This thread is here to discuss information and research of the PokeWalker. The hope is to decode the IR signals, and be able to replicate them in a homebrew environment. UPDATE 1/13/18: I have decoded the signal into Hex, and gotten it to show in pulseview. Shoutout to @shinyquagsire23 for the idea of looking into UART What's known: -Structure of sending a Pokemon (RAM, may be different from the IR signal) https://docs.google.com/spreadsheets/d/1dPeTH1CMiV7keva8QN-7YyqyMJZEXbh1BEcW0lOFoew/edit?usp=sharing -Minimal data is held on the walker. -Graphics are sent from the DS -Pokewalker init GFX start at 0x021F5588 for US HG (38160 bytes) -Pointers for individual sprites in the init gfx seem to appear at 0x021E81D4 -You can hardwire 3.3v to bat+, ground to gnd, and read stuff like SCLK and TX/RX with an arduino What's left to do: -Decode the IR signal, and figure out the format of it. Here's some hi-res images of the circuit board: Warning: Spoilers inside! Here is an AR code that might make cracking the IR signal easier: Warning: Spoilers inside! clear walker gfx ram HG US (press start) 94000130 FFF70000 (activate with start button) B21FFAD0 00000000 (set offset) DC000000 000000BE (skip to gfx) D5000000 00000000 (set dx data) C0000000 00000A00 (loop) D6000000 00000000 (write dx data) D1000000 00000000 (end loop) D2000000 00000000 (end code) The gfx of the pokewalker send pokemon data should be replaced with XXXXXXXX This seems to only work sometimes, but it's best to hold start, connect the walker, then release start Here is a code to dump 0x8000 bytes of ram from a pointer to the GBA save slot Warning: Spoilers inside! Press start 023FE4D8 0A000003 //AR hack 0 (fix DB) 94000130 FFF70000 //When start is pressed D3000000 00000000 //Set offset to 0 02000004 0A000000 //write dest address D9000000 021FFAAC //load address from pointer, change this to change the pointer D6000000 02000000 //write source address C0000000 00008000 //start loop D3000000 00000000 //Set offset to 0 B2000000 00000000 //set offset to the source DB000000 00000000 //read a byte into dxdata D3000000 00000000 //Set offset to 0 B2000004 00000000 //set offset to the dest D8000000 00000000 //write dxdata to dest D3000000 00000000 //Set offset to 0 D9000000 02000000 //read source address to dxdata D4000000 00000001 //add 1 to dxdata D6000000 02000000 //write dxdata back to source address and increase offset by 4 D9000000 02000000 //read dest offset to dxdata D4000000 00000001 //add 1 to dxdata D6000000 02000000 //write dxdata back to dest address and increase offset by 4 D1000000 00000000 //end loop D2000000 00000000 //end code For some reason this code may not be working Some interesting links: http://www.vishay.com/docs/84672/tfbs4650.pdf http://www.vishay.com/docs/82513/physical.pdf http://i.imgur.com/b2VTMyg.png I've also included a file that is a recording of sending stantler to the PokeWalker. RX/TX is from the PokeWalker's perspective, and RI# is hooked up to the PokeWalker's SCLK. This can be opend in PulseView Edit 1/12/18: The IR signal seems to send data in 128 byte chunks. Each byte of this has 10 bits, with a starting bit of 1, and an ending bit of 0. There is about 8.6μs between bits, and least significant bits are sent first. All bytes also seem to be XOR'ed with 0x55.