Hacking The Tiger(R) Quiz Wiz(TM)

Overview & Basic Operation

Tiger's Quiz Wiz (not to be misspelled Quiz Whiz or confused with Coleco Quiz Wiz) is an electronic quiz game. You type in a number of the question you want to answer, type an answer, and press Enter. You are then told if you are correct. I thought it would be a fun project to find out how Quiz Wiz and it's carts work, possibily leading to an emulator. Quiz Wiz's front panel looks like this:

+---------------------------------------------+
| SOUND OFF                                   |
| (****   )         Tiger            (speaker)|
|                 Quiz Wiz                    |
|           Electronic Question & Answer Game |
|                                             |
|  YES      9  8  7       Start []            |
| (led)     6  5  4       Enter |>        A B |
|           3  2  1       Clear o         C D |
| (led)        0                              |
|   NO                                        |
+---------------------------------------------+

The new Quiz Wiz's are grayish, but mine is black (1993).

0-9: These keys allow you to enter the question number. The number is appened to what I call "Q", a variable in memory storing the question number.BCD?
A-D: These keys select an answer, and store it in variable A. By default, A contains the answer "A", stored as 0.
Enter: Checks if answers[Q] == A, if so, lights up green yes LED, else red no LED. See later sections for info on how the answer is stored. Note that A and Q are not cleared here, but after pressing Enter, 0-9 will overwrite the Q variable.
Clear: Clears Q and A?

Answer Storage: "Books"

The answer books that come with Quiz Wiz are the only stored form of the question. That is, Quiz Wiz only identifies questions only by number, and has another number, 0-4 (00₂-11₂), associated somehow with that question number.

It is not entirely clear how answers are stored. If you ever wondered why the answer books are so light, it's because they don't really contain any electronic components at all except wires connecting various lines.

Books interface to the Quiz Wiz by a 10-wire (labelled 0-9) single-sided slot. Books have the slot, the unit has a female connection. If you want to make your own book, you'll need a 10-wire male slot connector, like those found on old 5.25" floppy drives (may require trimming). Or you can make your own on a Printed Circuit Board, using an etching kit such as Radio Shack's PC Board Kit, Cat.# 276-1576, like I did. Note that Quiz Wiz's port requires PCB thinkness to be about 0.06"; sand down the board if it doesn't fit. An all-purpose breadboard is useful for making connections, but if you use one remember to use non-stranded wire (or else coat the stranded wire with a thin layer of solder).

The exact meaning of the connections are unknown, but it is thought that they are input to some sort of predictable pseudo-random-number- generator, because the books contain no memory. It all must reside in the unit itself, and Tiger probably devised a way to generate 1001 seemingly-random answers by a simple seed.

As stated above, the wires of a Quiz Wiz book slot are numbered 0-9, zero being to the left when the unit is upside-down. I'll further label these wires as follows:

0 white
1 brown
2 red
3 orange
4 yellow
5 pink
6 blue
7 magenta
8 gray
9 offwhite

Those are the colors I used on my PCB.

After a few minutes of testing connections, I was able to find out the book port pinout:

 0  1  2  3  4  5  6  7  8  9  wire number
G0 G1 G2 K3 K7 K4 K9 K5 K2 K1  wire name

G0 should be on the left when the unit is upside-down. The "G" wires are groups. The "K" wires correspond to keys. Key wires should be connected to at least one group wire, or else they will not function. The best way to find out if a key is not functioning is turn on the sound and see if depressing a key makes any noise. Note that there is no key wire for 0, 6, and 8, because they function by default.

3456789 wire number
3749521 key wire #

G0 - white
G1 - brown
G2 - red
K0
K1 - offwhite
K2 - gray
K3 - orange
K4 - pink
K5 - magenta
K6
K7 - yellow
K8
K9 - blue

I'll use a square to specify which key wires are connected to which group. See below for an example.

K1 K2 K3
K4 K5 K6
K7 K8 K9

In place of the K# will be a group number, 0, 1, or 2, that the
key wire connects to.

K0, K6, and K8 do not exist and will have a dash in their place.

Here's an excerpt from a mail from Russ Perry Jr. (quoted), with comments added by me:

> So far, they all appear to follow groups of 3, 3 & 4
> for connections.
Let me elaborate on this a bit...

(edited)
Book 1
  3 connections to G0
  2 connections to G1  
  2 connections to G2

Book 4
  3 connections to G0
  2 connections to G1
  2 connections to G2

Book 14
  3 connections to G0
  2 connections to G1
  2 connections to G2

Of course, G[0-2] are wires too, so that's why they come 
in groups of 3, 3 and 4, in no particular order. I'm sure
there's some significance to this. Perhaps the group wires
can only drive at most 3 key wires. If nothing else, it'll
limit the number of carts I need to emulate..

> If that's true, and I did my math right, we're
> looking at a fair amount of combinations: 
> 10! / ((4 x 3 x 3) x 2), or 50,400.  So, the 
> 60 or so carts they did are only the
> beginning of the possibilities!
I'm not sure if that math is correct, because you have to 
remember that the seven K wires can only connect to G wires,
and there are three G wires. ... Regardless, the large amount 
of combinations rules out the possibility of the book being 
an index into some sort of ROM array. The book must be input 
to a random number generator or other algorithm - that's my 
theory.

Some Russ Perry Jr. speculation quoted, comments by me:

> >Without any book, the answers to questions
> >consisting of digits 0, 6, and 8 match those of 
> >book 1.
> 
> I wonder if maybe they don't match all books...
Questions with 0, 6, and 8 can be entered without a book, 
and they did match Book 1. I'll have to check the other books.

> >So there could be some sort of ROM in there - but a
> >ROM for every book seems impractical. Maybe there's
> >a ROM that Book 1 uses and all other books make
> >slight changes somehow.
> 
> Right.  It might just transpose the order the
> answers are given in some way.  The ROM just has 
> 1001 (or however many) answers, but the inputs start 
> in weird positions?  I'm sure the ROM is either 1K 
> or maybe some smaller number, but it could actually 
> be larger too.
Perhaps, but you can enter question numbers higher
than 1001. Maybe there's a possibility that the 
answers are tranposed, but it seems more likely that
the answers are stored by a PRNG (after all, there
is only 4 combinations).

> >Yeah, like a pseudo-RNG. With PRNGs a large
> >sequence of numbers is stored in ROM or generated 
> >with an algorithm, and the position within the 
> >sequence is selected by the seed - which in this 
> >case would be the cart configuration. Maybe the 
> >Quiz Wiz has a CPU which computes results of the 
> >zeta function or another PRNG algorithm, or there's 
> >just a dumb ROM in there.
>
> Right.  You know, I essentially misunderstood you
> last time when I brought up polynomial counters.  In 
> a sense the poly counters ACT as PRNGs.  So I was 
> suggesting the same thing you were, essentially.  
> The beauty is, it wouldn't require any ROM really, 
> it would just be built into the controller chip, 
> which I'm sure is just a gate array or something.  
> Nothing so complex as a CPU I imagine.
Exactly. I suspect Tiger did this rather than a ROM due to costs. 
They're too cheap to put a ROM in all their carts, why would they
put one in the main unit? :)

> >I opened up Quiz Wiz to check if there's a sign of 
> >any ROMs or CPUs. But thanks to modern technology, 
> >the IC that most wires run to is covered in a blob 
> >of epoxy.
> And it's pretty small too, right?  Probably just a
> gate array doing all the "system logic" and the PRNG.
Could be. Whatever it is, Tiger doesn't want us to  
know what it does. Or maybe they don't care anymore 
since it's an old device? I'll see if I contact them.

> >Gone are the days when devices used 7400 or 4000 DIP
> >ICs... I still have an 8088 motherboard which is
> >filled with them. Those where the days for
> >reverse-engineering. But I disgress.
> Yeah, but if you understand what those chips are 
> doing, you could build your own gate array "CPU".  
> You just can't disassemble what Tiger's doing so 
> easily.
If the algorithm was cracked, I could implement it 
hardware but in my opinion software would be a better
choice.

> >With today's technology, the chance of finding out 
> >how Quiz Wiz works is probably very slim unless 
> >there's a huge breakthough.
> Well, you might be able to figure it out by just 
> tracking signals are going in and coming out, but 
> yeah, it's a long shot.
I do in fact have an oscilliscope, but I doubt I'll
find anything useful.

Russ Perry Jr.'s brother on permutations and possible amount of cart configurations:

Here's what my brother had to say about the permutation situation:

---

If I'm reading the rules right on this, you must have three digits of 
one number, two of the second, and two of the third.  (There are 
necessarily three appearances of one of the three, or at most you get a 
6-digit number, but three is the maximum ... etc.)

If that's the case.  First assume you're rearranging 0 0 0 1 1 2 2.  
You can arrange them in 7! different ways, but you must divide by 2! = 2 
because the two 1's are indistinguishable, so you've overcounted 
sequences by a factor of 2 -- and divide by 2! because of the 2's, and then 
by 3! = 6 because the 0's are indistinguishable.  So you have 
7!/(3!2!2!) = 210 possibilities.  This remains true if it's three 1's or if it's 
three 2's, and so the total number of possibilities given your rules 
are 3 * 210 = 630 such seven-digit numbers.

Book 1: General Knowledge

The standard book that comes with Quiz Wiz.

Schematic:

+-----+---------+-+
|     |         | |     00-15510-200 EWIG 
| +---|-+-----+ | |          7-221
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

These wires are connected together:

0, 3, 8, 9 = G0, K3, K2, K1
1, 4, 7 = G1, K7, K5
2, 5, 6 = G2, K4, K9

Which means it's key-group connection square is:

0 0 0     3 connections to G0
2 1 -     2 connections to G1
1 - 2     2 connections to G2
00021-1-2

 0*3^0 = 0
 0*3^1 = 0
 0*3^2 = 0
 1*3^3 = 27
 1*3^4 = 81
 2*3^5 = 486
+2*3^6 = 1458
-------------
         2052

Keys 1-3 belong to group 0, 4-6 excluding 6 belong to 1, and 7-9 excluding 8 belong to 2. Dashes exist in spaces 6 and 8 because they have no key wires.

Some answers:

              
Q: 0123456789
00 ACDCBDBCAB
10 BABDDBDCDB
20 ABCAABBACA
30 BABDCCADBD
40 DBABDACBDC
50 ADDAACACAC
60 DBABCDBDBA
70 BCDDBBDDBC
80 AABCDACCAD
90 CBBDCCAACB
Q: 0123456789

Ewig Ind Co Ltd (here too) is a HongKong-based company, but that's all I could find out about them. "Ewig" appears to be German for "eternally". Also, according to irasia.com, Ewig was acquired by Unidux (in Malaysia, Singapore, Australia). But this is all I could find out about their products.

Book 4: Great Sports Legends

Thanks to Russ Perry Jr. for providing this schematic.

+---------+---+
|         |   |
| +---+---|---|-+-+
| |   |   |   | | |
| | +-|-+-|-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 5, 7    = G0, K4, K5
1, 3, 8, 9 = G1, K3, K2, K1
2, 4, 6    = G2, K7, K9

1 1 1    3 connections to G0 
0 0 -    2 connections to G1
2 - 2    2 connections to G2
11100-2-2

 1*3^0 = 1
 1*3^1 = 3
 1*3^2 = 9
 0*3^3 = 0
 0*3^4 = 0
 2*3^5 = 486
+2*3^6 = 1458
-------------
         1957

Book 5: Ripley's Believe It Or Not

Thanks again to Russ Perry Jr. for this and all the remaining schematic.

+-------+---+
|       |   |
| +-----|-+-|-+---+
| |     | | | |   |
| | +-+-|-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 4, 6    = G0, K7, K9
1, 5, 7, 9 = G1, K4, K5, K1
2, 3, 8    = G2, K3, K2

1 2 2    2 connections to G0
1 1 -    3 connections to G1
0 - 0    2 connections go G2
12211-0-0

 1*3^0 = 1
 2*3^1 = 6
 2*3^3 = 54
 1*3^4 = 81
 0*3^5 = 0
+0*3^6 = 0
-----------
         142

Book 9: Football Facts

+-----+-------+
|     |       | 
| +---|-+-----|-+-+
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
0 1 2 3 7 4 9 5 2 1
G G G K K K K K K K

G0, K3, K5
G1, K7, K8, K9
G2, K4, K9

- - 0
2 0 -
1 1 1

Book 10: ???

+-----+-----+
|     |     | 
| +---|-+---|---+-+
| |   | |   |   | |
| | +-|-|-+-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K6
G1, K4, K8, K9
G2, K5, K7

- - 0
1 2 0
2 1 1

Book 14: Computers & Games

+---------+-+-----+
|         | |     | 
|   +---+-|-|---+ |
|   |   | | |   | |
| +-|-+-|-|-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 5, 6, 9 = G0, K4, K9, K1
1, 3, 7    = G1, K3, K5
2, 4, 8    = G2, K7, K2

0 2 1
0 1 -
2 - 0
02101-2-0


 0*3^0 = 0
 2*3^1 = 6
 1*3^2 = 9
 0*3^3 = 27
 1*3^4 = 81
 2*3^5 = 486
+0*3^6 = 0
------------
         609

Book 26: ???

+-----+---------+
|     |         | 
| +---|-+-----+-|-+
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K2
G1, K7, K5, K1
G2, K4, K9

1 0 0
2 1 -
1 - 2

Book 29: Pro Basketball Hoopla

+-----+---------+
|     |         | 
| +---|---+-+---|-+
| |   |   | |   | |
| | +-|-+-----+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K2
G1, K4, K9, K1
G2, K7, K5

1 0 0
1 2 -
2 - 9

Book 37

+---------+-+
|         | | 
| +-----+-|-|-+---+
| |     | | | |   |
| | +-+-|-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1

G0, K4, K9
G1, K7, K5, K1
G2, K3, K2

1 2 2
0 1 -
1 - 0