TJ Bearygutted
?When I was a kid, my grandpa got me a Radio Shack 160 in?One?Electronics Kit.?I loved it, but I?only remember doing?two things with it. One was?a cheezy morse code project (with both noise, and lights, and both!) and the other was… the Shocker.
The Shocker?used the 9V battery connector, a relay, a capacitor,?a transformer, and probably one or?two more parts that I can’t remember.?It basically charged the capacitor, then somehow tripped the relay, then charged it again with a nasty clicking noise.?I zapped my sister a few times,?and was hooked.
So, in order to further my diabolical schemes, I bought a Radio Shack Printed Circuit Board Kit. I read the instructions, etched myself a crude circuit board, soldered it together, and slapped it into a Radio Shack project box. The box had a jack, into which plugged the “Shock Gloves”.
The Shock Gloves consisted of the wool inner lining of a military issue leather glove, with copper plumbing caps sewed onto the fingertips. The caps were soldered to wires which ended in a plug, which plugged into the project box. With the whole contraption on, if I touched you with two adjacent fingers, you would get a jolt.
This looked awesome, but was easy to short since the fingertips were so fatty. I later bought some wire screen door material and sewed that into the fingertips. This worked better, but not well enough. In the end, I settled for the “Shock Rods” which were two metal rods that I held in my hand. In my clumsy youth, I just as often zapped myself as anyone else.
All of this culminated in a duel with my friend Dennis, who decided to Karateka kick my Shock Rod hand and drive one of them into my palm. I still have a groovy stigmata-like scar where the rod punched in.
Anyway, the purpose of all this is to explain where my some-encompassing knowledge of electronics comes from. In other words, I ain’t no expert, but I know enough to be dangerous.
So this brings me to our friend TJ Bearytales. I first mentioned him in the stunning episode “Why I <3 Target“. He’s been staring at me funny, and scaring Mrs. G, so I thought it was time to give him a look and see what’s under the hood.
First off, the four screws on his back were nasty triangular security jobbies. This got me excited, one because I could use my eBay bought security bit-set, and two, because usually when this kind of security is used, it means there is something cool and?easily hacked inside. I was disappointed to find that my bits were way to big, but a Nintendo Tri-Wing saved the day.
?
The first thing I noticed is that big nasty black blob on the?right. This is a sure sign of a custom chip, or if not custom, unidentifiable because there are no markings. I’m assuming that this is where the actual micro-controller is.
Now this makes we happy! I’ve been?hoping that I can isolate the actual programming, and I’m pretty sure this is is where it is. The major clue is that?it has been soldered on. The micro-controller shown above is?locked in.?The?green board below?is made to be changed out.
Now all I have to do is figure out how to access the data on that thing. I start by tracing it back to the cartridge connector. I’m guessing that they share pins, and the cartridge is somehow given precedence when it exists in the circuit.
From what I can see, pin 1 is +3.3V, pin 12 is ground, and pins 3, 4, 5, and 6 are “something else”.
Now I just have to do a little research. My hopes and dreams/instinct is making me think that this is at it’s heart a USB memory stick, and I just have to wire it up and plug it in to a PC and read it. This could be totally ludicrous, or so crazy that it just might work.
But, I’ve got a Bunker Party to prepare for, so TJ Bearywhatever will have to wait. Don’t wear out the edge of your seat!
Not sure if you are still looking for the pinouts or not, but here is what I have (for the cartridge at least):
1 3.3v
2 GND (Looks like a detect switch)
3 NC – These wiggle when accesing on-board phrases, I assume they are chip selects for the on-board flash
4 NC
5 U8_CS* There are two memories in the cartridge. One chip select wiggles for song mode and the other for story mode
6 U7_CS*
7 CLK
8 DI
9 DO
10 Data2 ??
11 Data3 ??
12 GND
When I connect the cart up to a microcontroller using one of the CS lines, clock, and DI and DO, I get data streaming into the micro on each clock pulse. I don’t seem to have control over it yet using the DI line. I tried JEDEC commands for flash ID strings but didn’t have any luck with it yet. I originally thought that this was a QUAD-SPI config with 4 data lines. It may even possibly be eSD memory.
I am getting the cartridge and onboard flash module xrayed at work right now. Hopefully that will solve the mystery. When I get them back, one trick I plan to try is to solder it up to an SD reader and see if that gets me anywhere.
March 5th, 2013 at 17:08