Extracting Tamagotchi ROMs?

[SA311]

Hello, 

I have been wanting to get the ROMs of the older (vintage, connections) versions, but I'm no good with hardware and it seems i might need to solder.

I know that somebody already dumped the Tama-Go and the Friends, but I would like to have every version. Is there anyone who is good with electronics and would be willing to do this? I have no idea where else to ask.

The reasons for having these are finding unused content, figuring out things we might not know about them and, most importantly, preservation.

These little devices won't last forever, no matter how good they are maintained. They need to be preserved or they will be lost to time. It will still be a long time before that, of course, but even then, it's always good to do these things in advance.

Sorry if this isn't the right place to ask.

 

[hwd45]

Unfortunately it seems like one of the big obstacles getting in the way of us dumping any of them is the huge glob of epoxy covering the microcontroller.

As I recall, for the Tama-Go and the Friends, the microcontroller was identified by removing the epoxy using acid and then the figures and the NFC functionality were used in the dumping process. I think there were some security flaws or something that allowed it to happen. I guess if there's a security flaw in the IR functionality on the earlier models that might be used as a means to read the device's ROM? But I don't really know.

According to patent documents the microcontroller used on the V1 may have been an ML63189? Though it's hard to be sure they didn't opt for a different controller by the time of the release several months later.

There's definitely people interested in dumping their data but I'm just yet to see anyone succeed in their attempts. I sincerely hope we get a full code dump at some point though, because as you say...

The reasons for having these are finding unused content, figuring out things we might not know about them and, most importantly, preservation.

I couldn't have really put it better myself. I mean, we've known for a while that there is some unused data on each of the Connection versions, but there was never really a particularly accessible or consistent method to viewing most of this content. Any dump that happens will surely reveal a lot of secrets that were previously completely unknown to us.

Not only that, but there's an awful lot of different versions of each device, and it'd be nice to obtain some way to identify the differences between each version. It's still unclear why ROM versions 2.2, 2.3 and 2.4 all exist when they're so similar to 2.1, for example. Preserving and cataloguing each version would be the ideal way to solve this issue, I think.

I hope that ultimately something non-intrusive will be found to preserve all this data. If any particularly rare versions are found (like the GLAY Plus, the PUMA V2, and any pre-release versions that might emerge over time), we'd ideally want them to be preserved without risking destroying the device and its data. Either way though, if something was found for the Friends and the Tama-Go, I'm sure something will emerge for other versions too.

 

[SA311]

Unfortunately it seems like one of the big obstacles getting in the way of us dumping any of them is the huge glob of epoxy covering the microcontroller.

Yes, this is exactly where my investigation came to a stop. After my Catastrophic attempt to replace a capacitor I feel no confidence to do something that seems as risky as removing that blob.

I couldn't have really put it better myself. I mean, we've known for a while that there is some unused data on each of the Connection versions, but there was never really a particularly accessible or consistent method to viewing most of this content. Any dump that happens will surely reveal a lot of secrets that were previously completely unknown to us.

This is one of the points I'm most interested about, I Think you cannot debug the Japanese releases and I think these ones have the most potential for having unused characters hidden in the data. I have a hunch the V3 exclusive characters (Teketchi, Warusotchi...) were discarded characters for the Keitai series or the EnTama the way V2 characters were discarded V1 characters (Toratchi, Whaletchi, Flowertchi...).

But of course, there's no way of knowing that. Or if there were more discarded characters.

I also want to figure out the growth charts, because the ones from the V2-V4.5 are kind of a mess. I think I figured most of it out by now but having the code would help a lot.

I hope that ultimately something non-intrusive will be found to preserve all this data. 

Me too, at this point I would even be willing to sacrifice Tamagotchis that are already broken (in ways that don't affect the ROMs) to extract the ROMs if necessary, too.

 

[hwd45]

This is one of the points I'm most interested about, I Think you cannot debug the Japanese releases and I think these ones have the most potential for having unused characters hidden in the data. I have a hunch the V3 exclusive characters (Teketchi, Warusotchi...) were discarded characters for the Keitai series or the EnTama the way V2 characters were discarded V1 characters (Toratchi, Whaletchi, Flowertchi...).

But of course, there's no way of knowing that. Or if there were more discarded characters.

Hmm, that's a good point. I think the Keitai can be debugged using soldering as I recall? There's definitely a debug jumper that's a rectangle shape rather than a circle shape on some Keitai boards. As I recall, there's also one of these on some 2.0 European V1s too, though I'm not sure they've ever been successfully debugged.

There is also the question of how many characters might be present in the data but not in the debug character select. One prime example is Tsutatchi / Tsutayatchi, which is very much a selectable character on the Plus but behaves differently on other V1-3 versions. The food the character eats - and presumably any other character-specific behaviours - seem to have remained unchanged between the versions, but its sprite set uses Nazotchi's sprites instead, hence there being two Nazotchis in the debug character list. However, the only thing that seems to have changed is the set of sprites that the character points to, rather than the sprites themselves, as the sprites can still appear when other Deka characters use items on V2/3 (due to the Deka characters having limited sprite lists, I guess there's an overflow and it reads the sprites for a different character instead).

While logging Deka sprites, MasterPengo also noticed that some V2-exclusive sprites appear when certain Deka characters use certain items, too. After a lot of research I found that this is due to a bunch of sprite IDs seemingly not getting replaced by other sprites on the V3 - rather, new sprite IDs were added to the end of the sprite index list. What this basically means is that there's a few IDs for every character that aren't used because they correspond to sprites that would have only been used on the V2. A few of these are still a bit speculative:

27 - Skateboard 1
28 - Skateboard 2
29 - Boots
30 - Tools 1
31 - Tools 2
36 - Cape 1
37 - Cape 2
46 - Racquets?
64 - Computer 1?
65 - Computer 2?
70 - Glasses?

So the next question is whether new characters have totally unused sprites in these slots that would have been used should these items have stuck around, or whether the V2 sprites are still in these slots, even for characters that weren't in the V3. A dump would help answer that question.

I also want to figure out the growth charts, because the ones from the V2-V4.5 are kind of a mess. I think I figured most of it out by now but having the code would help a lot.

Totally, yeah. It'll be nice to finally determine once and for all what the required conditions for "good care" is, haha.

Me too, at this point I would even be willing to sacrifice Tamagotchis that are already broken (in ways that don't affect the ROMs) to extract the ROMs if necessary, too.

Lots of broken Tamagotchis come up every now and then on eBay and a few other sites. I know a few people interested in figuring out how to dump the connections have had their eyes on some of those listings to experiment with, so I hope one of them ends up giving us a positive result. Especially if it's a lot with a bunch of different versions and we can get them all dumped in one go, hahaha.

If they do get dumped I hope the code is like... readable, you know. It'll be important for both preservation and research purposes that the dumps are catalogued by their ROM version numbers; if the ROM versions aren't obvious (since I don't think they're stored as separate graphics like they are on the Tama-Go and Friends) it'll be that extra bit trickier knowing which version has been dumped.

 

[SA311]

Hmm, that's a good point. I think the Keitai can be debugged using soldering as I recall? There's definitely a debug jumper that's a rectangle shape rather than a circle shape on some Keitai boards. As I recall, there's also one of these on some 2.0 European V1s too, though I'm not sure they've ever been successfully debugged.

Huh, I didn't know there are debug jumpers in some of these, I have to open up mine and check. I just looked it up now and I can't find anything that shows any of these versions on debug mode.

I have 2 V1s that got water damaged when I was a child (bought here, in Europe) and they both have very different circuits. One of them Has the debug jumper, the other does not.

There is also the question of how many characters might be present in the data but not in the debug character select.

There's that too, there may be unused graphics showing discarded characters and functions (like that "try? yes/no" one that appears when glitching the V2) that can't be seen just by debugging.

Totally, yeah. It'll be nice to finally determine once and for all what the required conditions for "good care" is, haha.

Yeah, the V2-4.5 seem to use a system in addition to care misses that's odd, you can't really tell if you have given your character good enough care until it evolves, haha.

Lots of broken Tamagotchis come up every now and then on eBay and a few other sites. I know a few people interested in figuring out how to dump the connections have had their eyes on some of those listings to experiment with, so I hope one of them ends up giving us a positive result. Especially if it's a lot with a bunch of different versions and we can get them all dumped in one go, hahaha.

If they do get dumped I hope the code is like... readable, you know. It'll be important for both preservation and research purposes that the dumps are catalogued by their ROM version numbers; if the ROM versions aren't obvious (since I don't think they're stored as separate graphics like they are on the Tama-Go and Friends) it'll be that extra bit trickier knowing which version has been dumped.

I hope so too. As for the version numbers, hopefully the ROMs have a header with that info in them. If not, we might still be able to tell from other elements in the circuit but that would definetely be far less convenient haha.

 

[hwd45]

I have 2 V1s that got water damaged when I was a child (bought here, in Europe) and they both have very different circuits. One of them Has the debug jumper, the other does not.

At one point I was considering starting a project to take photos of all different kinds of boards to look for differences like this. Maybe if I get around to it I'll work a bit more on that project soon.

There's that too, there may be unused graphics showing discarded characters and functions (like that "try? yes/no" one that appears when glitching the V2) that can't be seen just by debugging.

Ah yeah, there's definitely some unused menus and things. I wonder if any of the cut features from the aforementioned patent document will turn up in ROM dumps.

Speaking of unused menus, supposedly by performing battery glitches on a V3 it's possible to get into the "HEADING / SLOT" menu from the V2, which is apparently still present for some reason. Even weirder is that playing SLOT supposedly works on the V3. Not something I've managed to reproduce, though. You'd think they'd be more careful about space usage on devices like a Tamagotchi but apparently unused games aren't a big deal

 

[LucidLyes]

IYou'd think they'd be more careful about space usage on devices like a Tamagotchi but apparently unused games aren't a big deal

I'm not surprised at all lol. I stumbled upon a video once that showed hilariously desperate comments from Half Life 2 programmers (iirc). With increasing storage space and the pressure to release new versions on schedule, suboptimal programming isn't shocking at all.

I wasn't aware of these rom hacking efforts though up until today. I really hope they're successful for all the reasons already mentioned.

Still, another idea I had was to create a sort of "Universal Virtual Pet Generator", where the users would create their own characters, provide the functionalities (growth conditions, death conditions, effects of various foods, etc.) in a simplified scripting language, animations,  etc. and then compile the vpet as either an android app, a GB rom, or a computer executable. Basically a sort of RPG Maker but for Virtual pets. If that were to exist, I'm pretty sure people would quickly reproduce almost every VPet that ever existed, with high fidelity. (It would still be cool to have such an app even if the latter wasn't the case though).

 

[orchidgoth]

Super interesting thread! I just got my paws on a bootleg tama with the Hello Gotchi/Apollo Super Pet program that I had as a kid. Sadly it keeps resetting itself, so I was looking into ways to access the program somehow and then possibly making it a more modern app (I’m a noob learning to code )

 

[nijinoya]

Here's a page that aggregates some technical info about Tamas:

http://tama.loociano.com/
I believe the original P1 has been dumped, and to my knowledge it is the ONLY vintage Tama that has been. My understanding (but [citation needed]) is that the ROM was extracted by looking at a high-res picture of the die (decapped using acid as somebody said in this thread already) and directly reading the 1s and 0s that compose it. Then if you know the type of CPU you can then interpret the 1s and 0s as code and data. It takes additional effort to figure out how the program works (and I guess figuring what's code and what's data would also be something you'd have to figure out)

Note that I'm not sure how they figured out what the CPU was for the P1, although Natalie Silvanovich's talk (linked on the page I provided above) tells the story of how she figured it out for a later model. There are apparently some patents floating around for the P1 that give a CPU model so maybe that was it...? (and of course then the next question is: how do we know that the same specs apply for the P2, Angel, and Ocean specifically)

I don't think any better method is known for the vintage Tamas other than what they did for the P1. If there were a way to dump the ROM that didn't require a board to be destroyed in the process (or the extremely time-consuming method of visually reading 1s and 0s), that would probably be a big deal.

On the subject of Tama hacking, I wonder if there might be some interesting stuff you can do with the Mesutchi and Osutchi since they can hook up to each other to communicate.

 

[leogames2012]

When you dumped you would want Mame to play it as long as the dump is from Mame.

 

[BitCritter]

Here's a page that aggregates some technical info about Tamas:

http://tama.loociano.com/
I believe the original P1 has been dumped, and to my knowledge it is the ONLY vintage Tama that has been. My understanding (but [citation needed]) is that the ROM was extracted by looking at a high-res picture of the die (decapped using acid as somebody said in this thread already) and directly reading the 1s and 0s that compose it. Then if you know the type of CPU you can then interpret the 1s and 0s as code and data. It takes additional effort to figure out how the program works (and I guess figuring what's code and what's data would also be something you'd have to figure out)

Do we know if there is documentation on the process of reverse engineering the P1? I ask because I only see a few mentions of the die being read online. There are a few different models of Tamagotchi that I believe use the same CPU as the P1 (P2, Mothra, Ocean, Angel) and I'd be interested in perhaps assisting in dumping those for archive reasons. I just need a little more information on the process used to dump the original P1 ROM.

 

[nijinoya]

They decapped the chip and then read off the bits from the ROM in a microscope. I don't think anybody documented how they did it anywhere unfortunately.