Reverse engineering a simple motorized cat toy

[gsgx]

I took apart this cat toy recently as my cats didn't really like it and I wanted to take a look inside:
https://smartykat.com/products/twirly-top-electronic-cat-toy/.

Inside was a very simple circuit board (images attached) which controlled a toy brushed DC motor. When the power button for the toy is pressed, the motor turns for a second or two, causing the toy to roll in one direction and then stop, then after a short pause the motor starts turning again (I forget if the direction always switches back and forth or if it's random each time). It automatically turns off after a few minutes.

I attempted to reverse engineer how it works with just a multimeter, see the attached schematic. The problem is that I don't see any markings on either the U1 or U2 chip. I took a look under a microscope and still couldn't make anything out. There's nothing I can do to determine what chips they are other than use a logic analyzer/oscilloscope and find a datasheet that seems to match what I'm seeing, right?

My guess would be U1 is some type of microcontroller controlling the motor timing, when it detects a signal on pin 2 it starts outputting on pins 5 and 6 and different intervals to control U2. I'm as sure about U2 though, it gets input on pins 2 and 3 and drives the motor with pins 5 and 8. I'm not sure if pin 4 is some enable/reset type pin, I've never seen pins like that connected with a 2.2 ohm resistor.

Does anyone know what this U2 chip could be? Is it some amplifier IC or a motor driver IC? Even if I can't find the exact chip, if I can find a chip in the same package that can do the same thing, that would help me better understand what's going on and potentially make some improvements to the board.

[ajb]

U2 looks like an H-bridge.  Guessing that R1 is used when braking the motor, suggesting it would move in the same direction each time.  Or it just spins a little slower in one direction.  U1 is absolutely a microcontroller.  People still say "why use a microcontroller when you could use a 555...", but this is why: all of the timing and operational logic and h-bridge control logic in one chip.

[gsgx]

Thanks! I had literally just came across the DRV8871, which I think seems to match U2: https://www.ti.com/lit/ds/symlink/drv8871.pdf

[gsgx]

Oops, it's not exactly a drop in replacement. Pin 1 is GND for the DRV8871, not VCC. But it's pretty close, so I get the idea of what's going on.