Nov
11
Tama-Town Tamago Teardown
The latest Tamagotchi has arrived, so I thought I would take it apart and see what’s inside.
A lot looks the same. The board has the same IR transmitter and receiver and SRAM as the previous version. There are a few more transistor/diode ICs and no visible debug pads.
Unfortunately, the microcontroller is still covered in epoxy. I tried to scrape it off (with heat) and dissolve it with acetone, neither of which worked.
A cool new feature of the Tamago is that you can put plastic characters on top to unlock certain games.
The contacts look like the contacts of a smartcard reader, but the tiny PCB inside the character is quite simple.
Using a multimeter, this appeared to act as just a jumper (although the copper makes it seem as if it is more complex). Definately an area to look into 
And the contacts on the other side are shaped like hearts. How can you not like that?
| Attachment | Size |
|---|---|
| box.png | 387.39 KB |
| board.jpg | 101.93 KB |
| expoxy.jpg | 58.26 KB |
| tama.jpg | 18.24 KB |
| contacts.jpg | 63.3 KB |
| tiny.jpg | 9.94 KB |
| hearts.jpg | 25.97 KB |
Subscribe to RSS Feed
Follow us on Twitter
Our Mailing Lists
Visit Kwartzlab TV
Yeah, another concern is that instruction memory might be ROM under the blob, in which case there’s no wire to tap into. If it’s in the SRAM, then I might be able to lift and dump it or tap the wires.
Generally, embedded code tends to go into flash memory as opposed to straight-out ROM. People who make embedded products like to have a way to reprogram in the event of a problem rather than having to outright replace the chip.
Even if they have no intention of reprogramming after the product is shipped, it’s generally nice to have comparable (if not identical) hardware in the prototype as in the finished product. Makes the testing process much easier.
Hmmm, time to build one of those open source logic analyzers, I think!
There are two types of character figures. Type 1: those that are bundled with the Tama-Go, and Type 2: those that are purchased separately. Type 1 does not contain a ROM. The content that’s unlocked by attaching them is actually already in the Tama-Go’s ROM. A Type 1 PCB contains only a few jumpers to inform the Tama-Go which content to unlock. Type 2 contain a ROM and a few jumpers. Each type 2 ROM contains 3 data areas which allows it to be shared across three Type 2 character figures. Some jumpers on the Type 2 PCB inform the Tama-Go which data area to read from.
There’s really no point in removing the epoxy. Underneath is actually the bare semiconductor die, wire-bonded to the PCB. There will be no markings or evidence of what chip is actually in there. The only thing you’ll accomplish is the complete destruction of the brains of the device.
I guess the best bet would be to hook some sort of logic analyzer up to the pins on the sides of the board (they look like the means by which the chip is programmed).
Ordinarily, I’d think it’d be near impossible to make any sense of any signals being read from them, but I would have thought the same about reverse-engineering the IR protocol on the previous generation. I was proven wrong.
The trouble is going to be: unlike the IR protocol, I don’t believe Natalie has the device to which these pins connect. It’s really hard to reverse-engineer a protocol when you can’t receive input from both ends of the connection.
Just to clarify:
I’m talking about the pins on the blue board, not the red one.