Pokemon Time Machine Lets You Really Catch ‘Em All

August 25, 2021 by Tom Nardi 14 Comments

Since 1996 the Pokemon series of games has moved through eight distinct generations, which roughly parallel the lineage of Nintendo’s handheld gaming systems. While the roster of “pocket monsters” has been updated steadily, players have had the option of bringing captured Pokemon from the older games into the newer releases. But there’s always been a gap in this capability. Due to hardware differences, the Game Boy and Game Boy Color generations of games were physically unable to communicate with the titles released for the Game Boy Advance.

But soon, that may no longer be the case. [Selim] is hard at work on Lanette’s Poke Transporter, a hardware and software solution for bringing Pokemon from the first and second generation games onto the third generation GBA games. Once they’ve been loaded there, players can move the creatures all the way up into the contemporary Pokemon games via official means.

The first Pokemon to make the generational leap.

The project was started in July of 2020, with [Selim] first focusing on the logistical challenges of bringing such early Pokemon into the newer games. Because so much changed between the different generations, there are many sanity checks that need to be made during the transfer. For example, the moves and techniques that the creatures are able to learn isn’t necessarily consistent between these early entries into the series. But after about a year of effort, the software side worked reliably on emulated games, and it was time to start thinking about the hardware.

Ultimately, [Selim] wants to create a physical device into which players can insert their Pokemon cartridges and trigger an automatic transfer. The code is already able to read and write to the cartridges, and has been ported over to Arduino so it doesn’t need a computer to run. A few prototype PCBs have been created, and beyond the inevitable bodges, it seems like they’re functional. There’s still breadboards and jumpers for as far as the eye can see, but this is the first step towards producing a dedicated Pokemon “time machine” that can transport them from the late 1990s to the present day.

With [stacksmashing] recently showing that the Raspberry Pi Pico is fast enough to emulate the Game Boy’s “Link Cable” accessory, and the protocol for trading Pokemon over the wire fairly well understood, we wonder if one day this technique couldn’t be done in real-time between linked handhelds. If you can make two copies of Tetris connect to each other over the Internet, it seems like you’d have enough time to fiddle with a Charizard’s stats.

A Charmander Lamp To Light Up The Garden

December 22, 2020 by Kristina Panos 6 Comments

[BrittLiv] loves Pokémon and has always wanted to make giant versions of them. Now that they’ve moved out of that apartment, it’s time to make those childhood dreams come true and fill the garden with Pokémon. First up is Charmander, one of [BrittLiv]’s absolute favorites and a perfect candidate for a flame tail that uses the guts of a solar garden lamp. The flame comes on automatically when it gets dark and has three modes: steady on, fade in and out, or flame emulation mode.

[BrittLiv] started with an open-source Charmander model and added a thread to the flame and the corresponding end of the tail. We love that [BrittLiv] was able to use up a bunch of old filament to print this — a total of 5kg worth over 280+ hours of print time.

[BrittLiv] added lead ballast in the feet for weight while gluing the pieces together and sealed it off at the ankles with epoxy. The entire outside surface was sanded and smoothed with clay and Bondo before getting epoxy, primer, black primer, and then a copper automotive paint that turned out to be too bright. Charmander ended up with copper paint that patinas, which is why it looks so much like a real statue. Check out the build video after the break.

There’s no word on whether there’s a future where Charmander’s flame steams when it rains, but [BrittLiv] does have plans to expand the garden with a Squirtle fountain and a Bulbasaur planter.

Want to add tangibility to Pokémon Go? Just add real pokéballs.

Continue reading “A Charmander Lamp To Light Up The Garden” →

Reverse Engineering A PokeWalker

November 21, 2020 by Matthew Carlson 16 Comments

The PokeWalker is part of Nintendo’s long quest to get children (and likely some adults) walking and exercising. There’s the PokeWalker, Pokemon Pikachu, PokeBall Plus, Pokemon Pikachu 2, Pokemon mini, and of course Pokemon Go. Despite being out a decade, there wasn’t a ROM dump for the device and there was minimal documentation on the communication protocol. [Dmitry Grinberg] took it upon himself to change all that and crack the PokeWalker open.

At its heart, the PokeWalker is just a pedometer with an IR port and a 96×64 grayscale screen. It came out in 2009 to accompany the new Pokemon release for the Nintendo DS. Cracking open the device revealed a 64KB EEPROM, a Renesas H8/38606R CPU, a Bosch BMA150 accelerometer, and a generic IR transceiver. The CPU is particularly interesting as in addition to being quite rare, it has a mix of 8, 16, and 32 bits with 24-bit pointers. This gives it a 64K address space. While the CPU is programmable, any attempt to do so erases the onboard flash. The communication protocol packets have an 8-bit header that precedes each packet. The header has a checksum, a command byte, and four bytes of session id, and an unused byte. Curiously enough, every byte is XOR’d with 0xAA before being broadcast.

One command is an EEPROM write, which uses back-referencing compression. Each chunk of data to be written is packaged into 128-byte chunks, though 128 bytes likely won’t be sent thanks to the compression. The command can theoretically reference 4k bytes back, but in practice, it can only reference 256 bytes back. It was this command that laid the foundation for the exploit. By carefully crafting the command to send, the command can overflow the decompression buffer and into executable code. Only a few bytes can be overflowed so the payload needs to be carefully crafted. This allowed for an exploit that reads the system ROM and broadcasts it out the IR port. Only 22k bytes can be dumped before the watchdog reboots the device. By changing the starting address, it was easy to do multiple passes.

After the ROM was stitched together from the different passes, the different IR commands were analyzed. In particular, a command was found that allows direct writes into RAM. This makes for a much easier exploit as you can write your exploit, then override a pointer in the event table, then have the exploit revert the event table once the system naturally jumps to your exploit.

[Dmitry] finishes off this amazing exploit by writing a PalmOS app to dump the ROM from a PokeWalker as well as modify the system state. PalmOS was chosen as it is an easy and cheap way to have a programmable IR transciever. All in all, a gorgeous hack with a meticulous writeup. This isn’t the first video game accessory that’s been reverse engineered with a scrupulous writeup, and we’re sure it won’t be the last.

Continue reading “Reverse Engineering A PokeWalker” →

Make Your Own Pet Fire Breathing Dragon

June 29, 2020 by Orlando Hoilett 24 Comments

[Jorvon Moss] a.k.a. [Odd_Jayy] is known as a maker of “companion robots” which he carriers perched on top of his shoulders. (I don’t know about you, but we’re getting some pretty strong Ash and Pikachu vibes.)

In one of his recent builds, he decided to give his companion bot a bit of sizzle. His Widget Dragon Companion Bot is an impressive 3D printed build, divided into a surprisingly few parts. The robot is controlled using an Adafruit Crickit, marketed specifically for robotics projects, and is easily programmed using the increasingly popular Microsoft MakeCode.

With a few servos, [Odd Jay] was able to animate his bot giving it more of an “alive” feel. Finally, he added a vape pen to give the dragon some pyrotechnic effects.

This is just the kind of energy we love to see here at Hackaday. While you’re around, take a look at some of [Odd_Jayy’s] other robot projects and head over to his Instagram page to see more real-time project updates.

Pokemon Cries And How They Work

January 4, 2019 by Lewin Day 4 Comments

If you grew up watching the Pokémon TV series, you’d naturally be familiar with the cries of all your favourite Pocket Monsters. Most of the creatures in the anime tend to say their own name, over and over again. Pour one out for the legions of parents who, upon hearing a distant “PIKA PIKA!”, still involuntarily twitch to this day.

However, the games differ heavily in this area. Generation I of Pokémon was released on the Game Boy, which simply didn’t have the sound capabilities to deliver full bitstream audio. Instead, sounds were synthesized for the various Pokémon based on various parameters. It’s quite a deep and involved system, but never fear – help is at hand via [Retro Game Mechanics Explained].

The video breaks down, at a bitwise level, how the parameters are stored for each Pokémon’s cry, and how they are synthesized. It’s broken down into easily understandable chunks, explaining first how the Game Boy’s sound hardware works, with two pulse channels and a noise channel, before later expanding upon why some Pokémon have the same or similar cries.

It’s a tour de force in retro game reverse engineering, and expertly presented with high quality graphical guides as to what’s going on at the software level. There’s even an emulator you can use to explore the various cries from the original game, and generate your own, too.

Now that we’re up to speed with Pokémon, how about fixing bugs in a 37 year old game? Video after the break.

Continue reading “Pokemon Cries And How They Work” →

Game-Ception: Pokemon Red Playable Inside Minecraft

April 30, 2018 by James Hobson 24 Comments

If you’ve ever wanted to take a dive into and visualize a game’s code, this could be a seminal example in a literal sense. After twenty-one months of effort, the entire Pokemon Red game is now playable inside Minecraft.

[Mr. Squishy] is the mad genius behind this project, laboriously re-coding the game literally block by block. A texture pack is needed for the specific sprites, but otherwise it is playable without mods. It’s not immediately apparent when loading in to the level, but chip your way through the floor of the stadium and you are confronted by something awe-inspiring: sprawling constructions, like great soaring cliffs, comprising approximately 357,000 command blocks — equating to the same in lines of code. Every animation, tracked stat, attack and their effects, the various pokemon and their properties, and so on are rendered in the game’s physical space for you to wander through.

Beneath that are levels of maps, positional data, properties of those areas, NPCs, and a clever glitch that [Mr. Squishy] used to keep everything loaded at once.

Continue reading “Game-Ception: Pokemon Red Playable Inside Minecraft” →

There’s A Mew Underneath The Truck Next To The SS Anne

March 17, 2017 by Brian Benchoff 26 Comments

Before we dig into this, I need to spend a paragraph or two conveying the knowledge of a twelve-year-old in 1996. Of course, most Hackaday readers were twelve at least once, but we’re just going to do this anyway. The payoff? This is an arbitrary-code-execution virus for Pokemon, and maybe the most amazing Game Boy hack of all time.

In the first generation of Pokemon games, there is a spectacularly rare Pokemon. Mew, the 151st Pokemon, could learn every move in the game. It was a psychic type, which was overpowered in the first gen. You could not acquire a Mew except by taking your Game Boy to a special event (or to Toys R Us that one time). If someone on the playground had a Mew, they really only had a GameShark.

There was a mythos surrounding Mew. Legend said if you went to the SS Anne and used Strength to move a truck sprite that appeared nowhere else in the game, a Mew would appear. Due to the storyline of the game, you didn’t have the ability to get to this truck the first time you passed it. However, if you started a new game – thus losing all your progress and your entire roster of Pokemon – you could test this theory out. Don’t worry, you can just trade me all your good Pokemon. I’ll give them back once you have a Mew. Screw you, Dylan. Screw you.

Now the Mew truck trick is real. You can do it on a copy of Red or Blue on an original Game Boy. If this hack existed in 1998, kids would have lost their god damned minds.

The basis for this hack comes from [MrCheeze], who created a ‘virus’ of sorts for the first generation of Pokemon games. Basically, given the ability to manually edit a save file, it is possible to replicate this save file over a Game Link cable. The result is a glitchy mess, but each Pokemon game has the same save file when it’s done.

Combine this virus with arbitrary code execution, and you have something remarkable. [MrCheeze] created a save file that allows you to move the truck next to the SS Anne. When the truck is moved, a Mew appears. It’s exactly what everyone was talking about over the sound of their sister’s Backstreet Boys marathon.

The new ‘Mew Truck virus’ is not as glitchy as the first attempt at a self-replicating save file. In fact, except for the music glitching for a few seconds, nothing appears abnormal about this Pokemon virus. It’s only when the Mew truck trick is attempted does something seem weird, and it’s only weird because we know it shouldn’t happen. Combine the self-replicating nature of this virus, and you have something that would have drawn the attention of Big N. This is a masterpiece of Pokemon-based arbitrary code execution and a hack that may never be equaled.

You can check out the video below.

Continue reading “There’s A Mew Underneath The Truck Next To The SS Anne” →