Tamagotchi Uni – HACKING THE NUGGETTTTT

On stream yesterday (7/18/2023) I spent five hours attempting to hack the brand new Tamagotchi Uni that came out on 7/15/2023. I acquired three of them and did everything on stream, so that was fun.

Yet, the nugget has yet to reveal to me its secrets! I will keep it up!

Here is some notes and random prose I’ve found/typed up/photos!

I’ve been making a real hard swing over the past two days to hardware hack the Uni, and while I have not gotten my prized flash dump/decompile yet, I do have some useful info:

to get the screw caps off of the back, use strong tape, they come off easier than they look.
all normal, smalll Phillips head screws are used
the SOP8 8pin 4mm chip is NOT a flash chip (heck my wasted time) its an audio amplifier
the flash data is stored on the ESP32-S3-WROOM-1 module, which supports up to 16mb quad-SPI flash
the module is capable of Bluetooth, in theory, but a) the software doesn’t support it and/pr b) the radio/antenna is not connected
the battery: li-ion 3.7v 1.369Wh
once taken apart, and battery lifted off the PCB, looking at the back side of the module, with the USB-C port on the left, you get four golden pads that imma try to UART into From left to right they are BOOT GROUND, TX, RXI – Not sure if the port is enabled yet, must try soldering wires on and trying it I’ve never had much luck soldering pins to the pads as other hardware hackers do, I always clumsily leverage the pads right off. I’mma try to tack each one and then melt in the tip a of DuPont male ended so see if we get signal. I also plan to hold everything down as best I can with tape to (hopefully) reduce the failure likelihood lol

I think imma have to power on the device, then connect a common ground with the uart with the GND pad, and see what I have to do with my Bus Pirate to make that boot pad work, if needed. (pulled/high, pulled/low, etc.) I still need to study that bit of the data sheet again.

The ESP32-S3-WROOM-1 module is:

384 KB ROM
512 KB SRAM

(up to?) 16 KB SRAM in RTC
Up to 8 MB PSRAM
its (meant to have, not sure if used) a RISC-V Ultra Low Power coprocessor that can run while asleep ULP-FSM
the core of the SoC is Xtensa®
dual-core 32-bit LX7 microprocessor, up to 240
MHz