In the late 1980s, Key Systems released the CD 2000, a key management system made for dealerships to keep track of who had what key out and what cars were popular – think of a key vending machine. Now, nearly 30 years later, a friend of mine picked up the CD 2000 on eBay because he wanted to play with it. We’ve gotten it to boot, fixed a failed power supply, gotten the software running in DOS Box, imaged the floppies, and (poorly) interfaced a terminal. The barcode scanner isn’t functioning correctly, but the rest of the unit seems to work.

This is the CD 2000. It’s not exactly small.

Internally, it can hold upwards of 400 keys, and uses a carousel system with a robotic arm and barcode scanner to check keys in and out. It supports multiple linked cabinets, and uses an attached Qume Terminal to enter new keys and run reports. A tractor-fed printer is used to print new barcodes, which are placed on plastic key holders and then fed into the machine.

It’s a interesting piece of historical machinery, and we’ve partially gotten it running. Here’s our progress.

Power!

Here’s a look at the top of the chassis, which holds two power supplies – a 48v PSU and a -12v/5v/12v PSU.

Within a few minutes of powering up the machine, a filter cap on the aging power supply failed. Rather than trying to replace the cap, I decided the easiest way to get the CD 2000 functional was to get a PC PSU and swap it out. Fortunately, a handful of modern power supplies still have the -12v rail that this machine needs. A trip to Micro Center and a wiring diagram later, we have a franken-PSU! Also, MicroCenter’s last USB floppy drive.

It’s 2018 and I bought a USB Floppy Drive. Time to party like it’s 1996. pic.twitter.com/nzBMJwXJTf

— Robert Scullin (@robertscullin) March 13, 2018

The 48v power supply didn’t give us any issues, but we’re puzzled by the odd power system – the 48v output goes into a bank of 6 50W/300Ω resistors, and then somewhere into the chassis.

Booting it

The CD 2000 has an Intel 8085 as it’s main processor, and runs some (unknown) variant of DOS. The system boots the main program code off the floppy, and then loads the databases into memory.

Once booted, the salesman would punch in the number of the car he wanted, then his ID. If he had access to the car, the machine would fetch the key and drop it in the lower slot. Since we don’t have access to any salesmen to ask for their ID, we had to improvise. I hooked up my laptop in hopes that I’d be able to get some form of serial output.

Output I did get, but unfortunately littered with Qume QVT100 control characters. It’s not the most pleasant to try to figure out what’s going on, but it’s somewhat workable.

By deleting the SETUP.DAT file on the floppy disk, I was able to remove any form of security restrictions and poke around the reporting menu. I was able to look up a salesman, his code, and a key code. Punching in the key code and the salesman ID resulted in the machine fetching the key and “dropping” it in the slot.

However, the barcode scanner seems to be inoperable, and thus there’s no way to put a key back into the system. Thus, we can only remove the handful of keys that the existing system still thought it had in it.

Booting it, in DOSBox

On a hunch, I tried booting the floppy img in DOSBox, and amazingly it worked – with no configuration. This should make it easier to RE the data formats and test binary modifications without having to be near the CD 2000.

Manuals

I scanned and OCR’d all the manuals that came with the CD 2000.

• CD 2000 - Users Guide
• CD 2000 - Service Information
• Kam II - Service Release (Motherboard Replacement)

Next Steps

Now that we have a (mostly?) functional system, there are a lot of things we’d like to do to make take this from “neat thing to poke at for an evening” to “neat thing to poke at for a month”.

• I’m going to image all the floppies we got with the machine. Of the 4 discs I imaged of v2.42 of the software, 1 had read errors. Hopefully I can get a valid read of the handful of different OS versions before the floppies die.
• I’m going to attempt to replace the Qume Terminal control characters with newlines to make the system a bit more readable. Since I can test in DOSBox, it’ll be a lot easier to see if it’s feasible. Having usable terminal output would make the machine more or less usable on the software side.
• Related, I want to see if I can RE the data format that the machine uses to store the salesmen/cars/access levels. It’d be a lot more convenient to edit a CSV and convert to/from the binary format rather than using the menu for initial setup.
• Attempt to fix the barcode scanner and print new barcodes. If we can’t get the scanner to work, most of the rest of this is moot.

Wrap Up

This was an interesting (though not incredibly practical) bit of historical exploring. If you have ideas for things to try, are good at REing late 80s-era binaries, or know of a Qume term emulator, let me know – Tweet me @robertscullin.

May 2019 Update: No new progress on this, unfortunatly. I don’t have direct access to the machine any more, so any follow ups will be from notes I took, or things I can reproduce in DOSBox.