Cracking Trivia Madness (1985)

M. Kramer Manufacturing's bar-top trivia with two question formats on one board. Long listed as undumped; turned up on archive.org in 2021. 6,910 questions across 8 categories. The board-wide phrase dictionary hid inside a graphics ROM.

April 19, 2026 · crack, kramer, thunderhead, trivia-madness, z80

← Archive

Trivia Madness

M. Kramer Manufacturing / Thunderhead Inc. · 1985 · Z80 · 8 categories · 6,910 records

The Cabinet

Trivia Madness¹ shipped in 1985 from Thunderhead Inc., built on a countertop board designed by M. Kramer Manufacturing of Asbury Park, NJ. Kramer was a tiny player in the bar-trivia boom, their catalog totals only two known cabinets, the other being the almost-impossible-to-find LA Beer Trivia Challenge, an Anheuser-Busch-licensed machine that debuted at the 1985 AMOA Expo. Both run the same basic hardware. The trivia was the product; the Kramer board was the delivery vehicle.

For decades Trivia Madness was on the “never dumped” list at mameworld.info/maws . The cabinet was rare enough, and Kramer obscure enough, that nobody with an EPROM reader had ever pulled its chips, until May 2021, when an uploader called “Sketch the Cow” dropped a complete dump onto the Internet Archive as arcade_trvmadns . Playable in a browser immediately. Extractable, with effort.

The Data

All 6,910 records browse at /browse?source=kramer_trvmadns . a mix of True/False (1,451) and Multiple-Choice (5,459) questions across eight categories.

• Extractor: scripts/thunderhead/extract.py
• Original ROM dump: archive.org/details/arcade_trvmadns
• MAMEWorld unMAMEd entry (historical): non_other80.html

How We Cracked It

The Hook: Two Formats, One Cabinet

The Trivia Madness board accepts question ROM chips in any of 16 bank positions. Operators could mix-and-match chips across categories. Most bar-top trivia cabinets of this era use one format; Kramer used two, and every category has both:

• True/False questions store short statements followed by .*T or .*F. Players answer TRUE or FALSE.
• Multiple-Choice questions store three-option records: \<question>*<correct>*<wrong1>*<wrong2>*. Players pick A, B, or C.

Same cabinet, same Z80, same ROM socket. The first chip of each category starts with an “MC” header that says how many pages each chip has and points to the category’s phrase table, the start of the multiple-choice list and the start of the True/False list. The chips of a category form one continuous run, so a single chip can hold the end of the multiple-choice list and the start of the True/False list.

The True/False Format

The True/False list has no header of its own. Records run top-to-bottom:

\SEXUAL ACTIVITY ELICITS<HORMONAL RESPONSES.*T
\A WOMAN CANNOT RAPE<A MAN.*F
\THE CLITORIS HAS OTHER<PURPOSES BESIDES<PROVIDING PLEASURE.*F
\KAI TEK AIRPORT<IS IN CHINA.*T

• \ marks the start of a record.
• < is a display line break, the monitor wrapped text at fixed character positions and the designers pre-computed where to break. Stripped to a space on extract, or to nothing after a hyphen that ends the line (TOGE-<THER).
• .*T or .*F terminates the record with the answer.

Bytes in the 0x80-0xFF range are inline word tokens. Bytes 0x80-0xBF go through a board-wide phrase table baked into one of the program ROMs, and bytes 0xC0-0xFE through the category’s own table in the header chip.

Finding the TF Dictionary

An initial pass at the TF chips left every question peppered with high-bit bytes that we couldn’t expand. The dictionary had to exist somewhere, the cabinet obviously renders full English on screen. but program ROM u5 (the main Z80 code) held only code, strings, and the attract-mode text. We almost shipped with the TF tokens stripped and moved on.

The fix was to scan every ROM on the board for a specific structural signature: a byte sequence where a high-bit token byte (0x80, 0x81, 0x82…) is followed by a short ASCII phrase, which is followed by the next sequential token byte, and so on. The pattern lands on a real dictionary and ignores incidental ASCII runs. Exactly one hit across 40 KB of ROM:

u6 “green” at offset 0x1EC0, a 49-entry phrase table:

  0x80 WHO   0x81 WHERE  0x82 WHAT  0x83 WHEN  0x84 HOW
  0x85 WAS   0x86 THE    0x87 IN    0x88 OF    0x89 IS
  0x8A AS    0x8B AN     0x8C WHICH 0x8D AND   0x8E HAD
  0x8F TO    0x90 ON     0x91 ARE   0x92 DID   0x93 FOR
  0x94 HAVE  0x95 WITH   0x96 FROM  0x97 YOU   0x98 SPENDING
  0x99 WHO WAS THE       0x9A WHEN WAS THE
  0x9B HOW MANY          0x9C 19   0x9D LEAD
  0x9E WHERE WAS THE     0x9F WAS THE          0xA0 MOST
  0xA1 YEAR              0xA2 HIGHEST          0xA3 THAT
  0xA4 TIME 0xA5 ONLY    0xA6 I SAY LA         0xA7 I SAY LA WHEN
  0xA8 AT   0xA9 I'VE    0xAA GOT   0xAB I'M   0xAC LONG
  0xAD IT'S 0xAE DAY     0xAF WORK  0xB0 PARTY

u6 is labelled “green” on the board, ostensibly the green colour plane of the character ROM, but Kramer quietly parked the dictionary in the tail of the file where the graphics would otherwise be all 0xFF padding. That is why the earlier pass missed it: nobody looks for phrase tables inside a colour ROM.

With the dict applied, the questions read as full English. Byte 0x86 alone (the most common token, 5,608 occurrences) is “THE”, five thousand missing THEs. Each category layers its own 0xC0+ dictionary on top of the same board-wide table, so words like “WHO WAS THE” get a token in the global table and chip-specific entries like “ALL MY CHILDREN” get a token in the category table.

An earlier pass left about 130 high-bit bytes unmapped in the True/False questions, category tokens like “SEXUAL” and “SOAP OPERA”. They sit in the same category table the multiple-choice questions use. With that table applied to both lists, every token maps.

The Multiple-Choice Format

The first chip of each category carries the header and the category’s phrase dictionary. The layout:

  0x0000    "MC" magic
  0x0003    8 KB pages per chip (2 or 4)
  0x0006    category name + "*"
  0x001B    pointers: phrase table, MC list start, TF list start
            0xFF padding (~220 bytes)
  0x0100    Token dictionary
            - Each token entry is <byte 0xC0-0xFE><ASCII text>
            - Runs until the next 0xC0-0xFE byte or 0xFF padding
  ~0x0380   0xFF padding
  ~0x0400   Multiple-choice records
            \<question>*<correct>*<wrong1>*<wrong2>*

Reading the Entertainment chip’s dictionary:

  0xC0: 'PLAYED THE TITLE ROLE'
  0xC1: 'WHO RECORDED THE THEME SONG'
  0xC2: ' BALLAD'
  0xC4: '\x86\x9c53'               ← garbage (chained to another token)
  0xC5: 'LORRETTA LYNN*\x82\x85 CHARLIE CHAPLIN\'S<'
  0xC7: 'CHARLES BRONSON'
  0xC8: 'DUSTIN HOFFMAN'
  0xC9: 'BURT LANCASTER'
  0xCA: 'JACK NICHOLSON'
  0xCB: 'CLINT EASTWOOD'
  0xCC: 'WHAT ACTOR PLAYED'
  ...
  0xE4: 'JAMES'
  0xE5: 'FIRST'
  0xE6: 'OSCAR'
  0xE7: 'JACK'
  0xE8: 'JOHN'

Every category defines roughly 50 tokens, mostly actor names, common film/music vocabulary, and short connectives. Each category has its own vocabulary because the space savings are category-specific: sports chips define “TOUCHDOWN”, “QUARTERBACK”, team names; travel chips define “CAPITAL”, “OCEAN”, “CONTINENT”.

After token expansion, a record reads:

\WHO CO-STARRED WITH ELVIS IN THE MOVIE,"VIVA LAS VEGAS"
    *ANN MARGRET*LANA TURNER*RITA HAYWARD*

Correct answer is always the first field after the question.

What Tripped Us Up

Four false starts before the real solve:

Mis-identifying the MC dictionary. The records themselves contain bytes in the 0xC0-0xFE range (from token references), so a naive dict-scanner that looks for “consecutive 0xC0+ bytes” will latch onto the record section instead of the real dictionary. The fix was to follow the header: offset 0x1B holds a pointer to the real dictionary.

Looking in the wrong ROM for the TF table. A first pass searched u5 (the main Z80 code) and u7 (graphics) for a phrase table, nothing there. The table lives in u6 (“green” colour ROM), which no one normally scans for text.

Treating TF chips as “dictionary-less”. A second pass just stripped all high-bit bytes from TF records rather than expand them, producing readable-ish English with words missing. That got shipped briefly before the u6 scan turned up the real table.

Calling each chip MC or TF. The old decoder guessed each chip’s format from its characters. But the header says where each list starts, and one chip can hold the end of the MC list and the start of the TF list. Reading the lists from the header pointers turned up about 700 more records.

The Eight Categories

After decoding both formats with the merged dictionary stack, the 6,910 records fall into eight categories:

The Rebel name is period slang, the category is Southern-masculine trivia (guns, bourbon, pickups, pop country). Not Confederate iconography, despite the name; just bar-top content aimed at the demographic the operator would drop a Trivia Madness cabinet in front of.

Output

6,910 records across the eight categories. Questions are a mix of True/False (1,451 records) and Multiple-Choice (5,459 records). The MC format carries 2 wrong answers; the TF format carries only the opposite boolean.

References

Related

Cross-archive analyses

• Who Stole From Whom: 2,171 plagiarism hits
• The Funny Bits: AI reads 115K trivia questions