This thread is here to discuss information and research of the PokeWalker. The hope is to decode the IR signals, and be able to replicate them in a homebrew environment.
UPDATE 1/13/18: I have decoded the signal into Hex, and gotten it to show in pulseview. Shoutout to @shinyquagsire23 for the idea of looking into UART
What's known:
-Structure of sending a Pokemon (RAM, may be different from the IR signal) https://docs.google.com/spreadsheets/d/1dPeTH1CMiV7keva8QN-7YyqyMJZEXbh1BEcW0lOFoew/edit?usp=sharing
-Minimal data is held on the walker.
-Graphics are sent from the DS
-Pokewalker init GFX start at 0x021F5588 for US HG (38160 bytes)
-Pointers for individual sprites in the init gfx seem to appear at 0x021E81D4
-You can hardwire 3.3v to bat+, ground to gnd, and read stuff like SCLK and TX/RX with an arduino
What's left to do:
-Decode the IR signal, and figure out the format of it.
Here's some hi-res images of the circuit board:
Here is an AR code that might make cracking the IR signal easier:
Here is a code to dump 0x8000 bytes of ram from a pointer to the GBA save slot
For some reason this code may not be working
Some interesting links:
http://www.vishay.com/docs/84672/tfbs4650.pdf
http://www.vishay.com/docs/82513/physical.pdf
http://i.imgur.com/b2VTMyg.png
I've also included a file that is a recording of sending stantler to the PokeWalker. RX/TX is from the PokeWalker's perspective, and RI# is hooked up to the PokeWalker's SCLK. This can be opend in PulseView
Edit 1/12/18: The IR signal seems to send data in 128 byte chunks. Each byte of this has 10 bits, with a starting bit of 1, and an ending bit of 0. There is about 8.6μs between bits, and least significant bits are sent first. All bytes also seem to be XOR'ed with 0x55.
Information on the CPU:
https://www.digchip.com/datasheets/download_datasheet.php?id=2373763&part-number=H8/38600R
https://www.renesas.com/br/ja/doc/products/mpumcu/tu/001/tnh8a414ae.pdf
UPDATE 1/13/18: I have decoded the signal into Hex, and gotten it to show in pulseview. Shoutout to @shinyquagsire23 for the idea of looking into UART
What's known:
-Structure of sending a Pokemon (RAM, may be different from the IR signal) https://docs.google.com/spreadsheets/d/1dPeTH1CMiV7keva8QN-7YyqyMJZEXbh1BEcW0lOFoew/edit?usp=sharing
-Minimal data is held on the walker.
-Graphics are sent from the DS
-Pokewalker init GFX start at 0x021F5588 for US HG (38160 bytes)
-Pointers for individual sprites in the init gfx seem to appear at 0x021E81D4
-You can hardwire 3.3v to bat+, ground to gnd, and read stuff like SCLK and TX/RX with an arduino
What's left to do:
-Decode the IR signal, and figure out the format of it.
Here's some hi-res images of the circuit board:
clear walker gfx ram HG US (press start)
94000130 FFF70000 (activate with start button)
B21FFAD0 00000000 (set offset)
DC000000 000000BE (skip to gfx)
D5000000 00000000 (set dx data)
C0000000 00000A00 (loop)
D6000000 00000000 (write dx data)
D1000000 00000000 (end loop)
D2000000 00000000 (end code)
The gfx of the pokewalker send pokemon data should be replaced with XXXXXXXX
This seems to only work sometimes, but it's best to hold start, connect the walker, then release start
94000130 FFF70000 (activate with start button)
B21FFAD0 00000000 (set offset)
DC000000 000000BE (skip to gfx)
D5000000 00000000 (set dx data)
C0000000 00000A00 (loop)
D6000000 00000000 (write dx data)
D1000000 00000000 (end loop)
D2000000 00000000 (end code)
The gfx of the pokewalker send pokemon data should be replaced with XXXXXXXX
This seems to only work sometimes, but it's best to hold start, connect the walker, then release start
Press start
023FE4D8 0A000003 //AR hack 0 (fix DB)
94000130 FFF70000 //When start is pressed
D3000000 00000000 //Set offset to 0
02000004 0A000000 //write dest address
D9000000 021FFAAC //load address from pointer, change this to change the pointer
D6000000 02000000 //write source address
C0000000 00008000 //start loop
D3000000 00000000 //Set offset to 0
B2000000 00000000 //set offset to the source
DB000000 00000000 //read a byte into dxdata
D3000000 00000000 //Set offset to 0
B2000004 00000000 //set offset to the dest
D8000000 00000000 //write dxdata to dest
D3000000 00000000 //Set offset to 0
D9000000 02000000 //read source address to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to source address and increase offset by 4
D9000000 02000000 //read dest offset to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to dest address and increase offset by 4
D1000000 00000000 //end loop
D2000000 00000000 //end code
023FE4D8 0A000003 //AR hack 0 (fix DB)
94000130 FFF70000 //When start is pressed
D3000000 00000000 //Set offset to 0
02000004 0A000000 //write dest address
D9000000 021FFAAC //load address from pointer, change this to change the pointer
D6000000 02000000 //write source address
C0000000 00008000 //start loop
D3000000 00000000 //Set offset to 0
B2000000 00000000 //set offset to the source
DB000000 00000000 //read a byte into dxdata
D3000000 00000000 //Set offset to 0
B2000004 00000000 //set offset to the dest
D8000000 00000000 //write dxdata to dest
D3000000 00000000 //Set offset to 0
D9000000 02000000 //read source address to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to source address and increase offset by 4
D9000000 02000000 //read dest offset to dxdata
D4000000 00000001 //add 1 to dxdata
D6000000 02000000 //write dxdata back to dest address and increase offset by 4
D1000000 00000000 //end loop
D2000000 00000000 //end code
Some interesting links:
http://www.vishay.com/docs/84672/tfbs4650.pdf
http://www.vishay.com/docs/82513/physical.pdf
http://i.imgur.com/b2VTMyg.png
I've also included a file that is a recording of sending stantler to the PokeWalker. RX/TX is from the PokeWalker's perspective, and RI# is hooked up to the PokeWalker's SCLK. This can be opend in PulseView
Edit 1/12/18: The IR signal seems to send data in 128 byte chunks. Each byte of this has 10 bits, with a starting bit of 1, and an ending bit of 0. There is about 8.6μs between bits, and least significant bits are sent first. All bytes also seem to be XOR'ed with 0x55.
Information on the CPU:
https://www.digchip.com/datasheets/download_datasheet.php?id=2373763&part-number=H8/38600R
https://www.renesas.com/br/ja/doc/products/mpumcu/tu/001/tnh8a414ae.pdf
Attachments
Last edited by froggestspirit,