Well, here’s a classic: hacking the old Billy M0uth Billy Bass! This is an absolute classic, it seems like everyone and their tin dog has done this one. I picked this thing up at a garage sale, the only intention I ever had was to hack it (who really wants this thing wailing at them?). Well, let’s get to it.
First things first, the mouth was broken… unacceptable! Let me tell you this thing is a pain to get open, the plaque is fine, but the fish itself… they must have heat sealed it on or something, it looks like a ship in a bottle, like it was assembled inside the skin. To finally free the mechanics from the skin I put a slit down the back of the tail about 2 or 3 inches long. Once I got it open it was obvious the plastic had just sheared, lacking patience for 3d printers I decided to just superglue it back together.
That pretty much fixed the mouth. When it breaks again (and it will) I’ll model and print another couple brackets. Now that that’s done, let’s examine the ASIC. ASIC stands for Application Specific Integrated Circuit, that means someone designed a specific chip to do this exact job. In very small runs these are usually FPGAs (Field Programmable Gate Arrays) because of the cost involved in creating an ASIC. In small runs they are usually like this, what we in the biz call “epoxy blobs”, they just bonded the silicon wafer to the PCB then covered it with epoxy. In larger runs they are made into standard package ICs. Epoxy blobs cause such a headache for hackers because the only way you can identify what’s under there is by dissolving the epoxy around the silicon wafer and just looking at. The more reasonable and down to earth way of identifying what’s in the chip is known as “black boxing” it. That involves looking at what the chip does, how it reacts to inputs and when it gives certain outputs. By using a bit of logic you can determine basically what a chip does (while it’s still in the circuit preferably) without needing to know exactly how it does it.
This is the ASIC in question, helpfully it’s on its own PCB mounted perpendicular to the main PCB. My solution for figuring this one out was to mount the ASIC on 0.1″ headers and stick it on a breadboard, run a ribbon cable and another 0.1″ header and jumper all of them together. After testing that it behaved the same, I started changing things. First I verified where ground was (by tracing it out). Once I had a reference I found (what I assume to be) a relatively stable/regulated 3.3v source. The next thing was watching what the lines did when the various motors triggered. That was the single longest time I listened to the built in audio… and I never will again. The button and CDS cell each seemed to generate analog voltages on two of the pins… kinda. I say analog voltages, but they’re probably supposed to be digital, but there’s some variance in them, so I use them as analog. The audio line I left off since I have yet to try to implement this. Two of the lines I haven’t figured out what they do, but they don’t seem to matter.
Before taking on a project like this I usually say to myself “which will be easier, strategically modifying existing circuitry to suit my needs, or ripping it out and putting in my own? I usually come to the conclusion that I could certainly build my own controller with a digital input, analog imput, l298d for the motors, but all that work is done for me here. There is even a nice sorta regulated voltage I can run off of. In this specific case it was easier for me to ignore how the circuit works (because it’s a mess of resistors, caps, diodes, and bjts) and just try to emulate the ASIC than design a circuit to do this job. The main reason was that I didn’t want to spend a motor driver IC on this project if I didn’t have to.
The next thing is the brain. The microcontroller is a key decision, the part that pushed my decision on this one was the voltage, the circuit seemed to run on about 3.5v so that meant I could use an arduino, but only if it was running at 8Mhz (which I didn’t have set up) or I could use an msp430 from one of the launchpads I had kicking around. I’m not familiar with programming for the msp430, but luckily there is a project to program the launchpads with wiring code (what the arduino uses): Energia. Slapping the msp430 on it I quickly built this small sketch to showcase all the inputs and outputs. My eventual plan with this is to get a serial link working so it’s just another peripheral you can interface to with whatever program you want (maybe an ROS module? but that’s an idea for a future project bleeding in). All images can be found here.