
disk image is uploaded.
archive.org/details/Motoro…
it's 1.7mb compressed! which makes sense. at runtime the ramdisk is only like 2.5mb, since the other 1.5mb have to be used for regular ram
even though I got it archived I still gotta be careful editing this thing, because to change the flash you need to load the flash driver (in config.sys) and then run the sync utility to copy the ramdisk onto the flash.
so if you did something as simple as "DEL CONFIG.SYS" and then synced it,, it wouldn't load the driver at start up, and there'd be no way to sync it again.
at least with how it's currently configured. I suspect the battery backup will keep the ramdisk contents in memory, too. then you could make a new config.sys and then reboot, and have it apply.
right now my backup battery is
1. disconnected
2. only outputting 0.02v

so I'll have to look into replacing that. Dunno how many volts it is supposed to be when fully charged. 4.5v, maybe? @qrs, any idea?
I disassembled the "off. com" binary.
it's only 12 bytes, but really all it's doing is sending a command (0xDE) to the keyboard controller.
That's not a defined command in any docs I've seen, so it's implementation specific.
it's weird that this file is even here. normally there's no way to turn this thing off!
windows is being run in a loop so that if you try to exit it, it just re-launches itself.
you turn it off by turning off the car.
It turns out it's 6x NiCad N-cells, 1.2v each, 270mAh.

So 7.2v.
yeah let's juts cut up a battery pack that's something between 20 and 30 years old, that's a good idea and won't accidentally set you on fire or poison you.
So, next plans:
Get pcmcia cards working, or SCSI?
Then put some games on it
Maybe stick more ram in it?
Find replacement battery.
Add rubber feet so it'll sit flat.
Maybe try moving dos or win onto the cf card, so it can be upgraded to a more full version.
Finally, put in the pcmcia wifi card and make this a Twitter terminal. So I can tweet from my cop car!
Speaking of which, I should make a lighter plug adapter for this and put it in my actual car for a photo or two.
Maybe I can hook it up through my phone for some connectivity.
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to foone
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!