Reverse Engineering HitClips

hitclipz

After a quick review of the Hackaday viewer demographics, we need to say the late 90s were weird. Even portable audio players were downright bizarre: MP3 players existed, but you loaded up your songs (all eight of them) over your PC’s parallel port.  While helping a cousin move some furniture, [Ch00f] found a huge collection of one of the oddest music formats ever: HitClips, a tiny plastic encapsulated bit of circuitry that stores 60 seconds of terrible-sounding mono audio. Yes, this was a thing, but so was the pet rock. With no HitClips player, [Ch00f] decided he would take a swing at reverse engineering these tiny, tinny songs.

After taking apart the plastic enclosure, [Ch00f] found a very simple circuit: a few resistors, a cap, and an epoxy blob that enclosed an die with the musical data. On the back of the clip, there are eight pads for connecting to the player. With nothing to go on, [Ch00f] started poking around and found connecting one of these pins to ground caused circuit to draw 300uA of current for about 60 seconds – the same length of time as the recorded sample.

[Ch00f] originally thought the HitClip would provide audio data over an SPI or other digital protocol. What he found was much more interesting: two of the pins on the HitClip correspond to the push and pull FETs of a class D amplifier. The audio on the HitClip is digital audio, but it’s encoded so it can directly drive an analog circuit. Pretty clever engineering for a happy meal toy, if you ask us.

After dumping this data with a logic analyzer, [Ch00f] turned all the values in to .WAV file. It was, amazingly, music. A little refinement to the process to nail down the timing resulted in a 60-second clip seen (heard?) after the break.

Since [Ch00f] doesn’t want to spend $40 on eBay for a vintage HitClips player, he’s right about at the limit of what he can reverse engineer out of these cheap, crappy music chips. He has put up all his documentation, though, so if you’re up for improving on [Ch00f]‘s methods, have a go.

30 thoughts on “Reverse Engineering HitClips

  1. That’s PWM , not Sigma-delta. Sigma-delta has a constant on/off time, and usually has an extremely fast timebase, much higher than 24kHz.

  2. Twenty years down the MTV road we could sell’em anything, including crap of crap.
    All of the sound toys I have probed use this trick of one bit digital audio or is it two bit, plus, zero, or minus. I have a old RS sleep aid noise maker with “night train” sounds, sounds good enough to be sound effects of a train mystery movie. Same deal so I would imagine they are a ROM tech, maybe not the latest ones.

  3. Heh, I still have a hitclips player, an FM radio module, and a hitclips recorder too. It sounds much better than the clip would lead you to believe, though I haven’t actually heard one in a decade.

          1. I think there is a bit more high frequency crap in the extracted version but I could just be imagining it. As for which sounds better they are both pretty amazingly crappy.

    1. I was quite young when these come out so was quite excited about them for a while. It didn’t take me long after having one to realize how shite they were and I think I never bought another song, but at least the radio was somewhat useful. I think my parents threw all my hitclips stuff out years ago but it would be nice to listen to it again now I know what proper audio sounds like.

  4. Actually, this is probably just an eprom storing analog values. The early greeting card chips worked this way.

    Instead of storing a digital value and then converting it to analog, some brainy person discovered that if you didn’t program an EPROM properly, but instead only hit it with a partial programming pulse, the value of the memory cell didn’t go all the way up to 1, it ended up somewhere shy of that. If you hit it with a very rapid series of programming pulses, and watched the voltage that the memory location ended up at, you could stop programming the memory cell when the voltage matched the analog value corresponding to the audio you were trying to record.

    As amazing as it sounds, this actually worked well enough to record audio in real-time

    the beauty of it is that playback is dead trivial, have a circuit that walked through the memory addresses (and with a serial memory chip this would be a simple oscillator), and then feed the ‘data’ line to an amplifier

    By the way, a similar technique is now used to program MLC flash, instead of hitting the flash cell with a full-power programming pulse and getting a 0 or 1 out of it, you hit it with a bunch of short programming pulses and stop when it gets to the ‘proper’ value. This lets you program 4 different values into the one memory cell, 00, 01, 10, 11 (corresponding to no voltage, 1/3 voltage, 2/3 voltage, and full voltage), the trick is making the different values be far enough apart that you can reliably tell the difference between them. As this technique gets better they are looking into the ability to reliably use more values. if they could store 8 values per cell instead of 4, the capacity of flash would double. I think I’ve heard that they can store 6 values per cell, which would increase capacity by 50% for the same number of cells.

    1. It’s pooping out crappy sounding PWM, so I have no doubt that the song is stored digitally.

      You’re thinking of the ISD (now Nuvoton) ChipCorder. It used EEPROM cells, but piped the audio signal straight into the write amp during EEPROM. Playback was much the same in reverse, feeding the read amp output through a second amp for driving a speaker.

      These were popular in the late ’90s in customizable greeting cards. Radio Shack sold the ISD1000 (60 seconds record time IIRC) in DIP form as well as a COB module using a similar part around the same time.

    2. Tlc (Triple level cell) is already in production, storing 3 bits with 8 levels. Used in the samsung 840-series ssds. https://en.wikipedia.org/wiki/Triple-level_cell also talks about a sandisk flash card with 4bits per cell. The more levels the slower the writes and the faster they wear out. Nothing for the high end right now but good enough for low/midrange.

      8 voltage levels is 50% more bits per cell than 4 (3bits vs 2bits), not twice, however, but I guess that’s what you meant.

  5. Someone donate this guy a Hit Clips player. A micro SD to HitClips adapter would be… I dunno, just crazy? Could probably put the contents of every HitClips clip ever made onto a single card.

    Pocket Rockers were earlier and had way better audio quality, plus two tracks on each tape. Take the concept of those compact cassette shaped MP3 players that play in a cassette tape player and apply it to a Pocket Rocker player.

  6. I’m laughing cause a friend gave me a Hit Clip player they had,but didn’t have any of the cartridges anymore… so I have the reverse problem of Ch00f. Perhaps I’ll pop it open and do a write up of it, though since I just moved, my workspace is somewhat still packed up. Oh well, that may be the first [electronics] project I do in the new workspace.

  7. I find it funny that you could fairly easily make a complete mp3 player with battery and 3W class D audio output in that same package today…

    Even the cheapest chinese $3 micro SD mp3 players are pretty bloated design wise and could easily be designed smaller, and one of the smaller 3W stereo Class D takes up less space than a micro SD card :P

    1. ‘modern’ US pennies (post-1980ish?) are copper coated zinc. it’s easy to strip the copper off and reveal the zinc beneath.

    2. Looks like he just etched the copper off the zinc. I’ve seen reactions (with CuSO4, and a few others, I think) that eat out the zinc and leave just the copper overcoat (a fraction of a mil in thickness, pretty fragile), so I’d assume this was something similar but aimed at the copper rather than the zinc. Just a guess though. Alternately, you could go oldschool and use some mercury to silver the penny… doesn’t last long, but it’s a cool effect (health concerns notwithstanding)…

  8. Sounds just like a project I worked on years (decades) ago. No attempt to code the signal in any special way, just hard limited the audio and relied on the zero crossings to try and reconstruct the original sound.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s