Controlling the WowWee Alive Elvis, Part 1: Inside the CartridgePosted by RetroPlayer on Tuesday, 12 August 2008
The WowWee Alive Elvis is an animatronic bust with very realistic facial and head movements utilizing 10 precision motors. We're going to talk about how to hack and control the Alive Elvis, and to do that, we're delving deep into the inner workings of his cartridge. Read on!
- Eyes U/D
- Eyes L/R
- Eyebrows U/D
- Left Eyelid
- Right Eyelid
- Lip curl
- Neck rotate
- Neck Tilt L/R
- Neck Tilt U/D
There are four modes of operation:
From the factory, Elvis comes with a cartridge containing 8 songs and 37 monologues. With no cartridge installed, Elvis will be in Alive mode and will play back random skits of famous Elvis lines. He will also track your movement in front of him. There are no songs or monologues without the cartridge. Elvis will prompt you to insert a cartridge if you attempt to enter these modes without one.
With the cartridge installed, you can switch between song and monologue mode. You can then use the remote to play/pause and skip forward/back between the recordings in each mode. To access karaoke mode, you either need to press the VOICE button on the remote, which turns on/off Elvis' voice or plug in a microphone into the front jack.
This gives us three modes of operation to customize.
In this series of articles, we will be exploring methods to customize the Elvis animatronic to play back your own audio clips and animations.
At the time of this writing Elvis is selling for around $70, which makes him a very inexpensive animatronics platform.
Having a cartridge makes for convenient hacking possibilities. And since the bulk of his animations are present on the cartridge, it made sense to attack that first. Upon opening the cartridge, we found a standard NAND Flash memory chip. By looking up the datasheet, we discovered that it is a 32MB memory. Using the pinout in the datasheet and tracing those lines to the cartridge connector, we were able to determine the pinout of the cartridge.
Now, on to reading the contents of the cartridge and trying to make sense of it!
Knowing that Smart Media and xD cards are direct interfaces to NAND chips with no controller, I determined that I would modify a Smart Media reader to offload the contents of the cartridge. I obtained the pinout for Smart Media cards and then wired everything up. I had prepared an image making program that would dump the raw contents of the cartridge, and plugged the reader into my USB port. To my surprise, up popped a normal drive formatted as FAT16 with just over 100 files on it. I was a bit shocked that it would be this easy. I captured a raw image of the drive before doing anything else. I then inspected the image to determine if there were any hidden partitions or unallocated space used for code. There was nothing. The entire NAND flash chip is formatted as one 32MB volume.
Contents of the WowWee Alive Elvis Cartridge
There are 123 files on the cartridge. These are:
CoSong01.dat through CoSong08.dat
CoSong01.txt through CoSong08.txt
Mono01.dat to Mono37.dat
Mono01.txt to Mono37.txt
Song01.dat to Song08.dat
Song01.txt to Song08.txt
SongNa01.dat to SongNa08.dat
SongNa01.txt to SongNa08.txt
And one single Elvis.exe file. This EXE file caught my attention first. It turns out that it is an MSDOS program which simply caculates the checksums of the files on the cartridge; which is most likely used in production to ensure that none of the files are corrupted before shipping. It displays the results, but does nothing else with them. It can be deleted.
I had a general idea of what I was looking for, which were audio clips and animation scripts.
Opening the DAT files in a hex editor, it was immediately apparent that these were MP3 files. I determined that they are recorded with these settings: 44.1KHz, 128kbps, Stereo. Some of the monologue recording and song names are recorded in mono, so it appears that either works fine.
That's it for the *.dat files. Just plain ol' MP3s. Nothing special about them. That made for a very short section, didn't it? Don't worry, it gets to be a little more complex shortly.
So, next up was the *.txt files. Given the extension, one might think they are plain ASCII text files, but they are not. The animation scripts are stored in hex.
Here is a sample of a small animation script, one of the song files:
The first thing to notice is that the bytes are obviously swapped (Little Endian) so 0100 should be read as 0001 and so forth.
We then searched for a pattern in the files and the result was 4 groups of 16 bits. There was some discussion on the forum about this and a theory was proposed. Each line was formatted as:
To test the theory, I needed to build a custom cartridge. The next article will show you how.
Stay Tuned for Part 2 of Controlling WowWee's Alive Elvis, coming soon!