Dancing Cactus: Difference between revisions

From Leo's Notes
This page was last edited on 18 December 2021, at 19:49.
← Older editNewer edit →
VisualWikitext
No edit summary
Line 4: Line 4:


==Hardware==
==Hardware==
The cactus has a small board with a AB21BP0K098-42A0 microprocessor and a T25S80 flash chip. An image of the board is available below.
The cactus has a small board with a JL AB21BP0K098-42A0 microprocessor and a T25S80 flash chip. An image of the board is available below.
[[File:Dancing Cactus Board.jpg|alt=Dancing Cactus Board|center|thumb|Dancing Cactus Board]]
[[File:Dancing Cactus Board.jpg|alt=Dancing Cactus Board|center|thumb|Dancing Cactus Board]]
Connected to the board are:
Connected to the board are:
Line 17: Line 17:
Because the flash chip has both DI and DO connected together on the board, I had to desolder the chip first and then connect it to my Raspberry Pi using some thin wires. It's interesting to note that the cactus is completely broken without the flash chip as buttons don't respond but it will continuously dance when powered on. None of the other features like the voice recorder or voice playback work either.
Because the flash chip has both DI and DO connected together on the board, I had to desolder the chip first and then connect it to my Raspberry Pi using some thin wires. It's interesting to note that the cactus is completely broken without the flash chip as buttons don't respond but it will continuously dance when powered on. None of the other features like the voice recorder or voice playback work either.


After some tinkering with the [[flashrom]] utility to force it to accept the flash chip ID, I was able to dump the contents of the flash chip. The layout of the chip appears to be the following:
After some tinkering with the [[flashrom]] utility to force it to accept the flash chip ID, I was able to dump the contents of the flash chip. Unfortunately, I'm unable to make much of the flash layout.
{| class="wikitable"
{| class="wikitable"
!Address
!Address
Line 23: Line 23:
|-
|-
|0x0000
|0x0000
|Boot data? Ends with{{Highlight
|Boot data? Starts with:{{Highlight
| code = 00000000: 2558 bf1d 302e 3031 f0c1 b367 c4ad ff97  %X..0.01...g....
00000010: 5348 3534 ffff ffff ffff ffff ffff ffff  SH54............
00000020: 8896 456f 9f3e 7cf8 76cf a367 8ebd 5b97  ..Eo.>{{!}}.v..g..[.
00000030: 7a7c 5317 a5ad 4521 f36d 13d9 b367 cf9f  z{{!}}S...E!.m...g..
00000040: 8ee3 e6b3 1931 7cf8 cbc1 a367 cc42 5b97  .....1{{!}}....g.B[.
00000050: 666d 5827 b2ec 4928 f57e 3d4f 22f1 309f  fmX'..I(.~=O".0.
00000060: 0c1d 60e0 1f2e 7cf8 0f3e 5c98 4f42 5a97  ..`...{{!}}..>\.OBZ.
00000070: 6e6e 4c27 b5ea 5511 f47c 7242 4c67 cf9f  nnL'..U..{{!}}rBLg..
00000080: fedf e911 1f2e 7cf8 e0c1 a367 98ac bddf  ......{{!}}....g....
00000090: ffef 9f1f 1f3e 70f8 f081 a367 7eac 5b97  .....>p....g~.[.
000000a0: 4de1 da7f d19f 076a 5c38 0f06 6aac 247c  M......j\8..j.${{!}}
000000b0: e051 170b ee36 4392 e634 2040 26f2 8453  .Q...6C..4 @&..S
000000c0: fae0 63d7 ea61 47e7 349d 6d82 cd3b 175a  ..c..aG.4.m..;.Z
000000d0: 7e19 8094 cb54 d9fc 3ac4 0e3d 0036 8694  ~....T..:..=.6..
000000e0: fbef 4a2e 3e9b dd03 8e1f bbb6 4ebc a66d  ..J.>.......N..m
000000f0: f1b7 734c 7f94 07b3 2d98 df11 7d3d 5ab5  ..sL....-...}=Z.
| lang = text
}}
Ends with{{Highlight
| code = 00000f00: c78e 1011 1707 2034 13d6 5997 fa2e 6f41  ...... 4..Y...oA
| code = 00000f00: c78e 1011 1707 2034 13d6 5997 fa2e 6f41  ...... 4..Y...oA
00000f10: 7689 28f0 1eb8 1c4b b54a a815 520a 5af9  v.(....K.J..R.Z.
00000f10: 7689 28f0 1eb8 1c4b b54a a815 520a 5af9  v.(....K.J..R.Z.
Line 31: Line 50:
| lang = text
| lang = text
}}
}}
|-
|0x0F40
|Blank -- all 0xFFs, probably just padding
|-
|-
|0x1000
|0x1000
Line 39: Line 55:


(761,856) bytes
(761,856) bytes
|{{Highlight
|Encoded data? Maybe a XOR type cypher?{{Highlight
| code = 00001000: efd6 722b 1f3f 6cf8 dc9b a267 4dbf 5b97  ..r+.?l....gM.[.
| code = 00001000: efd6 722b 1f3f 6cf8 dc9b a267 4dbf 5b97  ..r+.?l....gM.[.
00001010: 6e6e 4c27 b0f1 422f c371 7647 2898 cf9f  nnL'..B/.qvG(...
00001010: 6e6e 4c27 b0f1 422f c371 7647 2898 cf9f  nnL'..B/.qvG(...
Line 123: Line 139:
|}
|}


== Audio data analysis ==
==Audio data analysis==
Based on the headers starting at location 0x0BB000 and every subsequent 0x1000 onward, we see a repeating audio header. What's the structure?
Based on the headers starting at location 0x0BB000 and every subsequent 0x1000 onward, we see a repeating audio header. What's the structure?
{| class="wikitable"
{| class="wikitable"
Line 142: Line 158:
00ff  
00ff  
|ffff - always
|ffff - always
|3401, 8407, f400 ?  
|Length? /8?
3401, 8407, f400 ?
|0000 - always
|0000 - always
|Track ID
|Track ID
Line 171: Line 188:
|?? Audio
|?? Audio
|}
|}
I also find it odd that the bulk of the flash (744KB) isn't for audio data. Perhaps these records here refer to the data stored there?
Here are the headers from the entire dump:
Here are the headers from the entire dump:
{{Highlight
{{Highlight
Line 206: Line 225:
| lang = text
| lang = text
}}
}}
== See Also ==
Big Clive did a teardown of a buddha flower a few months earlier. There's a discussion on the flash dump that he uploaded on Reddit: https://old.reddit.com/r/BigCliveDotCom/comments/pmt390/buddha_machine_teardown_with_flash_dump/?sort=new

Revision as of 19:49, 18 December 2021

The dancing cactus is a toy that stirred up a small controversy in late 2021 after a Polish grandmother purchased it from Walmart only to find out that it contains the Polish cow meme song. I found and purchased one on Ebay for approximately $17 CAD which supposedly contains 120 songs and the ability to record a short message. My intention is to hack it to play my own sound clips.

After receiving the cactus, my initial impression of the toy is mixed. I like how silly the thing looks, but the audio is terrible and obnoxiously loud. Despite the listing saying it contains 120 songs, I think there were maybe a dozen songs which plays seemingly at random whenever the playback button is pressed. It has a voice record function which can be triggered by holding the second button down until it beeps. The recording ends when the second button is pressed again. While on, it will also play back any loud sounds it hears, similar to those cheap mimicry toys that have been available for the past few years.

Hardware

The cactus has a small board with a JL AB21BP0K098-42A0 microprocessor and a T25S80 flash chip. An image of the board is available below.

Dancing Cactus Board
Dancing Cactus Board

Connected to the board are:

  • 2 buttons (one for playing a random track, one for recording/replaying a voice recording)
  • a tiny speaker
  • a microphone
  • a motor which goes through some gears and up to the dancing cactus
  • a string of LED lights

Flash dump

Because the flash chip has both DI and DO connected together on the board, I had to desolder the chip first and then connect it to my Raspberry Pi using some thin wires. It's interesting to note that the cactus is completely broken without the flash chip as buttons don't respond but it will continuously dance when powered on. None of the other features like the voice recorder or voice playback work either.

After some tinkering with the flashrom utility to force it to accept the flash chip ID, I was able to dump the contents of the flash chip. Unfortunately, I'm unable to make much of the flash layout.

Address Comment
0x0000 Boot data? Starts with:
00000000: 2558 bf1d 302e 3031 f0c1 b367 c4ad ff97  %X..0.01...g....
00000010: 5348 3534 ffff ffff ffff ffff ffff ffff  SH54............
00000020: 8896 456f 9f3e 7cf8 76cf a367 8ebd 5b97  ..Eo.>|.v..g..[.
00000030: 7a7c 5317 a5ad 4521 f36d 13d9 b367 cf9f  z|S...E!.m...g..
00000040: 8ee3 e6b3 1931 7cf8 cbc1 a367 cc42 5b97  .....1|....g.B[.
00000050: 666d 5827 b2ec 4928 f57e 3d4f 22f1 309f  fmX'..I(.~=O".0.
00000060: 0c1d 60e0 1f2e 7cf8 0f3e 5c98 4f42 5a97  ..`...|..>\.OBZ.
00000070: 6e6e 4c27 b5ea 5511 f47c 7242 4c67 cf9f  nnL'..U..|rBLg..
00000080: fedf e911 1f2e 7cf8 e0c1 a367 98ac bddf  ......|....g....
00000090: ffef 9f1f 1f3e 70f8 f081 a367 7eac 5b97  .....>p....g~.[.
000000a0: 4de1 da7f d19f 076a 5c38 0f06 6aac 247c  M......j\8..j.$|
000000b0: e051 170b ee36 4392 e634 2040 26f2 8453  .Q...6C..4 @&..S
000000c0: fae0 63d7 ea61 47e7 349d 6d82 cd3b 175a  ..c..aG.4.m..;.Z
000000d0: 7e19 8094 cb54 d9fc 3ac4 0e3d 0036 8694  ~....T..:..=.6..
000000e0: fbef 4a2e 3e9b dd03 8e1f bbb6 4ebc a66d  ..J.>.......N..m
000000f0: f1b7 734c 7f94 07b3 2d98 df11 7d3d 5ab5  ..sL....-...}=Z.
Ends with
00000f00: c78e 1011 1707 2034 13d6 5997 fa2e 6f41  ...... 4..Y...oA
00000f10: 7689 28f0 1eb8 1c4b b54a a815 520a 5af9  v.(....K.J..R.Z.
00000f20: 9457 570b 2e22 92bd 0553 5049 0030 5f33  .WW.."...SPI.0_3
00000f30: 5f30 0442 4f4f 545f 5459 5045 0000 0000  _0.BOOT_TYPE....
00000f40: 00ff ffff ffff ffff ffff ffff ffff ffff  ................
0x1000

+ 0xBA000

(761,856) bytes

Encoded data? Maybe a XOR type cypher?
00001000: efd6 722b 1f3f 6cf8 dc9b a267 4dbf 5b97  ..r+.?l....gM.[.
00001010: 6e6e 4c27 b0f1 422f c371 7647 2898 cf9f  nnL'..B/.qvG(...
00001020: ec0e d049 9f3f 7cf8 dc98 a267 4c63 1913  ...I.?|....gLc..
00001030: 665f 2e92 3bdb 2b8a ca95 0a15 2b57 af5f  f_..;.+.....+W._
00001040: ab7f 2060 1f8e 77f8 f031 a067 fd7f df9f  .. `..w..1.g....
00001050: 6831 f80f 1f1e 1c18 1000 2041 7c98 f0c1  h1........ A|...
...
000ba800: e977 8d66 b519 d4f4 02aa dbfc d7fd 9fec  .w.f............
000ba810: 311a 9a6d bc3b a612 451b eb17 489a c4fe  1..m.;..E...H...
000ba820: 82dc 63c7 77fd d40f 1b36 21a3 67c8 012a  ..c.w....6!.g..*
000ba830: 3694 be6d a7e6 6169 0ddd 4bf9 9077 fe9d  6..m..ai..K..w..
000ba840: cad7 b868 9087 7c04 3a38 6121 4e8d d88b  ...h..|.:8a!N...
000ba850: 348a 150a 3448 b040 8122 64c9 ffff ffff  4...4H.@."d.....
000ba860: ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x0BB000

+0x1000

(4096) bytes

Audio data 1 - a short clip
000bb000: 41c6 1000 00ff ffff 3401 0000 1801 0000  A.......4.......
000bb010: 5741 5604 77ff ffff 1758 888b 8080 8808  WAV.w....X......
000bb020: 0088 0088 081c 9100 8088 11ab 12da 1270  ...............p
000bb030: 8118 c900 bb24 0014 0db1 318a 818e a194  .....$....1.....
000bb040: 58a0 31ea 02ac 3421 9249 ea22 8d92 8a81  X.1...4!.I."....
000bb050: 428a a109 29fa 6308 8018 ea14 0a02 1d91  B...).c.........
000bb060: 9ac1 1011 1331 eeb9 328b 4628 8a90 0a91  .....1..2.F(....
000bb070: 0230 ca12 3887 3ada 81bb 3738 0110 cdba  .0..8.:...78....
000bb080: 0100 2953 22dc 0a09 9652 9a91 39cb 80fa  ..)S"....R..9...
000bb090: 0210 0815 2801 bf90 3199 121b 9931 fe02  ....(...1....1..
000bb0a0: 1088 5288 200e b818 8bea 0289 0751 018b  ..R. ........Q..
000bb0b0: ba00 9916 28a1 2ac0 2289 0182 0fa8 09ff  ....(.*.".......
000bb0c0: 0882 4109 0010 0a24 9fa1 10ab a836 619a  ..A....$.....6a.
000bb0d0: 888a 808b c350 ba14 1892 1ab0 72ca a945  .....P......r..E
000bb0e0: 2289 1238 eea8 0140 9910 229b 0884 888b  "..8...@..".....
000bb0f0: fb99 3300 5738 9cb8 8811 9d90 1388 0aa5  ..3.W8..........
000bb100: 38db 9074 1120 aabb 0c13 4208 c963 9cba  8..t. ....B..c..
000bb110: 8200 109f 9923 0afe 1331 9981 1100 cd98  .....#...1......
000bb120: 836b 8621 8bc8 808a 9632 19cb 99b0 440b  .k.!.....2....D.
000bb130: ea13 119a 4510 9fa8 2200 1881 0b84 0c90  ....E...".......
000bb140: 0322 afa1 ffff ffff ffff ffff ffff ffff  ."..............
000bb150: ffff ffff ffff ffff ffff ffff ffff ffff  ................
0x0BC000 Audio data 2 -- a longer clip than the previous one.
000bc000: 8daa 1000 00ff ffff 8407 0000 1901 0000  ................
000bc010: 5741 5604 ffff ffff f118 0815 0880 0880  WAV.............
000bc020: 0808 8008 091d a281 9880 8119 bbf8 291a  ..............).
000bc030: 9234 6189 a998 bd91 3421 8802 0435 328a  .4a.....4!...52.
000bc040: b1b9 69ba 0902 0acb 1132 8777 18bb aa98  ..i......2.w....
000bc050: a9a0 6541 2210 808a cba8 20ba cc83 3149  ..eA"..... ...1I
000bc060: bca1 249e f922 0081 3009 cea0 1112 1623  ..$.."..0......#
000bc070: 09b9 3409 bfcb 9814 418b 9131 aafc 9800  ..4.....A..1....
000bc080: 0010 2223 1004 631a eb89 bcc9 2333 1231  .."#..c.....#3.1
000bc090: 139f fc18 0802 2228 8341 ccbb 9422 7312  ......"(.A..."s.
000bc0a0: 0808 a1bf f998 1222 8aa1 200b fba8 2611  .......".. ...&.
000bc0b0: 8812 1489 8a86 1089 9a0b 92ff 8022 328a  ............."2.
000bc0c0: ba29 f90a 0207 3001 8a83 8a8f 9117 3198  .)....0.......1.
...
000bcb10: 009a 12dc 889a a249 c800 1913 4143 b375  .......I....AC.u
000bcb20: 0898 888a b828 f830 1219 ea21 999b 81af  .....(.0...!....
000bcb30: 8312 9982 03bf f8a1 4130 4408 189a f919  ........A0D.....
000bcb40: a180 40b9 841d a9ba 810b 8750 8242 00aa  ..@........P.B..
000bcb50: 828a aa16 4182 418b adc9 ada9 0234 8350  ....A.A......4.P
000bcb60: 09c9 ab12 8011 4729 baa0 2990 4641 b920  ......G)..).FA.
000bcb70: ccca 319b e921 b834 32a8 0998 ba83 2672  ..1..!.42.....&r
000bcb80: 1052 00bc 8a81 a12b a3cb 9c51 8102 ccb9  .R.....+...Q....
000bcb90: ad85 2110 ffff ffff ffff ffff ffff ffff  ..!.............
000bcba0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
... every 0x1000 ... Audio data n
0x0EB000 Audio data 34

Audio data analysis

Based on the headers starting at location 0x0BB000 and every subsequent 0x1000 onward, we see a repeating audio header. What's the structure?

Byte 1+2 byte 3+4 byte 5+6 byte 7+8 Byte 9+10 Byte 11+12 Byte 13+14 Byte 15+16
Length?

41c6

Always

1000

Always

00ff

ffff - always Length? /8?

3401, 8407, f400 ?

0000 - always Track ID

1801, 1901, 1a01, 1b01, 0001, 0201, 0301,

0000 - always
Header

5741 (WA)

Header

5604 (V.)

???

7777, 77ff, 7fff, ffff

???

ffff, 77ff, ffb9,

Length?
 ??? Audio ??? Audio

8080, 0880

??? Audio
?? Audio ?? Audio ?? Audio ?? Audio ?? Audio ?? Audio ?? Audio ?? Audio

I also find it odd that the bulk of the flash (744KB) isn't for audio data. Perhaps these records here refer to the data stored there?

Here are the headers from the entire dump: 

000bb000: 41c6 1000 00ff ffff 3401 0000 1801 0000  A.......4.......
000bb010: 5741 5604 77ff ffff 1758 888b 8080 8808  WAV.w....X......
000bb020: 0088 0088 081c 9100 8088 11ab 12da 1270  ...............p
--
000bc000: 8daa 1000 00ff ffff 8407 0000 1901 0000  ................
000bc010: 5741 5604 ffff ffff f118 0815 0880 0880  WAV.............
000bc020: 0808 8008 091d a281 9880 8119 bbf8 291a  ..............).
--
000bd000: 1998 1000 00ff ffff f400 0000 1a01 0000  ................
000bd010: 5741 5604 7fff 77ff 41bc 862a 8080 8088  WAV...w.A..*....
000bd020: 0088 0808 081b a101 8908 a805 8802 ab19  ................
--
000be000: f603 1000 00ff ffff 9402 0000 1b01 0000  ................
000be010: 5741 5604 7fff ffb9 2943 f851 8080 8080  WAV.....)C.Q....
000be020: 8088 1919 2c6f fa91 1098 1008 12bb 011c  ....,o..........
--
000bf000: fa3b 1000 00ff ffff 8402 0000 0001 0000  .;..............
000bf010: 5741 5604 7777 77fb 75bd 052c 8080 8080  WAV.www.u..,....
000bf020: 8800 8800 8808 80cb 239d a111 1092 5988  ........#.....Y.
--
000c0000: 8262 1000 00ff ffff 1411 0000 0101 0000  .b..............
000c0010: 5741 5604 77ff 7779 a341 8c71 b41b 8ae0  WAV.w.wy.A.q....
000c0020: 8800 8800 8088 0080 92fc 38b1 5a91 0808  ..........8.Z...
--
000c2000: 0a89 1000 00ff ffff b405 0000 0201 0000  ................
000c2010: 5741 5604 ffff ffcf 9099 08a2 72a0 3060  WAV.........r.0`
000c2020: 8088 0088 0088 0088 0093 0071 99b3 789b  ...........q..x.
--
000c3000: 72d8 1000 00ff ffff 1403 0000 0301 0000  r...............
000c3010: 5741 5604 77ff 7777 ff25 0998 8080 8800  WAV.w.ww.%......
000c3020: 8088 0800 8808 900b 862a a8c8 3111 b93a  .........*..1..:

See Also

Big Clive did a teardown of a buddha flower a few months earlier. There's a discussion on the flash dump that he uploaded on Reddit: https://old.reddit.com/r/BigCliveDotCom/comments/pmt390/buddha_machine_teardown_with_flash_dump/?sort=new