Tamagotchi 4U teardown

[jimon]

Tamagotchi 4U, released in Japan on September 27, 2014. Tamagotchi's are evolved a lot from basic toys that we remember from 90-x, now there is a NFC, mobile app to connect to, tamagotchi in virtual world can go to school, find work, start family  New release added NFC connectivity and downloadable content (you can download new characters, food, places, games) from cards or mobile phone (and maybe from other tamagotchi device). More info here http://tamagotchi.wikia.com/wiki/Tamagotchi_4U

Cards with downloadable content are sold in Japan :


So I got this cute device in my hands, let's see what inside.

First let's start with power :
Device works on two AAA batteries, power consumption around 20 mA when display is on, device worked fine with voltages as low as 1.0 volt ! (So it will be alive for long time).

Whole device is hold together with 4 Philips screws, and 5 smaller Philips screws attach board to front panel.

Then let's continue to actual board :


Back side of board contains NFC board, Flash memory, unknown chip, two oscillators, some power management and miscellaneous passives.

Flash memory chip is MXIC MX29LV640E ( http://www.macronix.com/Lists/Datasheet/Attachments/1481/MX29LV640E%20T-B,%203V,%2064Mb,%20v1.7.pdf ) 8 MByte flash, why that big ? Not sure, I don't have ability to dump it at the moment.

There is a chip marked 16m4, not sure what is it.

NFC is placed on separate board with serial interface and provided by NXP 5570 (no information available, probably some generic NFC solution)

Let's continue with front of the board :


Pins from NFC board actually have header ! So it's really easy to sniff stuff there.

There are some debug pins marked as DCLK, DST0, DST1, DST2, DSIO, DPCO ..

Under screen there is a big dark blob .. no markings on actuall CPU


From googling pin marks I found that Epson S1C17611 (16 bit SoC) have same debug pins (more info http://www.epsondevice.com/webapp/docs_ic/DownloadServlet?id=ID002116), haven't looked deeper into this.

So that you have it. Little cute device, I wonder why integration is so bad on this model, they sell it for 50+$, it could be one chip solution, instead whole device is big and bulky, there are a lot of space wasted.

PS. If you want more : reverse engineering of TamaTown Tama-Go series done by Natalie Silvanovich :
http://recon.cx/2013/slides/Recon2013-Natalie%20Silvanovich-Many%20More%20Tamagotchis%20Were%20Harmed%20in%20the%20Making%20of%20this%20Presentation.pdf
Short : GPLB52320 as main CPU/LCD controller/SoC (6502 core), dumped mask rom through screen 

[krivx]

Just in case you hadn't seen it, there was a great CCC talk on previous generations of Tamagotchi:

[SeanB]

Interesting to place the RF choke in the battery side between the 2 cells. Makes sense as the NFC coil is wound around them, so it would otherwise superimpose the NFC comms on the power rail, and putting between saves having to join the inductor to a wire.

Ugh, that glue holding all the wires down, along with the speaker and NFC board. At least here it will merely grab moisture from the air and corrode the board, not turn into conductive goop like it does in TV sets where it gets hot.

Built in failure after a year or three.

[amyk]

Briefly contemplated a rack-mount Tamagotchi upon seeing the title...

That NFC IC pinout (oscillator connections) is similar to the other NXP NFC ICs e.g. MFRC522.

[N2IXK]

Briefly contemplated a rack-mount Tamagotchi upon seeing the title...

Glad I wasn't the only one....

[eas]

Where do you reckon it stores the soul it drains from its user?

[Vgkid]

Obviously the black hole in the last image.

[helius]

http://www.studiohunty.com/tamagothi/