Finally, after numerous attempts I made this thing speak to me!

But first things first. Currently I'm trying to find the code responsible for scanning and analyzing the keypresses. And I want to do it the easy way (i.e. using the debugger, not by reading /and understanding/ the whole source code). How hard can it be? Harder than I thought.

Let's take a look at the schematics (I have merged two pages and removed some irrelevant connections).

The keyboard matrix is driven by port A and port B of uPD7810. The CPU sets a 4 bit value on PB[0..3] which then gets decoded by IC11 and IC12. As you can see, both IC11 and IC12 enable lines are tied together, but IC11 is enabled when PB3 goes high and IC12, when it goes low. So if we set a PB value between 0 and 3, we will put SW lines 8-11 low, while values 8-F are enabling SW lines 0-7. SW lines 0-7 are connected to the keyboard and 8-11 are connected to the switch matrix.

SW columns are connected to PA through non inverting buffers. They are pulled up, so if no switch is pressed, PA should read 0xFF. DW6000 stores switch states in the external RAM ($27E9-$27EC). Ok, so far so good. Now, I thought that if I modify those addresses (e.g. change $27E9 from 0xFF to 0xEF) I should see some changes on the displays (= display memory - $27E1-$27E6 for 6 digits and $21E7 for the LEDs), right? Wrong. Each time I modified that value, it came back to 0xFF after some time with no change on displays whatsoever. I tried to set some watch- and registerpoints in the debugger, but it wasn't useful, cause the debugger was halting code execution too often.

I started to browse the source code looking for the places where PA is being read, but there was still too many gaps (i.e. addresses in RAM that contain something that gets analyzed, etc.). OK, so I need some help. Maybe I could force MAME to emulate those keypresses somehow?

Looking at the sources I found, that there are special handlers for both reading and writing to the memory and ports. I have modified the gmaster_state::gmaster_port_r handler to return a fixed value (0xFE) each time PA is being read and PB is set to 3. That should emulate the up key. The code compiled and as expected I saw one FE among FFs. Nice. Unfortunately that didn't work either. I was confused. After numerous attempts to make this damn thing speak to me I modified the code to return 0x00 (all keys pressed) no matter what. And this time... nothing happened. But at some point I changed one of the stored PA values and after some struggle I saw some values in the display memory saying "TAPE". Great success! OK, now I get it. There must be some sort of debouncing code that samples PA value, holds it, compares, yada yada yada and finally does what it should. I don't want to bore you to death describing my failed attempts to make this thing work, so I just show you what I ended with:

READ8_MEMBER(gmaster_state::gmaster_port_r)
{
	UINT8 data = 0xff;
	static __attribute__((__unused__)) UINT8 cnt = 0;
	switch (offset)
	{
	case UPD7810_PORTA:
		if (m_ports[UPD7810_PORTB] == 0x00)
		{
			if (++cnt % 3)
				data = 0xEF;
		}
		logerror("%.4x port %d read %.2x\n", 
                         m_maincpu->pc(), offset, data);
		break;
	}
	
	return data;
}

And that made me very happy. Looking at the memory window I finally saw some predictable changes: the value on the 1st display changed to 5- (1st keypress) and then to 55 (and so on).

Now I will try to "program" a sequence of keypresses which should bring me to an unsupported menu value. Wish me luck, I hope I'm getting closer.