Cracking Trivia Quest (1984)

Techstar / Sunn's Trivia Quest, one of the earliest English electronic trivia cabinets, stored every question and answer as plaintext ASCII behind a 21-byte pointer-table header. No encryption, no scramble. 486 questions recovered across Trivia and Sports.

April 24, 2026 · crack, alliedleisure, trvquest, 6809

← Archive

Trivia Quest

Techstar / Sunn Electronics · 1984 · Motorola 6809 · dual AY-3-8910 · 486 records

The Cabinet

Trivia Quest1 shipped in 1984, squarely inside the Trivial Pursuit board-game craze that had hit North America a year earlier. While Greyhound Electronics and Status Game Corporation were busy carving up the U.S. bar-top trivia market with their own cabinets, Trivia Quest came out of Techstar Inc. (incorporated July 1981, dissolved Nov 1988), a small Florida outfit that also published under the Sunn Electronics imprint. MAME files the driver under alliedleisure/ because the cabinet hardware traces back to Allied Leisure (Hialeah, FL) by way of Ed Miller, who founded Allied in 1968, renamed it Centuri in 1980, and left in 1982 to license cabinets through Telko Properties / Techstar. Allied / Centuri and Techstar are separate companies linked only by shared personnel; Trivia Quest itself is a Techstar release.

The hardware is unusual for a trivia cabinet of that era: a Motorola 6809 CPU, dual AY-3-8910 sound chips, and, critically, a question daughterboard with a socket for up to nine 8KB ROMs (roma..romi). Each ROM is a standalone question pack; swap one to swap the trivia. The main driver sits at scripts/roms/alliedleisure/trvquest.cpp in MAME.

Two question packs shipped:

The Data

All 486 records browse live at /browse?source=alliedleisure_trvquest . splittable by chip, plaintext questions and answers, three duplicates deduped across the nine ROMs.

How We Cracked It

No Encryption At All

This is the surprise. After the year we’ve spent cracking GEI’s T3 5-bit packing , Bally Sente’s base-40 radix , Status Games’ OR-0x40 + bit-6 word boundaries , Kramer’s bigram-plus-phrase compression , Enerdyne’s LZ-style phrase table , Merit’s dual-LUT address scramble , and Exidy’s bit-rotation , Trivia Quest just stores the questions as plain ASCII.

$ xxd roma | head -4
00000000: f0a5 4745 4e4f 2020 2020 0103 0000 00e8  ..GENO   .......
00000010: 0019 0037 004f 006d 0086 00b1 00d7 00fe  ...7.O.m........
00000020: 0134 0014 5768 6f2c 2061 7320 5072 6573  .4..Who, as Pres
00000030: 6964 656e 7420 6f66 2074 6865 0455 2e53  ident of the.U.S

You can see it right in the hex: Who, as President of the\x04U.S, a full trivia question sitting in the clear. The \x04 is an on-screen line wrap; everything else is ASCII.

The Record Format

Each question-ROM is sliced into one or more blocks. A block begins with the two-byte magic \xF0\xA5, followed by an 8-char category name (space-padded) and a 3-byte header. After the header, records are a fixed 21 bytes each:

offset 0x00..0x13  ten big-endian 16-bit pointers (p0..p9), relative to block base
offset 0x14        answer index (which pointer holds the correct answer)

The pointers mark where each field begins inside the block’s text area:

The answer byte at 0x14 tells the CPU which choice slot (0..3) to score as correct. Every other byte of the ROM is question text, stored in the clear.

The Parse

Blocks are variable length, parsing stops when the next 21-byte record fails two sanity checks:

  1. Monotonicity: pointers must be non-decreasing within a record (p0 ≤ p1 ≤ … ≤ p9).
  2. Range: every pointer must fit inside the block’s payload region.

The moment a prospective record fails either test, we know we’ve fallen off the end of the block into padding or the next block’s magic. Rewind, look for the next \xF0\xA5, repeat.

Yield

roma=66 romb=60 romc=60 romd=15 rome=58   (Trivia)
romf=63 romg=40 romh=64 romi=60            (Sports)
-------
total: 486 records (3 duplicates deduped)

The distribution tells its own story: romd is a short pack at 15 records, probably a late-addition chip the operator could slot in alongside the others. The rest land in the 40-66 range, about right for an 8KB ROM carrying plaintext question bodies plus choice text.

What It Tells Us

Trivia Quest is a reminder that not every 1980s arcade ROM is encrypted. Before the trivia wars escalated and operators started pirating each other’s question packs, some manufacturers just… wrote the questions down. The 21-byte pointer header is pure efficiency. the 6809 CPU can jump straight to any field with a single pointer dereference, no parsing, no decoding.

By 1986 nobody was shipping plaintext anymore. Trivia Quest is a snapshot of a two-year window where the market hadn’t yet decided that question text was a trade secret worth protecting.

References

Cross-archive analyses

  1. Trivia Quest (1984, Techstar / Sunn Electronics) · Arcade-Museum · MAME romset: trvquest ↩︎