For my next project I thought I’d try to keep it simple and check out a holiday card I received (as I found out, it’s probably a better idea for me to look at more complicated devices…).
This card has a button in the top left that plays “Jingle Bells” using barks (Figure 1):
Figure 1: Overview of the card
Once you open the card, you can see the rough outline of where some of the internals are — I tried to outline it a bit with a pencil (Figure 2):
Figure 2: Inside the card
Carefully opening this up with a razor blade, we see a small motor, a button, a speaker, and the board it’s all hooked up to (Figure 3):
Figure 3: Card components
The small board is laid out pretty nicely, actually — pretty much everything was labelled:
Figure 4: Main board
My main issue at this point is that since this is such a cheap piece of hardware (kind of crazy to think that this entire thing is meant to be disposable, basically) it’s another chip-on-board based system:
Figure 5: Chip on board close-up
Looking at this and the rest of the board, I was able to find what appear to be be 8 pins — V0, V1, P1, P2, SDA, SCL, VSS, and one that’s a bit too obscured by the packaging material to be read. Trying to search for 8-pin microcontrollers or ICs isn’t really getting me anywhere. Seeing that there’s just SCL and SDA, I’m thinking maybe it’s I2C, so I tried hooking up the logic analyzer and seeing what comes out when the button is pressed. I managed to capture some output coming from the chip towards the speaker as well as the SCL activity, but nothing really too interesting for me at this point. I think I’m going to move on and try to look at something with a bit more stuff on it for me to look at — like maybe some actual ROMs I could dump. I thought I’d be getting a better start by looking at these really simple things, but I think that they’re a bit too simple for me to get much out of it at this point.
I took a class on hardware RE back in June 2019, and it took me until now to actually get some basic equipment together (like a power supply, microscope, etc.) and start trying to do some on my own. I have a few devices kicking around (mostly leftover parts from things in the house) but I also went to some liquidator stores and bought whatever looked like the most crap electronics I could find.
I found something at one store that I can only describe as a “Tamagochi / Pokemon rip-off” that didn’t cost much so I added it to my purchases. I’m not going to include full details like the packaging and company name, but I’ll include my notes up until this point. I tried to be structured and careful about how I went about studying this thing as practice for other devices. I’ll say up front that I didn’t get very far, though I felt like overall it was a good learning experience.
Basically, the idea of this device is that you create a digital pet (choose from 160 breeds!) who lives in the device and eats and takes dumps and what not (unless it got constipated, which apparently is a feature supported by this device according to the instructions — you can deploy laxatives if this happens).
Figure 1: Front of the device
It’s about 2″x2″x0.75″, with a small LCD screen (I think?) that’s about 2cm square in the middle (almost 1″). Five buttons on the front, including a “reset” button which makes me think about what’s actually inside. It’s supposed to keep track of your pet over time, so it must have some way to save the current state, and I’m guessing the reset function just wipes that away? It also keeps track of the time, which is user entered upon first use.
Figure 2: Rear of the device
It’s held together in the back by three regular screws, plus one more that just keeps the battery case in place. It takes two LR44 batteries in parallel (I think — first, they look parallel and I’m not seeing anything to suggest they are in series, plus using a multimeter shows around 1.5v in the circuit, so I’m thinking that should indicate it’s parallel). No markings on the case or packaging to indicate something I could follow up on (like an FCC ID or something, though I do see that it has the CE marking in the plastic case).
Figure 3: Inside the case
Taking the case off reveals another four screws holding the circuit board in place, as well as what appears to be a rudimentary speaker (all it seems to do is beep, such as when a button is pressed or at power on).
Figure 4: Front, screen still in place
After removing the board and turning it around, you can see that basically it’s dominated by the screen and then by contacts for the buttons. The screen is actually pretty interesting to me — it’s very simple, and isn’t even connected to anything. It just lays on top of a series of connections to 33 pins (16 on top, 17 on the bottom) with what appears to be foam rubber. I figure that removing the screen must reveal the real inner workings of this thing.
Figure 5: Front of the board, possible COB in view
Uh… yeah. Not sure what’s in there, but I’m guessing a chip on board of some kind? Removing the screen also revealed some markings, “K-1459” and “16.12.02”, maybe a model number and production date?
Besides the buttons, speaker, and power (the batteries are connected via those two large blobs of solder to the right of the epoxy), I noticed a tiny SMD component of some kind off to the right:
Figure 6: Location and close-up of SMD component on board
Not sure what this is — a resistor? No markings either, and I didn’t try anything with the multimeter. I soldered a couple of wires to where the batteries hook up, then tried seeing what I could see at various connectors on the board (trying to find a ground and anything else). I wasn’t being too systematic at this point as I was running out of steam, but I also didn’t find anything that looked too obvious as an interesting connection. I noticed that the pins that lead to the screen all were around 0.75v when I tested them, and otherwise I was pretty much always seeing around 1.5v from everywhere else (same result that I got when I had it running on batteries as designed).
I was thinking that I need to get rid of the epoxy to try to figure out what’s under there, but I think it’s probably likely to be a COB and not just a packaged IC that’s under epoxy to help prevent disassembly. If I take the epoxy off of a COB, I’m almost certainty going to destroy it since I’ll be doing it with hot air and something metal, so I don’t really want to go that route. I even tried holding the board in front of a VERY bright light (1200 lumens) and while it lit up the board itself quite nicely, it still wasn’t enough to get through the epoxy. Next time I pick this one up I’ll try to see if I can figure out what might be a 40-pin 1.5v IC in there based on the manufacturer’s site and also maybe I can try to find a pin I can use to see what’s on the IC. I might also be able to think more carefully about where each pin is going and try to see what I can find based on that.
