Hallo Du!
Bevor du loslegst den Talk zu transkribieren, sieh dir bitte noch einmal unseren Style Guide an: https://wiki.c3subtitles.de/de:styleguide. Solltest du Fragen haben, dann kannst du uns gerne direkt fragen oder unter https://webirc.hackint.org/#irc://hackint.org/#subtitles oder https://rocket.events.ccc.de/channel/subtitles erreichen.
Bitte vergiss nicht deinen Fortschritt im Fortschrittsbalken auf der Seite des Talks einzutragen.
Vielen Dank für dein Engagement!

Hey you!
Prior to transcribing, please look at your style guide: https://wiki.c3subtitles.de/en:styleguide. If you have some questions you can either ask us personally or write us at https://webirc.hackint.org/#irc://hackint.org/#subtitles or https://rocket.events.ccc.de/channel/subtitles .
Please don't forget to mark your progress in the progress bar at the talk's website.
Thank you very much for your commitment!




======================================================================






welcome to the talk with the most catchy name in the schedule it's held by natalie and she's a security researcher at blackberry and as the name suggests this is a sequel to her last year's talk and i would say give her a huge round of applause for this year's even more tamagotchis who are harmed in the making of this presentation natalie silvanovic

so is this on

so today i'm going to talk about a very important subject how to hack tamagotchis at the last congress i talked about my tamagotchi hacking research and i've made a lot of progress since then so today i'm going to give you guys a bit of an update tell you how i got code execution on the tamagotchi how i dump the tamagotchi rom and how i created a tamagotchi development environment

but before we begin a bit about me by day i'm a security researcher at blackberry and you'll notice my slides have a bit of a disclaimer in them so just in case you think i get paid to hack tamagotchis i rather unfortunately do not i studied electrical engineering at university but since then i've been mostly into software hacking so this project really represents my first foray into hardware hacking although i'll admit it started to become a bit of a lengthy project so maybe i'm a bit of a hardware hacker by now and also just in case you didn't guess i really really really like tamagotchis

so just in case anyone doesn't know what are tamagotchis they're a type of virtual pet toy the idea is on the screen you have a picture of your pet and then you use the buttons to say feed your pet or play with your pet or clean up after your pet and they were really popular in the 90s but if you had one say when you were a kid you need to know that the functionality has evolved substantially since then you know back in the good old days tamagotchis just had to sit around and be fed and be played with and if they didn't like the situation they could run away but nowadays tamagotchis have to go to school they have jobs they make friends and if they don't do that right they can forget about getting married or having kids and how do they do this well the newer versions have an infrared interface so let's say you have two tamagotchis you can kind of hold them together like this and they'll talk to each other and you know they can become friends or even get married

now the specific tamagotchi version i looked at is called the tamatown tamago and it's the christmas uh tamagotchi from 2010. i just recently updated my slides from saying last year because i'm in denial about how long i've spent on this project um there this they're the same functionality as the smaller tamagotchis are meant for younger kids so they have bigger buttons and then they have one more great feature which is called figures and the idea is you slide the figure on top of the tamagotchi it unlock unlocks extra features like you know a shop your tamagotchi can shop at or an extra game

so what were my goals with this project well what i wanted to do was dump the tamagotchi code and answer what i call the deeper questions of tamagotchi life you know things like does what your tamagotchi eats affect how happy it is or does it really matter who your tamagotchi marries also i wanted to make my tamagotchis rich and happy i wanted to cheat at tamagotchi and have the richest and the happiest tamagotchis alive oh also i wanted to make a tamagotchi development environment because it's one thing for me to be able to hack tamagotchis but i wanted everyone to be able to hack time i got cheese and finally i just wanted to have fun because you know all those cool kids hanging out going to clubs they just haven't discovered reverse engineering yet

so i'm going to start off by talking about my previous work what i presented at the last congress for maybe 10 minutes and then i'm going to move on to what i've been doing recently so when i first got the tamatown tamago i ran out to the store you know bought about five of them made up some crazy story about how they were gifts for friends and took one apart and here's what the board of the tamatown tamago looks like and i'd say there's really only two interesting features on it one is the eeprom which is circled in red and that's the only persistent writable memory on the board of the tamagotchi it's what stores the state so like let's say you spent a lot of time getting a really cool old tamagotchi if you need to change the battery it will make sure you get that tamagotchi back the other thing on the right side is the blob and since there's no visible microcontroller on the board it seemed pretty clear that the microcontroller was under there i also took apart a figure what was kind of interesting is there's two types of figures there were some with an unpopulated pcb and then there were some with a blob which i assumed had mask rom underneath it so the first thing i needed to do was to identify the microcontroller i tried many crazy dangerous and ineffective ways of removing the epoxy before travis good speed was kind enough to decap it with acid so uh here's a picture of the die and i finally after lots of looking managed to identify it and what it is is it's a general plus lcd controller i'd say that the two most interesting things about it is that it runs 6502 like a commodore and that it has mask rom and i guess there's pros and cons to that but the major con to mask rom is that i can never reprogram it it's manufactured directly into the transistor so it's pretty much ruled out permanently modifying the tamagotchi in any way

so at this point i really wanted to dump this mask from and i had a few ideas of how i could do it and one of them was to restore a bad state from the eeprom i was hoping that maybe it had you know stack pointers and instruction pointers um in there but unfortunately it didn't this totally didn't work because it contained serialized data another idea i had was to look for test functionality because some microcontrollers will have test functions that can dump the code another idea was to exploit a vulnerability in the processing of the figure data or the infrared data because these are basically untrusted data that is processed by the tamagotchi so there really is a possibility there could be bugs in there another option would be to read the rom with a microscope one of the benefits of mask rom and reverse engineering is that the bits because they're manufactured into the transistors are visible so you could theoretically look at it with a microscope another option was pin manipulation you know maybe if i was able to listen into the right pin or even the right area on the die maybe i could see what instructions were being executed so the first thing i did was i looked at the test functionality and it turns out that all general plus microcontrollers have a mandatory test program and i suspected that this would probably allow you to dump code just because the nature of mask rom is that it's very expensive up front but very cheap to make copies so i think it would be a common problem that customers complain that the math ground wasn't manufactured correctly so it would make sense they would have a way to prove that it was correct so i looked around for this quite hard but unfortunately at this point i could not find the test program so i had to move on so the next thing i did was i looked at the figure rom and i thought this could be useful in a few ways as i said my main goal was to dump the rom but i thought there were some other fun things i could do maybe i could ex
ecute code on the tamagotchi maybe i could make my own tamagotchi games because i figured support games and if nothing else i was sure it would make me better understand the tamagotchi behavior

so to figure out what was inside a figure i scraped off the solder mask of the unpopulated pcb and i compared it to a bunch of pad layouts and it turned out that it was an spi rom by the same company that made the microcontroller general plus this allowed me to figure out the pin outs on the figure interface which in turn allowed me to dump a figure then i was able to look at the format of the dump and eventually i figured out how to decode images and there's a picture of it there at this point i could look at all the images and i already knew a few things about the tamagotchi from them one thing that was interesting is that all the text was an image so there was no ascii or other text format in there if the tamagotchi said dress on the screen there was a bitmap that had the word dress on it so that kind of shows that tamagotchi isn't very advanced in its programming the other thing i noticed was that every animation was a series of images so for example if your tamagotchi was wearing the dress there would be every single sprite with every single dress drawn there was no you know sprite handling or overlays or anything like that so i looked into the rest of the rom hoping that there might be say code in there but there wasn't um and there wasn't i'd say even a lot of non-image data not compared to the size of the image data so i assumed there was probably logic information in some sort of serialized format now to understand this a bit better i didn't think that reading the rom was enough i thought that i had to be able to write the rom so i could change things and see what they do so eventually i made a rig that basically uh simulated the rom by bit banging that's a picture of it there and from this i was able to do a few things to start off i could put different pictures on the front of the tamagotchi that was fairly simple when you put a figure on it draws a picture of like a wardrobe or a chest that you keep your toys in or something like that so i was able to sw
ap that out for different images also i was able to play around with some of the logic one thing that i found interesting was the game logic i was expecting the game logic to take up a lot of memory because games are complex but it turned out to be quite small less than 50 bytes of non-image data read at any point during the figure functionality even more interesting was that the game logic like what decided you know when you got points and stuff like that was represented by a single byte code which basically what this means is you know there's a few types of games you know there's the one where you catch falling stuff and there's the one where you match stuff and those are all actually in the internal realm of the tamagotchi and the figure just you know says which one which bit of logic it is the other thing that was even more interesting was what happened if i put in an invalid index this would cause me to jump to other valid screens that had nothing to do with games so i'd put in like one invalid index and i'd go to the screen where you feed your tamagotchi and i put in another invalid index and it would go to say where your tamagotchi takes a shower and what was also interesting was that there was it wasn't very smart once again if i say went to the feeding screen and hit back i would go back to the screen that you would normally go to from that screen not the one i'd come from so this basically meant to me that the tamagotchi was one big state machine with no concept of a state stack or a screen stack so i thought this was quite interesting and then the final thing which at the time i had no idea what to make of was that some invalid codes caused freezing and i actually had to reset my tamagotchi but i didn't have any way to find out more about what was going on than that so um here's a quick example of this um in this video i am jumping to the evolve function so basically uh this is what makes your tamagotchi grow older

so there we go my tamagotchi is now

older so this is where i was at at the last congress and right afterwards i was contacted by a guy called mr blinky and he wanted to order his own figures and reproduce my research but something funny happened when he ordered his figures they had flash in them and it turns out there's actually three types of figures there's the ones with the unpopulated pcbs and there's the one with the mask roms and there's actually a type that contains flash and what was even cooler is that you could basically just program the flash right through the contacts of the figure the picture i have in here has a wire connecting the right pin but that's completely unnecessary i just didn't want to open up a second one to take a picture but basically all you need to do is make a programmer and you're good to go and you can re-flash the figures which was great so this is mr blinky's programmer and basically the idea is you put in a standard spi flash programmer in there and there's also a switch and then you could go into programming mode or regular mode in the tamagotchi a guy called asterisk also made a similar programmer and this is my programmer

but i promise it still works

so at this point i could play a bit more with the functionality so one thing i played with was items and the tamagotchi supports lots of different types of items for example you can see on the left and the right at the bottom there's the clothing store and then you can buy a dress that your tamagotchi wears and then you can also do things like take your tamagotchi on a trip to see the statue of abraham lincoln in washington dc which is the middle picture so i played around with this a bit and i found out it was in a byte code format and you could do things like display an image on the screen play a sound and you can also change stats so for example when your tamagotchi sees abraham lincoln it gets really really happy but there's nothing really useful in there there was some unusual behavior for invalid instructions but nothing else that i could use to dump the code but thankfully i could do some fun things like make a music video or make my tamagotchi do the harlem

shake

so that was a lot of fun but once again i really just wanted to dump the rom so i started thinking again about this game logic and as i said earlier it was represented by this one byte code that would sometimes jump to a different state and sometimes cause freezing and i didn't know quite what to make of this but i thought it was possible that this could be exploitable so i started looking into how 6502 worked and i found out some very interesting things for one thing 6502 is mapped into a single address space so when you execute code you can access every single memory address you'll never for example get an exception and you'll never reset and this is because there's no mmu so basically what will happen if you um access unmapped memory or memory that doesn't exist it will usually return zero it might return another value but it will never stop execution the same thing with invalid instructions i think what the standard says is it will execute undefined behavior taking an undefined amount of time but practically speaking this means that it acts as a and basically reset is rare the only way you can reset a 6502 device is basically jump to the reset vector which actually if you think about this this is like great for exploitation because usually you know like let's say you can move your instruction pointer somewhere and you get it wrong you'll have problems because say you'll access an invalid memory address or you'll get an invalid instruction and then you'll crash but with 6502 if you're a little bit off the code you're trying to jump to you still might make it because everything acts like a no-op and even if you don't right it's just going to keep executing in wild loops forever and maybe you'll get there so i thought um

i thought knowing this it was worth you know just trying to exploit this so i kind of just imagined how it might work internally and i thought well you know maybe game codes are indexes into a jump table and there's only a small amount of ram that i can control from a figure and that's the stuff that's displayed on the screen but that's about 200 bytes of ram and i thought well i'll just make an op sled and hope so this is marachi in front of my knob sled i eventually figured out how to make her move as not to mess with my exploit and i tried all 250 codes and hoped i would jump to the shell code and i did not but i did find some very interesting behavior in a code mcc basically i found that you know the first time i tried it it buzzed and what the buzzing was dependent on was if bit three of byte68 of the lcd ram was set um it would buzz otherwise it would freeze so i thought that was kind of odd the other thing that i thought was odd was that some of the middle indexes um worked when i was first playing with this it was the top and the bottom of the range that would work and the middle always froze but once i started trying every single index some of them worked so i came up with kind of a new theory which was that all the indexes were valid but maybe it was something else that was causing the freezing maybe the stack wasn't set right maybe memory addresses weren't set right maybe registers weren't set right and then i kind of came up with a theory why i was hearing the noise right maybe it's checking if sound is enabled and then but it's accidentally i'm setting checking the lcd ram because something's corrupted and then it's playing a sound and then maybe it's doing jumps based on corrupted memory which would cause um basically based on this bit for it to sometimes play sound repeatedly and sometimes not but this started to drive me crazy i thought if this is how it works and i have 255 vulnerabilities and i have this fairly large chunk of ram full of an op sled
 you know why isn't it working i could be very unlucky but you know probably not so i went and i looked at my shell code and at this point i had used a sun plus 6502 for my shell code because i thought well why have a table if it's regular 6502 but i switched my shell code to regular 6502 and i made it something a little bit more foolproof and at this point it worked the fourth time i tried index d4 so this is an example of my exploit circled in blue at the bottom is the stub of shellcode i hit it actually turns out that the lcd ram isn't contiguous so that's actually a very tiny knob sled and it was quite fortunate i ended up hitting it at the top because i don't have enough room i'm jumping to the actual shell code circled in yellow and what this shell code actually does is it writes some white to the lcd ram and that's circled in red and what i was trying to do here is since i now knew the lcd ram wasn't contiguous i was trying to figure out where all the addresses were but that's just a simple example that shows that it works so the next thing i wanted to do was to dump the tamagotchis rom so what i did is i broke out the button lines which are port a and then i just wrote out the entire memory space using spi and then i used my signal analyzer to analyze it unfortunately this wasn't the entire rom because the rom is actually much larger than the memory space and it uses rom paging to make its memory space larger so basically the way it works is the first page of rom is always mapped and that's in the upper half of addresses and then the lower half of addresses can be different parts of the rom depending on a register and looking at the first page which i managed to dump i was able to figure out what this register was it was three thousand and then i was able to dump all 19 pages of rom so looking at them quickly i could figure out what they all were pages 0 to 6 were code pages 7 to 9 were unused page 10 contained a pointer table for images pages 11 to 18 conta
ined images and i don't know what page 19 contains but i'm figuring it's audio because where else would the audio be otherwise so here's some of the cute highlights of my rom dump you can see at the bottom are some close-ups of all the tamagotchis some other interesting things is circled in blue is a bunch of text so once again the tamagotchi has no text encoding they're all images and also circled in red is some stuff from a startup test program which was also interesting it meant that basically you know everything was in the rom which is which is cool and made me think that i dumped everything so my next step here was to reverse the rom you know figure out the secrets of tamagotchi life i'd been wanting to know the learning curve was a bit steep um i started off using ida and there was no paging support so eventually i wrote a simulator based on a tool called pi 65 to try and figure out what it did and then a guy called asterisk wrote a way better simulator i would actually recommend if you like tamagotchis download this it's really cool you can see you can step through all the different locations you can look at the values of the eeprom trigger the interrupts all that stuff so i thought that was awesome so basically here's how a tamagotchi works after startup it's in one big loop so a state machine like i expected and every time the interrupt gets triggered it cycles around the loop and then it waits and then it cycles and then it waits and it's always in one of hex 41 states and there's a big table that determines the state actions and some of the states have sub-states and sub-sub-states and sub-sub-sub-states and it's the state itself that is responsible for handling that so basically when you enter a state it will have you know start-up behavior and then after that it will be responsible for everything except for lcd update and spi pull so it will have to play sound it will have to handle memory it will have to even put you into the next state you need to be 
in and the only things it doesn't do is it will write into a fake lcd buffer and then there is an lcd update function that actually updates the lcd and also you're not responsible for pulling spi that's the one thing that's done outside of your states and just a general note there were tons and tons of pointer tables i don't know quite why they liked them so much but there were pointers to pointers to pointers everywhere

so um i was able to figure out a few secrets one was what makes a tamagotchi a boy or a girl and i found out that there was an entropy source um c4 that is based on how many times a timer one has fired and basically this is what determines whether it's a boy or a girl so when you're starting up your tamagotchi the instant at which you press the button to enter your name that's what seals your tamagotchi's fate um also i found out right you start off with a baby tamagotchi that grows into a toddler and i found out that this is completely random except sometimes it's evened out so basically if you had one toddler last time you'll it's more likely than not you'll get a different toddler the next time you raise a tamagotchi what i also thought was fun was that some toddlers are higher maintenance than others some you hardly need to care for them and they'll become you know the best teenager and some you gotta care for a lot and it doesn't even seem to have an effect so i found what tina toddler becomes is much more complex though basically there's two care factors and they start off at zero and every time you mistreat your tamagotchi you know don't feed it or something you get dinged on them and then based on you know how low these factors are you get different tamagotchis but there still is some entropy involved for example which factor gets dinged is random oh so what adulteen becomes becomes on depends on these same factors but there's also a third factor which is how well disciplined your tamagotchi is and also i found that toddler care matters in what adult your teen becomes basically you know if you take great care of your toddler you don't have to take such good care of your teen for it to become a great adult but if you've neglected your toddler you've got a lot of catching up to do if you want to get the great adult tamagotchi another fun thing is that you can potty train your tamagotchi every time you see your tamagotchi doing the potty dance you can drag it t
o the toilet and this will increment its discipline and eventually if you wait long enough it'll start going itself

another fun thing i discovered is that the tamagotchi has a test mode in it and this was kind of cool i was looking at the figure processing and there's really two types of figures ones with restaurants and ones with shops but i found there was a third type of figure so i made a figure of this type and i put it on my tamagotchi and i found it has a debug mode in it and it'll it's pretty cool it allows every stat to be altered so you can make your tamagotchi less hungry you can make it every single character you can change you know what its spouse looks like you can see the characters and i also found a bunch of unused functionality in this so there were some other secrets this helped me figure out for example for example i found out it doesn't matter who your tamagotchi marries they're just as happy and the kids turn out just the same the exception being there's kind of a well-known tamagotchi trick where if you marry a certain tamagotchi called an oldichi you do get a special toddler also i found that figures there had been some debate about you know if you have a figure just on your tamagotchi but aren't using it does it change how your tamagotchi behaves and i found out the answer to that is no there's just a special display if you have 100 figures for your tamagotchi so i put this online and i got some interesting reactions number one just be aware the user cannot be held responsible if you do these these are your choice at your own risk and my personal favorite interesting you are putting much effort into something that most consider not worth it kudos to you oh well what can you do

so the next thing i did was i analyzed the general plus test program and this was of interest to me because as i mentioned earlier this is on every single general plus lcd controller so i thought it would be useful in dumping say older tamagotchis and just a generally useful for everything that runs general plus and basically i looked at it and it turns out it pull basically you start up with the test pin pulled and then it pulls port a for a code and then it puts output on port b and the most interesting code was code 16 which would actually take code off of port b fill up around with it and jump to it so that's pretty cool that basically means that there's now a method you can use to dump code from any general plus lcd controller the caveat being that port a port b and tests have to be bonded so on some chips you might actually have to remove the epoxy but this can be always be used to dump the code which i thought was pretty cool

so the next thing i wanted to do was make some dev tools and i already had two of them that i'd made in the process of reversing the first one is called portrait dot pi and i used that to put the scree the image on the screen of the tamagotchi so that's a simple one i also had item make which is what i used to make the tamagotchi music videos um if you like the harlem shake you can check out my youtube channel i have a few others but they both have some serious limitations um you know they're both for specific things so i wanted to write a generic tool that you can use to run generic assembly but the big problem i ran into was that my exploit wasn't very reliable i would say it's 30 to 40 reliable but it was very finicky sometimes it tended to work really well if the tamagotchi had been running for a long time but as soon as i started resetting it stopped working and i thought about it and i thought well really for a useful dev tool you need 100 reliability so i couldn't use this bulb so i started to look into how it worked and basically i was right about it being a jump table and basically what um the figure does is it will fetch the game index that one value that determines what game you're playing add hex 27 to it and then jump to that in the state table and there's no validity check so your problem is that you're jumping to a state that's out of range but then what does a tamagotchi actually do with that invalid state well it turns out when the tamagotchi does a state change it jumps into the state table what it actually does is it pulls a page number out of that table and then jumps into address 4000 there and then address 4000 in that page table it has code that will make you jump into another jump table so this means that invalid states could do a few things they could jump to a non-code page they could jump to an unexpected address they could bring up an invalid page lots of options there and if you look at what this original vulnerability did is it would re
turn instead of a valid page part of the lcd table which was 3c and what happens when you make a general plus lcd controller go to an invalid page well i don't really know i tried playing around with this writing it out to the lcd and i got all dark all fff but i didn't know what this meant i think it can mean two of one of two things basically either when you go to an invalid page it causes the memory to float and that would be what's causing my execution that this floating data somehow cause jumps into my code the other option would be that executing ff for whatever reason caused a jump into my code both of these are very weird but for whatever reason seem to work but no wonder this exploit is unreliable and certainly there's no way to make it more reliable so i did what i call vulnerability idle i tried out all the other indexes and i eliminated ones you know voted against them if they started failing and i found out you know which vulnerability was going to star in the tamagotchi dev kit and that was cd and i looked into it i figured out how it worked and basically what's happening here is it's i'm adding 27 to cd and going to f4 and it's returning another piece of the lcd table which is four but this is a valid page so then it goes and executes the jump um code in that valid page but it goes somewhere that's invalid in the jump table and it's actually a code location so it's treating an inc11e as a pointer which is actually one ee but very fortunately the way lcd ram is addressed on the microcontroller it actually ignores those internal bits that you know aren't part of the proper address so i'm one e e e will resolve to one o e which is in the lcd ram so that so this means that this exploit will jump to the code in the lcd ram 100 of the time which is great so now i was ready to make my dev kit and i made tasim gauchi the 6502 assembler for tamagotchi and what it does is it basically outputs a binary ready to be loaded on the figure so you don't need to mess a
round with exploits or anything you just need to compile load and then you can execute the code and basically what it does is it loads the code into ram and then executes it contains a few convenience functions for things like writing to the lcd and ir and these are largely based on the tamagotchi rom and it's based on a 6502 assembler for python called ofis so making the dev kit was a little bit difficult one of the main problems was the lack of a data sheet so i still don't know what all the ports in this general plus lcd controller do so i was able to determine some of the functionality from the test program but there's still you know some interrupts we don't know when they're file fired we don't know how power management works the spu the watchdog and i just want to mention if anyone does figure this out contributions are welcome so let's make the dev kit uh more generally useful i made a programming board called an egg shell and this is basically an spi programmer for the tamagotchi so you can take your figure and push it on and then program it over usb i also put on infrared there right now there are no tamagotchi remote exploits where you can reprogram it over ir but i'm not 100 sure that isn't possible so i put on the components you know just in case we ever find one and it's also a lily pad usb arduino if you want to use it for something else so i basically have all my tools there the three programming tools and also the board specs so today i'm gonna do a workshop people want to learn how to use these tools um today the room opens at 7 30 and i'll start talking at eight and i'll be selling kits for 30 euros including that and they include basically the board and the figure and the tamagotchi and everything you need to learn how to program a tamagotchi i mean if you want to sign up or learn more about it i have a link there i also wanted to do a quick plug for my boards i'm selling these at the url below and i don't profit from these or from the workshop bu
t i ended up doing a very large run of them because i wanted the unit price to be affordable to everyone who wants to hack tamagotchis so if you like my project and want to support it i'd appreciate if you bought a board there's a url where you can get more info below um so i'm going to do a quick demo here this is basically um what the dev kit does is a simple program but you can see um to get to the exploit you have to play the game and then that's the shell code and then it jumps into user code you can see it there and then the user code just every time you press the button says the letter of the button

so basically that's the dev kit so basically this is it um in this project i managed to dump the tamagotchi code i learned about tamagotchi internals i learned about the secrets of tamagotchi life i made my tamagotchi do new things but most importantly good times were had by all except for the tamagotchis

uh so since we have a little bit of extra time here um i wanted to run through i made some bonus slides about the new tamagotchi there was actually a new tamagotchi that was released on december the 26th and so i have some speculation on it here basically this is the new tamagotchi and here are its features

for a great

friends from bandai

so to distill what that ad said basically it's the same lcd and form factor as the tamatown tamago but it doesn't have irr figures anymore instead it supports nfc and you use the nfc bump to do all the ir and figure functionality sending gifs so you can visit you can also send text messages using these new tamagotchis which is a new feature and one limiting factor which i'm already having problems with is that there's daily limits so with the figures and with the ir you could do that as many times a day as you wanted but now you can only do it five times a day so one of the first things i'm going to try and do is circumvent that limit

so here's a picture of the board what's interesting is it's a lot sparser than the previous tamagotchi but i think it has basically the same functionality components are just smaller now and you can see at the ee prom at the lower right and also you can see the nfc antenna on the other side and that's not hugely interesting you can just see there's a tiny pcb on it and once again this is the same um blob i'm not sure if it's the same microcontroller because this looks a tiny bit smaller than the tamago but the functionality is so similar it even uses the same images that i think it probably is so it was just some quick speculation i think it probably uses the same mcu so that means that we could probably dump the code using the general plus test program although decapping may be required to bond the wires and also there's a reduced attack surface for code execution because there aren't the figures anymore but i'd say there's about a 50 50 chance that there's probably that there's a vulnerability in the nfc that can be used to execute code so it's just a wait and see thing it may or may not be possible but hopefully and then just one last thing which i think is a lot of fun this is the chart they provide of how the tamagotchi works so you know if this is for small children wow i imagine what it looks like in ida

so that's it i'd be happy to take any questions that people have okay yeah well we have well first thanks for this wonderful talk we might see you again on this stage

always always add some color to these slides which we're seeing usually do we have some questions uh signal angel no questions from the internet so far okay so then we need something from in here i see someone at number four maybe yes hi um i just have a short question uh dude we got his support same-sex marriage

not officially but the marriage checks are what hackers like to call client-side so if you make your own device uh you can do this okay number three yeah sort of the same but in the last year talk you said uh the gender is determined by a three-bit code and you couldn't figure out one of these three bits did you get some more knowledge on that i guess i'd say sort of sort of know like i can definitely see where it has the three bits and where it checks them and kind of what it does with each of them now why they chose to have three instead of one i still don't know i think it might have just been a convenience thing okay thank you okay what was that uh yeah is there is this used at number four no i think that's uh it for right now i have maybe one one more thing that's the thing is do you have any feedback maybe of the people manufacturing the toys do you do to know about your work or have you ever got any feedback or is it just silence yeah silence i haven't heard a word from them yet which i guess is so far so good

okay

we have somewhat number four please yeah i have a question do you have any knowledge how many hours you did spend on this awesome project

like with the number of years i've spent on it i'm in complete denial on that

subject

okay i think then ah we have some more at number two go ahead but have you figured out how to give the tamagotchi a soul i don't know this has actually been a debate on several tamagotchi forums whether whether tamagotchis have souls and whether i've destroyed the magic of that unfortunately i think this is more of a philosophical subject that can't be determined by technical means

again do you know of any other products using these same general plus chips that uh your sort of reverse engineering efforts could be applicable to not the exact chip although i've heard that furby's also used general plus also i was looking into general plus and basically a lot of toy manufacturers or toy consulting companies one of the things they offer to do is you know set you up with general plus so i think like my guess is that a very large number of toys actually use use it actually now that i think of it there was actually a third one that i found out about which was a hannah montana toy and they actually managed to dump the code of that using an internal test mode of the toy uh jumping it off dumping it off the lcd but yeah those are i guess the two i've heard of

so now that that yeah okay so now that this dev tool is out so we are maybe looking forward to maybe next time see people doing great stuff with this with these toys and maybe have some some uh yeah some new software for it and maybe some uses maybe next year on the congress yeah i'm excited to see what everyone does with it okay i think then we have it so thanks a lot again for having you here and yeah let's see what plows

you