Hello Pokéwalker by PoroCYon
Hello Pokéwalker by PoroCYon/K2^TiTAN
For the Pokéwalker
A quick overview of the Pokéwalker, and how it compares to the Pokémon Mini:
- Renesas H8/38606F industrial MCU -vs- 100% custom Nintendo system
- 8/16-bit H8/300H CPU @ 3.6 MHz -vs- custom 8-bit CPU @ 4 MHz
- 2k RAM, 16-bit addressing -vs- 4k RAM (incl. VRAM), 24-bit addressing
- control LCD over SPI, no sprites -vs- MMIO LCD control, 24 sprites
- IR, RTC, movement sensor, ...
----------------------------------------
Because my laptop got 12V 4A to the USB ports, and I only got it working back
on Friday the second, I had to practically partycode the entire thing. The
deadline being on Saturday 12:00, I had less than 24h to make this.
Getting code to run has already been demonstrated before ([0] as well as my own
[1], in order to dump the internal flash ROM, with all the code). However,
nobody ever managed to get something on screen. Calling the ROM routines that
draw stuff on screen didn't seem to work, either, which meant I was going to
control the LCD directly (using SPI). Allegedly the LCD is an SSD1854,
however, it actually doesn't behave all that much like it, which meant I had to
reverse-engineer the thing while also working on the prod itself. This uh,
was bad news. But in the end I prevailed, though I didn't manage to figure out
how to use more than the top 8 pixels. Oh well. But hey, having figured this
out, there's probably a serious demo for the walker coming soonish. Maybe.
[0]: http://dmitry.gr/?r=05.Projects&proj=28.%20pokewalker
[1]: https://git.titandemo.org/PoroCYon/pokewalker-rom-dumper
----------------------------------------
How to run it on your own Pokéwalker:
You need to upload the 126-bit "pwcode.bin" file, either using the
.nds file you can run on your Nintendo DSi or 3DS, or using another
tool running on eg. a Palm device. These basically exploit a remote code
execution bug in the Pokéwalker's ROM to run the prod.
The DSi/3DS tool runs from the SD card and needs a genuine Pokémon HGSS/BW/B2W2
cart inserted while it is running, see the README of the [1] link above
for more info.
A custom tool will have to use IR command 0x06 to write into the Pokéwalker's
internal RAM: the payload file to 0xfa70, and then write that address
(big-endian, 2 bytes) to address 0xf7e0. The Pokéwalker will then execute the
code at the address written to 0xf7e0. See Dmitry's writeup or the code of my
dumper for more info.
----------------------------------------
Greets to Dmitry, mamba2410, nocash, Team Pokeme, and the melonDS dev team,
and also to Adapt, Alcatraz, Calodox, CyberCat, Desire, DSS Elix, EOS, Fuel,
Impure 1940, Ivory Labs, Matt Current, Monad, Nuance, Polarity, Poo-Brain, PVM,
Rabenauge, RBBS, Shitfaced Clowns, Slipstream, Suricrasia Online, TRBL, WRD,
xq, Xylem, #lsc
[ back to the prod ]