-

Wed, 16 Jul 2025 16:29:04 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

On the bench today: a Learning Resources button stole... borrowed from my toddler. Has a li'l button on the side, press it to record a phrase.

show all 7 comments

Wed, 16 Jul 2025 16:33:11 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

Contents of the button: some passives and a small transistor mic preamp, an electret mic and a speaker, a blob with the main logic and a 25F40-style 512KByte SPI flash chip.

Wed, 16 Jul 2025 16:35:48 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

Flash chip desoldered and wired to a header

Desoldering the flash chip and connecting it via a header means I can easily read and write it without having to resolder it. I really ought to design a PCB for this, hand-soldering the wires gets tedious after a while.

Wed, 16 Jul 2025 16:39:21 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

Hexdump of flash contents of the start of the dumped binary

Flash seems to have a few regions: some sort of partition table at 0x0, a few bytes @0x1000, some unencrypted data (entropy-wise) at 0x1100, then some encrypted or compressed data at 0xB000. Initial guess is that the firmware is at 0x1100, the audio at 0xB000.

Wed, 16 Jul 2025 16:43:43 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

vbindiff of flash dumps with two different messages recorded on it

However, recording a new message and diffing the flash proves that wrong: it seems the data at 0x1000 is some sort of length indicator, and the data at 0x1100 is likely the recorded waveform. Looking at the hex data closelier, the data is probably recorded as umcompressed PCM.

Wed, 16 Jul 2025 16:49:32 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

It's interesting that they did it this way around... it likely means that there's only around 40K of sample memory available, with the firmware containing the following 24K... leaving the remaining 450K of flash entirely empty and unusable. I guess they designed the system with a 64K flash chip in mind, but nowadays 512K is the cheapest you can get? Strange.

Wed, 16 Jul 2025 16:55:57 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

I'm wondering if I'm able to figure out what CPU this thing runs and change the firmware... could do something like put Never Gonna Give You Up in the remaining flash, then do something with a RNG and have 5% chance of it playing that rather than the recorded sample. It doesn't *look* like the firmware is encrypted or compressed, there are regions of consecutive bytes and null bytes in there. On the other hand, there aren't any strings (not that you'd necessarily expect any in a console-less microcontroller app) and no recognizable instruction alignment either. Plus, cpu_rec and isadetect.com do not detect anything sane in there.

Wed, 16 Jul 2025 17:06:43 +0200

Sprite_tm

sprite_tm@social.spritesmods.com

Hm, sleepy time here. If anyone else wants to play along at home, here's a binary.