Writing out the in port will likely shorten this Tamagotchi’s lifespan. Oh well …

It would have been more convenient to dump the ROM via IR or the SPI ports at the top of the Tamagotchi, but unfortunately, I don’t have any information on how to write to those ports. There is an application note describing how to write to port A on the General Plus site, though.

I started by dumping the entire memory space, from 0×0000 to 0xffff, which included all mapped memory, such as ROM, RAM and ports. This only dumped some of the ROM, though, as the GPLB52x microcontroller supports paging outside of 6502 paging. The first 16 kilobytes of the ROM are always mapped to 0xc000-0xffff, and then the rest of the ROM is split into 19 pages that can be mapped to 0×4000-0xbfff as needed. To dump the entire ROM, I needed to figure out how to page.

Loading oxc000-0xffff into IDA, it became apparent how to page pretty quickly.

Tamagotchi startup code (0xcc00 is the reset vector)

The address 0×3000 was written to quite often before jumps, and there were several subroutines that pushed and restored this value before jumping to another subroutine. Trying this in my dumping code, I was able to dump the entire ROM!

Doing a quick analysis, pages 0 through 6 appear to be code, pages 7, 8 and 9 are empty, pages 11-18 contain image data, page 10 contains some image data and some other data and I’m not sure what 19 contains (if I had to guess it would probably be audio).

Decoding the image data, you can already find out some interesting things. For example, here’s some of the images from page 18:

Pictures from page 18 (click to see full size)

In blue are all the possible Tamagotchi characters you can get on the Tama-Go! And in red below are the images from the factory test program, one of which I’ve never seen before, suggesting that there’s features of this program that haven’t been found yet.

For the Tamagotchi fans in the room, I’ve posted all the images I dumped here. I’ll be posting the rest of the code as I make sense of it.

In the mean time, here are some of the cuter highlights of the ROM dump.

Kwartzlab Radio Episode 6

Hip hip hooray!!

I mentioned in an earlier post that I saw some ‘freezing’ behaviour in the figure game functionality. Game logic is controlled in its entirety by a single bit ‘game code’, which I suspected was the index of a jump table containing all Tamagotchi functionality, and invalid game codes, especially those in the middle of the 0-255 range cause the Tamagotchi to freeze, requiring reset.

Looking into how 6502 (the Tamagotchi microcontroller architecture) works, I thought this might be a sign that the microcontroller was veering off into unexpected code.  Memory in 6502 is mapped into a single address space, and there’s no MMU or other memory protection. If unmapped memory is accessed, it returns 0 or some other garbage value. Invalid instructions do not cause a reset, but execute undefined behaviour taking a non-deterministic amount of time. This meant that freezing was unlikely to be due to an error being detected by the microcontroller (of course, it was possible that an error was being detected by the code on the microcontroller, and it handled the error by going into a tight loop, but this struck me as unlikely, as the Tamagotchi tends to handle detected errors by resetting). It also meant that exploiting a bug in 6502 should be reasonably forgiving,  as  if the PC ends up somewhere before the intended address, it will likely execute any garbage instructions in sequence, and end up at the right address anyhow.

My first thought was that maybe the invalid “game codes” corresponded to indexes outside of the jump table, so the microcontroller was jumping to addresses that were actually other data. Since LCD RAM is the only memory that can be controlled by a figure, I was hoping that maybe one of these values would cause a jump into LCD RAM. So   I filled up my LCD with a NOP slide and shell code and hoped.

Shellcode works better when an annoying Tamagotchi doesn’t stand in front of it

I tried all 255 indexes, but none of them worked. I did notice two interesting things, though. First, the indexes in the middle of the range weren’t all invalid. Some of them showed valid screens, although these screens didn’t always work. This meant that I probably wasn’t jumping to an unintended address, but something else was happening to cause freezing, such as the stack wasn’t set up correctly for the jump. Secondly, the index 0xCC had some interesting behaviour. If bit 3 of the 68th byte in the LCD RAM was set, it played a repeated beeping, and would detect when the figure was removed, and return to the main screen. If this bit wasn’t set, it would play no sound, and freeze. Based on the sound, I guessed that this was the location the Tamagotchi jumps to when playing a sound when a key is pressed. So the logic would be “check if sound is enabled (probably based on an address on the stack), and if set play the sound and return to the address on the stack otherwise return to  a different address on the stack”. Except the stack was messed up, so it was checking the LCD RAM for the bit, and returning to the address where it started instead of the correct address.

I found this perplexing. Considering that this behavior confirmed that pointers to the LCD RAM were being put on the stack before the jump, I found it surprising that none of the  255 possibilities were causing code execution. Eventually, I suspected my shellcode might be wrong. Since I have no sample microcontroller to test code on, and don’t know the locations of the ports, I thought this was likely. My original code was supposed to flash the IR LED, but I moved to the less ambition jumping to reset (since practically nothing will reset a 6502 microcontroller, this would be a good indicator of code execution). I also checked my code with the SunPlus compiler. And found I was using entirely the wrong instruction set. With the right instruction to byte value mapping, the Tamagotchi reset on the third “game code” I tried, 0xd4.

Playing with different instructions, I found the code execution was very unreliable, especially when calling longer instructions like stores and loads. Eventually, I figured out that the Tamagotchi LCD does not use one contiguous piece of LCD RAM, but uses at least two separate pieces. Jumping to one of these locations immediately after starting execution made it much more reliable.

Below is an example of changing the LCD using stores and loads. The area circled in blue is the first code that gets executed, and the area circled in green is the code in the contiguous memory it jumps to. The white boxes (circled in red) are the contiguous pieces of memory, set to be white using STA. The entire row is part of the memory, but I only set one byte (four pixels) per row.

Yes, I’m aware this is the lamest POC ever

For people trying this at home, the LCD RAM locations so far are:

Rows 1-7: 0x10cc-0×1107

Rows 8-18: 0×1120-0x117C

Row 17: 0x10B4-0x10CB

Row 18-31: ???

Next step: chain this together to dump the code!

Charlotte began her journey into art in the 1970’s creating pen and ink drawings with watercolour inspired by Aubrey Beardsley. In 2003, She attended a tile painting class which provided a whole new outlet for her creativity. Learning to manipulate the paint on a hard surface was challenging initially, but soon proved to provide the variety of expression necessary to keep going with it. She has always be drawn to bold colour contrasts and natural images. Charlotte especially enjoys painting on irregular shaped  tiles and sometimes on glass tile as well. Recently, she is experimenting with combining the paint with coloured ink and watercolour on other surfaces such as paper and wood. She is also doing Collage. Branching out into these other mediums has been exciting, drenched in possibility. To quote a dear friend, Bernie Rohde, Art is a Verb.

KW Maker Terry Jantzi drops by Kwartzlab to show off two of his bicycle creations: a tadpole recumbent “Warrior”, and the KrankiKobra. Check out his videos — lots of interesting things being made here in KW.

Enjoy!

Kwartzlab Radio Episode 5

Dev House Google Group

Kwartzlab Radio Episode 4

Enjoy!

Any groups or individuals interested in participating should complete the simple application at http://makerfairewaterloo.com/ by the end of April.

It’s no secret that I’m not impressed with the current state of University education. I’ve spent a long time griping about the various issues, and pointing out ways I would do it differently. None of that makes any difference, however, until I actually do something about it.

While my issues are with post-secondary education generally, my primary expertise (especially of late) is in Computer Science and Software development. So, I developed a curriculum, found a community, and started teaching a class.

Teaching one class does not constitute a solution, but it does provide a learning experience for me. The class is over half done now, and in the rest of this post I will be examing things I have tried and what I have learned.

Hands-on Learning

Since my approach is focused entirely on education, I did not assign any exercizes early on. I provided students with the tools needed to play with the concepts on their own, and set them free to hack. This turned out to be too open-ended. When encountering a new concept for the first time, many students simply had no concept of what direction they should take their explorations in.

I am now providing some concrete exercizes to the students, but really I need to find a way to integrate more hands-on learning into the class itself. This is made more difficult because of the pacing I chose for this version.

Pacing

Probably the biggest experiment in this first version of the course is the pacing I am using. The class is an overview of Computer Science from both the perspective of functional abstractions and low-level machine implementation. It is designed to give students a flavour of what parts of Computer Science they might find interesting for further study. I am doing the whole thing in 8 weeks.

The amount of material I am covering would normally be covered in two or more semesters at a University. Why am I doing this? For two reasons: so that students have less time to get bogged down on individual details (since, as an overview course, this is not about depth), and also to find out how fast one can reasonably progress without hopelessly confusing students.

While I cannot be sure without more experiments, I am also beginning to suspect that the pacing increases student engagement (at least for the sorts of students I have solicited). New material every single class means that students do not have an opportunity to tune out because “we already talked about this”.

While the pacing is definitely hurting the students’ ability to deeply absorb the subject matter, I conduct informal experiments periodically to determine understanding. Students in general seem to be grasping concepts, and find themselves coming back up to speed on items they failed to retain quickly enough to demonstrate a level of penetration.

Students

For this course, primarily because of the pacing, I solicited students with prior knowledge of computer internals and programming. I started out with a good mix of students from various backgrounds, but certain students (about half of the 10 I started with) dropped the course fairly early on.

Students who stuck with the course were precisely those students who had both enough knowledge of computer internals to handle the pace, and enough of a deficiency in prior experience with Computer Science-related material to be interested in an overview. I hope to run both slower and more in-depth courses in the future in order to serve other sorts of students.

While prior knowledge of the basics seems to be helping the students’ ability to comprehend new material, it also occassionally poses a distraction, since I cannot present any idea as strictly new. I need to improve my ability to communicate an idea that is “new” in the context of a course, without speaking as though no one present has ever heard of it before.

From the Top and Bottom

The concept of my particular curriculum for this course is to start at the “most” abstract and “most” machine-specific concepts, and work inward. This is in stark contrast to most first-year Computer Science courses, which start out in practical programming, move on to machine specifics, and then later on do algorithms and (maybe) more abstract (actual) Computer Science.

Students have indeed struggled with the seemingly-abstract concepts, especially early on when they may not yet even have a basis on which to understand “why they care” about the abstractions that are possible. This is partly because of my failure to spur adequate hands-on learning, and partly because of the ordering. On the other hand, the juxtaposition of abstractions and related implementation details has already more than once resulted in realizations about the nature of the abstractions (“that product type is just like a struct!”)

Next Steps

I still have to finish teaching this class, and will report more at that time. Some of my students (and also other members of the Kwartzlab community) have expressed interest in an Operating Systems implementation course, based on my Writing a Simple OS Kernel series of posts. I hope to run this course mid-summer, and structure it purely as a project course. This should give me more experience with the ways that hands-on learning can be effectively brought directly into a class.

I am also excited about the idea of running other more in-depth courses, based on community interest. From a “Computer Science for Programmers” side I would like to run a course I’m calling “Advance Abstractions” (dealing with advanced concepts in control flow and data modelling) and also a non-course structured as various talks by various contributors on specific data structures and algorithms.

I would also like to run the “slow version” of this same course, targetted at complete beginners. The problem with this version is that it requires participants to have more time to dedicate to the course. We’ll see where that goes.