Hacking the Tandy Zoomer Z-PDA / Casio Z-7000

by Enigma

Recently, I purchased a Personal Digital Assistant (PDA).  I chose the Tandy/Casio model over the Apple model partly because I was familiar with the i8088 and GEOS operating system (I figured I could write software and hardware hacks much more easily), but the big driving force of my decision was a nice employee discount!

Those who own the Z-PDA and are already familiar with the IBM world can vouch that it is very similar to a PC - all the way down to the AUTOEXEC.BAT and CONFIG.SYS.  This got me to thinking about how to hack its software and firmware.

The File Manager is one of the most important parts of the Z-PDA in my personal opinion.  It lets you see which files are located in which directory.  It verifies the existence of AUTOEXEC.BAT, CONFIG.SYS, and various INI files.  The key to hacking into the Zoomer lies in these files - but how to get to them?

Something that Casio and Tandy did NOT tell you is that a simple text editor exists for the standard, stock Z-PDA.  It's part of America Online's Compose Mail feature.  Just launch America Online, select File Open, and use the dialogue box to pick (almost) any file.  Try looking at A:\AUTOEXEC.BAT right now.  This batch file and its complement CONFIG.SYS are executed when you first turn on the Z-PDA and when you press the reset button in the battery compartment.

The big problem with this, though, is that these essential files are located on the ROM disk.  You can change them on-screen, but when it comes to saving them, you will not be allowed to.  So we can't change these.  What now?

There are still all those INI files lurking about.  Can we change these?  Try it.  The answer is: not directly.  There are two main files: B:\GEOWORKS\GEOS.INI and A:\NET.INI.  You can open NET.INI and see all kinds of nifty things to play with, but nothing that can be changed - alas, it's on the ROM drive.  When you try to open the other file (GEOS.INI), you will get a file error.

After some experimentation coupled with my programming experience, I concluded that this INI file is "in use" by the GEOS operating system itself.  Because of this, GEOS will stop you from using that file.

At this point, we know that we have to change the contents of A:\NET.INI, but there does not seem to be a way to do that.  Oh, dreck!  So close and yet so far...

Look through the AUTOEXEC.BAT again and see that it makes a call to a little batch file named MKRAM.BAT.  This batch file checks the existence of: B:\GEOWORKS\GEOS.INI

If it isn't there, one of the ROM files, A:\LOCAL.INI, is copied to B:\GEOWORKS\GEOS.INI, in effect creating the proper INI file.  This gives us a lead into what is contained in: GEOS.INI

Open A:\LOCAL.INI and you will see a simple two-line configuration that points to A:\NET.INI.  Hmmm, interesting...  GEOS.INI is on the RAM disk (i.e., it, theoretically, can be modified) and points to a config on the ROM disk.

We will need to do two things at this point:

  1. Copy NET.INI to the RAM disk, allowing us to modify it.
  2. Change GEOS.INI to point to our NEW NET.INI.

With the GEOS operating system restrictions, this doesn't seem like an easy task.  The first thing to do is load up the File Manager.  Copy A:\NET.INI to BANET.INI.  This is the easy part.

Now we have a NET.INI that resides in RAM which can be easily modified.  Don't edit this file yet, though, as you don't know what you're doing and can potentially mess something up.

The second step is a little more tricky.  Somehow we have to change the second line in GEOS.INI from ini=A:\NET.INI to ini=B:\NET.INI.  Because GEOS won't let you edit the file directly, this is easier said than done.

You may have noticed that there is a file in the File Manager, SDISK.EXE, that will completely reset your Z-PDA to factory defaults, clearing all memory.  If you run this by double-clicking, it looks like GEOS shells to DOS and then executes the program.  You may also notice that SDISK.EXE has a slightly different icon.  If you rename SDISK.EXE or if you create a batch file and try to execute it under the File Manager, the Z-PDAZ-PDA spews out an error message.

Now, with this information, take a look at the NET.INI config file.  Under the entry [fileManager] are a few lines - specifically one mentioning SDISK.EXE followed by, presumably, an icon name.  You'll also notice that lines exist for PENRIGHT.BAT, ZDRIVER.EXE, ZDRIVER.COM, and ZDRIVER.BAT.

This means that ANY non-GEOS file named one of these five things can be executed directly from the File Manager.  Another practical advantage of this icon execution is that when GEOS shells out to one of these files, it closes all of its data files (including GEOS.INI).  A batch file can then delete or overwrite this all important INI file.

Now, how to specifically do this?  Simple.  Use File Manager to make a copy GEOS.INI called, say, TEMP.INI.  Use America Online to modify the string A: into B: in your TEMP.INI file and save it.

Now use America Online to create a new file called ZDRIVER.BAT and fill it with this line:

COPY B:\GEOWORKS\TEMP.INI B:\GEOWORKS\GEOS.INI

and save it.

Jump back over to File Manager, and double-click on your ZDRIVER.BAT file and it will install your own, personal GEOS.INI.  You can delete TEMP.INI now, if you wish to free a little disk space.

You will now be able to modify your own B:\NET.INI to your heart's content!

Take note, though, that the only time GEOS will reread this configuration file into memory is when the Z-PDA is rebooted or when GEOS returns from a shell.  Rebooting is accomplished by hitting the reset button in the battery compartment while the unit is on (be sure that your are not holding down the A and B buttons while doing this or else all of your data will be wiped).

So, after you edit NET.INI, you will have to hit the reset button.  This can be gotten around, though, by creating a ZDRIVER.BAT file with just a single line that does not do anything (REM, ECHO, EXIT).

A word of caution before we continue.  Any time you screw with a computer's configuration, especially if you do not know what you're doing, you are going to lose something.  When your Z-PDA locks up beyond hope because of a faulty INI file, the only way to fix it is with a total reset (both action buttons and reset).  I have found this out the hard way several different times.  If you are going to play with your Z-PDA's configs, be prepared to lose something.  A null modem cable or a serial cable with a null modem adapter plug will only cost about $25.  The "official" transfer software for the Z-PDA costs about $100 and something similar can be found on America Online (and who can't get a 5-free-hour-voucher for AOL these days?).  To put it bluntly, if you have important information, be sure to back it up because it will get wiped.

Now that we can get to and change the configuration, let's look at what can be done.  NET.INI contains many different things to play with.  Some of the more stable ones I've found (title followed by variable) are:

[system] (fontSize) and [motif] (fontSize):  These two variables are, by default, equal to 10.  If you have good eyes, you can change them to a smaller value to make the screen less cluttered.  You can also make them larger.

[ui] (screenBlanker):  This is usually set to "true".  You can change it to "false" if you don't want the screen blanker to ever kick in.

[hardIconBar] (app0 ... app5):  These are the filenames of applications to run when you tap on the hard icon bar.  I've found that it's a little more convenient to change the World Clock icon so that it will run the File Manager (in my opinion, much more useful!).

[fileManager] (filenameTokens):  This section seems to contain information about what non-GeoWorks (DOS) programs and batch files the File Manager will let you run.  You can add entries here to fool the File Manager into letting you run your own little programs.

Have fun figuring this stuff out!

I've ordered the Zoomer Software Development CD and the service manual for myself, so I may have some more useful information in a future article.  Before concluding this article, I would like to pose a question to my fellow 2600 readers.  Organizers (such as the ZPAD, the Casio BOSS, etc.) have a password feature.  Does anyone know how secure those passwords are?  Or more exact, does anyone know a specific way to bypass the password in one of these gadgets?  Obviously, there must be SOME sort of backdoor that the technicians can use to get into the organizer without wiping the data.

Happy hacking!

Return to $2600 Index