MrScott... HAHAHAHAHA! Thanks!

If I hack him, THAT will have to be one of his phrases.

I have started to do a more in-depth tear-down. As mentioned, Elmo Live consists of three motors, three encoders, 4 pushbutton switches, a tilt switch, and a main controller PCB.

There are 3 gearboxes each with a motor and a mechanical encoder. The three gearboxes are: Head, legs, and arms. The way he works is that movement through a certain range will perform one action, while moving beyond that range, it performs a different action. I started working with the head a little and will describe that. But first, let's look at some pictures:

All the main pieces of Elmo separated.

Head Mechanism

Arm Mechanism

Leg Mechanism

Main PCB top

Main PCB bottom

I am currently looking a little closer at the electronics and found some interesting things I will be working with:

First up is the ROM daughterboard. As you can see, the connections are labeled. It should be possible to get a dump of this.

Next up is the top-side in the logic area of the board. There is an interesting jumper labeled Rx. It is connected by a trace on the board to the other side of the jumper and this goes to one of the speaker pins. The other speaker pin goes to a via directly under the CPU blob. Just a theory here, but this configuration looks like it is meant to cut the trace and use the line for serial, maybe? And then the connection could be replaced by filling the jumper.

Between the CPU and the IO Extender (educated guesses) there are two test points. If these are sunplus chips, then these test points are probably the I2C interface between the two chips. My logic analyzer should answer that question.

Also, near what appears to be an IO Extender, are four unpopulated jumpers. If filled, each one would be pulled to VSS (ground.)

The function of those jumpers are unknown. But not for long.... :)

Anyone want to place bets on how quickly Fisher-Price contacts me after I dump the ROM and show how to make your own messages? I know this information will be used for evil.

First attempts to capture the ROM activity have not been successful. It looks like maybe he needs to be completely hooked up first. Right now, I have the PCB on my desk and powering it from a bench supply. No sound on the speaker either.

So, I just spent an hour in the workshop doing a few mods to make testing possible while he is put back together. I have a cable coming out which is connected to all of the ROM signals. I cut the trace on the Rx/Speaker jumper and connected a switch and a "look wire". This will also allow me to shut off his voice during testing.

Finally, I connected wires to all of the jumpers (J1-J4) and these will go to a DIP switch on a separate PCB.

These connections should allow me to access all of the signals that I am interested in. Now I just need to get him all back together (minus fur), but I have run out of time for today.

Yes, I was aware of that story, Shel. :) That was what I meant by 'evil.' I actually appeared in a Boston Globe article about hacking toys that mentioned the same story. That was around 2002, I think.

Looks like this hit all the blogs already. :) Guess the pressure is on to perform.

I am getting data from the ROM right now and Sevik and I are analyzing the interface.

Not extremely important as we know enough to get a microcontroller to dump the ROM for us. But, that is going to take some time. If it is some known standard interface, I might have the tools to dump it more quickly.