PokeWalker Hacking

Discussion in 'NDS - ROM Hacking and Translations' started by froggestspirit, Mar 18, 2016.

  1. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    This thread is here to discuss information and research of the PokeWalker. The hope is to decode the IR signals, and be able to replicate them in a homebrew environment.

    What's known:
    -Structure of sending a Pokemon https://docs.google.com/spreadsheets/d/1dPeTH1CMiV7keva8QN-7YyqyMJZEXbh1BEcW0lOFoew/edit?usp=sharing
    -Minimal data is held on the walker.
    -Graphics are sent from the DS
    -Pokewalker init GFX start at 0x021F5588 for US HG (38160 bytes)
    -Pointers for individual sprites in the init gfx seem to appear at 0x021E81D4
    -You can hardwire 3.3v to bat+, ground to gnd, and read stuff like SCLK and TX/RX with an arduino

    What's left to do:
    -Dump and document other methods of transfer (Working on recieving Pokemon from Walker)
    -Decode the IR signal, and figure out the format of it.

    Here's some hi-res images of the circuit board:
    Warning: Spoilers inside!
    Here is an AR code that might make cracking the IR signal easier:
    Warning: Spoilers inside!
    Here is a code to dump 0x8000 bytes of ram from a pointer to the GBA save slot
    Warning: Spoilers inside!
    For some reason this code may not be working

    Some interesting links:
    http://www.vishay.com/docs/84672/tfbs4650.pdf
    http://www.vishay.com/docs/82513/physical.pdf
    http://i.imgur.com/b2VTMyg.png

    I've also included a file that is a recording of sending stantler to the PokeWalker. RX/TX is from the PokeWalker's perspective, and RI# is hooked up to the PokeWalker's SCLK. This can be opend in PulseView
     

    Attached Files:

    Last edited by froggestspirit, Jan 16, 2017


  2. Criminal90

    Criminal90 Advanced Member

    Newcomer
    60
    10
    Feb 4, 2007
    Italy
    nice project!
     
  3. Grim Ripper

    Grim Ripper GBAtemp Regular

    Member
    251
    94
    Jan 25, 2016
    Greece
    Good luck. :)

    It's nice to see gbc being used like this nowdays.
     
  4. 8BitWonder

    8BitWonder Small Homebrew Dev

    Member
    634
    361
    Jan 23, 2016
    United States
    47 4F 54 20 45 45 4D
    That's some really neat work you have going on there! Would love to see how this develops further.
     
  5. gudenau

    gudenau Never a unique idea

    Member
    3,240
    1,216
    Jul 7, 2010
    United States
    /dev/random
    Nice, I should crack mine open and see if I spot anything obvious.
     
  6. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    I'm guessing a GBC is probably poor for the job, since I don't know the speed the pokewalker transmits. Obviously it transfers bit by bit, I'm thinking another option would be better, like an IR reciever on a 3DS with homebrew to record the readings. Does anyone have a pinout of the pokewalker (mostly the IR)?
     
  7. gudenau

    gudenau Never a unique idea

    Member
    3,240
    1,216
    Jul 7, 2010
    United States
    /dev/random
    Could go the other way, dump the ROM and figure out the CPU that it uses.
     
  8. cooroxd

    cooroxd Dirty Pirate

    Banned
    1,192
    522
    Aug 30, 2014
    Canada
    B.C.
    If you can somehow dump the rom from the walker and then port it to an android device, we can then use our phones as a pokewalker :D
     
  9. 8BitWonder

    8BitWonder Small Homebrew Dev

    Member
    634
    361
    Jan 23, 2016
    United States
    47 4F 54 20 45 45 4D
    That'd be amazing!
     
  10. N64

    N64 GBAtemp Fan

    Member
    425
    143
    Apr 16, 2014
    United States
    watching this thread. i got two of these guys and would love to be able to do something fancy with them
     
  11. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    you dont need the rom, just the transfer protocol
     
  12. migles

    migles Mei the sexiest bae

    Member
    GBAtemp Patron
    migles is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    6,624
    4,343
    Sep 19, 2013
    Saint Kitts and Nevis
    my dad works for nintendo.
    would an android with IR receiver\transmitter be any use in this progect?
    i got an htc, which does have IR blaster, in a month or so, i will get a pokewalker..

    if i could help with something...

    i do have the soul silver and the ds, if someone could make a pokewaler emulator for android with IR connectivity, that would also be cool
     
  13. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    That's what I'm hoping. I also have an HTC (one m8), but it's windows, so I'm not sure how I could put it to use. I think if someone wrote a quick homebrew for 3DS or something to use the IR, it could help. I'm not sure if this is better in the 3DS section or not

    Edit: I decided I might wire up the IR reciever of my (somewhat broken, but working IR) gameboy color. Even though my current program only records for about a second, I should be able to get a constant read with this set up (I'm hoping).

    Edit: finished the wiring, only to realise I don't have a computer with line-in (to record it as a waveform). My only option seems to be my capture device
     
    Last edited by froggestspirit, Mar 20, 2016
  14. Flame

    Flame Me > You

    Member
    3,830
    4,941
    Jul 15, 2008
    this is a really cool project.
     
  15. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    My capture card was a no go, but I should be getting a mic-in to usb adapter in the mail tomorrow, so that *should* let me record the IR signals

    Edit: Got the adapter, and it's working just as I hoped.
    The pokewalker sends 20 pulses when trying to connect. It seems like they can vary in frequency, but it seems to be not much quicker than a pulse every 0.1 second, and not much slower than a pulse every 0.135 seconds
     
    Last edited by froggestspirit, Mar 30, 2016
  16. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    Here's a sample recording. It's data from the game sending a chickorita to the pokewalker. the first half seems to be sending data, the second half seems to be clock signals to time incoming data from the walker.
    I'm kind of stuck with decoding the data. If I could figure out better what the transfer rate is, then I could at least have the gameboy try to emulate it, and recieve
     

    Attached Files:

    danzou22 likes this.
  17. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    I've started to look into this again with an arduino and an actual IR reciever
     
    Riyaz and TheVinAnator like this.
  18. shinyquagsire23

    shinyquagsire23 SALT/Sm4sh Leak Guy

    Member
    1,961
    3,231
    Nov 18, 2012
    United States
    Las Vegas
    Good luck with this, I'm not exactly sure where my own pokewalker is but I'm always interested in weird devices.
     
    froggestspirit likes this.
  19. migles

    migles Mei the sexiest bae

    Member
    GBAtemp Patron
    migles is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    6,624
    4,343
    Sep 19, 2013
    Saint Kitts and Nevis
    my dad works for nintendo.
    That should do the trick...
    Since March I now have 2 poke walkers, I can't open them but if you need some help testing or what not, tell me
    I have an htc m8, so if there is an Android app to read/send IR signals I can help
     
    froggestspirit likes this.
  20. froggestspirit
    OP

    froggestspirit D/P/Pt Demix Guy

    Member
    1,064
    526
    Jul 28, 2011
    United States
    Right now I have a simple program to read IR signals, and print them in the serial monitor. I might post a few dumps, but I'm getting the feeling that the arduino (leonardo) might not be fast enough to read all the data. I might also look into reading the ram values through an emulator, to see if I can find the buffer of data the DS sends (then it'd be easier to know what to look for in the IR dumps). Only drawback with this is that emulators don't support the IR, so I'll have to see how far I can go with that.

    EDIT: Here's a part of a RAM dump for sending a stantler to the first walker route. Graphics can be viewed if loaded into a tile editor (gameboy format). Pidgey is also there because it is the pokemon that will join if you have no pokemon in the walker.

    I just dumped this section because it looks like a lot of blank space was before and after it.
    There is also Pokewalker init stuff earlier in a full dump, it contains more graphics, and spinda (probably for the spot placement)
    If this isn't allowed, please have a mod remove the file.

    Edit2: a pointer to this data can be found at 0x021FFAD0 (HeartGold US)
     

    Attached Files:

    Last edited by froggestspirit, Jan 8, 2017