Reverse Engineering A PokeWalker

The PokeWalker is part of Nintendo’s long quest to get children (and likely some adults) walking and exercising. There’s the PokeWalker, Pokemon Pikachu, PokeBall Plus, Pokemon Pikachu 2, Pokemon mini, and of course Pokemon Go. Despite being out a decade, there wasn’t a ROM dump for the device and there was minimal documentation on the communication protocol. [Dmitry Grinberg] took it upon himself to change all that and crack the PokeWalker open.

At its heart, the PokeWalker is just a pedometer with an IR port and a 96×64 grayscale screen. It came out in 2009 to accompany the new Pokemon release for the Nintendo DS. Cracking open the device revealed a 64KB EEPROM, a Renesas H8/38606R CPU, a Bosch BMA150 accelerometer, and a generic IR transceiver. The CPU is particularly interesting as in addition to being quite rare, it has a mix of 8, 16, and 32 bits with 24-bit pointers. This gives it a 64K address space. While the CPU is programmable, any attempt to do so erases the onboard flash. The communication protocol packets have an 8-bit header that precedes each packet. The header has a checksum, a command byte, and four bytes of session id, and an unused byte. Curiously enough, every byte is XOR’d with 0xAA before being broadcast.

One command is an EEPROM write, which uses back-referencing compression. Each chunk of data to be written is packaged into 128-byte chunks, though 128 bytes likely won’t be sent thanks to the compression. The command can theoretically reference 4k bytes back, but in practice, it can only reference 256 bytes back. It was this command that laid the foundation for the exploit. By carefully crafting the command to send, the command can overflow the decompression buffer and into executable code. Only a few bytes can be overflowed so the payload needs to be carefully crafted. This allowed for an exploit that reads the system ROM and broadcasts it out the IR port. Only 22k bytes can be dumped before the watchdog reboots the device. By changing the starting address, it was easy to do multiple passes.

After the ROM was stitched together from the different passes, the different IR commands were analyzed. In particular, a command was found that allows direct writes into RAM. This makes for a much easier exploit as you can write your exploit, then override a pointer in the event table, then have the exploit revert the event table once the system naturally jumps to your exploit.

[Dmitry] finishes off this amazing exploit by writing a PalmOS app to dump the ROM from a PokeWalker as well as modify the system state. PalmOS was chosen as it is an easy and cheap way to have a programmable IR transciever. All in all, a gorgeous hack with a meticulous writeup. This isn’t the first video game accessory that’s been reverse engineered with a scrupulous writeup, and we’re sure it won’t be the last.

Continue reading “Reverse Engineering A PokeWalker”

AlphaSmart Neo Teardown: This Is The Way To Write Without Distractions

History will always have its in-between technologies — that stuff that tides us over while the Next Big and Lasting Thing is getting the kinks worked out of it. These kinds of devices often do one thing and do it pretty well. Remember zip drives? Yeah you do. Still have mine.

The halcyon days of the AlphaSmart NEO sit in between the time where people were chained to heavy typewriters and word processors and the dawn of on-the-go computing. Early laptops couldn’t be trusted not to die suddenly, but the NEO will run for 700 hours on three AAs.

The NEO stands for the freedom to get your thoughts down wherever, whenever, without the need for a desk, paper, ink, ribbons, power cords, and the other trappings that chain people indoors to flat surfaces. And that’s exactly what was so tantalizing to me about it. Inspiration can truly strike anywhere at any time, so why not be prepared? This thing goes from off to blinking cursor in about a second and a half. There’s even a two-button ‘on’ option so you don’t run the battery down or accidentally erase files while it’s in your bag.

These might be the world’s greatest scissor switches.
L-R: DC power, IR, USB-B, and USB-A for connecting to a printer.

I bought this funny little word processor a few years ago when I wanted to attempt NaNoWriMo — that’s National Novel Writing Month, where you write 50,000 words towards a novel, non-fiction book, or short story collection in any genre you want. It averages out to 1,667 words a day for 30 days. Some days it was easy, some days it was not. But every non-Hackaday word I typed that month was on this, my Mean Green Words Machine.

Continue reading “AlphaSmart Neo Teardown: This Is The Way To Write Without Distractions”

An Open Source IR Gateway Based On The ESP8266

The market is absolutely inundated with smart gadgets, with everything from coffee makers to TVs advertising that they support the latest and greatest in home automation platforms. Don’t worry about how many of those platforms and services will still up up and running in the next few years, the thing will probably stop working before then anyway. No sense worrying about the details in a disposable world.

Of course, not all of us are so quick to dump working hardware in the name of the latest consumer trend. Which is why [Viktor] has developed an open source infrared gateway that can connect your “dumb” devices to the latest flash in the pan backend service with nothing more than a software update. Though even modern smart TVs still include IR remotes, so there’s nothing stopping you from using it with newer gear if you don’t trust like the built-in implementation.

The hardware here is really quite simple, essentially boiling down to a few IR LEDs and an IR receiver hanging off the GPIO ports of an ESP8266. While the receiver isn’t strictly necessary, it does allow [Viktor] to rapidly implement new IR codes. He just points the existing remote at the board, hits a button, and the decoded command gets sent out over MQTT where he can easily snap it up.

[Viktor] has done the hard work of creating the PCB design and testing out different IR LEDs to find the ones with the best performance. But if you wanted to just throw something together in a weekend, you should be able to get his firmware running with little more than a bare ESP and a random IR LED salvaged from an old remote. But don’t be surprised if you get hooked on the concept and end up rolling your own home automation system.

Seek And Ye Shall Command

If we count all the screens in our lives, it takes a hot minute. Some of them are touchscreens, some need a mouse or keyboard, but we are accustomed to all the input devices. Not everyone can use the various methods, like cerebral palsy patients who rely on eye-tracking hardware. Traditionally, that only works on the connected computer, so switching from a chair-mounted screen to a tablet on the desk is not an option. To give folks the ability to control different computers effortlessly [Zack Freedman] is developing a head-mounted eye-tracker that is not tied to one computer. In a way, this is like a KVM switch, but way more futuristic. [Tony Stark] would be proud.

An infrared detector on the headset identifies compatible screens in line of sight and synchs up with its associated HID dongle. A headset-mounted color camera tracks the head position in relation to the screen while an IR camera scans the eye to calculate where the user is focusing. All the technology here is proven, but this new recipe could be a game-changer to anyone who has trouble with the traditional keyboard, mouse, and touchscreen. Maybe QR codes could assist the screen identification and orientation like how a Wii remote and sensor bar work together.

Cheap And Effective Mosquito Trap Looks Like A Disco

Words cannot quite articulate the collective loathing humankind has for mosquitoes, and rightfully so! These parasite peddling, blood sucking little critters are responsible for a great deal of human suffering. Mosquito-borne diseases such as malaria still account for a significant proportion of human mortality, especially in under-developed parts of the world . So it’s no wonder that people try to reduce their numbers; see this latest $40 mosquito trap by [jacobsk]. (Video, embedded below.)

The idea is critically simple, opening up the potential for widespread deployment. The base and body of the trap are made out of three five-gallon buckets with a mini desk fan sandwiched in between, providing suction into the main trap bin. An opening is cut in the top bucket as a point of entry, and an old school incandescent blacklight is mounted in the centre, with just enough IR and UV output to entice these little vermin, who will definitely regret mistaking it for a black-light rave.

[jacobsk] also does a very good job of showing every step of its construction in his videos. Whilst this solution is purposefully low tech, check out this admittedly overcooked way of killing mosquitoes, with a laser turret.

Continue reading “Cheap And Effective Mosquito Trap Looks Like A Disco”

Teardown: The Writer Word Processor

For modern students, the spiral notebook has given way to the laptop and the pocket calculator has been supplanted by the smart phone. We’re not just talking about high school and college, either. Today, the education of even grade school children is intrinsically linked with technology. While some might question the wisdom of moving away from the pencil and pad at such a young age, there’s little question that all the kids stuck at home right now due to COVID-19 would have had a much harder time transitioning to remote learning otherwise.

But that certainly wasn’t the case when Advanced Keyboard Technologies released the Writer in 2003. Back then, five years before the first netbooks hit the market, you’d be hard pressed to find a laptop cheap enough to give to a grade school student. In comparison, these small electronic word processors could be purchased for as little as $150. Not only was the initial price low, but the maintenance costs were almost negligible. They ran for hundreds of hours on a standard AA batteries, and didn’t require schools to have any IT staff to manage them. Sure they couldn’t get on the Internet or even run any software, but they would give students a chance to hone their keyboarding skills. Continue reading “Teardown: The Writer Word Processor”

Run Your Favorite 8-bit Games On An ESP32

Here at Hackaday HQ we’re no strangers to vintage game emulation. New versions of old consoles and arcade cabinets frequently make excellent fodder for clever hacks to cram as much functionality as possible into tiny modern microcontrollers. We’ve covered [rossumur]’s hacks before, but the ESP_8-bit is a milestone in comprehensive capability. This time, he’s topped himself.

There isn’t much the ESP 8-bit won’t do. It can emulate three popular consoles, complete with ROM selection menus (with menu bloops). Don’t worry about building a controller, just connect any old (HID compliant) Bluetooth Classic keyboard or WiiMote you have at hand. Or if that doesn’t do it, a selection of IR devices ranging from joysticks from the Atari Flashback 4 to Apple TV remotes are compatible. Connect analog audio and composite video and the device is ready to go.

The system provides this impressive capability with an absolute minimum of components. Often a schematic is too complex to fit into a short post, but we’ll reproduce this one here to give you a sense for what we’re talking about. Come back when you’ve refreshed your Art of Electronics and have a complete understanding of the hardware at work. We never cease to be amazed at the amount of capability available in modern “hobbyist” components. With such a short BOM this thing can be put together by anyone with an ESP-32-anything.

There’s one more hack worth noting; the clever way [rossumur] gets full color NTSC composite video from a very busy microcontroller. They note that NTSC can be finicky and requires an extremely stable high speed reference clock as a foundation. [rossumur] discovered that the ESP-32 includes a PLL designed for audio work (the “APLL”) which conveniently supports fractional components, allowing it to be trimmed to within an inch of the desired frequency. The full description is included in the GitHub page for the project and includes detailed background of various efforts to get color NTSC video (including the names of a couple hackers you might recognize from these pages).

Continue reading “Run Your Favorite 8-bit Games On An ESP32”