Hacking The Tiger(R) Quiz Wiz(TM)

Overview & Basic Operation

Tiger's Quiz Wiz (not to be misspelled Quiz Whiz or confused with Coleco Quiz Wiz) is an electronic quiz game. You type in a number of the question you want to answer, type an answer, and press Enter. You are then told if you are correct. I thought it would be a fun project to find out how Quiz Wiz and it's carts work, possibily leading to an emulator. Quiz Wiz's front panel looks like this:

+---------------------------------------------+
| SOUND OFF                                   |
| (****   )         Tiger            (speaker)|
|                 Quiz Wiz                    |
|           Electronic Question & Answer Game |
|                                             |
|  YES      9  8  7       Start []            |
| (led)     6  5  4       Enter |>        A B |
|           3  2  1       Clear o         C D |
| (led)        0                              |
|   NO                                        |
+---------------------------------------------+
Photo of Quiz Wiz unit

The new Quiz Wiz's are grayish, but mine is black (1993).

0-9
These keys allow you to enter the question number. The number is appened to what I call "Q", a variable in memory storing the question number.BCD?
A-D
These keys select an answer, and store it in variable A. By default, A contains the answer "A", stored as 0.
Enter
Checks if answers[Q] == A, if so, lights up green yes LED, else red no LED. See later sections for info on how the answer is stored. Note that A and Q are not cleared here, but after pressing Enter, 0-9 will overwrite the Q variable.
Clear
Clears Q and A?

Answer Storage: "Books"

The answer books that come with Quiz Wiz are the only stored form of the question. That is, Quiz Wiz only identifies questions only by number, and has another number, 0-4 (002-112), associated somehow with that question number.

It is not entirely clear how answers are stored. If you ever wondered why the answer books are so light, it's because they don't really contain any electronic components at all except wires connecting various lines.

Books interface to the Quiz Wiz by a 10-wire (labelled 0-9) single-sided slot. Books have the slot, the unit has a female connection. If you want to make your own book, you'll need a 10-wire male slot connector, like those found on old 5.25" floppy drives (may require trimming). Or you can make your own on a Printed Circuit Board, using an etching kit such as Radio Shack's PC Board Kit, Cat.# 276-1576, like I did. Note that Quiz Wiz's port requires PCB thinkness to be about 0.06"; sand down the board if it doesn't fit. An all-purpose breadboard is useful for making connections, but if you use one remember to use non-stranded wire (or else coat the stranded wire with a thin layer of solder).

The exact meaning of the connections are unknown, but it is thought that they are input to some sort of predictable pseudo-random-number- generator, because the books contain no memory. It all must reside in the unit itself, and Tiger probably devised a way to generate 1001 seemingly-random answers by a simple seed.

As stated above, the wires of a Quiz Wiz book slot are numbered 0-9, zero being to the left when the unit is upside-down. I'll further label these wires as follows:

Those are the colors I used on my PCB.

After a few minutes of testing connections, I was able to find out the book port pinout:

 0  1  2  3  4  5  6  7  8  9  wire number
G0 G1 G2 K3 K7 K4 K9 K5 K2 K1  wire name

G0 should be on the left when the unit is upside-down. The "G" wires are groups. The "K" wires correspond to keys. Key wires should be connected to at least one group wire, or else they will not function. The best way to find out if a key is not functioning is turn on the sound and see if depressing a key makes any noise. Note that there is no key wire for 0, 6, and 8, because they function by default.

3456789 wire number
3749521 key wire #

I'll use a square to specify which key wires are connected to which group. See below for an example.

K1 K2 K3
K4 K5 K6
K7 K8 K9

In place of the K# will be a group number, 0, 1, or 2, that the
key wire connects to.

K0, K6, and K8 do not exist and will have a dash in their place.

Here's an excerpt from a mail from Russ Perry Jr. (quoted), with comments added by me:

> So far, they all appear to follow groups of 3, 3 & 4
> for connections.
Let me elaborate on this a bit...

(edited)
Book 1
  3 connections to G0
  2 connections to G1  
  2 connections to G2

Book 4
  3 connections to G0
  2 connections to G1
  2 connections to G2

Book 14
  3 connections to G0
  2 connections to G1
  2 connections to G2

Of course, G[0-2] are wires too, so that's why they come 
in groups of 3, 3 and 4, in no particular order. I'm sure
there's some significance to this. Perhaps the group wires
can only drive at most 3 key wires. If nothing else, it'll
limit the number of carts I need to emulate..

> If that's true, and I did my math right, we're
> looking at a fair amount of combinations: 
> 10! / ((4 x 3 x 3) x 2), or 50,400.  So, the 
> 60 or so carts they did are only the
> beginning of the possibilities!
I'm not sure if that math is correct, because you have to 
remember that the seven K wires can only connect to G wires,
and there are three G wires. ... Regardless, the large amount 
of combinations rules out the possibility of the book being 
an index into some sort of ROM array. The book must be input 
to a random number generator or other algorithm - that's my 
theory.

Some Russ Perry Jr. speculation quoted, comments by me:

> >Without any book, the answers to questions
> >consisting of digits 0, 6, and 8 match those of 
> >book 1.
> 
> I wonder if maybe they don't match all books...
Questions with 0, 6, and 8 can be entered without a book, 
and they did match Book 1. I'll have to check the other books.

> >So there could be some sort of ROM in there - but a
> >ROM for every book seems impractical. Maybe there's
> >a ROM that Book 1 uses and all other books make
> >slight changes somehow.
> 
> Right.  It might just transpose the order the
> answers are given in some way.  The ROM just has 
> 1001 (or however many) answers, but the inputs start 
> in weird positions?  I'm sure the ROM is either 1K 
> or maybe some smaller number, but it could actually 
> be larger too.
Perhaps, but you can enter question numbers higher
than 1001. Maybe there's a possibility that the 
answers are tranposed, but it seems more likely that
the answers are stored by a PRNG (after all, there
is only 4 combinations).

> >Yeah, like a pseudo-RNG. With PRNGs a large
> >sequence of numbers is stored in ROM or generated 
> >with an algorithm, and the position within the 
> >sequence is selected by the seed - which in this 
> >case would be the cart configuration. Maybe the 
> >Quiz Wiz has a CPU which computes results of the 
> >zeta function or another PRNG algorithm, or there's 
> >just a dumb ROM in there.
>
> Right.  You know, I essentially misunderstood you
> last time when I brought up polynomial counters.  In 
> a sense the poly counters ACT as PRNGs.  So I was 
> suggesting the same thing you were, essentially.  
> The beauty is, it wouldn't require any ROM really, 
> it would just be built into the controller chip, 
> which I'm sure is just a gate array or something.  
> Nothing so complex as a CPU I imagine.
Exactly. I suspect Tiger did this rather than a ROM due to costs. 
They're too cheap to put a ROM in all their carts, why would they
put one in the main unit? :)

> >I opened up Quiz Wiz to check if there's a sign of 
> >any ROMs or CPUs. But thanks to modern technology, 
> >the IC that most wires run to is covered in a blob 
> >of epoxy.
> And it's pretty small too, right?  Probably just a
> gate array doing all the "system logic" and the PRNG.
Could be. Whatever it is, Tiger doesn't want us to  
know what it does. Or maybe they don't care anymore 
since it's an old device? I'll see if I contact them.

> >Gone are the days when devices used 7400 or 4000 DIP
> >ICs... I still have an 8088 motherboard which is
> >filled with them. Those where the days for
> >reverse-engineering. But I disgress.
> Yeah, but if you understand what those chips are 
> doing, you could build your own gate array "CPU".  
> You just can't disassemble what Tiger's doing so 
> easily.
If the algorithm was cracked, I could implement it 
hardware but in my opinion software would be a better
choice.

> >With today's technology, the chance of finding out 
> >how Quiz Wiz works is probably very slim unless 
> >there's a huge breakthough.
> Well, you might be able to figure it out by just 
> tracking signals are going in and coming out, but 
> yeah, it's a long shot.
I do in fact have an oscilliscope, but I doubt I'll
find anything useful.

Russ Perry Jr.'s brother on permutations and possible amount of cart configurations:

Here's what my brother had to say about the permutation situation:

---

If I'm reading the rules right on this, you must have three digits of 
one number, two of the second, and two of the third.  (There are 
necessarily three appearances of one of the three, or at most you get a 
6-digit number, but three is the maximum ... etc.)

If that's the case.  First assume you're rearranging 0 0 0 1 1 2 2.  
You can arrange them in 7! different ways, but you must divide by 2! = 2 
because the two 1's are indistinguishable, so you've overcounted 
sequences by a factor of 2 -- and divide by 2! because of the 2's, and then 
by 3! = 6 because the 0's are indistinguishable.  So you have 
7!/(3!2!2!) = 210 possibilities.  This remains true if it's three 1's or if it's 
three 2's, and so the total number of possibilities given your rules 
are 3 * 210 = 630 such seven-digit numbers.

Book 1: General Knowledge

The standard book that comes with Quiz Wiz.

Schematic:

+-----+---------+-+
|     |         | |     00-15510-200 EWIG 
| +---|-+-----+ | |          7-221
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
Book 1 Photo

These wires are connected together:

Which means it's key-group connection square is:

0 0 0     3 connections to G0
2 1 -     2 connections to G1
1 - 2     2 connections to G2
00021-1-2

 0*3^0 = 0
 0*3^1 = 0
 0*3^2 = 0
 1*3^3 = 27
 1*3^4 = 81
 2*3^5 = 486
+2*3^6 = 1458
-------------
         2052

Keys 1-3 belong to group 0, 4-6 excluding 6 belong to 1, and 7-9 excluding 8 belong to 2. Dashes exist in spaces 6 and 8 because they have no key wires.

Some answers:

              
Q: 0123456789
00 ACDCBDBCAB
10 BABDDBDCDB
20 ABCAABBACA
30 BABDCCADBD
40 DBABDACBDC
50 ADDAACACAC
60 DBABCDBDBA
70 BCDDBBDDBC
80 AABCDACCAD
90 CBBDCCAACB
Q: 0123456789

Ewig Ind Co Ltd (here too) is a HongKong-based company, but that's all I could find out about them. "Ewig" appears to be German for "eternally". Also, according to irasia.com, Ewig was acquired by Unidux (in Malaysia, Singapore, Australia). But this is all I could find out about their products.

Book 4: Great Sports Legends

Thanks to Russ Perry Jr. for providing this schematic.

+---------+---+
|         |   |
| +---+---|---|-+-+
| |   |   |   | | |
| | +-|-+-|-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 5, 7    = G0, K4, K5
1, 3, 8, 9 = G1, K3, K2, K1
2, 4, 6    = G2, K7, K9

1 1 1    3 connections to G0 
0 0 -    2 connections to G1
2 - 2    2 connections to G2
11100-2-2

 1*3^0 = 1
 1*3^1 = 3
 1*3^2 = 9
 0*3^3 = 0
 0*3^4 = 0
 2*3^5 = 486
+2*3^6 = 1458
-------------
         1957

Book 5: Ripley's Believe It Or Not

Thanks again to Russ Perry Jr. for this and all the remaining schematic.

+-------+---+
|       |   |
| +-----|-+-|-+---+
| |     | | | |   |
| | +-+-|-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 4, 6    = G0, K7, K9
1, 5, 7, 9 = G1, K4, K5, K1
2, 3, 8    = G2, K3, K2

1 2 2    2 connections to G0
1 1 -    3 connections to G1
0 - 0    2 connections go G2
12211-0-0

 1*3^0 = 1
 2*3^1 = 6
 2*3^3 = 54
 1*3^4 = 81
 0*3^5 = 0
+0*3^6 = 0
-----------
         142

Book 9: Football Facts

+-----+-------+
|     |       | 
| +---|-+-----|-+-+
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
0 1 2 3 7 4 9 5 2 1
G G G K K K K K K K

G0, K3, K5
G1, K7, K8, K9
G2, K4, K9

- - 0
2 0 -
1 1 1

Book 10: ???

+-----+-----+
|     |     | 
| +---|-+---|---+-+
| |   | |   |   | |
| | +-|-|-+-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K6
G1, K4, K8, K9
G2, K5, K7

- - 0
1 2 0
2 1 1 

Book 14: Computers & Games

+---------+-+-----+
|         | |     | 
|   +---+-|-|---+ |
|   |   | | |   | |
| +-|-+-|-|-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

Connections:

0, 5, 6, 9 = G0, K4, K9, K1
1, 3, 7    = G1, K3, K5
2, 4, 8    = G2, K7, K2

0 2 1
0 1 -
2 - 0
02101-2-0


 0*3^0 = 0
 2*3^1 = 6
 1*3^2 = 9
 0*3^3 = 27
 1*3^4 = 81
 2*3^5 = 486
+0*3^6 = 0
------------
         609

Book 26: ???

+-----+---------+
|     |         | 
| +---|-+-----+-|-+
| |   | |     | | |
| | +-|-|-+-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K2
G1, K7, K5, K1
G2, K4, K9

1 0 0
2 1 -
1 - 2

Book 29: Pro Basketball Hoopla

+-----+---------+
|     |         | 
| +---|---+-+---|-+
| |   |   | |   | |
| | +-|-+-----+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1
G0, K3, K2
G1, K4, K9, K1
G2, K7, K5

1 0 0
1 2 -
2 - 9

Book 37

+---------+-+
|         | | 
| +-----+-|-|-+---+
| |     | | | |   |
| | +-+-|-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1

G0, K4, K9
G1, K7, K5, K1
G2, K3, K2

1 2 2
0 1 -
1 - 0

Book 40

+-----+---------+-+
|     |         | | 
| +---|-+---+   | |
| |   | |   |   | |
| | +-|-|-+-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
      3 7 4 9 5 2 1

G0, K3, K2, K1
G1, K7, K9
G2, K4, K5

0 0 0
2 2 -
1 - 1

Book 55: Facts About The Earth

Thanks to Russ Perry Jr. for this schematic.

+-----+---------+
|     |         | 
| +---|---+---+-|-+
| |   |   |   | | |
| | +-|-+-|-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9
0, 3, 8    = G0, K3, K2
1, 5, 7, 9 = G1, K4, K5, K1
2, 4, 6    = G2, K7, K9

1 0 0
1 1 -
2 - 2
10011-2-2

Book 56: American History

Thanks to Russ Perry Jr. for this schematic.

+-----+-------+---+
|     |       |   | 
| +---|---+-+ |   |
| |   |   | | |   |
| | +-|-+-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

0, 3, 7, 9 = G0, K3, K5, K1
1, 5, 6    = G1, K4, K9
2, 4, 8    = G2, K7, K2

0 2 0
1 0 -
2 - 1

Book 57: Mythology

Thanks to Russ Perry Jr. for this schematic.

+---------+-+-----+
|         | |     | 
| +-----+-|-|---+ |
| |     | | |   | |
| | +-+-|-|-|-+ | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

0, 5, 6, 9 = G0, K4, K9, K1
1, 4, 8    = G1, K7, K2
2, 3, 7    = G2, K3, K5

0 1 2
0 2 -
1 - 0

Book 58: Sports Stars of The 90's

Thanks to Russ Perry Jr. for this schematic.

+-------+---+
|       |   | 
| +---+-|---|-+---+
| |   | |   | |   |
| | +-|-|-+-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

0, 4, 6    = G0, K7, K9
1, 3, 7, 9 = G1, K3, K5, K1
2, 5, 8    = G2, K4, K2

1 2 1
2 1 -
0 - 0

Book 59: Pro Sports

Thanks to Russ Perry Jr. for this schematic.

+-----+-----+-----+
|     |     |     | 
| +---|---+-|-+   |
| |   |   | | |   |
| | +-|-+-|-|-|-+ |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

0, 3, 6, 9 = G0, K3, K9, K1
1, 5, 7    = G1, K4, K5
2, 4, 8    = G2, K7, K2

0 2 0
1 1 -
2 - 0

Book 60: Fads, Events, and People of The 90's

Thanks to Russ Perry Jr. for this schematic.

+---------+---+---+
|         |   |   | 
| +-----+-|---|-+ |
| |     | |   | | |
| | +-+-|-|-+ | | |
| | | | | | | | | |
0 1 2 3 4 5 6 7 8 9

0, 5, 7, 9 = G0, K4, K5, K1
1, 4, 8    = G1, K7, K2
2, 3, 6    = G2, K3, K9

0 1 2
0 0 -
1 - 2

No Book

Without a book, the only numerical keys which function are 6, 8, and 0. 0-6-8-consisting answers:

0   6   8   60  66  68  80  86  
A   B   A   C   B   C   A   C

However, it's possible to make all numerical keys function by putting in a book, typing the question, removing it, then typing your answer. This is what I've done:

    *     * *
Q:  0123456789
00  ACDCBDBCA..

A strange thing occured. These answers are those of Book 1! It would be expected that this is caused if typing in the question reads the correct answer, but the 0-6-8-consisting answers do in fact match. There are several possible explainations for this: Quiz Wiz could save the book's data and use it when a book is removed, the book does not really do anything, or this is the default group connections. I'll find out by using Quiz Wiz with no book, after the batteries are reinserted.

They do match, even with no book and reinserted batteries. Will this work with other books, like my custom one? Results: If a book is removed, Quiz Wiz's answers default to that of Book 1. Maybe a built-in default.

All-Connected Book

Book All-Connected Photo This book was custom made by me with aluminium foil and cereal box cardboard. All of the wires are connected to each other. Suprisingly, this does not kill the Quiz Wiz. Connection square:

012 012 012
012 012 ---
012 --- 012

A pattern should become apparent here.. Known answers:

             was all A, somehow changed (need to figure out how+why)
              
Q: 0123456789
00 BCDBDBBDBD
10 DABBABDBDB
20 CACAAAADDA
30 CDBACDBBBB
40 CAACCACACA
50 BCDCDBDBDC
60 A

Further observations: The answers can change when the book's connection changes, on the fly. Maybe book is used as direct input to a PRNG. I can't see any distinct pattern. New goal is to find out how 14-19 became all A for a second; create a book where every question is A, or any distinct pattern for that matter.

This could be used to make a custom answer booklet. In fact, I did such a thing. qwt.pl uses an All-Connected book to generate questions on trivia from funtrivia.com. You'll also need trivia.db; funtrivia.com's public domain trivia database.

Disconnected-0 Book

This book is like All-Connected, but the leftmost wire (when upside-down), known as 0, is floating. Known answers:

Q: 0123456789
00 AAAAAA      inconsistant

Update: wire 0 is G0, but all wires are connected to group 1 and 2, so it's connection square is:

12 12 12
12 12 --
12 -- 12

K9=G1 book

Like Book 1 except keywire 9 is connected to group 1:

0 1 2
0 1 -
0 - 1

Answers come in groups of four, most of the time. Begins out with CCCC, BBBB, but following questions keep repeating answers AAAA, AAAA, and BB.

Q: 0123456789
00 CCCCBBBBAA
10 AAAAAABBAA good pattern here, but doesn't last long
20 AAAAAABBAA
30 BABBBBAAAB verified
40 DBABCBC

All-0 Book

All keywires are connected to group 0 (white):

0 0 0
0 0 -
0 - 0

Similar to answers Book 1; differences are bolded. Notice how only D, C and sometimes B differ from the original.

Q: 0123456789
00 ACDCDCBCAD
10 BABCDCDDDB
20 CDCACDDACC
30 CABDBDADBB
40 CDCACADACC (not yet compared to Book 1)
50 BABDBDADBB
60 DBABABBBBA
70 BDBDBDADBB
80 AACCBCCCAB
90 CDCACADACC

Book Summary

Book 1 is the only official book I own. But thanks to various contributors, currently only Russ Perry Jr., I was able to build up an extensive collection of whats inside these cartriges of mystery. If you have any other books which I don't have the schematic for and would like to contribute, you can do so by disassembling the "book" and either making a schematic of it, or sending me a photo, or listing the connected wires. Information on books I don't have is greatly appreciated, even if all you have is the title and number. Here's the books I know about:


Modified Sun Mar 25 08:48:47 2007 generated Sun Mar 25 08:56:33 2007
http://jeff.tk/quizwiz/