Challenge: Identify the MCU of a 1$ Tamagotchi clone with epoxy blob

Maybe it's got a 6502 core, maybe not. Either way I'd like to find out.

It's got a hardcoded LCD of the usual type(what are they called?) and accepts 3 volts.
It's got a piezo buzzer.
They couldn't be bothered with anything else - not even mounting the 100nF decoupling cap XD

Any good ideas to identify the CPU? Power it up repeatedly and check what all the pins do on reset with a logic analyzer and/or scope?

_________________
---
New new new new new video out! Serial Bootloader for my 65uino
Also, check out: I2C on a 6502 Single Board Computer
and Complete hardware overview of my 6502 SBC R1

Hmm, got a friendly dentist? Maybe an x-ray would help...

This might be relevant: https://hackaday.com/2013/05/24/tamagotchi-rom-dump-and-reverse-engineering/

Gotta remember that one for later!



That's kinda where I got the idea(dead links overcome with help of internet archive) - except this is muuuuch lower quality. Still old though - I believe this clone was first see in 2004.
I'm still looking through how Natalie did it.. Edit: No luck - the one she messed with had external ROM. This is just a black box that'll probably be harder to manipulate...

_________________
---
New new new new new video out! Serial Bootloader for my 65uino
Also, check out: I2C on a 6502 Single Board Computer
and Complete hardware overview of my 6502 SBC R1

This person uses abrasive techniques:
Mechanically Decapping a Chip-On-Board (COB)

More conventional (but not too attractive to me) is to use an acid, whether fuming nitric or rosin
Decapping ICs (removing epoxy packaging from chips to expose the dies)

Perhaps, whatever you try, try it on something of low value first...

You can't get much lower than a Tamagotchi.

_________________
Bill

If you've only one specific one, I'd say practice first on something you have half a dozen of.

Is hacking up the epoxy blob the most obvious way here? I guess a few photos of the die wouldn’t hurt but wouldn’t you first try analyzing the signals?

Secondary objective could reusing the lcd.. any one have a datasheet for that type of LCD?

I think I have about a dozen of them - permanently killing a tamagotchi close won’t affect my continence or wallet much

_________________
---
New new new new new video out! Serial Bootloader for my 65uino
Also, check out: I2C on a 6502 Single Board Computer
and Complete hardware overview of my 6502 SBC R1

For this kind of one-chip system, I'd expect all the I/Os to be dedicated to their function, so I wouldn't expect to be able to see anything by way of microprocessor-specific behaviour. It's possible there could be a test mode, which might even allow for dumping ROM, but finding it would be a bit of a challenge. Perhaps more likely there would be some unbonded pads which allow test before packaging.

Another kind of attack is a glitching attack - the power input is dipped (or spiked) precisely at some clock cycles, to hope to disturb the machine into an unexpected state. It's still a bit of a puzzle as to how this would give an insight, but it's very deep stuff and maybe there is a way.

Does the LCD module have a decoupling capacitor? The problem only begins when both parties make the cheapest product by assuming the other party provides decoupling.

_________________
Modules | Processors | Boards | Boxes | Beep, Beep! I'm a sheep!

Single sided PCB. Literally the only components are the pcb, the blob, the speaker and the lcd + buttons, plastic and wires. Battery mount is a bare wire only soldered on one end.

_________________
---
New new new new new video out! Serial Bootloader for my 65uino
Also, check out: I2C on a 6502 Single Board Computer
and Complete hardware overview of my 6502 SBC R1