Released in July of 2025, the Tamagotchi Paradise may look somewhat like the late 90s toy that terrorized parents and teachers alike for years, but it’s significantly more complex and powerful hardware-wise. This has led many to dig into its ARM Cortex-M3-powered guts, including [Yukai Li] who recently tripped over a hidden section in the bootrom of the dual-core Sonix SNC73410 MCU that makes up most of the smarts inside this new Tamagotchi toy.
Interestingly, [Yukai] did see that the visible part of the bootrom image calls into the addresses that make up the hidden part right in the reset handler, which suggests that after reset this hidden bootrom section is accessible, just not when trying to read it via e.g. SWD as the hiding occurs before the SWD interface becomes active. This led [Yukai] to look at a way to make this ROM section not hidden by using the Cortex-M3’s standard Flash Patch and Breakpoint (FPB) unit. This approach is covered in the project’s source file.
With this code running, the FPB successfully unset the responsible ROM hide bit in the OSC_CTRL register, allowing the full bootrom to be dumped via SWD and thus defeating this copy protection with relatively little effort.
Heading image: PCB and other components of a torn-down Tamagotchi Paradise. (Credit: Tamagotchi Center)
Copy protecting these is a overkill. I think everyone wants to play DOOM on them instead of copying whatever is inside.
The encryption provided by the bootrom is actually used by the stock firmware. The device can do some communications over UART, generate a QR code that encodes some gameplay stats, expose a UART console that needs a knock sequence, and render sprites from a custom format. All of that’s in the PRAM, and specifically there to take advantage of the encryption. Presuming the scheme was decent, this would have slowed down modding attempts. But unfortunately for Bandai, the scheme’s not very good, and since it runs a lot of the code XIP out of flash, you could just modify that and dump the PRAM into flash to read out later.