Sunday, November 24, 2019

VTech I.Q.Unlimited (German) - rarest cartridge in the Vtech-Universe

Nearly seven years ago, i dumped the rom of the I.Q.Unlimited laptop from VTech. (https://team-europe.blogspot.com/2012/12/vtech-iq-unlimited-german.html)

This machine was a big failure in 1999, as the price was way to high and nobody knew if it's now a kids-learning-toy or a work-machine for adults.
That said, the sales of the I.Q.Unlimited were pretty bad back then.

Today the machine has some fan's, because of the Dragonball EZ cpu inside, which is normally only used on PalmOS machines.
And that's also the reason, why the prices are currently most likely in the range of 50-100EUR for a used machine.

Now to the interesting part:
As the machine did not sale very well in the late nineties, and as no information were anywhere in the internet, i always thought that no cartridges got ever released for this machine. (beside the SAVE-Cartridge, which could get used to store some data on it).
Even in the last seven years i never did see any cartridge popping up in the auction platforms.

This all changed last week. I found and bought a complete unit which included a "learning"-cartridge for this system!
It's called "Englisch für Anfänger" (English for beginners):


After playing a little bit with the complete system and the cartridge (both working really well),  i opened it:

VTech used a LH5S4 maskrom with a non-standard TSOP48 pinout. While i know the "LH*"-maskroms already pretty good, as VTech used them in most of their toys, i basically knew, because of the LH5S4, that this is a 4mbit (512kb) maskrom. But the pinout was completely unknown and nothing i have seen so far.
I searched the net for all LH*-datasheets and after about 2 hours i found the correct pinout. I proofed all lines and while this is for a bigger maskrom, everything fitted perfectly!
This even showed that the I.Q. could take cartridges up to 32mbit as all lines go to the cartridge connector.


 Speaking about the cartridge-connector, here is the cartridge-pinout:
01|GND
02|NC
03|D10
04|D11
05|D4
06|D3
07|D12
08|D2
09|D5
10|D9
11|D13
12|D1
13|D6
14|D8
15|D14
16|D0
17|D7
18|OE
19|D15
20|A4
21|A0
22|A16
23|A1
24|A15
25|A2
26|A14
27|A3
28|A13
29|A12
30|A11
31|A10
32|A9
33|A5
34|A8
35|WE??
36|A19
37|A20
38|->JUMPER R4
39|NC
40|CE
41|A18
42|A17
43|A7
44|A6
45|VCC

Next step was to dump the maskrom. For sure, none of my programmers supported this kind of pinout (as it's really ways off, of the standard TSOP48 pinout). So i had to wire an adapter for dumping it.
While i desoldered the maskrom, i did see that the package type is about 3mm shorter as a standard TSOP48 chip, so i couldn't use a normal TSOP48-ZIF-socket to dump the maskrom, as the legs would not connect to the socket.

After another two hours of work i ended up with this:
My ArduinoMega based LH5S4 dumper! ;-)
Which is also usable for all future LH5S4 or  LH5332 maskroms in the TSOP48 package.

I dumped the complete maskrom as the 32mbit variant and got the same 512kb over and over again:
easier to read if you byteswap this:

WTF! "Entertain Trivia" does not sound like "Englisch für Anfänger" or "English for Beginners".
I hoped for something like this happening! As we already knew that VTech did put two games inside most of their cartridges! (easier/cheaper to produce one cartridge for two games and just select the first half of the rom or the second half of the rom with a soldered switch)

Looking at the second half of the dump you see this:
And this is what i was looking for!

So while i thought the I.Q.Unlimited did not have any cartridges ever released! We now have the content of two!

The dump will get forwarded to MAME and should get added in the next few days.

This was a really great challenge for at least half a day, but the story with the I.Q.Unlimited will continue...
My next step will be to create a flashcart for this device!





1 comment:

  1. Hello! Thanks for this, I have an Italian Bitmaster thing that I got a while ago and I sought to reverse engineer it. It seems to use an LH5S4ROJ, in a DIP package, and everything leads up to a blob. I also saw an 8kb SRAM, which appears to be general purpose RAM connected to the blob chip due to the system freezing when I mess with the data lines. I'm more curious about the screen circuitry as it looks quite interesting, the display is 80 pixels wide but I haven't been able to count the columns just yet.

    One more thing, maybe I can reprogram the maskrom or use another rom to achieve the same thing, and write custom software for the thing!

    ReplyDelete