ROM Hack PokeWalker Hacking

[froggestspirit]

This thread is here to discuss information and research of the PokeWalker. The hope is to decode the IR signals, and be able to replicate them in a homebrew environment.
UPDATE 1/13/18: I have decoded the signal into Hex, and gotten it to show in pulseview. Shoutout to @shinyquagsire23 for the idea of looking into UART

What's known:
-Structure of sending a Pokemon (RAM, may be different from the IR signal) https://docs.google.com/spreadsheets/d/1dPeTH1CMiV7keva8QN-7YyqyMJZEXbh1BEcW0lOFoew/edit?usp=sharing
-Minimal data is held on the walker.
-Graphics are sent from the DS
-Pokewalker init GFX start at 0x021F5588 for US HG (38160 bytes)
-Pointers for individual sprites in the init gfx seem to appear at 0x021E81D4
-You can hardwire 3.3v to bat+, ground to gnd, and read stuff like SCLK and TX/RX with an arduino

What's left to do:
-Decode the IR signal, and figure out the format of it.

Here's some hi-res images of the circuit board:

Spoiler

Here is an AR code that might make cracking the IR signal easier:

Spoiler

clear walker gfx ram HG US (press start)
94000130 FFF70000 (activate with start button)
B21FFAD0 00000000 (set offset)
DC000000 000000BE (skip to gfx)
D5000000 00000000 (set dx data)
C0000000 00000A00 (loop)
D6000000 00000000 (write dx data)
D1000000 00000000 (end loop)
D2000000 00000000 (end code)
The gfx of the pokewalker send pokemon data should be replaced with XXXXXXXX
This seems to only work sometimes, but it's best to hold start, connect the walker, then release start

Here is a code to dump 0x8000 bytes of ram from a pointer to the GBA save slot

Spoiler

Press start
023FE4D8 0A000003 //AR hack 0 (fix DB)
94000130 FFF70000 //When start is pressed
D3000000 00000000 //Set offset to 0
02000004 0A000000 //write dest address
D9000000 021FFAAC //load address from pointer, change this to change the pointer
D6000000 02000000 //write source address
C0000000 00008000 //start loop
D3000000 00000000 //Set offset to 0
B2000000 00000000 //set offset to the source
DB000000 00000000 //read a byte into dxdata
D3000000 00000000 //Set offset to 0
B2000004 00000000 //set offset to the dest
D8000000 00000000 //write dxdata to dest
D3000000 00000000 //Set offset to 0
D9000000 02000000 //read source address to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to source address and increase offset by 4
D9000000 02000000 //read dest offset to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to dest address and increase offset by 4
D1000000 00000000 //end loop
D2000000 00000000 //end code

For some reason this code may not be working

Some interesting links:
http://www.vishay.com/docs/84672/tfbs4650.pdf
http://www.vishay.com/docs/82513/physical.pdf
http://i.imgur.com/b2VTMyg.png

I've also included a file that is a recording of sending stantler to the PokeWalker. RX/TX is from the PokeWalker's perspective, and RI# is hooked up to the PokeWalker's SCLK. This can be opend in PulseView

Edit 1/12/18: The IR signal seems to send data in 128 byte chunks. Each byte of this has 10 bits, with a starting bit of 1, and an ending bit of 0. There is about 8.6μs between bits, and least significant bits are sent first. All bytes also seem to be XOR'ed with 0x55.

Information on the CPU:
https://www.digchip.com/datasheets/download_datasheet.php?id=2373763&part-number=H8/38600R
https://www.renesas.com/br/ja/doc/products/mpumcu/tu/001/tnh8a414ae.pdf

 

[Criminal90]

nice project!

 

[Grim Ripper]

Good luck.

It's nice to see gbc being used like this nowdays.

 

[8BitWonder]

That's some really neat work you have going on there! Would love to see how this develops further.

 

[gudenau]

Nice, I should crack mine open and see if I spot anything obvious.

 

[froggestspirit]

I'm guessing a GBC is probably poor for the job, since I don't know the speed the pokewalker transmits. Obviously it transfers bit by bit, I'm thinking another option would be better, like an IR reciever on a 3DS with homebrew to record the readings. Does anyone have a pinout of the pokewalker (mostly the IR)?

 

[gudenau]

I'm guessing a GBC is probably poor for the job, since I don't know the speed the pokewalker transmits. Obviously it transfers bit by bit, I'm thinking another option would be better, like an IR reciever on a 3DS with homebrew to record the readings. Does anyone have a pinout of the pokewalker (mostly the IR)?

Could go the other way, dump the ROM and figure out the CPU that it uses.

 

[cooroxd]

If you can somehow dump the rom from the walker and then port it to an android device, we can then use our phones as a pokewalker

 

[8BitWonder]

If you can somehow dump the rom from the walker and then port it to an android device, we can then use our phones as a pokewalker

That'd be amazing!

 

[N64]

watching this thread. i got two of these guys and would love to be able to do something fancy with them

 

[froggestspirit]

If you can somehow dump the rom from the walker and then port it to an android device, we can then use our phones as a pokewalker

you dont need the rom, just the transfer protocol

 

[migles]

you dont need the rom, just the transfer protocol

would an android with IR receiver\transmitter be any use in this progect?
i got an htc, which does have IR blaster, in a month or so, i will get a pokewalker..

if i could help with something...

i do have the soul silver and the ds, if someone could make a pokewaler emulator for android with IR connectivity, that would also be cool

 

[froggestspirit]

would an android with IR receiver\transmitter be any use in this progect?
i got an htc, which does have IR blaster, in a month or so, i will get a pokewalker..

if i could help with something...

i do have the soul silver and the ds, if someone could make a pokewaler emulator for android with IR connectivity, that would also be cool

That's what I'm hoping. I also have an HTC (one m8), but it's windows, so I'm not sure how I could put it to use. I think if someone wrote a quick homebrew for 3DS or something to use the IR, it could help. I'm not sure if this is better in the 3DS section or not

Edit: I decided I might wire up the IR reciever of my (somewhat broken, but working IR) gameboy color. Even though my current program only records for about a second, I should be able to get a constant read with this set up (I'm hoping).

Edit: finished the wiring, only to realise I don't have a computer with line-in (to record it as a waveform). My only option seems to be my capture device

 

[Flame]

this is a really cool project.

 

[froggestspirit]

My capture card was a no go, but I should be getting a mic-in to usb adapter in the mail tomorrow, so that *should* let me record the IR signals

Edit: Got the adapter, and it's working just as I hoped.
The pokewalker sends 20 pulses when trying to connect. It seems like they can vary in frequency, but it seems to be not much quicker than a pulse every 0.1 second, and not much slower than a pulse every 0.135 seconds

 

[froggestspirit]

Here's a sample recording. It's data from the game sending a chickorita to the pokewalker. the first half seems to be sending data, the second half seems to be clock signals to time incoming data from the walker.
I'm kind of stuck with decoding the data. If I could figure out better what the transfer rate is, then I could at least have the gameboy try to emulate it, and recieve

 

[froggestspirit]

I've started to look into this again with an arduino and an actual IR reciever

 

[shinyquagsire23]

I've started to look into this again with an arduino and an actual IR reciever

Good luck with this, I'm not exactly sure where my own pokewalker is but I'm always interested in weird devices.

 

[migles]

I've started to look into this again with an arduino and an actual IR reciever

That should do the trick...
Since March I now have 2 poke walkers, I can't open them but if you need some help testing or what not, tell me
I have an htc m8, so if there is an Android app to read/send IR signals I can help

 

[froggestspirit]

Right now I have a simple program to read IR signals, and print them in the serial monitor. I might post a few dumps, but I'm getting the feeling that the arduino (leonardo) might not be fast enough to read all the data. I might also look into reading the ram values through an emulator, to see if I can find the buffer of data the DS sends (then it'd be easier to know what to look for in the IR dumps). Only drawback with this is that emulators don't support the IR, so I'll have to see how far I can go with that.

EDIT: Here's a part of a RAM dump for sending a stantler to the first walker route. Graphics can be viewed if loaded into a tile editor (gameboy format). Pidgey is also there because it is the pokemon that will join if you have no pokemon in the walker.

I just dumped this section because it looks like a lot of blank space was before and after it.
There is also Pokewalker init stuff earlier in a full dump, it contains more graphics, and spinda (probably for the spot placement)
If this isn't allowed, please have a mod remove the file.

Edit2: a pointer to this data can be found at 0x021FFAD0 (HeartGold US)