Exploring Homebrew For The Pokémon Mini

Originally only sold at the Pokémon Center New York in late 2001 for (inflation adjusted) $80, the Pokémon Mini would go on to see a release in Japan and Europe, but never had more than ten games produced for it. Rather than Game Boy-like titles, these were distinct mini games that came on similarly diminutive cartridges. These days it’s barely remembered, but it can readily be used for homebrew titles, as [Inkbox] demonstrates in a recent video.

Inside the device is an Epson-manufactured 16-bit S1C88 processor that runs at 4 MHz and handles basically everything, including video output to the monochrome 96×64 pixel display. System RAM is 4 kB of SRAM, which is enough for the basic games that it was designed for.

The little handheld system offered up some capabilities that even the full-sized Game Boy couldn’t match, such as a basic motion sensor in the form of a reed relay. There’s also 2 MB of ROM space directly addressable without banking.

Programming the device is quite straightforward, not only because of the very accessible ISA, but also the readily available documentation and toolchain. This enables development in C, but in the video assembly is used for the added challenge.

Making the screen tiles can be done in an online editor that [Inkbox] also made, and the game tested in an emulator prior to creating a custom cartridge that uses an RP2040-based board to play the game on real hardware. Although a fairly obscure gaming handheld, it seems like a delightful little system to tinker with and make more games for.

Continue reading “Exploring Homebrew For The Pokémon Mini”

Upcycling An IPad Into A Touchscreen Display For Your PC

Installing an RPi Pico board like it's a modchip. (Credit: Tucker Osman, YouTube)
Installing an RPi Pico board like it’s a modchip. (Credit: Tucker Osman, YouTube)

Although generally iPads tend to keep their resale value, there are a few exceptions, such as when you find yourself burdened with iCloud-locked devices. Instead of tossing these out as e-waste, you can still give them a new, arguably better purpose in life: an external display, with touchscreen functionality if you’re persistent enough. Basically someone like [Tucker Osman], who spent the past months on making the touchscreen functionality play nice in Windows and Linux.

While newer iPads are easy enough to upcycle as an external display as they use eDP (embedded Display Port), the touch controller relies on a number of chips that normally are initialized and controlled by the CPU. Most of the time was thus spent on reverse-engineering this whole process, though rather than a full-depth reverse-engineering, instead the initialization data stream was recorded and played back.

This thus requires that the iPad can still boot into iOS, but as demonstrated in the video it’s good enough to turn iCloud-locked e-waste into a multi-touch display. The SPI data stream that would normally go to the iPad’s SoC is instead intercepted by a Raspberry Pi Pico board which pretends to be a USB HID peripheral to the PC.

If you feel like giving it a short yourself, there’s the GitHub repository with details.

Thanks to [come2] for the tip.

Continue reading “Upcycling An IPad Into A Touchscreen Display For Your PC”

Usagi’s New Computer Is A Gas!

[Dave] over at Usagi Electric has a mystery on his hands in the form of a computer. He picked up a Motorola 68000 based machine at a local swap meet.  A few boards, a backplane, and a power supply. The only information provided is the machines original purpose: gas station pump control.

The computer in question is an embedded system. It uses a VME backplane, and all the cards are of the 3u variety. The 68k and associated support chips are on one card.  Memory is on another.  A third card contains four serial ports. The software lives across three different EPROM chips. Time for a bit of reverse engineering!

Continue reading “Usagi’s New Computer Is A Gas!”

The Inner Workings Of The Intel 8086’s Arithmetic Logic Unit

In the 1970s CPUs still had wildly different approaches to basic features, with the Intel 8086 being one of them. Whereas the 6502 used separate circuits for operations, and the Intel 8085 a clump of reconfigurable gates, the 8086 uses microcode that configures the ALU along with two lookup tables. This complexity is one of the reasons why the Intel 8086 is so unique, with [Ken Shirriff] taking an in-depth look at its workings on a functional and die-level.

These lookup tables are used for the ALU configuration – as in the above schematic – making for a very flexible but also complex system, where the same microcode can be used by multiple instructions. This is effectively the very definition of a CISC-style processor, a legacy that the x86 ISA would carry with it even if the x86 CPUs today are internally more RISC-like. Decoding a single instruction and having it cascade into any of a variety of microcodes and control signals is very powerful, but comes with many trade-offs.

Of course, as semiconductor technology improved, along with design technologies, many of these trade-offs and disadvantages became less relevant. [Ken] also raises the interesting point that much of this ALU control technology is similar to that used in modern-day FPGAs, with their own reconfigurable logic using LUTs that allow for on-the-fly reconfiguration.

The Defunct Scooter Company, And The Default Key

Äike were an Estonian scooter company, which sadly went bust last year. [Rasmus Moorats] has one, and since the app and cloud service the scooter depends on have lost functionality, he decided to reverse engineer it. Along the way he achieved his goal, but found a vulnerability that unlocks all Äike scooters.

The write-up is a tale of app and Bluetooth reverse engineering, ending with the startling revelation of a hardcoded key that’s simply “ffffffffffffffff”. From that he can unlock and interact with any Äike scooter, except for a subset that were used as hire scooters and didn’t have Bluetooth. Perhaps of more legitimate use is the reverse engineering of the scooter functionality.

What do you do when you find a vulnerability in a product whose manufacturer has gone? He reported to the vendor of the IoT module inside the scooter, who responded that the key was a default value that should have been changed by the Äike developers. Good luck, should you own one of these machines.

Meanwhile, scooter hacking is very much a thing for other manufacturers too.

Converting A Nebra Cryptocurrency Miner To A Meshcore Repeater

After the swivel by Helium Inc. towards simply running distributed WiFi hotspots after for years pushing LoRaWAN nodes, much of the associated hardware became effectively obsolete. This led to quite a few of these Nebra LoRa Miners getting sold off, with the [Buy it Fix it] channel being one of those who sought to give these chunks of IP-67-rated computing hardware a new life.

Originally designed to be part of the Helium Network Token (HNT) cryptocurrency mining operation, with users getting rewarded by having these devices operating, they contain fairly off-the-shelf hardware. As can be glanced from e.g. the Sparkfun product page, it’s basically a Raspberry Pi Compute Module 3+ on a breakout board with a RAK 2287 LoRa module. The idea in the video was to convert it into a Meshcore repeater, which ought to be fairly straightforward, one might think.

Unfortunately the unit came with a dead eMMC chip on the compute module, the LoRa module wasn’t compatible with Meshcore, and the Nebra breakout board only covers the first 24 pins of the standard RPi header on its pin header.

Continue reading “Converting A Nebra Cryptocurrency Miner To A Meshcore Repeater”

Repair And Reverse-Engineering Of Nespresso Vertuo Next Coffee Machines

Well there’s your problem. (Credit: Mark Funeaux, YouTube)

Akin to the razor-and-blades model, capsule-based coffee machines are an endless grind of overpriced pods and cheaply made machines that you’re supposed to throw out and buy a new one of, just so that you don’t waste all the proprietary pods you still have at home. What this also means is a seemingly endless supply of free broken capsule coffee makers that might be repairable. This is roughly how [Mark Furneaux] got into the habit of obtaining various Nespresso VertuoLine machines for attempted repairs.

The VirtuoLine machines feature the capsule with a bar code printed on the bottom of the lip, requiring the capsule to be spun around so that it can be read by the optical reader. Upon successful reading, the code is passed to the MCU after which the brewing process is either commenced or cruelly halted if the code fails. Two of the Vertuo Next machines that [Mark] got had such capsule reading errors, leading to a full teardown of the first after the scanner board turned out to work fine.

Long story short and many hours of scrubbed footage later, one machine was apparently missing the lens assembly on top of the photo diode and IR LED, while the other simply had these lenses gunked up with spilled coffee. Of course, getting to this lens assembly still required a full machine teardown, making cleaning it an arduous task.

Unfortunately the machine that had the missing lens assembly turned out to have another fault which even after hours of debugging remained elusive, but at least there was one working coffee machine afterwards to make a cup of joe to make [Mark] feel slightly better about his life choices. As for why the lens assembly was missing, it’s quite possible that someone else tried to repair the original fault, didn’t find it, and reassembled the machine without the lens before passing the problem on to the next victim.

Continue reading “Repair And Reverse-Engineering Of Nespresso Vertuo Next Coffee Machines”