Rescuing A Pokémon Off A Pokéwalker After Losing The Game Cartridge

The Pokéwalker is a gadget that was sold alongside the Pokémon HeartGold and SoulSilver games for the Nintendo DS which players could use to take a Pokémon out on a walk in the real world. Not only would you earn points while walking, but you’d be able to find items, battle wild enemies, etc. The Pokémon inside the device is however linked to the game cartridge. This fact turned into tragedy when [Etchy] found his old Pokéwalker with a treasured Pokémon still on it, but was forced to erase the device as he had lost the cartridge over the years.

Although he had been told repeatedly by then that it was impossible to transfer such a digital pet to a new save file, this never felt right. Although it made some sense that a specific critter would be linked to a specific save file as a level of security, there’s also the question of whether all data of the Pokémon in question would be erased from said save file.

Cloning a Snickers. {Credit: Etchy, YouTube)
Cloning a Snickers. {Credit: Etchy, YouTube)

Fortunately, [Dmitry] has reverse-engineered the Pokéwalker already, including the infrared protocol that uses the IR transceiver in the cartridge itself. As it turns out, only some basic information is sent over to the device, while the Pokémon is simply hidden in the save file, including the data that isn’t sent to the device. Case closed, right?

It would be a sad ending for those who have lost Pokémon on these devices if it was that simple, fortunately. After some digging, [Etchy] found out that the device only checks for three pieces of information to ensure that it is being accessed from a valid game session: the version (HeartGold or SoulSilver), the region (NA, JP, etc.), and the training and secret IDs.

This thus means that if you try long enough, or use an RNG manipulation hack as demonstrated, you can get a new save file created that has the exact same IDs. As long as you make sure that your local critter’s details in terms of species and form are the same as on the device, there’s nothing really stopping the device from happily handing over the critter’s details.

Of course, the real thing that defines a single Pokémon is its ID (PID) that defines its properties, and this is only saved in the save file. The final answer is thus that there’s no way to rescue a trapped Pokémon, as it only really exists on the cartridge that may or may not still exist in some physical form.

Continue reading “Rescuing A Pokémon Off A Pokéwalker After Losing The Game Cartridge”

How A Belkin USB Charger Pulls Off A 3 Milliwatt Standby Usage

Belkin charger standby power. (Credit: Denki Otaku, YouTube)
Belkin charger standby power. (Credit: Denki Otaku, YouTube)

A well-known property of wall warts like power bricks and USB chargers is that they always consume some amount of power even when there’s no connected device drawing power from them. This feels rather wasteful when you have a gaggle of USB chargers constantly plugged in, especially on a nation-sized scale. This is where a new USB-C wall charger by Belkin, the BoostCharger Pro, is interesting, as it claims ‘zero standby power’, which sounds pretty boastful and rather suspect. Fortunately, [Denki Otaku] saw fit to put one to the test and even tear one down to inspect the work of Belkin’s engineers.

Naturally, no laws of physics were harmed in the construction of the device, as ‘zero standby power’ translated from marketing speak simply means ‘very low standby power usage’, or about 3 milliwatt with 0.3 mA at the applied 100 VAC.

Fascinatingly, plugging in an e-marker equipped USB-C cable with no device on the other end caused this standby usage to increase to about 30 mW, clearly disabling the ‘zero standby’ feature. With that detail noted, it was time to tear down the charger, revealing its four PCBs.

Continue reading “How A Belkin USB Charger Pulls Off A 3 Milliwatt Standby Usage”

Running Windows 98 On The IPAQ IA-2 Internet Appliance

Devices that were limited to only run a web browser were relatively common around 2000, as many people wanted to surf the Information Super Highway, but didn’t quite want to get a regular PC — being in many ways the retro equivalent of a Chromebook. The Compaq iPAQ IA-2 from 2000 that [Dave Luna] got is no exception, with a Microsoft CE-based OS that is meant to be used with Microsoft Network (MSN) dial-up, which amusingly is still available today.

In order to get a more useful OS on it, like Windows 98, you have to jump through quite a few hoops, as [Dave] found out. Although there is an IDE connection on the mainboard, this cannot be booted from, likely due to BIOS limitations. This means that he had to chain boot via the 16 MB NAND Flash drive that the original OS booted from, which was done by writing MS-DOS to the Flash drive using another workaround as it’s not a standard IDE device either.

From this you can then boot Windows 98 from an IDE drive by pretending that it’s an ATAPI IDE device to dodge a limitation on IDE devices. The system’s hardware isn’t really going to make it into a blazing fast retro computer. It only has a 266 MHz Geode GX1 CPU and supports up to 256 MB of SDRAM. The IA-2 is also limited to 800×600, which required the use of an external monitor (as seen above) hooked up to the internal VGA port to set the proper resolution in the OS.

But at least it can run DOOM, so that bare minimum requirement can be ticked off.

Continue reading “Running Windows 98 On The IPAQ IA-2 Internet Appliance”

It’s 1979 – What Exactly Did That ∫ Key Do?

[Michel Jean] asked a question few others might: what exactly is going on under the hood of a classic HP scientific calculator when one presses the key? A numerical integration, sure, but how exactly? There are a number of useful algorithms that could be firing up when the integral button is pressed, and like any curious hacker [Michel] decided to personally verify what was happening.

[Michel] implemented different integration algorithms in C++ and experimentally compared them against HP calculator results. By setting up rigorous tests, [Michel] was able to conclude that the calculators definitely use Romberg-Kahan, developed by HP Mathematician William Kahan.

Selected by HP in 1979 for use in their scientific calculators, the Romberg-Kahan algorithm was kept in service for nearly a decade. Was it because the algorithm was fast and efficient? Not really. The reason it was chosen over others was on account of its robustness. Some methods are ridiculously fast and tremendously elegant at certain types of problem, but fall apart when applied to others. The Romberg-Kahan algorithm is the only one that never throws up its hands in failure; ideal for a general-purpose scientific calculator that knows only what its operator keys in, and not a lick more.

It’s a pretty neat fact about classic HP calculators, and an interesting bit of historical context for these machines. Should you wish for something a bit more tactile and don’t mind some DIY, it’s entirely possible to re-create old HP calculators as handhelds driven by modern microcontrollers, complete with 3D-printed cases.

Thanks to [Stephen Walters] for the tip!

Take A Ride On Wrongbaud’s Hardware Hacking Highway

Regular Hackaday readers will no doubt be familiar with the work of Matthew Alt, AKA [wrongbaud]. His deep-dive blog posts break down hardware hacking and reverse engineering concepts in an engaging way, with practical examples that make even the most complex of topics approachable.

But one of the problems with having a back catalog of written articles is making sure they remain accessible as time goes on. (Ask us how we know.) Without some “algorithm” at play that’s going to kick out the appropriate article when it sees you’re interested in sniffing SPI, there needs to be a way to filter through the posts and find what’s relevant. Which is why the new “Roadmap” feature that [wrongbaud] has implemented on his site is so handy.

At the top of the page you’ll find [wrongbaud]’s recommended path for new players: it starts with getting your hardware and software together, and moves through working with protocols of varying complexity until it ends up at proper techno wizardry like fault injection.

Clicking any one of these milestones calls up the relevant articles — beginners can step through the whole process, while those with more experience can jump on wherever they feel comfortable. There’s also buttons that let you filter articles by topic, so for example you can pull up anything related to I2C or SPI.

Further down the page, there’s a helpful “Common Questions” section that gives you a brief overview of how to accomplish various goals, such as identify an unknown UART baud rate, or extract the contents of an SPI flash chip.

Based on the number and quality of the articles, [wrongbaud]’s site has always been on our shortlist of must-see content for anyone looking to get started with hardware hacking, and we think this new interface is going to make it even more useful for beginners who appreciate a structured approach to learning.

Reverse-Engineering The Bluetooth Fichero Thermal Label Printer Protocol

It’s hard to deny that label printers have become more accessible than ever, but an annoying aspect of many of these cheap units is that their only user interface is a proprietary smartphone app connected via Bluetooth. The Fichero-branded label printer that [0xMH] obtained for a mere 10 Euro at a store in the Netherlands was much the same, with an associated app that doesn’t just bind it to smartphones, but also requires no fewer than 26 permissions. Obviously this required some reverse-engineering of the BLE protocol.

The fruits of this reverse-engineering effort can be found in the GitHub repository, with the most interesting part probably being that this Fichero is just one of many relabeling of generic label printers, this one being an AiYin D11, by Xiamen Printer Future Technology. This means that other iterations of this D11 will work exactly the same, as they all use the same ‘LuckPrinter’ SDK.

[0xMH] provides a Web GUI to talk with a local D11 printer, though you can also use the Python scripts, or of course implement the protocol using your favorite language and frameworks, so that you can finally control a cheap label printer from a PC or even BLE-equipped MCU like the software gods intended.

Thanks to [T-ice] for the tip.

Reverse Engineering The PROM For The SGI O2

The SGI O2 was SGI’s last-ditch attempt at a low-end MIPS-based workstation back in 1996, and correspondingly didn’t use the hottest parts of the time, nor did it offer much of an upgrade path. None of which is a concern to hobbyists who are more than happy to work around any hardware- and software limitations to e.g. install much faster CPUs. While quite a few CPU upgrades were possible with just some BGA chip reworking skills, installing the 900 MHz RM7900 would require some PROM hacking, which [mattst88] recently took a shake at.

The initial work on upgrading SGI O2 systems was done in the early 2000s, with [Joe Page] and [Ian Mapleson] running into the issue that these higher frequency MIPS CPUs required a custom IP32 PROM image, for which they figured that they’d need either SGI’s help or do some tricky reverse-engineering. Since SGI is no longer around, [mattst88] decided to take up the torch.

After downloading a 512 kB binary dump of the last version of the O2’s PROM, he set to work reverse-engineering it, starting by dissembling the file. A big part of understanding MIPS PROM code is understanding how the MIPS architecture works, including its boot process, so much of what followed was a crash-course on the subject.

With that knowledge it was much easier to properly direct the Capstone disassembler and begin the arduous process of making sense of the blob of data and code. The resulting source files now reassemble into bit-identical ROM files, which makes it likely that modifying it to support different CPUs is now possible with just a bit more work.

For those who want to play along, [mattst88] has made his ip32prom-decompiler project available on GitHub.

Thanks to [adistuder] for the tip.


Top image: Silicon Graphics 1600SW LCD display and O2 workstation. (Source: Wikimedia)