Cracking Trivia Quest (1984)

Techstar / Sunn's Trivia Quest, one of the earliest English electronic trivia cabinets, stored every question and answer as plaintext ASCII behind a 21-byte pointer-table header. No encryption, no scramble. 489 questions recovered across Trivia and Sports.

April 24, 2026 · crack, alliedleisure, trvquest, 6809

← Archive

Trivia Quest

Techstar / Sunn Electronics · 1984 · Motorola 6809 · dual AY-3-8910 · 489 records

The Cabinet

Trivia Quest1 shipped in 1984, squarely inside the Trivial Pursuit board-game craze that had hit North America a year earlier. While Greyhound Electronics and Status Game Corporation were busy carving up the U.S. bar-top trivia market with their own cabinets, Trivia Quest came out of Techstar Inc. (incorporated July 1981, dissolved Nov 1988), a small Florida outfit that also published under the Sunn Electronics imprint. MAME files the driver under alliedleisure/ because the cabinet hardware traces back to Allied Leisure (Hialeah, FL) by way of Ed Miller, who founded Allied in 1968, renamed it Centuri in 1980, and left in 1982 to license cabinets through Telko Properties / Techstar. Allied / Centuri and Techstar are separate companies linked only by shared personnel; Trivia Quest itself is a Techstar release.

The hardware is unusual for a trivia cabinet of that era: a Motorola 6809 CPU, dual AY-3-8910 sound chips, and, critically, a question daughterboard with a socket for up to nine 8KB ROMs (roma..romi). Each ROM is a standalone question pack; swap one to swap the trivia. The main driver sits at scripts/roms/alliedleisure/trvquest.cpp in MAME.

Two question packs shipped:

The Data

All 489 records browse live at /browse?source=alliedleisure_trvquest . splittable by chip, plaintext questions and answers. Three questions are stored twice with different wrong answers; both copies are kept.

How We Cracked It

No Encryption At All

This is the surprise. After the year we’ve spent cracking GEI’s T3 5-bit packing , Bally Sente’s base-40 radix , Status Games’ OR-0x40 + bit-6 word boundaries , Kramer’s bigram-plus-phrase compression , Enerdyne’s LZ-style phrase table , Merit’s dual-LUT address scramble , and Exidy’s bit-rotation , Trivia Quest just stores the questions as plain ASCII.

$ xxd roma | head -2
00000000: f0a5 5452 4956 4941 2020 0401 1401 b101  ..TRIVIA  ......
00000010: d501 d601 de01 df01 eb01 ec01 f501 f601  ................
$ xxd -s 0x1b0 -l 0x30 roma
000001b0: 0157 6861 7420 6973 2074 6865 206c 6172  .What is the lar
000001c0: 6765 7374 206c 616e 6420 6361 726e 6976  gest land carniv
000001d0: 6f72 653f 0404 476f 7269 6c6c 6104 044b  ore?..Gorilla..K

You can see it right in the hex: What is the largest land carnivore?, a full trivia question sitting in the clear. The \x04 ends each screen line; everything else is ASCII.

The Record Format

Each question-ROM is sliced into one or more blocks. A block begins with the two-byte magic \xF0\xA5, followed by an 8-char category name (space-padded) and 3 more bytes: a \x04, the level (Scholar or Genius) and the number of questions in the block. After that, records are a fixed 21 bytes each:

offset 0x00..0x13  ten big-endian 16-bit pointers (p0..p9), relative to block base
offset 0x14        answer index (which pointer holds the correct answer)

The pointers mark where each field begins inside the block’s text area:

Each pointer is one screen line, running up to the next \x04. Line 2 is usually empty; when it isn’t, it holds the rest of the text and we join the two lines with a space.

The answer byte at 0x14 tells the CPU which choice slot (0..3) to score as correct. Every other byte of the ROM is question text, stored in the clear.

The Parse

Blocks are variable length. The count byte in the block header says how many 21-byte records follow. Read that many, then look for the next \xF0\xA5, repeat.

Yield

roma=66 romb=60 romc=60 romd=15            (Trivia)
rome=58 romf=65 romg=40 romh=65 romi=60    (Sports)
-------
total: 489 records (490 in the ROM, 1 left out as broken in the ROM itself)

The distribution tells its own story: romd is a short pack at 15 records, probably a late-addition chip the operator could slot in alongside the others. The rest land in the 40-66 range, about right for an 8KB ROM carrying plaintext question bodies plus choice text.

What It Tells Us

Trivia Quest is a reminder that not every 1980s arcade ROM is encrypted. Before the trivia wars escalated and operators started pirating each other’s question packs, some manufacturers just… wrote the questions down. The 21-byte pointer header is pure efficiency. the 6809 CPU can jump straight to any field with a single pointer dereference, no parsing, no decoding.

By 1986 nobody was shipping plaintext anymore. Trivia Quest is a snapshot of a two-year window where the market hadn’t yet decided that question text was a trade secret worth protecting.

References

Cross-archive analyses

  1. Trivia Quest (1984, Techstar / Sunn Electronics) · Arcade-Museum · MAME romset: trvquest ↩︎