Mike's PCjr Page

So the PCjr has some undocumented diagnostics code built-in the ROM.

Basically when you enter into diagnostics mode with Ctrl + Alt + Insert, you can trigger different diagnostics mode with the following.
Right after pressing Ctrl + Alt + Insert do:

• Press: Joy 1 button B, and Joy 2 buttons A & B for Manufacturing burn-in mode: enters diag loop mode without the diag screen
• Press: Joy 1 button A, and Joy 2 buttons A & B for Manufacturing system test mode: enters boot loop. Keeps booting
• Press: Joy 1 buttons A & B, and Joy 2 button B for Service loop-post mode: displays all diagnostics options, even if the hardware is not present
• Press: Joy 1 buttons A & B, and Joy 2 button A for Service system-test mode
• Press: Joy 1 buttons A & B, and joy 2 buttons A & B: enters boot loop with sound test

It also has a hidden "joystick" test that can only be "tested" with the keyboard. I guess it was just testing code that IBM forgot to remove. This one:


Here is a tool the tool to trigger the hidden "joystick" test (press "7") and to trigger the different diagnostics mode (in case you don't have two joysticks):
https://github.com/ricardoquesada/ibm_p ... r/undiagjr


Warning: If you enter into the first mode (Manufacturing burn-in mode), it will format the floppy diskette without any warning.
In fact, I wrote a vulnerability report about this
IBM PCjr zero-day data-destroy vulnerability: https://retro.moe/2018/01/15/ibm-pcjr-z ... erability/

I have to say, I'm shocked to learn something new about the PCjr -- I never dove deep enough into the BIOS listing to catch this. Very impressive digging!

Trixter wrote:I have to say, I'm shocked to learn something new about the PCjr -- I never dove deep enough into the BIOS listing to catch this. Very impressive digging!

Thanks!

Nice work, even made it to Hackaday

smitty wrote:Nice work, even made it to Hackaday

Ha, thanks! It was a nice surprise to see it in hackaday.

Kudos! I've poured over a good portion of the BIOS code too and never found this. Pretty cool!

Having done a lot of debugging a problem over the last few days I think this discovery is a result of an IBM test harness that was used by service organizations. There was a test plug documented in the IBM docs that plugged between the two joystick ports. I believe, but not sure that this connection activated the "advanced" tests that you get to with <cntl><alt><insert>. Doing this sequence normally gets you to the "customer tests" but the docs talk about another level and that chapter follows the insertion of the test-plug that connects the two ports.

I think these undocumented diagnostics were found by pressing joystick buttons that accidentally mapped to what the test plug connects.

Would love to find a test plug or how one would be made. Might be more there than what we know!

-t

I actually don't think this is undocumented - it's just not commonly known. But I won't tell anyone ...

It's in the Hardware Maintenance and Service Manual for the PCjr.