Comments on: Tama-Town Tamago Teardown

By: natalies

natalies — Wed, 30 Nov -0001 00:00:00 +0000

Yeah, another concern is that instruction memory might be ROM under the blob, in which case there’s no wire to tap into. If it’s in the SRAM, then I might be able to lift and dump it or tap the wires.

By: jlamothe

jlamothe — Wed, 30 Nov -0001 00:00:00 +0000

Generally, embedded code tends to go into flash memory as opposed to straight-out ROM. People who make embedded products like to have a way to reprogram in the event of a problem rather than having to outright replace the chip.

Even if they have no intention of reprogramming after the product is shipped, it’s generally nice to have comparable (if not identical) hardware in the prototype as in the finished product. Makes the testing process much easier.

By: jeff-o

jeff-o — Wed, 30 Nov -0001 00:00:00 +0000

Hmmm, time to build one of those open source logic analyzers, I think!

By: Anonymous

Anonymous — Wed, 30 Nov -0001 00:00:00 +0000

There are two types of character figures. Type 1: those that are bundled with the Tama-Go, and Type 2: those that are purchased separately. Type 1 does not contain a ROM. The content that’s unlocked by attaching them is actually already in the Tama-Go’s ROM. A Type 1 PCB contains only a few jumpers to inform the Tama-Go which content to unlock. Type 2 contain a ROM and a few jumpers. Each type 2 ROM contains 3 data areas which allows it to be shared across three Type 2 character figures. Some jumpers on the Type 2 PCB inform the Tama-Go which data area to read from.

By: jeff-o

jeff-o — Wed, 30 Nov -0001 00:00:00 +0000

There’s really no point in removing the epoxy. Underneath is actually the bare semiconductor die, wire-bonded to the PCB. There will be no markings or evidence of what chip is actually in there. The only thing you’ll accomplish is the complete destruction of the brains of the device.

By: jlamothe

jlamothe — Wed, 30 Nov -0001 00:00:00 +0000

I guess the best bet would be to hook some sort of logic analyzer up to the pins on the sides of the board (they look like the means by which the chip is programmed).

Ordinarily, I’d think it’d be near impossible to make any sense of any signals being read from them, but I would have thought the same about reverse-engineering the IR protocol on the previous generation. I was proven wrong.

The trouble is going to be: unlike the IR protocol, I don’t believe Natalie has the device to which these pins connect. It’s really hard to reverse-engineer a protocol when you can’t receive input from both ends of the connection.

By: jlamothe

jlamothe — Wed, 30 Nov -0001 00:00:00 +0000

Just to clarify:

I’m talking about the pins on the blue board, not the red one.