Last chance to enter The Hackaday Prize.

Reverse Engineering HitClips

hitclipz

After a quick review of the Hackaday viewer demographics, we need to say the late 90s were weird. Even portable audio players were downright bizarre: MP3 players existed, but you loaded up your songs (all eight of them) over your PC’s parallel port.  While helping a cousin move some furniture, [Ch00f] found a huge collection of one of the oddest music formats ever: HitClips, a tiny plastic encapsulated bit of circuitry that stores 60 seconds of terrible-sounding mono audio. Yes, this was a thing, but so was the pet rock. With no HitClips player, [Ch00f] decided he would take a swing at reverse engineering these tiny, tinny songs.

After taking apart the plastic enclosure, [Ch00f] found a very simple circuit: a few resistors, a cap, and an epoxy blob that enclosed an die with the musical data. On the back of the clip, there are eight pads for connecting to the player. With nothing to go on, [Ch00f] started poking around and found connecting one of these pins to ground caused circuit to draw 300uA of current for about 60 seconds – the same length of time as the recorded sample.

[Ch00f] originally thought the HitClip would provide audio data over an SPI or other digital protocol. What he found was much more interesting: two of the pins on the HitClip correspond to the push and pull FETs of a class D amplifier. The audio on the HitClip is digital audio, but it’s encoded so it can directly drive an analog circuit. Pretty clever engineering for a happy meal toy, if you ask us.

After dumping this data with a logic analyzer, [Ch00f] turned all the values in to .WAV file. It was, amazingly, music. A little refinement to the process to nail down the timing resulted in a 60-second clip seen (heard?) after the break.

Since [Ch00f] doesn’t want to spend $40 on eBay for a vintage HitClips player, he’s right about at the limit of what he can reverse engineer out of these cheap, crappy music chips. He has put up all his documentation, though, so if you’re up for improving on [Ch00f]‘s methods, have a go.

Comments

  1. aztraph says:

    I think this was the predecessor to the musical greeting card chip. have any luck loading other audio files onto it?

  2. Omg that sounds terrible :-)

    Good work!

  3. supershwa says:

  4. mike says:

    He lost me at “192kbps [...] lossless audio”…

  5. rj says:

    That’s PWM , not Sigma-delta. Sigma-delta has a constant on/off time, and usually has an extremely fast timebase, much higher than 24kHz.

  6. echodelta says:

    Twenty years down the MTV road we could sell’em anything, including crap of crap.
    All of the sound toys I have probed use this trick of one bit digital audio or is it two bit, plus, zero, or minus. I have a old RS sleep aid noise maker with “night train” sounds, sounds good enough to be sound effects of a train mystery movie. Same deal so I would imagine they are a ROM tech, maybe not the latest ones.

  7. sinembarg0 says:

    Heh, I still have a hitclips player, an FM radio module, and a hitclips recorder too. It sounds much better than the clip would lead you to believe, though I haven’t actually heard one in a decade.

  8. David Lang says:

    Actually, this is probably just an eprom storing analog values. The early greeting card chips worked this way.

    Instead of storing a digital value and then converting it to analog, some brainy person discovered that if you didn’t program an EPROM properly, but instead only hit it with a partial programming pulse, the value of the memory cell didn’t go all the way up to 1, it ended up somewhere shy of that. If you hit it with a very rapid series of programming pulses, and watched the voltage that the memory location ended up at, you could stop programming the memory cell when the voltage matched the analog value corresponding to the audio you were trying to record.

    As amazing as it sounds, this actually worked well enough to record audio in real-time

    the beauty of it is that playback is dead trivial, have a circuit that walked through the memory addresses (and with a serial memory chip this would be a simple oscillator), and then feed the ‘data’ line to an amplifier

    By the way, a similar technique is now used to program MLC flash, instead of hitting the flash cell with a full-power programming pulse and getting a 0 or 1 out of it, you hit it with a bunch of short programming pulses and stop when it gets to the ‘proper’ value. This lets you program 4 different values into the one memory cell, 00, 01, 10, 11 (corresponding to no voltage, 1/3 voltage, 2/3 voltage, and full voltage), the trick is making the different values be far enough apart that you can reliably tell the difference between them. As this technique gets better they are looking into the ability to reliably use more values. if they could store 8 values per cell instead of 4, the capacity of flash would double. I think I’ve heard that they can store 6 values per cell, which would increase capacity by 50% for the same number of cells.

    • chango says:

      It’s pooping out crappy sounding PWM, so I have no doubt that the song is stored digitally.

      You’re thinking of the ISD (now Nuvoton) ChipCorder. It used EEPROM cells, but piped the audio signal straight into the write amp during EEPROM. Playback was much the same in reverse, feeding the read amp output through a second amp for driving a speaker.

      These were popular in the late ’90s in customizable greeting cards. Radio Shack sold the ISD1000 (60 seconds record time IIRC) in DIP form as well as a COB module using a similar part around the same time.

    • Qaz says:

      Tlc (Triple level cell) is already in production, storing 3 bits with 8 levels. Used in the samsung 840-series ssds. https://en.wikipedia.org/wiki/Triple-level_cell also talks about a sandisk flash card with 4bits per cell. The more levels the slower the writes and the faster they wear out. Nothing for the high end right now but good enough for low/midrange.

      8 voltage levels is 50% more bits per cell than 4 (3bits vs 2bits), not twice, however, but I guess that’s what you meant.

  9. Galane says:

    Someone donate this guy a Hit Clips player. A micro SD to HitClips adapter would be… I dunno, just crazy? Could probably put the contents of every HitClips clip ever made onto a single card.

    Pocket Rockers were earlier and had way better audio quality, plus two tracks on each tape. Take the concept of those compact cassette shaped MP3 players that play in a cassette tape player and apply it to a Pocket Rocker player.

  10. I’m laughing cause a friend gave me a Hit Clip player they had,but didn’t have any of the cartridges anymore… so I have the reverse problem of Ch00f. Perhaps I’ll pop it open and do a write up of it, though since I just moved, my workspace is somewhat still packed up. Oh well, that may be the first [electronics] project I do in the new workspace.

  11. Chris says:

    I remember these! I also remember thinking “what an awful and shitty product”.

  12. Sven says:

    I find it funny that you could fairly easily make a complete mp3 player with battery and 3W class D audio output in that same package today…

    Even the cheapest chinese $3 micro SD mp3 players are pretty bloated design wise and could easily be designed smaller, and one of the smaller 3W stereo Class D takes up less space than a micro SD card :P

  13. Bob says:

    Why is that penny silver?

  14. Joseph says:

    Sounds just like a project I worked on years (decades) ago. No attempt to code the signal in any special way, just hard limited the audio and relied on the zero crossings to try and reconstruct the original sound.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 91,159 other followers