Glasdons BT Monarch N2.X config Database

MONARCH - THE DIGITAL CALL CONNECT SYSTEM

SOFTWARE RELEASE M MEQ N2.4

PRODUCT   - CD SYSTEM

SITE CODE - DN098Q0A/000

Memory Map

The address bus on the 8088 in 16 bits ie 0000 - FFFF (64k)

but the Monarch uses "banking" to fit more things in.

Below is a monarch memory map, but it does NOT match the system I have.

eg My Monarch's Database PROM in 2x8k and starts at 16, NOT at 32k as in the diagram

so its between 16k-32k ?

Using the LMEM command you can read memory locations in Eprom,RAM and EEprom

The 16k (2x8k eeprom, IC49, IC50) Daughter card  (ASU 2A1/SA21023) can be found in the memory map ..

IC49 - between 03FF:0010 and - 05FF:000F or starting at 16k (16384 decimal)

The FTDB command causes the database in the NVram to be copied into the EEprom on the daughter board(ASU 2A1/SA21023)

Its similar to the TDB that copied the database in the NVram to a blank eprom in the daughter board.

Cracking the Monarch MMI passwords

16k Database MMI Passwords

One of the major hurdles to getting control of my Monarch was not being able to get into the MMI.

It had  non standard passwords set.

I found that the passwords could be found in the IC49  EEprom

If you get an eprom reader and get it to export in intel hex format, you will get something like this...

At line 129 you would find something like this.

:200FE000FFFFFFFFFFFFFFFFFF8E000F27C90755AADD444E3039385130412F30303011C6FF

The :200FE000 is not eeprom contents its the location

The FF at the end is again not eeprom contents its a line checksum

8E00 s the OSLC password in this case 142  =HEX2DEC("008e")

0F27 is the OSLM password in this case 9999  =HEX2DEC("270F")

C907  is the OSLS password in this case 1993 =HEX2DEC("07c9") i.e. OSLS 1993

If you can access the MMI, you can see the passwords (system keys) in 

EEPROM copy of the config database here with LMEM

03FF:0FF0 FF FF FF FF FF FF FF FF FF 8E 00 0F 27 C9 07 55

or the ram copy of the config database here with LMEM ie  "LMEM 7FFF FF0 F"

The LSK - List System Keys command does not list the OSLS password for some reason...

4k Database MMI Passwords

These passwords can be found in a similar way to the 16k ones above, but at a different location

:200A6000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7AFFFFDE000F27721297E5

222,9999,4722

Database Table 1 - Cards Installed

The first table in the data base starts at byte 2, the fist byte may be a checksum

The data in this table can be read with the LEND command

It looks like for each equipment number between 0 and 795 it holds 1 byte of what type of port it is.

What I know.

Table starts at 7FFF:0011 which is EN0 ( equipment number zero)

shelf5 starts at 7FFF:0206 which is en500 ( equipment number 500)

shelf 5 finishes at around  7fff:0264 which is EN 595 or 599 ?

Byte Meaning

Database table  containing directory numbers

when x2102 was en=1 and ln=1

80FF:0920 FF FF FF 00 00 01 00 02 00 03 00 04 00 05 00 06 BA

             2100  2101  2102  2103  2104  2015  2106  2107

when x2102 became spare (RDN 2102 2885)

80FF:0920 FF FF FF 00 00 FF FF 02 00 03 00 04 00 05 00 06 B7

             2100  2101  2102  2103  2104  2015  2106  2107

--------

when 2885 and 2878 was spare

80FF:0F30 FF FF FF FF FF FF FF 26 02 23 02 21 02 1F 02 FC 44

                         2878  2879  2880  2881  2882  2883

(RDN 2102 2885)

ADDN 2146 2878

became

80FF:0F30 FF FF FF FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 73

             2876  2877  2878  2879  2880  2881  2882  2883

2D hex = 45 decimal = EN45

80FF:0F40 01 25 02 FF FF 22 02 20 02 1E 02 1C 02 1A 02 18 AC

        2883 2884  2885  2886  2887  2888  2889  2890 

after (RDN 2102 2885)

80FF:0F40 01 25 02 01 00 22 02 20 02 1E 02 1C 02 1A 02 18 AF

        2883 2884  2885  2886  2887  2888  2889  2890

01 hex = 01 decimal =EN for x2885

x2876 was spare

80FF:0F30 FF FF FF FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 73

             2876  2877  2878  2879  2880  2881  2882  2883

ADDN EXTN 2122 EXTN 2876

80FF:0F30 FF 15 00 FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 8A

             2876  2877  2878  2879  2880  2881  2882  2883

15 hex is 21 decimal =LN

2D hex is 45 decimal =LN

                SELECT  WAITING SIC     DIVERT  VDU     FORCE

EXTN    EN   LN ANSWER  AMP     CHECK   OVRIDE  FBACK   RELEASE  MF4    10PPS

2878   121   45                                                   1       1

? LTKA 13

 TN   TYPE    DIRN   EN   LN    CONS I/C GRP KEY  ACCESS   GROUP

 13   EXCH2W  IN     84  621         1

 TN    DAP    NAP    DDI   DN  GP  ATTEN  REMOTE END  PW TYPE

 13    CONS   2170   OFF             3                        ACTIVE