Remix.run Logo
PalmOS on FisherPrice Pixter Toy(dmitry.gr)
127 points by dmitrygr 12 hours ago | 14 comments
emddudley 9 hours ago | parent | next [-]

I was an intern at Fisher Price when they introduced the Pixter Color. I did QA on some of the games, the Dora one comes to mind. You can imagine the torture playing a level over and over.

The games were developed overseas (India I think?). I would send them bug reports in Mantis and overnight they would send a new build. Sometimes they would even fix the bugs. I would burn the builds on to EEPROMs and verify them the next day. The EEPROMS had a little round window so they could be erased in a UV box before programming.

Fisher Price used a video codec from Actimagine to fit video clips onto the game cartridges. That's how I learned about Virtualdub. I remember editing clips from a show called Winx.

The big competition was the Leapster LeapPad and they were trouncing us.

One fun thing the engineers did periodically was a toy teardown to see how competitors saved on cost. Cost was critical. They told me how Walmart basically dictates toy cost because they controlled the shelf space.

yjftsjthsd-h 8 hours ago | parent | next [-]

> The EEPROMS had a little round window so they could be erased in a UV box before programming.

Nitpick: That'd be a EPROM ("erasable programmable read-only memory"), not EEPROM ("electrically erasable programmable read-only memory"), right?

(But also thanks for the insight; I did wonder a bit as I was reading dmitrygr's article what the other side was of building these)

echelon_musk an hour ago | parent | prev | next [-]

> Virtualdub

There's a blast from the past.

I remember using it to remux and join 2CD XviD movies into a single avi. Making sure to identify any duplicated key frames and delete them.

I still have a YouTube video I encoded with virtual dub ~20yrs ago.

dmitrygr 9 hours ago | parent | prev | next [-]

I have an upcoming article on Pixter itself which includes giving them a LOT of credit for cost cutting. There are some quite clever things there. I also worked out how to dump games (not easy with those damn melody chips, or what did you call them?) and will release an archive of all games and working emulators.

enoent 4 hours ago | parent [-]

Nice work Dmitry, looking forward to read your next article.

The later model Pixter Multimedia had the full memory space accessible via JTAG, which is how some carts and even boot ROM got dumped a while ago [1], is it the same deal with Pixter Color?

That OpenOCD script was a bit flaky, and sometimes the boot ROM would be already unloaded before reading, maybe you have some insights in how to make it more robust.

btw, have you looked into the original Pixter? The cart connector seems to have a very narrow bus, so it doesn't look like those carts have code, and probably can only be dumped with a decap.

[1]: https://qufb.gitlab.io/writeups/pixter

oatmealcookie 5 hours ago | parent | prev [-]

> They told me how Walmart basically dictates toy cost because they controlled the shelf space.

I wonder if that is still true due to online shopping.

yjftsjthsd-h 10 hours ago | parent | prev | next [-]

Hats off; this kind of mad genius is the best of what I hope to read on Hacker™ News.

zubiaur 2 hours ago | parent [-]

Dmitry is a mad genius. He has been doing stuff like this for 20 years, he was fixing palm’s issues for years. All his hardware projects are phenomenal, and so is his writing.

ACCount37 an hour ago | parent [-]

I aspire to be half the mad genius reverse engineer he is.

theblazehen 9 hours ago | parent | prev | next [-]

I love your work, it's always very fascinating. Been reading your posts for years

wasmainiac 9 hours ago | parent | prev | next [-]

I love posts like this. Amazing work!

dmitrygr 11 hours ago | parent | prev [-]

Possible user-space DoS on Linux when running on an ARM7 CPU in just two instructions. Would that be a record? If the kernel was configured to support OABI (exclusively or together with EABI), I think the following two-ARM-instr binary will simply crash the kernel if the core has alignment checking: SUB PC, PC, #2; SWI 0. I am not sure how common such configs are, but someone should maybe fix that? The fix would be only one extra instruction.

zeta0134 6 hours ago | parent [-]

6502 can do it in one. 12 opcodes are glitched in a way that permanently halts the CPU, by causing it to never reset the internal tick counter (...sortof) that starts the next instruction. Recovery is only possible with a power cycle.

dmitrygr 6 hours ago | parent [-]

6502 doesn’t host Linux :)

Being able to crash a Linux kernel from unprivileged user code is more fun.