Cracking Status Games Trivia (1984)

Add-0x20 character encoding, bit-6 word boundaries, and compressed phrase tokens, 18,801 questions from the statriv2 family

April 2, 2026 · crack, status-games, statriv2, 8085

← Archive

Status Games Triv (Quiz / Two / Four / Sex / Super Triv II-III)

Status Game Corporation · 1984-1988 · Intel 8085 @ 12.4 MHz · 10 ROM sets · 18,801 records

The Games

Status Game Corporation was a small Brooklyn-based coin-op operator that spent the mid-1980s shipping bar-trivia cabinets into the same NYC-area taverns and diners as its bigger competitors. Their machines were the kind of thing you’d glance at near the cigarette vending machine, a simple upright or cocktail cabinet, color monitor, four chunky answer buttons, and a coin slot ready for quarters. Players got a handful of questions per credit, cycling through trivia categories, chasing a score posted on the attract loop.

The lineup spanned enough gameplay styles to keep an operator’s route interesting. Triv Quiz¹ (1984) was the original 4-answer multiple choice format. Triv Two (1984) and Triv Four (1985) extended it with more questions per coin. Hangman (1984) put a twist on the formula, players guessed letters to reveal an answer phrase, with each wrong letter adding to the doomed stick figure (this one got its own write-up , its program ROM had no phrase table at all). Sex Triv (1985) was the adult version for certain bars (“Ensexlopedia”, “Sensual Knowledge”, and “Sexperts Only” as categories). Super Triv II (1985) added XOR encryption, and Super Triv III (1988) bumped the question pack to include late-80s pop culture, Miami Vice, Back to the Future, Top Gun.

All of them ran on the same platform: an Intel 8085 board at 12.4 MHz that the MAME driver calls statriv2. Status Games didn’t design the hardware from scratch; they shared it across their whole trivia line and just swapped question ROMs and program EPROMs. The result is eight ROM sets that all speak the same encoded dialect.

The Data

18,801 cracked records across the ten statriv2 ROM sets covered here (Hangman’s 893 are documented separately):

Triv Quiz → · Status Trivia 2 → · Triv III → · Status Trivia 4 → · Trivia 5 SE → · Sex Trivia → · Super Triv II → · Super Triv III → · New Super Triv III → · Qua Quiz 2 →

How We Cracked It

The Question

Open any Status Games question ROM in a hex editor and you get garbage. No plaintext. No obvious ASCII. Every byte has bit 6 cleared, which destroys the distinction between uppercase letters, lowercase letters, and control codes. There are four layers to undo.

Layer 1: Add 0x20

The foundational encoding. Every character byte in the ROM sits 0x20 below its ASCII code. To recover ASCII, add 0x20 to each byte, which is exactly what the 8085 does right before it prints:

  ROM byte:   0x34  0x32  0x29  0x36  0x29  0x21
  + 0x20:     0x54  0x52  0x49  0x56  0x49  0x41
  ASCII:       'T'   'R'   'I'   'V'   'I'   'A'

This is not encryption, it is a side effect of how the 8085 firmware stores characters. The letter A (0x41) becomes 0x21. Space (0x20) becomes 0x00. The $ sign (0x24) becomes 0x04, and the digits become 0x10-0x19. The low 6 bits carry the character identity; bit 6 is freed up as a structural flag.

We used to read 0x01-0x0F as extra uppercase letters, which turned “$64,000” into “D64,000” and “rodgers & hart” into “rodgers F hart”. They’re just punctuation.

Layer 2: Bit-6 Word Boundaries

Bit 6 does double duty. When a raw byte has bit 6 set (range 0x40-0x7F), it marks the last character of a word, a space should be inserted after it. The byte itself IS the ASCII code (no OR needed), and a word boundary follows.

This eliminates storing space characters between words. Consider “IN FLASH GORDON”:

  Bytes:  29 6E 26 2C 21 33 68 07 2F 32 24 2F 6E
          I  n  F  L  A  S  h  '  G  O  R  D  O  N

  0x29 = 'I'  (bit 6 clear → regular character, OR 0x40 → 0x69 → 'i')
  0x6E = 'N'  (bit 6 SET → end of word "IN", byte is 0x6E = 'n', insert space)
  0x26 = 'F'  (bit 6 clear → OR 0x40 → 0x66 → 'f')
  0x2C = 'L'  (bit 6 clear → OR 0x40 → 0x6C → 'l')
  0x21 = 'A'  (bit 6 clear → OR 0x40 → 0x61 → 'a')
  0x33 = 'S'  (bit 6 clear → OR 0x40 → 0x73 → 's')
  0x68 = 'H'  (bit 6 SET → end of word "FLASH", byte is 0x68 = 'h', insert space)
  ...
  0x6E = 'N'  (bit 6 SET → end of word "GORDON", insert space)

The result: IN FLASH GORDON stored in 13 bytes instead of 15 (no spaces). For short trivia questions this saves 10-15%, significant on 8KB EPROMs.

Layer 3: High-Bit Word Tokens (0x80+)

Bytes with bit 7 set (0x80-0xBF) are not characters at all. They are indices into a phrase table stored in the 8085 program ROM. Each game variant has its own table. For Triv Quiz, the table lives at address 0x2F0D in the program ROM:

  Token   Phrase
  ─────   ──────────────────────────────
  0x80    WHAT IS THE CAPITAL OF
  0x82    WHAT IS THE
  0x84    WHAT IS
  0x88    WHO INVENTED THE
  0x8C    WHO SAID
  0x8E    IN THE
  0x93    WHO
  0x94    THE
  0x96    WHAT
  0x97    FIRST
  0xA2    WORLD SERIES
  0xB4    WHO PLAYED
  0xBC    'GILLIGAN'S ISLAND'
  0xBF    'BEVERLY HILLBILLIES'

A single byte 0xB4 expands to WHO PLAYED , 11 characters from 1 byte. The Triv Quiz table has 64 entries (0x80-0xBF), heavily weighted toward trivia question starters and TV show titles. A question beginning with “WHO PLAYED THE LEAD IN” compresses to just three bytes: B4 94 ... plus the remaining text.

Layer 4: Field Delimiters

The delimiter bytes in the 0xF0+ range give structure to each question record:

  0xFE, question text line break (wraps to second display line)
  0xFA, answer separator (first answer is correct)
  0xFB, answer separator (variant)
  0xFC, answer separator (variant)
  0xFF, end of question record

A complete question record looks like this:

  [question text bytes...]
  FE                          ← line break (display wraps here)
  [more question text...]
  FA                          ← first answer follows (this is the correct one)
  [correct answer bytes...]
  FA                          ← second answer
  [wrong answer bytes...]
  FA                          ← third answer
  [wrong answer bytes...]
  FA                          ← fourth answer
  [wrong answer bytes...]
  FF                          ← end of record

The parser splits on 0xFF, finds the first answer delimiter (0xFA, 0xFB, or 0xFC, which one varies by ROM set), then splits answers on that same delimiter. The first answer is always correct; the game shuffles display order at runtime.

Layer 5: Super Triv II Encryption

Super Triv II (1986) adds a fifth layer: per-byte XOR encryption based on the ROM address. Each byte is first inverted and masked to 5 bits, then XORed with a bit-swapped version of the address byte:

  decrypted = (~byte) & 0x1F
  key = bitswap8(address & 0xFF, 4, 3, 3, 2, 2, 1, 1, 0)
  decrypted ^= key

The bitswap8 function reorders the 8 bits of the address low byte. bit 0 of the output comes from bit 0 of the input, bit 1 from bit 1, bit 2 from bit 1, bit 3 from bit 2, and so on. The doubled bits mean the key space is smaller than 256 values, but it is enough to defeat casual hex-editor browsing. This algorithm was confirmed against the MAME driver source for supertr2.

After decryption, the standard add-0x20 / bit-6 / token encoding applies.

Extracting the Token Tables

Each game variant compiles its own phrase table into the 8085 program ROM. Early on the extractor just scanned for runs of uppercase phrases separated by 0xFF bytes and numbered them from 0x80. That works when the game reads its phrases in order, and for some of them it doesn’t.

The firmware doesn’t index the phrases directly. It goes through a small pointer table: the print routine masks the token byte, looks it up in the table, and prints whatever phrase that pointer lands on. Every Status game uses the same bit of code, so it’s easy to find:

  and 7Fh        ; token byte -> index (Triv Two uses and 3Fh / dec a)
  rla            ; x2, pointers are 2 bytes
  ld hl,TABLE    ; the pointer table
  call add_a_hl
  ld e,(hl) / inc hl / ld d,(hl)   ; DE = phrase, print until 0xFF

Now every set reads its map straight out of that table. For Triv Quiz, Super Triv II and Super Triv III the plain scan was already right. Triv Two, Triv III and Sex Triv weren’t: their maps had been pieced together from question context, and a lot of them were wrong. That’s where questions like “what what team did jackie jensen play for” and “what percentage prime reason for sex” came from.

Results

18,801 questions extracted across the 10 statriv2 ROM sets covered by this post (Hangman’s 893 are documented separately):

  Triv Quiz          1,392 questions   (1984)
  Triv Two           1,271 questions   (1984)
  Triv III           1,226 questions   (1985)
  Triv Four          1,039 questions   (1985, 4 category chips)
  Triv 5 SE          1,039 questions   (1985, special edition)
  Sex Triv             957 questions   (1985, offset-4 token table)
  Super Triv II      3,849 questions   (1986, XOR encrypted)
  Super Triv III     3,439 questions   (1988, ROMREGION_INVERT)
  New Super Triv III   898 questions   (1988, alt question set, 1 bad chip dropped)
  Qua Quiz 2         3,691 questions   (1985, German-language)
  ─────────────────────────────────────
  Total             18,801

Super Triv II alone, with its 8 question ROM chips and XOR encryption, is the largest single extraction in the archive. Sample questions:

  [Triv Quiz]    WHAT IS THE CAPITAL OF Montana
    ✓ Helena  ✗ Billings / Great Falls / Butte

  [Triv Two]     WHO PLAYED the scarecrow in the wizard of oz
    ✓ Ray Bolger  ✗ Bert Lahr / Jack Haley / Frank Morgan

  [Super Triv II] IN FLASH GORDON what was the name of the evil emperor
    ✓ Ming  ✗ Ling / Khan / Fang

What Remains

Not much on the token side. Every set’s phrase map is now read from its own 8085 pointer table, so there’s no guessing left.

The last guessed token went too. Super Triv III’s 0xE1 had been filled in from context as MOVIE , and the ROM says PRODUCT : “a gross commercial on a product called ‘brown 25’” → The Groove Tube.

Hangman’s trivia chips turned out to be leftovers from other Status games, so each one now decodes with its own game’s table (see the Hangman write-up ). One of its sports questions is damaged in the ROM itself and stays garbled no matter which table you use, so we left that copy out. The other copy still reads: “what fiege football career record does obed ariri hold → field goals”.

Zero placeholder-bearing rows ship in the archive.

The encoding itself is elegant for 1984: three layers of compression (bit-6 boundaries, phrase tokens, field delimiters) on an 8-bit CPU with no hardware compression support. The 8085 runs at 12.4MHz, fast enough to decode tokens in real time as the player reads the question on screen.

Arcade Trivia Archive, data extracted from MAME ROM dumps using a custom Python decoder. Extractor: scripts/statriv2/extract.py · Format: scripts/statriv2/format.py

References

Related

More cracks

• Status Games Hangman

Cross-archive analyses

• Who Stole From Whom: 2,171 plagiarism hits
• The Funny Bits: AI reads 115K trivia questions