Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/143 Thanks!
Welcome to the talk with the most
catchy name in this schedule.
It's Health by Natalie Sin
Evanovich, and she's a security
researcher at BlackBerry.
And as the name suggests, this
is a sequel to her
last year's talk and I
would say, give her a
huge round of applause for this
year's even more.
Tamagotchis were harmed in the making
of this presentation, not to mention
a lot of its.
So was this on?
So today I'm going to talk about a
very important subject
how to hack Tamagotchis
at the last Congress, I
talked about my Tamagotchi hacking
research. And I've made a lot of progress
since then.
So today I'm going to give you guys a bit
of an update.
Tell you how I got code execution on
the Tamagotchi, how I dumped the
Tamagotchi ROM and how I
created a Tamagotchi development
environment.
But before we begin a bit about me.
By day, I'm a security researcher at
BlackBerry and you'll notice my slides
have a bit of a disclaimer in them.
So just in case you think I get paid to
hack Tamagotchis, I rather unfortunately
you do not.
I studied electrical engineering at
university, but since then I've
been mostly into software hacking.
So this project really represents my
first foray into hardware hacking,
although I'll admit it started to become
a bit of a lengthy project.
So maybe I'm a bit of a hardware
hacker by now.
And also, just in case you didn't guess,
I really, really, really like
Tamagotchis.
So just in case anyone doesn't know what
our Tamagotchis Tamagotchis there, a
type of virtual pet toy, the
idea is on the screen.
You have a picture of your pet and then
you use the buttons to say, feed your pet
or play with your pet or clean up after
your pet.
And they were really popular in the 90s.
But if you had one say when you were a
kid, you need to know that the
functionality has evolved substantially
since then.
You know, back in the good old days,
Tamagotchi just had to sit around
and be fed and be played with, and if
they didn't like the situation, they
could run away.
But nowadays, Tamagotchi, you have to go
to school, they have jobs, they
make friends.
And if they don't do that right, they can
forget about getting married or having
kids.
And how do they do this?
Well, the newer versions have an infrared
interface, so let's say you have to
Tamagotchis.
You can kind of hold them together like
this and they'll talk to each other and
you know, they can become friends or even
get married.
Now, the specific Tamagotchi version I
looked at is called the town a town tam
ago, and it's the Christmas
Tamagotchi from 2010.
I just recently updated my slides from
saying last year because I'm in denial
about how long I've spent on this
project.
I'm there this.
They're the same functionality as the
smaller Tamagotchis are meant for younger
kids, so they have bigger buttons,
and then they have one more great
feature, which is called figures.
And the idea is you slide the figure on
top of the Tamagotchi and long
unlocks extra features like, you know, a
shop your Tamagotchi can shop at or an
extra game.
So what were my goals with this project?
Well, what I wanted to do is dump the
Tamagotchi code and answer
what I call the deeper questions
of Tamagotchi life.
You know, things like does
what your Tamagotchi eats
affect, how happy it is
or does it really matter
who your Tamagotchi marries?
Also, I wanted to make my Tamagotchi
is rich and happy.
I wanted to cheat at Tamagotchi and
have the richest and the happiest
Tamagotchis alive.
Oh.
Also, I wanted to make a Tamagotchi
development environment, because it's one
thing for me to be able to hack
Tamagotchis, but I wanted everyone
to be able to hack Tamagotchis.
And finally, I just wanted to have
fun because, you know, all those cool
kids hanging out, going to clubs,
they just haven't discovered reverse
engineering yet.
So I'm going to start off
by talking about my previous work, what I
presented at the last Congress for maybe
10 minutes, and then I'm going to move on
to what I've been doing recently.
So when I first got the TAM a town
TAM ago, I ran
out to the store, you know, bought about
five of them, made up some crazy story
about how they were gifts for friends
and took one apart.
And here's what the board of the TAM town
TAM ago looks like.
And I say there's really only two
interesting features on it.
One is the prom, which is circled in red,
and that's the only persistent, readable
memory on the board of the Tamagotchi.
It's what stores this day.
So like, let's say you spent a lot of
time getting a really cool old
Tamagotchi.
If you need to change the battery, it
will make sure you get that Tamagotchi
back.
The other thing on the right side
is the blob.
And since there's no visible
microcontroller on the board, it seemed
pretty clear that the microcontroller was
under there.
Also took apart a figure.
What was kind of interesting is there's
two types of figure is there are some
with an unpopulated PCB.
And then there were some with a blob,
which I assumed had mass from underneath
it.
So the first thing I needed to do was to
identify the microcontroller.
I tried many crazy, dangerous
and ineffective ways of removing the
epoxy before Travis Goodspeed
was kind enough to to cap it with acid.
So here's a picture
of the dye and I finally,
after a lot of looking managed to
identify it and what it is
is it's a general plus LCD controller.
I'd say that the two most interesting
things about it is that it runs 65
02 like a Commodore and that
it has mass Graham.
And I guess there's pros and cons
to that. But the major con to
ask Graham is that I can never reprogram
it. It's manufactured directly into the
transistors, so it's pretty much ruled
out permanently modifying
the Tamagotchi in any way.
So at this point, I really wanted to dump
this mask from, and I had a few ideas
of how I could do it.
And one of them was to restore a bad
state from the prom.
I was hoping that maybe it had, you know,
stack pointers and instruction pointers
in there, but unfortunately it did.
This totally didn't work because it
contained serialized data.
Another idea I had was to look
for test functionality because some
microcontrollers will have test functions
that can dump the code.
Another idea was to exploit a
vulnerability in the processing of the
figure data or the infrared data,
because these are basically untrusted
data that is processed by the Tamagotchi.
So there really is a possibility there
could be bugs in there.
Another option would be to read the ROM
with a microscope.
One of the benefits of mascara and
reverse engineering is that the bits,
because they're manufactured into the
transistors are visible, so you could
theoretically look at it with a
microscope.
And another option was pin manipulation.
You know, maybe if I was able to listen
into the right pin or even the right area
on the dye, maybe I could see
what instructions were being executed.
So the first thing I did was I looked at
the test functionality, and
it turns out that all general plus
microcontrollers have a mandatory test
program.
And I suspected that this would probably
allow you to dump code just because
the nature of Mascaro means that it's
very expensive up front, but very
cheap to make copies.
So I think it would be a common problem
that customers complained that the mask
around wasn't manufactured correctly, so
it makes sense they would have a way to
prove that it was correct.
So I looked around for this quite hard,
but unfortunately at this point I could
not find the test program, so I had to
move on.
So the next thing I did was I
looked at the figure rom
and I thought this could be useful in a
few ways.
As I said, my main goal was to dump
their arm. But I thought there were some
other fun things I could do.
Maybe I could execute code on the
Tamagotchi.
Maybe I could make my own Tamagotchi
games because the figure support games,
and if nothing else, I was sure it would
make me better understand the Tamagotchi
behavior.
So to figure out what was inside a
figure, I scraped off the
slaughter mask of the unpopulated
PCB and I compared it to a bunch
of pad layouts, and it turned out
that it was an spy run
by the same company that made the
microcontroller general plus.
This allowed me to figure out the notes
on the figure interface, which in turn
allowed me to dump a figure.
Then I was able to look at the format of
the dump, and eventually I figured out
how to decode images and there was a
picture of it there.
At this point, I could look at all the
images, and I already knew a few things
about the Tamagotchi from them.
One thing that was interesting is that
all of the text was an image.
So there is no ASCII or other text
format in there.
If the Tamagotchi said address on
the screen, there was a bitmap that had
the word dress on it.
So that kind of shows the Tamagotchi
isn't very advanced in its programing.
The other thing I noticed was that every
animation was a series of images.
So, for example, if your Tamagotchi was
wearing the dress, there would be every
single sprite with every single dress
drawn. There was no, you know, sprite
handling or overlays or anything like
that.
So I looked into the rest
of the rom hoping that there might be,
say, code in there.
But there wasn't, and
there wasn't, I'd say, even a lot of
image data, not compared to the size of
the image data.
So I assume that was probably logic
information in some sort of serialized
format.
Now to understand this a bit better.
I didn't think that reading the ROM was
enough. I thought that I had to be able
to write the ROM so I could change things
and see what they do.
So eventually I made a rig that
basically simulated the ROM
by bit banging.
That's a picture of it there.
And from this, I was able to
do a few things to start off.
I could put different pictures on the
front of the Tamagotchi.
That was fairly simple.
When you put a figure on it draws a
picture of like a wardrobe or a chest
that you keep your toys in or something
like that. So I was able to swap that out
for a different images.
Also, I was able to play around with some
of the logic.
One thing that I found interesting was
the game logic.
I was expecting the game logic to take up
a lot of memory because games are
complex, but it turned out to be quite
small less than 50 bytes of nine image
data read at any point
during the figure functionality.
Even more interesting was that the game
logic like what decided
you know when you got points and stuff
like that was represented by
a single byte code,
which basically what this means is, you
know, there's a few types of games.
You know, there's the one where you catch
falling stuff and there's the one where
you match stuff and those
are all actually in the internal realm of
the Tamagotchi.
And the figure just, you know, says which
one, which bit of logic it is.
The other thing that was even more
interesting was what happened if I put
in an invalid index,
this would cause me to jump to other
valid screens that had nothing to do with
games. So I put in like one invalid index
and I'd go to the screen where you feed
your Tamagotchi.
And I put in another invalid index
and it would go to say what your
Tamagotchi takes a shower.
And what was also interesting was
that there was it wasn't very smart.
Once again, if I say went to the
feeding screen screen and hit back,
I would go back to the screen that you
would normally go to from that screen,
not the one I'd come from.
So this basically meant to me that the
Tamagotchi was one big state machine
with no concept of a state stack or a
screen stack.
So I thought this was quite interesting.
And then the final thing which at the
time I had no idea what to make of was
that some invalid codes caused freezing
and I actually had to reset my
Tamagotchi.
But I didn't have any way to find out
more about what was going on than that.
So here's a quick example of this
in this video I am jumping
to the evolve function.
So basically, this is what makes your
Tamagotchi grow older.
So there we go.
My Tamagotchi is now older.
So this is where I was at at the last
Congress, and right afterwards I
was contacted by a guy called Mr. Blinky,
and he wanted to order his own figures
and reproduce my research.
But something funny happened when he
ordered his figure is they had flashing
them. And it turns out there's actually
three types of figures.
There's the ones with the unpopulated
PCBs, and there's the one with the mask.
And there's actually a tape that contains
flash.
And what was even cooler is that you
could basically just program the flash
right through the context of the figure.
The picture I have in here has a wire
connecting the right pin, but that's
completely unnecessary.
I just didn't want to open up a second
one to take a picture.
But basically, all you need to do is make
a programmer and you're good to go and
you can really flash the figure, which
was great.
So this is Mr. Blinkist programmer.
And basically the idea is you put in a
standard SPI flash programmer
in there and there's also a switch.
Then you could go into programing mode or
regular mode in the Tamagotchi.
I guy called Asterix, also made a similar
programmer, and this is
my programmer,
but I promise it still works.
So at this point in time, I could play a
bit more with the functionality.
So one thing I played with was items,
and the Tamagotchi supports lots of
different types of items.
For example, you can see on the left
and the right at the bottom, there's the
clothing store and then you can buy a
dress that your Tamagotchi wears.
And then you can also do things like
Take your Tamagotchi on a trip to see
the statue of Abraham Lincoln in
Washington, D.C., which is the middle
picture.
So I played around with this a bit,
and I found out it was in a bytecode
format and you could do things
like display an image on the screen, play
a sound and you can also change a
stat. So for example, when your
Tamagotchi sees Abraham Lincoln, it
gets really, really happy.
But there is nothing really useful in
there. There were some unusual behavior
for invalid instructions, but nothing
else that I could use to dump the code.
But thankfully, I could do some fun
things like make a music video or make
my Tamagotchi do the Harlem Shake.
So that was a lot of fun, but once
again, I really just wanted to dump the
rum. So I started thinking again
about this game logic.
And as I said earlier, it was represented
by this one byte code that would
sometimes jump to a different state
and sometimes cause freezing.
And I didn't know quite what to make of
this, but I thought it was possible that
this could be exploitable.
So I started looking into how sixty five
02 worked, and I found out some
very interesting things,
for one thing.
Sixty five 02 is mapped into a single
address space.
So when you execute code, you can access
every single memory address.
You'll never, for example, get an
exception and you'll never reset.
And this is because there's no you.
So basically, what will happen if
you access unmapped
memory or memory that doesn't exist,
it will usually return zero.
It might return another value, but it
will never stop execution.
The same thing with invalid instructions.
I think what the standard says is it will
execute undefined behavior, taking an
undefined amount of time.
But practically speaking, this means that
it acts as a no op and
basically reset is rare.
The only way you can reset a 65 02 device
is basically jump to the reset vector,
which actually, if you think about this,
this is like great for exploitation
because usually, you know, like, let's
say you can move your instruction pointer
somewhere and you get it wrong.
You'll have problems because say
you'll access an invalid memory address
or you'll get an invalid instruction and
then you'll crash, but
was 65 02.
If you're a little bit off the code,
you're trying to jump to it.
You still might make it because
everything acts like a no op.
And even if you don't write, it's just
going to keep executing and wild loops
forever, and maybe you'll get there.
So I thought,
I thought knowing this, it was worth, you
know, just trying to exploit this.
So I kind of just imagined how it might
work internally, and I thought, Well,
you know, maybe game code or indexes into
a jump table and there's
only a small amount of RAM that I
can control from a figure.
And that's the stuff that's displayed on
the screen, but that's about 200 bytes of
RAM. And I thought, Well, I'll just make
a not sled and hope.
So this is mariachi in front
of me, not sled.
I eventually figured out how to make her
move as not to mess with my exploit.
And I tried all two hundred and fifty
codes and hoped I would jump
to the shellcode.
And I did not, but
I did find some very interesting behavior
in a code. I'm CC.
Basically, I found that, you know, the
first time I tried it, it buzzed.
And what the buzzing was dependent on was
this bit three of eight sixty eight of
the LCD ram was set.
It would buzz, otherwise it would freeze.
So I thought that was kind of odd.
The other thing that I thought was odd
was that some of the middle indexes
worked.
When I was first playing with this, it
was the top and the bottom of the range
that would work and the middle always
froze. But once I started trying every
single index, some of them worked.
So I came up with kind of a new theory,
which was that all the indexes were
valid, but maybe it was something else
that was causing the freezing.
Maybe the stack wasn't set right.
Maybe memory addresses weren't set right.
Maybe registers weren't set right.
And then they kind of came up with a
theory of why I was hearing the noise,
right? Maybe it's checking if sound
is enabled and
then, but it's accidentally setting
checking the LCD round because
something's corrupted and then it's
playing a sound.
And then maybe
it's doing jumps based on corrupted
memory, which would cause basically based
on this bit for it to sometimes play
sound repeatedly and sometimes not.
But this started to drive me crazy.
I thought, if this is how it works
and I have 255 vulnerabilities
and I have this fairly large chunk of RAM
full of Inot sled, you know,
why isn't it working?
I could be very unlucky.
But, you know, probably not.
So I went and I looked at my shell code,
and at this point I had used OnePlus
6T five 02 for my shell code because I
thought, Well, why have a table if it's
regular sixty 02?
But I switched my shell code to regular
sixty five O two and it made it something
a little bit more foolproof.
And at this point, it worked the fourth
time I tried Index D for.
So this is an example of my exploit
circled in blue at the bottom is the
stub of shellcode I hit.
It actually turns out that the LCD RAM
isn't contiguous, so that's actually a
very tiny not sled, and it was quite
fortunate I ended up hitting it
at the top because I don't have enough
room. I'm jumping to the actual shellcode
circled in yellow.
And what this shell code actually does,
is it right? Some white to the LCD ram
and that's circled in red.
And what I was trying to do here is since
I now knew the LCD RAM wasn't contiguous,
I was trying to figure out where all the
addresses were.
But that's just a simple example that
shows that it works.
So the next thing I wanted to do was
to dump the Tamagotchis Raw.
So what I did is I broke out the Badin
lines, which are Port A..
And then I just wrote out the entire
memory space using
Spy.
And then I use my signal analyzer
to analyze it.
And fortunately, this wasn't the entire
Iran because the problem is actually much
larger than the memory space, and it uses
rampaging to
make its memory space larger.
So basically, the way it works is the
first page of Iran is always mapped, and
that's in the upper half of addresses.
And then the lower half of addresses
can be different parts of the room,
depending on a register.
And looking at the first page, which
I managed to dump, I was able to figure
out what this register was.
It was three thousand and then I was able
to dump all 19 pages of ROM.
So looking at them quickly, I could
figure out what they all were Peaches,
zero to six were code pages,
seven to nine were unused.
Page 10 contained a pointer table for
images.
Pages 11 to 18 contain images
and I don't know what Page 19 contains,
but I'm figuring it's audio because where
else would the audio be otherwise?
So here's some of the key highlights
of my RAM dump you can see at
the bottom are some close ups of all the
Tamagotchis.
Some other interesting things is circled
in blue is a bunch of text.
So once again, the Tamagotchi has no text
encoding. They're all images.
And also circled in red is some stuff
from a startup test program,
which is also interesting.
It meant that basically, you know,
everything was in the ROM,
which which is cool and made me
think that I dumped everything.
So my next step here was to reverse
the Rahm, you know, figure out the
secrets of Tamagotchi life I had been
wanting to know the learning curve
was a bit steep.
I started off using it and there was no
paging support.
So eventually I wrote a simulator
based on a tool called PI 65
to try and figure out what it did.
And then a guy called Asterisk wrote A
way better simulator.
I would actually recommend if you like
Tamagotchis, download this.
It's really cool.
You can see you can step through all the
different locations.
You can look at the values of the E
trigger, the interrupts, all that stuff.
So I thought that was awesome.
So basically, here's how a Tamagotchi
works. After start up,
it's in one big loop.
So a state machine like I expected, and
every time the internet gets triggered,
it cycles around the loop and then it
waits, and then it cycles, and then it
waits. And it's always in one
of Hex 41 states
and there is a big table that determines
the state actions.
And some of the states have said states
and subsub states and subsub sub states,
and it's the state itself that is
responsible for handling that.
So basically, when you enter a state, it
will have, you know, startup behavior.
And then after that, it will be
responsible for everything except
for LCD update and SBI Pool.
So it will have to play sound.
It will have to handle memory, it will
have to even put you into the next state
you need to be in.
And the only things it doesn't do is it
will write into a fake LCD buffer.
And then there is an LCD update function
that actually updates the LCD.
And also you're not responsible for
pulling spy.
That's the one thing that's done outside
of your state.
And just a general note, there were tons
and tons of pointer tables.
I don't know quite why they like them so
much, but there were pointers to pointers
to pointers everywhere.
So I was able to figure out a
few secrets.
One was what makes a Tamagotchi a boy
or a girl?
And I found out that there was an entropy
source C4
that is based on how many times a timer
one has fired.
And basically, this is what determines
whether it's a boy or a girl.
So when you're starting up your
Tamagotchi, the instant at which
you press the button to enter your name,
that's what seals your Tamagotchis fate.
Also, I found out, right?
You start off with a baby Tamagotchi that
grows into a toddler.
And I found out that this is completely
random, except sometimes it's
even. So basically, if you had one
toddler last time, you'll it's more
likely than not. You'll get a different
toddler the next time you raise a
Tamagotchi.
But I also thought was fun was that some
toddlers are higher maintenance than
others. Some you hardly need to
care for them and they'll become, you
know, the best teenager.
And Sam, you got to care for a lot, and
it doesn't even seem to have an effect.
So I found what teen
a toddler becomes is much more complex,
though. Basically, there's two care
factors and they start off at zero.
And every time you mistreat your
Tamagotchi, you know, don't feed it or
something, you get dinged on them.
And then based on, you know, how
low these factors are, you get different
Tamagotchis.
But there still is some entropy involved.
For example, which factor gets dinged is
random.
Also, what adult teen becomes
becomes on depends
on these same factors.
But there's also a third factor, which is
how well disciplined your Tamagotchi is.
And also, I found that toddler
care matter isn't what adult or teen
becomes. Basically, you know, if you take
great care of your toddler, you don't
have to take such good care of your teen
for it to become a great adult.
But if you've neglected your toddler,
you've got a lot of catching up to do if
you want to get the great adult
Tamagotchi.
Another fun thing is that you can
potty train your Tamagotchi
every time you see your Tamagotchi doing
the potty dance.
You can drag it to the toilet, and this
will increment its discipline.
And eventually, if you wait long enough,
it'll start going itself, you
know.
Another fun thing I discovered
is that the Tamagotchi has a test mode in
it, and this was kind of cool.
I was looking at the figure processing,
and there's really two types of figure
this ones with restaurants and ones with
shops.
But I found there was a third type of
figure, so I made a figure of this type
and I put it on my Tamagotchi and I found
it has a debug mode in it and
it's pretty cool. It allows every stat to
be altered so you can make your
Tamagotchi less hungry.
You can make it every single character
you can change. You know what its spouse
looks like?
You can see the care factor, and I also
found a bunch of unused functionality
in this.
So there were some other secrets this
helped me figure out, for example.
For example, I found out it doesn't
matter who your Tamagotchi marries,
they're just as happy and the kids turn
out just the same.
The exception being, there's kind of a
well known Tamagotchi trick where if
you marry a certain Tamagotchi called an
odyssey, you do get a special toddler.
Also, I found that figures
there had been some debate about, you
know, if you have a figure just on your
Tamagotchi but aren't using it.
Does it change how your Tamagotchi
behaves? And I found out the answer to
that is no.
There's just a special display if you
have 100 figures for your Tamagotchi.
So I put this online and I got some
interesting reactions.
Number one, just be aware the user
cannot be held responsible.
If you do these, these are your choice at
your own risk and my personal
favorite.
Interesting.
You are putting much effort into
something that most consider not worth
it. Kudos to you.
Oh, well, what can you do?
So the next thing I did was I analyzed
the General Plus test program,
and this was of interest to me because
as I mentioned earlier, this is on every
single general test LCD controller.
So I thought it would be useful in
dumping, say, older Tamagotchi is in just
a generally useful for everything that
runs General Plus.
And basically, I looked at it and it
turns out it pool.
Basically, you start up with the test pin
pulled and then it pulls Port A for a
code and then puts out put on Port B.
And the most interesting code was code
16, which would actually
take code off of Port B,
fill up RAM with it and jump to it.
So that's pretty cool.
That basically means that there's now a
method you can use to dump code from any
general plus LCD controller.
The caveat being that Port A, Port
B and Test have to be bonded.
So on some ships, you might actually have
to remove the epoxy, but this can be
always be used to dump the code, which I
thought was pretty cool.
So the next thing I wanted to do
was make some dev tools,
and I already had two of them that I had
made in the process of reversing.
The first one is called Portrait Dot Pie.
And I use that to put the screen the
image on the screen of the Tamagotchi.
So that's a simple one.
I also had item make, which is what I
used to make the Tamagotchi music videos.
If you like the Harlem Shake, you can
check out my YouTube channel.
I have a few others, but
they both have some serious limitations.
You know, they're both for specific
things. So I wanted to write a generic
tool that you can use to run generic
assembly.
But the big problem I ran into
was that my exploit wasn't very reliable.
I would say it's 30 to 40 percent
reliable, but it was very finicky.
Sometimes it tended to work really well
if the Tamagotchi had been running for a
long time, but as soon as I started
resetting, it stopped working
and I thought about it and I thought,
Well, really, for a useful tool, you need
100 percent reliability.
So I couldn't use this phone.
So I started to look into how it worked.
And basically, I was right about it being
a jump table.
And basically what
the figure does is it will fetch the game
index that one value
that determines what game you're playing.
Add Hex 27 to it and then
jump to that in the state table.
And there's no validity check.
So your problem is that you're jumping
to a state that's out of range.
But then what's the Tamagotchi actually
do with that invalid state?
Well, it turns out when the Tamagotchi
does a state change, it jumps into
the state table.
But it actually does is it pulls a page
number out of that table and then jumps
into Address 4000 there
and then address four thousand in that
page table.
It has code that will make you jump into
another jump table.
So this means that invalid states could
do a few things.
They could jump to an on code
page, they could jump to an unexpected
address. They could bring up an invalid
page. Lots of options there.
And if you look at what this original
vulnerability did is it would
return instead of a valid page
part of the LCD table, which is three.
See, and what happens
when you make a general plus LCD
control or go to an invalid page?
Well, I don't really know.
I tried playing around with this, writing
it out to the LCD and I got
all dark, all f f f.
But I didn't know what this meant.
I think it can mean to have one of two
things basically, either when you go
to an invalid
page, it causes the memory to float
and that would be what's causing my
execution that this floating data
somehow caused jumps into my code.
The other option would be that executing
f f for whatever reason, caused a jump
into my code.
Both of these are very weird,
but for whatever reason, seem to work.
But no wonder this exploit is unreliable,
and certainly there's no way to make it
more reliable.
So I did what I call vulnerability
idle.
I tried out all the other indexes
and I eliminated ones, you know, voted
against them if they started failing.
And I found out, you know, which
vulnerability was going to star in the
Tamagotchi Dev Kit, and that was
seedy.
And I looked into it and figure out how
it worked. And basically, what's
happening here is it's
adding 27 to CD and going to f four,
and it's returning another piece of the
LCD table, which is four,
but this is a valid page.
So then it goes and executes
the jump code in that valid page,
but it goes somewhere that's invalid
in the jump table and it's actually
a code locations.
So it's treating ink
1:1 e as
a pointer, which is actually one EEG.
But very fortunately, the way L CD
ROM is addressed on the microcontroller,
it actually ignores those internal bits
that you know aren't part of the proper
address.
So money will
resolve to one which is in the LCD
lab so that so this means that this
exploit will jump to the code in the LCD
around 100 percent of the time, which
is great.
So now it is ready to make my dev kit
and I made it hasn't got she the 65
oh two assembler for Tamagotchi.
And what it does is it basically outputs
a binary ready to be loaded on the figure
so you don't need to mess around with
exploits or anything.
You just need to compile load
and then you can execute the code.
And basically, what it does is it
loads the code into RAM and then
executes. It contains a few convenience
functions for things like writing to the
LCD and air.
And these are largely based on the
Tamagotchi ROM, and it's
based on a 65 or two assembler for
Python called office.
So making the dev kit was a little bit
difficult.
One of the main problems was
the lack of data
sheets, so I still don't know
what all the ports in this general plus
LCD controller do.
So I was able to determine some of the
functionality from the test program.
But there's still, you know, some
interrupts. We don't know when their file
fired.
We don't know how power management works.
The SPU, the watchdog
and I just want to mention if anyone does
figure this out, contributions are
welcome.
So take the dev kit
more generally useful.
I made a programing board called
an eggshell and this is basically an
API programmer for the Tamagotchi.
So you can take your figure and push it
on and then program it over USB.
I also put on infrared there.
Right now, there are no Tamagotchi
remote exploits where you can reprogram
it over air, but I'm not 100 percent sure
that isn't possible.
So I put on the components, you know,
just in case we ever find one.
And it's also a lily pad, USC,
Arduino, if you want to use it for
something else.
So I basically have all my tools there,
the three programing tools and
also the board specs.
So today I'm going to do a workshop
if people want to learn how to use these
tools today.
The room opens at 7:30 and I'll
start talking at 8:00 and I'll be selling
kits for 30 euros, including that.
And they include basically the board
and the figure and the Tamagotchi.
Everything you need to learn how to
program a Tamagotchi.
I mean, if you want to sign up or learn
more about it, I have a link there.
I also wanted to do a quick plug for my
boards. I'm selling these at the URL
below, and I don't profit from these
or from the workshop, but I
ended up doing a very large run of them
because I wanted the unit price to be
affordable to everyone who wants to
hack Tamagotchis.
So if you like my project and want to
support it, I'd appreciate if you bought
a board, there's a URL where you
can get more info below.
And so I'm going to
do a quick demo here.
This is basically
what the Dev Kit does is a simple
program, but you can see get to the
exploit, you have to play the game and
then that's the shell code and then it
jumps into user code.
You can see it there and then the user
code just every time you press the button
and says the letter of the bug in.
So basically, that's the dev kit.
So basically, this is it
in this project, I managed to dump the
Tamagotchi code, I learned about
Tamagotchi internals,
I learned about the secrets of Tamagotchi
life.
I made my Tamagotchi do new things.
But most importantly, good times were had
by all except for the Tamagotchis.
So since we
have a little bit of extra time here, I
wanted to run through, I made some bonus
slides about the new Tamagotchi.
There is actually a new Tamagotchi that
was released on December the 26th.
And so I have some speculation on it
here.
Basically, this is the new Tamagotchi,
and here are its features
Tamagotchi.
We've got a voice
where you can feed
and take care of your Tamagotchi.
So can I see you, me?
She's hungry.
Time to take
your Tamagotchi tech
for the occasion, and I'll bump you back
for a great Monday down.
Oh my god, she.
Tamagotchis, I'm still calling for even
more cool stuff, Tamagotchi,
friends from Bandai.
So it is still what that ad said,
basically, it's the same LCD
and form factor as the tomato in town
they go. But it doesn't have IRA figures
anymore. Instead, it supports NFC
and you use the NFC bumper
to do all the air
and figure functionality, sending GIFs
so you can visit.
You can also send text messages using
these new Tamagotchis, which is a new
feature.
And one limiting factor
which I'm already having problems with
is that there's daily limits.
So with the figure and with the air,
you could do that as many times a day as
you wanted, but now you
can only do it five times a day.
So one of the first things I'm going to
try and do is circumvent that limit.
So here's a picture of the
board, and what's interesting is it's a
lot sparser than the previous Tamagotchi.
But I think it has basically the same
functionality. That components are just
smaller now, and you can see the
prom at the lower right and also
you can see the NFC antenna
on the other side.
And that's not hugely interesting.
You can just see there's a tiny PCB on
it. And once again, this
is the same blob.
I'm not sure if it's the same
microcontroller because this looks a tiny
bit smaller than the time ago, but the
functionality is so similar it even uses
the same images that I think it probably
is.
So it's just some quick speculation.
I think it probably uses the same
MCU.
So that means that we could
probably dump the code using the General
Plus test program, although kneecapping
may be required to bond the wires.
And also, there's a reduced attack
surface for code execution because there
aren't the figures anymore.
But I'd say there's about a 50 50 chance
that there's probably there's a
vulnerability in the NFC that can be used
to execute code.
So it's just a wait and see thing.
It may or may not be possible,
but hopefully.
And then just one last thing, which I
think is a lot of fun.
This is the chart they provide of
how the Tamagotchi works.
So, you know, if this is for small
children, wow, I imagine what it looks
like an idea.
So that's it, I'd be happy to take any
questions that people have.
OK. Yeah, well, we have.
Well, first, thanks for this wonderful
talk. We might see you again
on this stage.
Always, always add some color to these
slides, which we're seeing usually
do, we have some questions?
Signal Angel, no questions
from the internet so far.
OK, so then we need something from
in here. I see someone at number
four. Maybe?
Yes, hi.
I just have a short question due to
Tamagotchis, so to
support same sex marriage.
Not officially, but the
marriage checks are what hackers like
to call a client side.
So if you make your own device,
you can do this.
Number three. Yeah.
Sort of the same.
But in the last year talk, you said
the gender is determined by a three
bit code and you couldn't
figure out one of these three bits.
Who did you get some more knowledge on
that?
I guess I'd say sort of sort of know
like, I can definitely see where it has
the three bits and where it checks them
and kind of what it does with each of
them. Now why they chose to have
three instead of one, I still don't know.
I think it might have just been a
convenience thing.
OK, thank you.
OK. What was that?
Yeah.
Is there is this use
at number four? No, I think that's
it for right now.
I guess maybe one one more thing.
That's the thing is, do you have any
feedback, maybe of the people
manufacturing their toys
to you to to to know about
your work? Or have you ever got any
feedback? Or is it just silence?
Yeah, silence. I haven't heard a word
from them yet, which I guess is so far
so good.
OK.
We have some more at number four, please.
Yeah, I have a question.
Do you have any knowledge, how many hours
you did spend on this awesome project?
Like with the number of years I've spent
on it, I'm in complete denial on that
subject.
OK. I think then
we have some more at number two.
Go ahead.
But have you figured out how to give the
Tamagotchi a soul?
I don't know. This has actually been a
debate on several Tamagotchi
forums, whether it
was their Tamagotchis have souls
and whether I've destroyed
the magic of that.
Unfortunately, I think this is more of a
philosophical subject that
can't be determined by technical means.
Again, do you know of any other
products using these same general plus
chips that you're sort
of reverse engineering efforts could be
applicable to,
not the exact chip, although I've heard
that Furbys also use general plus
also I was looking into General Plus
and basically a lot of toy manufacturers
or toy consulting companies.
One of the things they offer to do is,
you know, set you up with General Plus.
So I think like my guess is that a very
large number of toys actually
use, use it actually.
Now that I think of it, there is actually
a third one that I found out about, which
was a Hannah Montana toy,
and they actually managed to dump the
code of that using an internal test
mode of the toy.
Jumping it off.
Dumping it off the LCD.
But yeah, those are, I guess, the two
I've heard of.
So now that that, yeah,
OK, so now that this theft all
this out, so we are maybe looking forward
to maybe next time see people doing
great stuff with this with these toys and
maybe have some some, you
know, some new software for it and maybe
some users, maybe
next year on the Congress.
Yeah, I'm excited to see what everyone
does with it.
OK. I think that we have
it. So, uh.
Thanks a lot again for having you here.
And yeah, let's see what house?