OUR NETWORK:TechLore Explore3DTV MyOpenRouter MediaSmart home TiVoCommunity See all... About UsAdvertiseContact Us

 
Learn about scoring Forum's Raw Score: 1.06714E7
July 15, 2008 11:41 AM

Categories: Other WowWee Robots

Rating (4 votes)
  • 1
  • 2
  • 3
  • 4
  • 5
Rate This!


Member Avatar

RetroPlayer

Member
Joined: 03/07/2008

The Wowwee Alive Elvis utilizes a cartridge which contains all of his songs and monologues. Opening the cartridge, we found that it contained a single IC. We looked up the datasheet for this IC and determined that it was a 32MB 3.3v NAND flash. Using the datasheet and a multimeter, we were able to determine the pinout of the cartridge connector.

Knowing that xD and Smartmedia flash cards, typically used in cameras and MP3 players use a straight-through NAND flash interface, we compared the pinouts of the cards with the pinouts of the cartridge. We found that all needed signals were present to connect the cartridge directly to a USB xD/Smartmedia reader and dump the cartridge contents.

What we found was a very pleasant surprise! The cartridge is formatted as a standard FAT16 volume viewable by Windows, Linux, Mac, etc..

There are 123 files on the cartridge which takes up about 26.5MB of the 32MB cartridge. The cartridge is not write protected and there is approximately 5MB free.

First, we looked at the audio clips. The 8 Song titles, 8 Songs, 8 Karaoke versions of the songs, and 37 monologues are all regular MP3s with the file extension, *.dat. The audio clips are endcoded with these settings: 44.1kHZ, 128kb/s Joint Stereo.

For every audio clip, there is an animation script associated with it. Its filename is the same as the audio clip, but with a *.txt extension. It is not a text file and cannot be opened or edited with a text editor. Instead one must edit the files with a hex editor (or a custom program) once the format is decoded.

There is also one MSDOS *.exe file on the cartridge. Running it calculates the checksums of all files on the cartridge and the total checksum. It looks like it is used in production to ensure that none of files are corrupted before shipping.

What this means, so far, is that it should be possible to customize Elvis' behavior in his three modes of operation: Songs, Monologues, and Karaoke; including making him an entirely different character. Combined with GWJax's articles on customizing the Elvis skin, this makes for a great entry-level animatronics platform for halloween displays, etc...

What we cannot do, so far, using this method:

  • Connect Elvis to a PC to control him in real-time
  • Modify any of his voice and animations when in autonomous mode
  • Create any level of interactivity using his IR sensors
  • Add more sensors, motors, etc...

This limits the usefulness of this hack, but techniques are being discussed to utilitze this method to its fullest, however, it should be good enough for simple displays. Further research is being done to accomplish the rest of the above list.

Things left to do:

1. Modify Elvis to accept custom cartridges --DONE!

  • Option A: Modify USB smartmedia reader with cartridge slot
  • Option B: Create custom cartridge with xD adapter                    ---DONE!
  • Option C: Install xD or Smartmedia socket in the Elvis bust

2. Decode the animation scripts and write a program to create custom scripts --- 1/2 DONE (still need a decent program to make animations)

3. Dump flash on Elvis mainboard, determine its contents and develop a method for reflashing it in-circuit                           ---- DONE!

4. Possibly replace the CPU on the Elvis main board to accomplish full interactivity, addition of hardware, and real-time computer control

4. Determine practical methods of applying this knowledge to completely modify the behavior of the Elvis bust into a programmable and interactive animatronics platform.

Discussion:    Add a Comment | Comments 1-15 of 358 | Latest Comment | 1 2 3 424 Next »

July 15, 2008 11:46 AM updated: July 31, 2008 3:10 PM

Here is a list of the files on the cartridge:

FOLDER M:\ ------- 0 123 26,529,375 26,529,375 (approximately 26.5MB) FAT16 format
FILE CoSong01.dat ********DAT files are audio
FILE CoSong02.dat ******** Audio is MP3 format
FILE CoSong03.dat ******** 44Khz 128Kbps Stereo
FILE CoSong04.dat ******** CoSong##.dat are full songs
FILE CoSong05.dat
FILE CoSong06.dat
FILE CoSong07.dat
FILE CoSong08.dat
FILE Mono01.dat ******** Monologues
FILE Mono02.dat
FILE Mono03.dat
FILE Mono04.dat
FILE Mono05.dat
FILE Mono06.dat
FILE Mono07.dat
FILE Mono08.dat
FILE Mono09.dat
FILE Mono10.dat
FILE Mono11.dat
FILE Mono12.dat
FILE Mono13.dat
FILE Mono14.dat
FILE Mono15.dat
FILE Mono16.dat
FILE Mono17.dat
FILE Mono18.dat
FILE Mono19.dat
FILE Mono20.dat
FILE Mono21.dat
FILE Mono22.dat
FILE Mono23.dat
FILE Mono24.dat
FILE Mono25.dat
FILE Mono26.dat
FILE Mono27.dat
FILE Mono28.dat
FILE Mono29.dat
FILE Mono30.dat
FILE Mono31.dat
FILE Mono32.dat
FILE Mono33.dat
FILE Mono34.dat
FILE Mono35.dat
FILE Mono36.dat
FILE Mono37.dat
FILE Song01.dat ***** Songs without Elvis vocals
FILE Song02.dat ***** For Sing-Through mode (karaoke)
FILE Song03.dat
FILE Song04.dat
FILE Song05.dat
FILE Song06.dat
FILE Song07.dat
FILE Song08.dat
FILE SongNa01.dat ****** Song names in Elvis voice
FILE SongNa02.dat
FILE SongNa03.dat
FILE SongNa04.dat
FILE SongNa05.dat
FILE SongNa06.dat
FILE SongNa07.dat
FILE SongNa08.dat
FILE ELVIS.EXE ****MS-DOS console app. Calculates the checksum of all files
FILE CoSong01.txt ****Animation scripts, named after the audio clip
FILE CoSong02.txt ****it corresponds with.
FILE CoSong03.txt
FILE CoSong04.txt
FILE CoSong05.txt
FILE CoSong06.txt
FILE CoSong07.txt
FILE CoSong08.txt
FILE Mono01.txt
FILE Mono02.txt
FILE Mono03.txt
FILE Mono04.txt
FILE Mono05.txt
FILE Mono06.txt
FILE Mono07.txt
FILE Mono08.txt
FILE Mono09.txt
FILE Mono10.txt
FILE Mono11.txt
FILE Mono12.txt
FILE Mono13.txt
FILE Mono14.txt
FILE Mono15.txt
FILE Mono16.txt
FILE Mono17.txt
FILE Mono18.txt
FILE Mono19.txt
FILE Mono20.txt
FILE Mono21.txt
FILE Mono22.txt
FILE Mono23.txt
FILE Mono24.txt
FILE Mono25.txt
FILE Mono26.txt
FILE Mono27.txt
FILE Mono28.txt
FILE Mono29.txt
FILE Mono30.txt
FILE Mono31.txt
FILE Mono32.txt
FILE Mono33.txt
FILE Mono34.txt
FILE Mono35.txt
FILE Mono36.txt
FILE Mono37.txt
FILE Song01.txt
FILE Song02.txt
FILE Song03.txt
FILE Song04.txt
FILE Song05.txt
FILE Song06.txt
FILE Song07.txt
FILE Song08.txt
FILE SongNa01.txt
FILE SongNa02.txt
FILE SongNa03.txt
FILE SongNa04.txt
FILE SongNa05.txt
FILE SongNa06.txt
FILE SongNa07.txt
FILE SongNa08.txt
TOTAL M:\ ------- 0 123 26,529,375 26,529,375

123 files ~26.5MB, ~5MB free space, 32768 KB total (32MB)

Based on a raw image dump of the entire 32768 Kbytes of memory, this volume is FAT only and there are no hidden partitions or unallocated space.

July 15, 2008 11:54 AM

I will be laying out a cartridge with an xD socket on it next. I'd like to see how big of a card it can actually handle.

I'll also look into the animation scripts a little more.

I don't see any switches in the elvis.exe, it was compiled with Borland Turbo-C and does not look encrypted, compressed, or "packed." I believe it is just a test application used in production to ensure that none of the files are corrupted. It doesn't print, doesn't create any files, etc.. just displays all the files, their individual checksums, and the total checksum for the disk.

Finally, I will see if I can figure out what exact format the audio clips are stored in. As I said, I can play them with VLC, but it complains that it doesn't recognize the format (but plays anyway.)

More tomorrow.

July 15, 2008 12:11 PM

Audio clips are 44KHZ, 128kb/s stereo. They are definitely a headerless MP3 file. Every program I have plays it just fine as an MP3.

I will have to look at what is in a MP3 header that needs to get removed (if it even needs to get removed at all) for custom audio clips.

July 15, 2008 12:33 PM

Hmm, I just found some of the dat files with headers.

This is from the SongNa04.dat file:

00000000 4944 3303 0000 0000 0176 5052 4956 0000 ID3......vPRIV..
00000010 000E 0000 5065 616B 5661 6C75 6500 B054 ....PeakValue..T
00000020 0000 5052 4956 0000 0011 0000 4176 6572 ..PRIV......Aver
00000030 6167 654C 6576 656C 00E2 0C00 0000 0000 ageLevel........
00000040 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000050 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000060 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000070 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000080 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000090 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000A0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000B0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000C0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000D0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000E0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000F0 0000 0000 0000 0000 0000 0000 0000 0000 ................


Does this mean anything to anyone?

July 15, 2008 12:43 PM

Have you decoded action scripts format?

Can you put some of script files somewhere?

Or just post hexdumps of some...

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 12:44 PM

About headers - seems like just plain MP3 ID3 tags:

00000000 49 44 33 03 00 00 00 00 05 76 54 45 4e 43 00 00 |ID3......vTENC..|
00000010 00 12 00 00 00 53 70 69 64 65 52 20 43 6f 6c 6c |.....SpideR Coll|
00000020 65 63 74 69 6f 6e 54 49 54 32 00 00 00 1c 00 00 |ectionTIT2......|
00000030 00 44 69 72 74 79 20 44 65 65 64 73 20 44 6f 6e |.Dirty Deeds Don|
00000040 65 20 44 69 72 74 20 43 68 65 61 70 54 52 43 4b |e Dirt CheapTRCK|
00000050 00 00 00 02 00 00 00 31 54 59 45 52 00 00 00 05 |.......1TYER....|
00000060 00 00 00 32 30 30 34 54 43 4f 50 00 00 00 04 00 |...2004TCOP.....|
00000070 00 00 53 61 52 54 50 55 42 00 00 00 08 00 00 00 |..SaRTPUB.......|
00000080 4b 69 63 6b 61 73 73 54 43 4f 4e 00 00 00 0a 00 |KickassTCON.....|
00000090 00 00 48 61 72 64 20 52 6f 63 6b 54 41 4c 42 00 |..Hard RockTALB.|
000000a0 00 00 14 00 00 00 54 68 65 20 42 6f 6e 20 53 63 |......The Bon Sc|
000000b0 6f 74 74 20 59 65 61 72 73 54 50 45 32 00 00 00 |ott YearsTPE2...|
000000c0 06 00 00 00 41 43 2f 44 43 54 50 45 31 00 00 00 |....AC/DCTPE1...|
000000d0 06 00 00 00 41 43 2d 44 43 57 58 58 58 00 00 00 |....AC-DCWXXX...|
000000e0 13 00 00 00 00 53 70 69 64 65 52 20 43 6f 6c 6c |.....SpideR Coll|
000000f0 65 63 74 69 6f 6e 43 4f 4d 4d 00 00 00 16 00 00 |ectionCOMM......|
00000100 00 65 6e 67 00 53 70 69 64 65 52 20 43 6f 6c 6c |.eng.SpideR Coll|

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 12:47 PM updated: July 15, 2008 1:00 PM

real mp3 files - not enclosed in RIFF/WAV container does not have visible header, they are just sequence of MP3 frames

See http://en.wikipedia.org/wiki/MP3 section "File Structure"

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 12:53 PM

DOH!! What a moron. VLC isn't complaining about the MP3 file, it is trying to load the associated .txt as a lyric file, and complaining about that.

So... they are simply MP3s. Some have headers some do not. Doesn't seem to matter.

Also, I am making some progress already on the animation script. I'll show the hex for it before explaining what I see.

This is from SongNa08.txt, one of the small animations:

00000000 0000 6100 5100 3100 ..a.Q.1.
00000008 0000 6200 5100 3200 ..b.Q.2.
00000010 0000 6300 5100 3400 ..c.Q.4.
00000018 0000 6400 5100 3400 ..d.Q.4.
00000020 0000 6500 5100 3300 ..e.Q.3.
00000028 0000 6600 6100 3300 ..f.a.3.
00000030 0000 6700 5100 3000 ..g.Q.0.
00000038 0000 6800 5000 3300 ..h.P.3.
00000040 0000 6900 5A00 3800 ..i.Z.8.
00000048 0000 6A00 5100 3800 ..j.Q.8.
00000050 0000 6B00 5100 3800 ..k.Q.8.
00000058 0000 6C00 5100 3800 ..l.Q.8.
00000060 0100 6100 6100 3100 ..a.a.1.
00000068 0100 6200 5100 3200 ..b.Q.2.
00000070 0100 6300 6100 3400 ..c.a.4.
00000078 0100 6400 6100 3400 ..d.a.4.
00000080 0100 6500 5100 3300 ..e.Q.3.
00000088 0100 6600 4100 3300 ..f.A.3.
00000090 0100 6700 5100 3000 ..g.Q.0.
00000098 0100 6800 4100 3300 ..h.A.3.
000000A0 0100 6900 4700 3800 ..i.G.8.
000000A8 0100 6A00 4700 3800 ..j.G.8.
000000B0 0100 6B00 5100 3800 ..k.Q.8.
000000B8 0100 6C00 5100 3800 ..l.Q.8.
000000C0 0200 6100 5100 3100 ..a.Q.1.
000000C8 0200 6200 5100 3200 ..b.Q.2.
000000D0 0200 6300 5100 3400 ..c.Q.4.
000000D8 0200 6400 5100 3400 ..d.Q.4.
000000E0 0200 6500 5100 3300 ..e.Q.3.
000000E8 0200 6600 6100 3300 ..f.a.3.
000000F0 0200 6700 5100 3000 ..g.Q.0.
000000F8 0200 6800 6100 3300 ..h.a.3.
00000100 0200 6900 4100 3000 ..i.A.0.
00000108 0200 6A00 5100 3800 ..j.Q.8.
00000110 0200 6B00 5100 3800 ..k.Q.8.
00000118 0200 6C00 5100 3800 ..l.Q.8.
00000120 FFFF ..

As you can see, the first two bytes go 0000, 0100, 0200, etc... in extremely long files this just keeps climbing and climbing.

For each of these, there are always 12 entries. No matter how long the animation is.

The second group of two bytes, always starts at 6100 and also increments through the frame, and ends with 6C00 and then starts over. This one actually increments in each row for each of the 12 records.

The third set of 2 bytes varies pretty wildly in longer songs. This is probably actual animation information. I have never seen anything but 00 in the second byte.

The fourth set of two bytes, also varies, but doesn't seem to change as wildly. Also, I have never seen anything other than 00 in the second byte of this group.

So, the first 16 bit word looks like a frame header, the 6100-6C00 looks like a record (motor group, maybe?) and the last 32 bits look like animation information.

I'll be interested to hear your thoughts on this. How many motors are there total in the Elvis again?

July 15, 2008 1:04 PM

The fourth set of bytes in several full song animations that I looked at never go lower than 3000 and never higher than 3800. So, 9 total variations. There are 9 motors in the Elvis if I remember correctly. I will need to dig out my elvis and actually count the motors unless someone else knows off the top of their head.

The third set, I am still working on. It does seem to stay within a range. After looking at a few file, I don't see it going below 4100 and never above 6100. So, 32 different vaules.

July 15, 2008 1:11 PM

I don't have elvis myself :)) I have Robopanda and it's cartridge format is not so straightforward unfortunately...

About your analyze - it seems very likely and if elvis really has 12 motors, than 3 and 4 group can be target position and moving speed for each motor.

You can try to match length of animations with length of song - to see if it's a fixed rate action stream.

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 1:39 PM

Song08.dat is 57 seconds in duration
The details of the associated Song08.txt file:

I forgot to mention that all .txt files end with FFFF

First the hard data in case I get some math or conversions wrong below:
File size is 27178 bytes (including end of file "FFFF")
The last offset (hex)of the data is 6A27

The highest "frame" is 1D01

There are 3,396 "records"/12 = 283 "frames"
3396 records/57seconds = 59 records per second (hmm... 60, actually?)
283 frames/57 seconds = 4 frames per second

File length is 27176 bytes (not counting the always present "end of file" FFFF)

=======================================================
I just noticed something about this particular file. Starting at 1901, it only contains 5 rows, and the typical 6100-6C00 is no longer being followed.

Here's the dump of the last several rows beginning at 1901:

00006960 1901 6300 5200 3400 ..c.R.4.
00006968 1901 6400 5200 3400 ..d.R.4.
00006970 1901 6600 6100 3400 ..f.a.4.
00006978 1901 6900 4100 3400 ..i.A.4.
00006980 1901 6B00 4100 3400 ..k.A.4.
00006988 1A01 6300 5200 3400 ..c.R.4.
00006990 1A01 6400 5200 3400 ..d.R.4.
00006998 1A01 6600 6100 3400 ..f.a.4.
000069A0 1A01 6900 4100 3400 ..i.A.4.
000069A8 1A01 6B00 4100 3400 ..k.A.4.
000069B0 1B01 6300 5200 3400 ..c.R.4.
000069B8 1B01 6400 5200 3400 ..d.R.4.
000069C0 1B01 6600 6100 3400 ..f.a.4.
000069C8 1B01 6900 4100 3400 ..i.A.4.
000069D0 1B01 6B00 4100 3400 ..k.A.4.
000069D8 1C01 6300 5200 3400 ..c.R.4.
000069E0 1C01 6400 5200 3400 ..d.R.4.
000069E8 1C01 6600 6100 3400 ..f.a.4.
000069F0 1C01 6900 4100 3400 ..i.A.4.
000069F8 1C01 6B00 4100 3400 ..k.A.4.
00006A00 1D01 6300 5200 3400 ..c.R.4.
00006A08 1D01 6400 5200 3400 ..d.R.4.
00006A10 1D01 6600 6100 3400 ..f.a.4.
00006A18 1D01 6900 4100 3400 ..i.A.4.
00006A20 1D01 6B00 4100 3400 ..k.A.4.

Perhaps this part being different might be the key that unlocks this!

July 15, 2008 1:50 PM

heh :))

This supports idea of 2 group as motor number. so only needed in this frame moves are encoded.

Data is clearly in different endiannes - so 0 in 2,3,4 groups is not a LSB, but MSB.

0x11D = 285
285/57 = 5.000000

So most likely 1 group is frame number with 5 frames per second...

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 1:55 PM

last frames with constant values in 3 and 4 groups possible give some time for motors to settle on target positions...

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

July 15, 2008 2:12 PM

OK, started listening to all the files.

Song01.dat to song08.dat have no Elvis lyrics in them, just instruments and backup vocals. Karaoke mode?

CoSong01.dat to CoSong08.dat are the full songs. Not "conversations" like I thought.

SongNa01.dat to SongNa08.dat are the names of the songs in Elvis' voice

There are 37 monologues named Mono01.dat to Mono37.dat

I will have to see how the animations between the Song and CoSong files differ. I wouldn't imagine that he would be lipsynching in karaoke mode (I didn't even know there was a karaoke mode... goes to show how little I played with it before taking it apart!)

Notably absent are any clips of his "reactions." I don't remember all of his reactions, but it seems that he at least said something if you held his head while he tried to move.

Also, there is no "master script" that tells what audio clips are on the cart and when to play them. This means that right now, modifying him is limited to the monologue, Karaoke, and song modes. I imagine that he will play any number of them, however, if they planned to make other carts in the future.

Looks like for this to be really useful, I still need to dump the main flash on the motherboard and see if I can find a serial port. Another day... I would like to get the animation scripts decoded first. I would post the files somewhere, but I am pretty sure that wowwee would not be cool with this. Especially the MP3s.

July 15, 2008 2:28 PM

For decoding action script values just split it by motor, and i think you will see much cleaner picture...

Try to match values from script with real motions of elvis (using stopwatch, video or some other method).

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

Discussion:    Add a Comment | Back to Top | Comments 1-15 of 358 | Latest Comment | 1 2 3 424 Next »

Add Your Reply

(will not be displayed)

Email me when comments are added to this thread

 
 

Please log in or register to participate in this community!

Log In

Remember

Not a member? Sign up!

Did you forget your password?

You can also log in using OpenID.

close this window
close this window