Tamagotchi ROM dump and reverse engineering

tamagotchi-rom-dump-and-reverse engineering

Often the true key to success is persistence and that holds true for this project which dumped the ROM from the current generation of Tamagotchi toys. If you’re a fan of learning the secrets built into consumer electronics — and you know we are — you’ll want to go back and watch the 24-minute lecture on Tamagotchi hacking which [Natalie Silvanovich] gave a 29C3 last year. She had made quite a bit of headway hacking the playable pods, but wasn’t able to get her hands on a full ROM dump from the General Plus chip on board processor. This update heralds her success and shares the details of how it was done.

As we learned form the video lecture it was a huge chore just to figure out what processor this uses. It turned out to be a 6502 core with a few other things built in. After prowling the manufacturer’s website she found example code for writing to Port A. She was then able to execute her own code which was designed to dump one byte of ROM at a time using the SPI protocol.

[Natalie] posted her code dump if you’re interested in digging through it. But as usual we think the journey is the most interesting part.

[Thanks Itay]

14 thoughts on “Tamagotchi ROM dump and reverse engineering

      1. Enjoy your lifetime of involuntary servitude!

        (Don’t worry, you’ll just have to push the “food” button every 5 minutes. It’s like Spacely Sprockets but with more iron bars and corporal punishment.)

  1. Coolness. I was thinking about cracking one of the old ones open myself and poking around. I’ll definitely be giving this a read.

    1. You’re probably better cracking a new one. Better features, and weren’t the first ones supposed to be worth millions to tiny keyring-panderers of the future?

      I was quite pleased to get a couple of them, the last two in the Woolworths in the only town that seemed to have any. One for my sister, since they didn’t talk to each other or anything. They were silly but simple enough to have a sort-of appeal to them, the minimalism retro-style. Monochrome 48×32 (I think!) and 3 carbon-pad rubber buttons that couldn’t have been smaller or cheaper made.

      In the end I left it behind in a house move, along with a load of old and great computers. Managed to take one of the PETs with me, with the dual full-height disk drives. It was a 96K Super-PET, I later discovered. I think I once got it to boot up a game or two. Them big giant dots on the floppy disks don’t fade away easily.

      I left the PET, when I had to move 300 miles. It had made a great TV stand / conversation piece! You could even turn it on and let people’s kids play with it. Pressing the buttons and seeing stuff come up on screen was excellent entertainment for the 3 and 4-year olds my friends had at the time.

      In other wierd computers, I recall a luggable with an orange plasma screen that booted into some sort of Minix or other Unix clone. I never got past the login, it was some sort of multi-user server. Keyboard flipped down from one side, it was on a cord. There was a handle (I think!) on top and it weighed a damn ton! Pretty soon it stopped booting altogether. I know very little about it. Any ideas what it might’ve been?

      1. Probably a Compaq Portable III. Gas plasma screen with a 20mhz 386. Came with Xenix installed (Microsoft’s gander at unix). I can’t into unix so I put dos 6.22 on it and installing a SoundBlaster/Ether16

      2. Sounds like a Bondwell (12 or 14 ?).

        The Bondwell-14 (1984). The Bondwell-12 was a "luggable" portable computer with a built-in 9 inch (23 cm) monochrome CRT display, equipped with 128 kB of internal memory, CP/M 3.0 and two double-sided, double density, 5.25 inch floppy disk drives (360 kiB).I got it second hand, and I wanted it because it was running CP/M 3.0. But I didn't like the orange display, I prefer green. Well, I sold it to another guy.

        I remember using one, and being super excited at being allowed to take it home from work to play overnight.
        OS was CP/M

  2. I actually had one when I was 19 in the army. It kept me from going crazy during all of those times we had to “hurry up and wait”.

  3. I never knew these had 6502s in them.
    I always thought they had a 4 bit uC like a μPD75X sometimes found in TV remotes.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s