Dancing Cactus
The dancing cactus is a toy that stirred up a small controversy in late 2021 after a Polish grandmother purchased it from Walmart only to find out that it contains the Polish cow meme song. I found and purchased one on Ebay for approximately $17 CAD which supposedly contains 120 songs and the ability to record a short message. My intention is to hack it to play my own sound clips.
After receiving the cactus, my initial impression of the toy is mixed. I like how silly the thing looks, but the audio is terrible and obnoxiously loud. Despite the listing saying it contains120 songs, I think there were maybe a dozen songs which plays seemingly at random whenever the playback button is pressed. It has a voice record function which can be triggered by holding the second button down until it beeps. The recording ends when the second button is pressed again. While on, it will also play back any loud sounds it hears, similar to those cheap mimicry toys that have been available for the past few years.
Hardware
The cactus has a small board with a AB21BP0K098-42A0 microprocessor and a T25S80 flash chip. An image of the board is available below.
Connected to the board are:
- 2 buttons (one for playing a random track, one for recording/replaying a voice recording)
- a tiny speaker
- a microphone
- a motor which goes through some gears and up to the dancing cactus
- a string of LED lights
Flash dump
Because the flash chip has both DI and DO connected together on the board, I had to desolder the chip first and then connect it to my Raspberry Pi using some thin wires. It's interesting to note that the cactus is completely broken without the flash chip as it will continuously dance when powered on. None of the other features like the voice recorder or voice playback work either.
After some tinkering with the flashrom utility to force it to accept the flash chip ID, I was able to dump the contents of the flash chip. The layout of the chip appears to be the following:
| Address | Comment |
|---|---|
| 0x000000 | ??? |
| 0x0000F40 | Blank |
| 0x001000 | ??? |
| 0x0BB010 | WAV 1 |
| 0x0BC010 | WAV 2 |
| ... every 0x1000 | ... WAV N |
| 0x0EB010 | WAV 34 |