foone Profile picture
13 Jan, 64 tweets, 18 min read
fun fact: for a brief period in the early 2000s, Microsoft tried to increase the number of users who would register their software by employing hypnosis
This is actually the registration card that came with this odd piece of microsoft hardware. It's a set-top box from 2001 which displays JPEGs on your TV, off floppy disks.
I guess the idea is that it let you use a big living room TV to look at photos, instead of a small PC CRT?
You can tell from the remote that they're aiming at the "not very tech savvy" market. It has five buttons!
So here's the device. It's a weird size. It's like they almost wanted it to be portable? but at the same time it's still too big for that.
2001, so you don't get HDMI. It's just RCA (composite) video.
It's also got a video-in port, but it's just a pass thru. While the device is off, it passes through the video coming in, so it doesn't stop you from leaving it hooked up while you have a VCR of game console connected
It comes with two floppies. One is a Quick Tour disk, and the other appears to be blank? possibly it was just printed on thermal paper and has faded over the last 20 years.
So if you turn it on, it quickly gives you this message. STICK IN A FLOPPY ALREADY
And there we go, the tour disk!
There's 15 pictures on here about using the Microsoft TV Photo Viewer, but they're gonna look shit if I keep taking pictures of my tiny LCD.
Lemme see if I can just load up the JPEGs from the floppy disk.
yep! it seems it has 15 JPEGs, then some additional files which are used for viewing the images in a web browser?
and the HTML still works, thankfully. It's JS-heavy so that's not always a given.
But here's a picture straight off the disk. It's 640x480... I suspect that's the native resolution of the device.
It's aiming at an analog NTSC TV, so that's a perfectly fine resolution
Gonna dump all the pictures. Here's 2-5
6-9. I like the suggestion to use it as a "screensaver" for you TV.
Hey, Microsoft, you know what people used as screensavers for their CRT TVs? ACTUAL TV, or they just TURNED IT OFF
10-13. They suggest you use the included software to organize "up to 40 pictures" (is that a hard limit?) but I don't think it's required. I think this can just play any disk with pictures on it. I'll test shortly!
14 and 15.
That bottom text is completely unreadable on my LCD, btw.
So, interestingly, the device seems to only show you images 01-15.jpg
The GIFs and the THUMBS.JPG? they don't appear. So it apparently has some way to limit which images it views. Probably inside index.bin?
yeah, index.bin is very small and seems to just list all the files it shows
The side of the box specifically mentions Sony Mavicas, so I assume it can display any JPEGs on a disk.
It says it supports "JPG, JPEG, BMP, GIF, and TIF" formats.
(both JPG and JPEG, eh?)
so the blank disk is... blank.
what a surprise.
So I tried using it with a random JPEG... it failed.
Either the filename was too long or the resolution was too high (1280x960)
So I copied over a file with a 640x480 resolution and a very long filename.
DONK. failed again.
renamed it to 01.jpg, and... DONK AGAIN
I randomly found when I first opened this thing up, but didn't test it then:
ok I copied over a video screenshot (of @TechConnectify), resized to 640x480, saved at relatively low quality so that it's only 35k... and there we go! it does work!
so I'm guessing it just don't like JPEGs which require too much quality. It probably doesn't have much RAM in there.
Here's the bottom. it takes a 6v power supply, which is included. 1.5 amps.

Part number "X08-22497"
inside, to no one's surprise, is A FLOPPY DRIVE
It's a full size drive, too. not a slimline laptop drive.
The construction of the device is slightly odd. There's four screws holding the two haves of the case together, and then the floppy drive is held in with TAPE.
no screws, no bolts, not even plastic clips.
double sided tape.
Anyway, under the TAPED IN FLOPPY DRIVE we've got the motherboard, which calls itself an X01-03386-01 SN, from Microsoft, 2001.
The main CPU appears to be this, a Z8L18020VSC
So that's an 8-bit Zilog microprocessor in the Z8 series, with the Z180 core, running at up to 20mhz.
Z180 is basically the Z80 plus some extra features like an MMU, DMA controller, and interrupts built in.
and I wasn't expecting an FPGA, but here we have a Xilinx Spartan, an XC2S200. That's from the Spartan 2 series, with about 8k of ram and 200,000 gates.
I'm guessing they're using this as either a simple video generation chip or they'd decoding JPEGs with it. Maybe both.
Next to the FPGA we've got two Samsung K4S1616220-TC70 ram chips. Each one of those is 2 megabytes, so this system has 4 megabytes in total.
And we've got an Analog Devices AD9708AR, which is a DAC, as it says on it.
This converts digital RGB video to analog video, and given that it's wired directly into the FPGA I think we can confirm that they're using the FPGA as a video card.
Then we've got a Holtek HT27LC020. That's a 256-kilobyte EPROM. So this must store the software for the system.
and I don't believe this FPGA has internal configuration storage, so the microcontroller must also configure it on power-on.
And this slightly hard to photograph blurry chip is an SMSC FDC37C78 Floppy Disk Controller.

Fun fact: These are still in production, according to Microchip's website.
This little chip is an AD8052AR. It's an dual-op-amp
It's connected to the DAC, so it probably it increases the signal before it's sent out the composite.
and this blurry chip here is a TI 16C945K. It's an infrared decoder, which makes sense because it's right next to the IR receiver.
also why googling that I found this page, which did a similar teardown!…
There's also what looks like a serial output of some kind next to the Z180. I wonder if it is dumping some kind of debug info on that?
Nothing on the back. Mainly a big ground plane.
So the obvious couple things I need to do with this machine:
1. listen to that debug port and see if it's indeed spitting out debugging logs
2. desolder and dump that EPROM
possibly leading to:
3. see if I can get it to run different code?
4. replace the floppy drive with a 5.25" drive!
I should probably do #1 before #2, just in case desoldering the EPROM fries something.

and replacing it with different code is gonna be annoying. There's not really room for a socket to be added, so I'd have to solder in any replacement code.
The drive is a Mitsumi D359M3D. A very generic 3.5" drive. The is the slightly cheaper version with no 3-mode support, so you won't be able to view your PC98 JPEGs
aha. So it doesn't have a floppy disk activity light visible, and you know how they did that?
They taped over the LED.
Soldered some pins to that serial, and attached a cheapo logic analyzer.
looks like there's just one burst at power on. I'm not sure if I have the right sampling rate here, I need to turn up my resolution.
got it! it's saying "Main Loop..." after a CRLF
and before that, it says "FPGA Configured", with more newlines.
yeah, and no other messages any other times that I can see.
Lemme see if it throws and error when it fails to load an image
well that's a useless serial port.
it seems to be running at 115200 baud, btw.
onto the eprom! warming up my soldering iron for a bit of desoldering
The chip has been desolded, which revealed a SECRET MESSAGE
the EPROM dumped fine, and there's definitely some debug strings in it.
I wonder if there's some other pins I needed to short to enable debug mode?
Soldered a socket on it. It won't fit back in the case now, but at least I can hack it.
and it still works. yay.
nothing obviously interesting in the EPROM dump. Ghidra can mostly understand it, it seems.

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with foone

foone Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Foone

15 Jan
Lockpicking Floppies!
I don't know why twitter is refusing to insert a card for this one. In any case, It's the @LockPickingLwyr, and it's a floppy-drive-lock. Image
so I've been meaning to do a video or thread on these sorts of locks myself. I have several, of different designs.
Read 11 tweets
15 Jan
summon night - swordcraft story 2 encodes the letter "A" as 8260h

B is 8261h which makes some amount of sense
a is 8281 so I don't know
! is 8149 so it's not just a pointless prefixing of 81 to everything

Read 55 tweets
15 Jan
uh oh Image
yep Image
Read 6 tweets
14 Jan
I wonder if this'll still install on windows 10 Image
I didn't actually want to bork my win10 install so I'm running it on a slightly older OS Image
ahh, yeah, I remember installing Internet Explorer as a kid, it looked just like this! Image
Read 21 tweets
14 Jan
Something that I didn't realize but hurt my brain to learn:
John Norman (aka John Frederick Lange Jr.), of the Gor series of sci-fi/BDSM novels, is still alive.
He released two books (one of them a Gor book, #35), in 2019. Image
I guess with the fact that the series started in 1966 and feels like it's always a historical thing... I assumed he had to have quit writing and/or died back in like 1986.

Nope. Still alive, he's 89, and was apparently still writing as of 2 years ago.
also, my brain being what it is, I totally just googled for the book's cover image by entering "trans man of gor" which is NOT the title.
Read 14 tweets
14 Jan
gonna get in line for the vaccine because I've heard all these urban legends about tracking microchips

and I think I might be able to root it and install Doom
supposedly bill gates is involved, right?
so it's probably like a miniaturized 386 running ROM-DOS.
the doctor walks in, looks down at my charts, and sighs.
"well, the bad news is that you've got the virus. I'm sorry..."
"and the good news?"
*at doom's gate starts faintly playing from my lungs*
Read 44 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!