Cracking GEI Greyhound Electronics (1984)

Plaintext ASCII, mob connections, and an unsolved compression, 6,048 questions from the original bar trivia machine

April 3, 2026 · crack, gei, greyhound, z80

← Archive

GEI Video Trivia (Series 1-7 + A/B)

Greyhound Electronics, Inc. · 1984 · Z80 @ 4 MHz · 27 category chips · 6,048 records

The Cabinet

This is not a story about a clever encoding. The encoding is trivial, plaintext ASCII, visible in any hex editor. This is a story about a concrete factory in New Jersey, the Scarfo crime family, and the first subscription content model in gaming.

Greyhound Electronics, Inc. was founded in August 1982 in a repurposed concrete factory in Toms River, New Jersey, by Edmund Florimont, Robert Holland, and Carmen Ricci. They built one of the first dedicated bar trivia machines, a Z80-based board running at 4MHz with non-JAMMA wiring and five swappable 16KB EPROM sockets for question categories.

The machine was a hit. GEI shipped Series 1 in 1984 with five category chips: general_@1, movies-tv_@1, music_@1, science_@1, sports_@1. Each chip held roughly 180-200 questions. But the real innovation was what came next.

The ROM Subscription Model

GEI pioneered something that looks remarkably like early SaaS, but with physical chips. Operators bought new EPROM packs on a subscription basis to keep their bar trivia content fresh. Pop out the old sports_@1, snap in sports_2_#2. New questions, same hardware.

Over seven series, GEI shipped dozens of category chips. The naming tells the story of an expanding content library:

  Series 1:  general_@1, movies-tv_@1, music_@1, science_@1, sports_@1
  Series 2:  comics_#1, entertainment_#1, general_2, sports_2_#2, tv_mash
  Series 3:  beatlemania_#1, country-west, general_3, sports_3_#3, tv_soaps
  Series 4:  history-geog, star_trek, television_#1
  Series 5:  hockey, james_bond
  Series 7:  general_5

Star Trek. Beatlemania. James Bond. TV Soaps. These were niche content packs for a bar audience in 1984, the same long-tail content strategy that would later drive Netflix and Spotify, executed in UV-erasable silicon.

The Mob Connection

In 1990, GEI president Carmen Ricci was arrested for ties to the Scarfo crime family, the Philadelphia-South Jersey mob organization led by Nicky Scarfo. The connection wasn’t trivia: Ricci was selling illegal poker machines through the same distribution channels as the trivia boards. The legitimate bar trivia business was cover for the real money.

The company didn’t survive the indictment. But by then, GEI had shipped at least 18 series of trivia ROMs and established the template that every bar trivia system, NTN, Buzztime, Megatouch, would follow.

The Data

All 6,048 records browse at /browse?source=gei , Series 1-7 plus Series A and B across 27 category chips. The later compressed series (8 and beyond) split off into the GEI T3 Compression post .

How We Cracked It

The Encoding: Plaintext ASCII

Open any Series 1-7 question ROM in a hex editor and the questions stare back at you. Here’s the science_@1 chip:

  Offset    Hex                                        ASCII
  ──────────────────────────────────────────────────────────────
  0000      55 54 53 43 49 45 4E 43  45 FF 20 23 31 FF 5E   UTSCIENCE. #1.^
  000F      ...pointer table (binary, ~0xE0 bytes)...
  00E0      57 48 49 43 48 20 41 53  54 52 4F 4E 41 55 54   WHICH ASTRONAUT
  00EF      20 57 41 53 20 54 48 45  20 53 45 43 4F 4E 44    WAS THE SECOND
  00FE      20 54 4F 20 53 45 54 0A  46 4F 4F 54 20 4F 4E    TO SET.FOOT ON
  010D      20 54 48 45 20 4D 4F 4F  4E FF 01 4E 45 49 4C    THE MOON..NEIL
  011C      20 41 52 4D 53 54 52 4F  4E 47 FF 45 44 57 49    ARMSTRONG.EDWI
  012B      4E 20 41 4C 44 52 49 4E  FF 4D 49 43 48 41 45   N ALDRIN.MICHAE
  013A      4C 20 43 4F 4C 4C 49 4E  53 FF                  L COLLINS.

The header UTSCIENCE identifies the category. After an 0xFF delimiter and a binary pointer table (~224 bytes of jump offsets), the questions begin as raw ASCII text.

The Record Format

Every question follows the same 0xFF-delimited structure:

  [QUESTION TEXT]
  FF                    ← delimiter
  [INDEX BYTE] [CORRECT ANSWER TEXT]
  FF                    ← delimiter
  [WRONG ANSWER 1]
  FF                    ← delimiter
  [WRONG ANSWER 2]
  FF                    ← delimiter (next question follows)

Annotated hex for the first question in science_@1:

  57 48 49 43 48 20 41 53 54 52 4F 4E 41 55 54    "WHICH ASTRONAUT"
  20 57 41 53 20 54 48 45 20 53 45 43 4F 4E 44    " WAS THE SECOND"
  20 54 4F 20 53 45 54 0A                          " TO SET" + newline
  46 4F 4F 54 20 4F 4E 20 54 48 45 20 4D 4F 4F    "FOOT ON THE MOO"
  4E                                                "N"
  FF                                                ← end of question
  01                                                ← answer index: 0x01
  4E 45 49 4C 20 41 52 4D 53 54 52 4F 4E 47       "NEIL ARMSTRONG"
  FF                                                ← end of answer 1
  45 44 57 49 4E 20 41 4C 44 52 49 4E              "EDWIN ALDRIN"
  FF                                                ← end of answer 2
  4D 49 43 48 41 45 4C 20 43 4F 4C 4C 49 4E 53    "MICHAEL COLLINS"
  FF                                                ← end of answer 3

Three-choice format: one correct answer, two wrong. The 0x0A byte in the question text is a line break for the display, the game’s screen was narrow, so long questions wrapped manually.

The Answer Index Bug

The single byte between the first 0xFF and the correct answer text is the display index, 0x01 through 0x04. It tells the game hardware which on-screen slot to place the correct answer in, so the right answer isn’t always in position 1.

  Index byte values:
    0x01 → correct answer displays in position 1
    0x02 → correct answer displays in position 2
    0x03 → correct answer displays in position 3
    0x04 → correct answer displays in position 3 (with implied NOTA)

Our first extraction pass ignored this byte entirely and assumed the first answer after the question was always correct. It matched fine against spot-checks because position 1 was the most common. But when we validated against MAME gameplay captures, roughly 30% of answers were wrong, the index byte was shuffling them.

The fix in format.py:

  # The first answer part starts with a display index byte (0x01-0x04)
  correct_idx = 0
  if len(a1_raw) > 1 and a1_raw[0] <= 0x04:
      correct_idx = a1_raw[0]
      a1_text = _decode_text(a1_raw[1:])

  # Select correct answer based on index byte
  if correct_idx == 1:
      correct = answers[0]
      wrong = [answers[1], answers[2]]
  elif correct_idx == 2:
      correct = answers[1]
      wrong = [answers[0], answers[2]]
  elif correct_idx in (3, 4):
      correct = answers[2]
      wrong = [answers[0], answers[1]]

A single byte. Easy to miss.

The Pointer Table

Each ROM starts with the category name (e.g., UTSCIENCE), followed by 0xFF, then a binary pointer table of approximately 224 bytes. These are 16-bit addresses into the ROM, jump offsets so the Z80 can seek directly to a random question without scanning sequentially. The parser skips this table by looking for the first long run of printable ASCII after offset 0x20:

  def _find_question_start(data: bytes) -> int:
      run_len = 0
      for i in range(0x20, min(len(data), 0x200)):
          if data[i] in _PRINTABLE_OR_NEWLINE:
              run_len += 1
              if run_len >= 10:
                  return i - run_len + 1
          else:
              run_len = 0
      return 0x20  # fallback

Simple but effective, the pointer table is binary noise, so 10 consecutive printable characters reliably marks where questions begin.

The Unsolved: Series 8+ Compression

Starting with Series 8 (1986), GEI moved to a new PCB called T3 with 32KB ROMs. Open one in a hex editor and you see a very different picture:

  Offset    Hex                                        ASCII
  ──────────────────────────────────────────────────────────────
  0000      54 33 53 43 49 45 4E 43  45 FF 76 ...          T3SCIENCE.v...
  0010      A8 3A 88 5C 9C B0 C4 D8  EC 86 ...           (binary noise)
  0020      5A B4 F6 DC 86 0A C0 40  98 ...              (binary noise)

The header still identifies itself, T3SCIENCE instead of UTSCIENCE, but after the category name, the data is opaque. No readable ASCII. No obvious structure. Shannon entropy measurement: 7.4 bits per byte.

Update: T3 is cracked. Read the full story: Cracking GEI T3 Compression →

Results

6,048 questions extracted from Series 1-7 plus Series A and B across 27 category chips:

  Series 1:   934 questions (5 chips)
  Series 2:  1,004 questions (5 chips)
  Series 3:    889 questions (5 chips)
  Series 4:    543 questions (3 chips)
  Series 5:    335 questions (2 chips)
  Series 7:    200 questions (1 chip)
  Series 7a:   867 questions (2 chips)
  Series A:    599 questions (3 chips)
  Series B:    677 questions (4 chips)

  Sample:
  [science] Which astronaut was the second to set foot on the moon
    ✓ Edwin Aldrin  ✗ Neil Armstrong / Michael Collins

  [general] In which U.S. state did bourbon originate
    ✓ Kentucky  ✗ Tennessee / Texas

  [general] What was Coca-Cola originally used for
    ✓ Headache remedy  ✗ Hangover cure / Iron tonic

  [sports] Who was "The Louisville Lip"
    ✓ Cassius Clay  ✗ Babe Ruth / Hank Aaron

The questions are a time capsule of 1984 bar culture, heavy on sports, booze, TV trivia, and Americana. The Sears Tower is the tallest building. Pluto is a planet. The World Trade Center is standing.

Arcade Trivia Archive, data extracted from MAME ROM dumps using a custom Python decoder. Extractor: scripts/gei/extract.py

References

Related

More cracks

• GEI T3 Compression

Cross-archive analyses

• Who Stole From Whom: 1,349 plagiarism hits
• The Funny Bits: AI reads 115K trivia questions