close-circle
Close
0%
0%

Pokewalker Hacks

Like everything the else the pokewalker is destined to have some sort of microcontroller in it so why not try to hack it?

Similar projects worth following
close
I am going to try to reverse-engineer a Nintendo Pokewalker to see how it works what it is capable of and maybe just maybe completely re-make it.

MCU Used in Cartridge: H8/38600R RAM: 512 Bytes ROM: 8 KiloBytes

Save Storage Used on Cartridge: M45PE40 Size:4 MegaBits

MCU Used on Pokewalker: H8/38606R

MCU can be debugged or reprogrammed using an emulator ( E7/8/8a )

toim4232 (1).pdf

Describes the toim4232 ic

Adobe Portable Document Format - 579.34 kB - 08/03/2017 at 08:30

eye
Preview
download-circle
Download

PrgMnl.pdf

Notes describing in more detail programming and instruction set

Adobe Portable Document Format - 535.74 kB - 06/02/2017 at 22:30

eye
Preview
download-circle
Download

AppNts.pdf

Notes describing how this family of MCU communicate with an LCD and other things

Adobe Portable Document Format - 428.79 kB - 06/02/2017 at 22:30

eye
Preview
download-circle
Download

datasheet.pdf

Datasheet for one of the miscellaneous components on the lcd side of the motherboard

Adobe Portable Document Format - 331.96 kB - 06/02/2017 at 03:39

eye
Preview
download-circle
Download

physical.pdf

Datasheet describing IR communications

Adobe Portable Document Format - 101.08 kB - 05/23/2017 at 01:49

eye
Preview
download-circle
Download

View all 8 files

  • 1 × Nintendo Pokewalker Pedometer for Walking Virtual Pokemon
  • 1 × Pokemon HeartGold/SoulSilver Game for Playing/Sending Pokemon to Pokewalker
  • 1 × Nintendo DS/Lite/XL/3DS/2DS/ECT Console for Playing Nintendo DS Game Cartridges
  • 1 × Laptop With WiFi For RESEARCH!!!!!!

  • Dang USB Drive and More Plans

    Colton08/04/2017 at 22:57 0 comments

    So I was able to make a bootable drive for my defunct laptop and was able to copy the work I had done with the schematics to another USB drive. Fast forward to when the installer finally finished and I booted up my laptop and inserted the drive, only to find that the files on it where somehow corrupt! So for now I'm going to move on to designing the IR dongle to interface the Pokewalker to a PC but continue working on the schematics in the mean time and upload them when they're done. I will also begin deciding what major features I want to put in the final redesigned Pokewalker. My thoughts so far are:

    CPU: ESP32-WROOM Module (Manually Upgraded Flash Storage)

    LCD: 1" Color TFT Display (DT010TFT)

    SD CARD READER: GL827L

    DEGUB HW: FT2232H

    My idea behind using the ESP32 as the CPU is that you can connect it to the internet and have Pokemon fights and the bluetooth for listening to music. The FT2232H would be connected to the CPU as a USB to JTAG device for debugging and it would also be connected to the transceiver circuit via UART so that I can debug and interface the transceiver with a PC. Since both the SD card reader and FT2232H are USB devices there will have to be a switching IC that can be set to connect to either chip. The same will have to be done with the CPU and SD card reader because they are both SDIO devices. They would be set up so that when the device is connect by USB the device will go to sleep so that it can charge faster and so that the PC can access the SD card properly.  For an enclosure for the device I want to use the enclosure from a broken Pokewalker that I have laying around because I want to make it look as close to the actual Pokewalker as possible.

  • All figured out

    Colton08/03/2017 at 08:29 0 comments

    I finally figured out what that mystery component has to be! By process of elimination it has to be some sort of motion sensor or accelerometer. So now that I now what all of the components are, and once I recover the schematics from my laptop I can work on designing a little dongle to communicate with the pokewalker. I'm almost certain that it uses an SIR (serial infrared) interface to communicate with the cart. The application PDF that describes ir communication mentioned an IC called the TOIM4232 (Added the datasheet ) that allows a uart port to directly interface a serial ir device when paired with a compatible Vishay transceiver. So my plans are to finish up the schematics then design a dongle to communicate with the pokwalker and then design a whole new pokewalker based off the dongle.

  • It's not needed

    Colton06/20/2017 at 20:57 0 comments

    I was thinking about how the game sends pokemon to the walker and decided that a ROM dump of the walker isn't necessary. The only thing the game cares about is that the walker accepts the data stores it and sends it back properly. The game doesn't care how the walker does that, just that it simply does it. We only need to know how the IR protocol and hardware works then we can make a device that mimics the walker and then improve the design from there. In terms of writing and emulator for PC we don't even need to worry about the IR protocol at all because the IR hardware is independent of the game itself. The console sends data to the MCU via SPI and then that's it. For all an emulator would care it's just writing another save file. From there I can grab that file and send it to a program that picks it apart and just sits on your desktop looking cute. Now if I wanted to send the pokemon across platforms to an actual walker ( Or a phone ;) ) THEN I would have to re-create the IR hardware, protocol and all of that stuff. So that's the plan, re-create the IR hardware and protocol and port it to another platform and then make my own platform.

  • Mysterious Component

    Colton06/02/2017 at 22:28 0 comments

    So I was trying my hardest to find the datasheets for as many Pokewalker parts as I could and there where two things that I simply could not find the specs for: The LCD screen (I did find one that is extremely similar but not it though) and a part just behind the IR transceiver. The only thing I was able to figure out about it is that it is an SPI device because the picture I drew on (That I also added to the project gallery) shows that the MISO line is connected to one of the pins on that chip. Googling the part number gave me no results, only other products by similar part/model numbers. I think it's a memory chip of some sorts, most likely for storing the sprite sets sent from the DS cartridge. Another theory I have about that device is more memory to execute code from, made for just this processor and that's why I wouldn't be able to find a datasheet for this exact MCU (Which also leads me to believe that this MCU was made for Nintendo and it's not meant to be used for anything but this product, but hey they could just not be making it anymore or something). I was also able to get more info on how the MCU handles communicating with the LCD. The file describes the entire MCU family (H8/300H) but especially how they communicate to an LCD. I also found a pdf that describes the way the device is programmed and how it's instruction set works in general. Also I found several other pdfs that describe other similar MCU families (H8S H8 etc) being able to use their SSU (Serial Synchronous Unit) to communicate with SPI devices, which makes sense because the MCU doesn't seem to have any other ways to communicate with those types of devices. Next, I'm going to upload the schematics for the Pokewalker once I finish them and then poke and prod at the device with an arduino. (But not the one with my Speed Form Deoxys on it though XD.)

  • New plans for this project.

    Colton06/02/2017 at 03:19 0 comments

    So I was thinking about the differences between the pokewalker and the pokemon games (HeartGold and SoulSilver) and thought that it would be cool for the walker to have more features that are in the ds games like status affects, being able to use items. Also, acutally progressing down a "path" and if your pokemon faint you get reset to the beginning and loose some watts etc. This would include resetting the rarity of pokemon found at that point along the path. Basiclly make the pokewalker a more complete and portable version of the actual ds version but orientated towards putting the spotlight back on exercising with the pokewalker in a new and innovative way. (Hahaha maybe even putting GPS in it, make some pokemon appear in some places, some in others and making it the legacy version of PokemonGO) Of course to do this I would need a ROM dump of the walker, a complete reverse engineering of the hardware and to gain control of the MCU on the cartridge. I suspect that might be really easy considering all of the info I have about walker and the MCU on cartdridge.

    ***EDIT***

    Just added a datasheet for a miselainious component on the motherboard. Not really sure what it does at the moment.

  • Added files and plan of attack

    Colton05/23/2017 at 02:05 0 comments

    I added the files froggestspirits posted on gbatemp. They're data sheets describing how the IR transceiver works and the IR layer in general. Also I have been working on a schematic of the pokewalker device that should make its way here soon. My plan A for getting a ROM dump of the pokewalker itself starts with the game cartridge. How the MCU is connected in the cartridge is rather simple. The memory chip that stores the save data communicates to the ds by spi. The sixth tab over from the left on the cartridge connector is normally to enable/disable the memory chip on that spi bus. But with the addition of the MCU for IR communications the only method to transfer data between the two is spi. So the chip select is used to toggle between communicating with the MCU and communicating with the save memory. So the theoretical plan to get a ROM dump from the pokewalker is to use an arduino as a master on the spi bus and generate data that the MCU will then send to the pokewalker. That data will hopefully be a program made using the highly embedded workshop by Renesas. (Obviously) A perk of their software is they have a simulator for their chips so I can test my program before putting on the pokewalker.

  • ** UPDATE **

    Colton05/19/2017 at 00:33 0 comments

    Hello! Back again after 10 months! Just a quick update: I found another post by: User name froggestspirit Link: https://gbatemp.net/threads/pokewalker-hacking.419462/

    He seems to have made a lot of AR codes for messing with and dumping graphics and sprites for the pokewalker from ds ram. I myself have been doing a lot of hardware related work with both the walker and the cart and will be posting more updates soon.

    ALL CREDIT FOR THE WORK LINKED TO GBATEMP.COM GOES TO GBATEMP USER FROGGESTSPIRIT MY OWN WORK WILL BE PUBLISHED SOON.

  • MORE INFO

    Colton07/17/2016 at 20:13 0 comments

    After more research I found a picture of the circuit board used in the pokewalker and noticed a lot of exposed pads. What peeked my interest is the four pads near the buzzer connections labelled NMI, E7-0, E7-1 and E7-2. I then searched E7-0 on the Renesas website ( Renesas being the manufacturer of the MCU used in the pokewalker ) and found that they make emulators that are able to debug and reprogram these MCUs. The one made for this MCU is the E7 but is no longer being sold. Its successor ( The E8a ) however costs ~$150 and you have to call to order so at this time its out of my reach and this project is at a stopping point until I can figure out how to get a hold of one of these emulators. Meanwhile I will download and explore the High-Performance Embedded Workshop and Flash Developement Kit available for download on their website.

  • Information Update

    Colton07/15/2016 at 00:48 0 comments

    As I was Researching I found a forum where another person figured out how to get a RAM dump using Action Replay codes and was messing around with sprites on the walker ( link here: Pokewalker Sprite Hacking ) and at the bottom of the forum someone posted a link to a Japanese website ( Pokewalker Info ( HEADS UP TRANSLATION NEEDED ) ) that had a lot of useful information like the part number for the microcontroller used in the game cartridge ( H8 / 38600R ) and using that info I found a datasheet for said microcontroller. When I skimmed the datasheet I found that the microcontroller had IR functionality built into it. The basics of how it works is there is a serial port that sends out data that is converted into IR frames and sent with IR diodes so its a wireless UART interface of sorts. I also learned that the microcontroller has a Masked ROM so re-writing it is impossible. I also explored other parts of the website ( Other Pokemon HG/SS Info MORE TRANSLATING ) and found the datasheet for the flash memory on the cartridge so editing the save file is a possibility. The other website mentions different speeds for transfering data on cartridge but its a little hard to understand.

View all 9 project logs

Enjoy this project?

Share

Discussions

jeffrey_hensley wrote 07/26/2017 at 03:56 point

I'm also interested in understanding the IR protocol.  How far have you gotten along that line?

  Are you sure? yes | no

Colton wrote 07/26/2017 at 23:27 point

well I was pretty far along until my laptop refused to boot.   :) Trying my hardest to recover it all.

  Are you sure? yes | no

j258633 wrote 07/20/2017 at 03:13 point

hey there, I too found this project while searching a way to emulate a pokewalker so we can use it in nds emulators.  So, do know that at least 2 people are eagerly awaiting for progress and cheering you on!  ^_^

  Are you sure? yes | no

kelly wrote 06/18/2017 at 17:44 point

Found this project while looking for a way to emulate a pokewalker with a PC. I'm hoping to write a script that lets me use my fitbit as the step counter for the pokewalker and then sync it back to the game via PC. Looking forward to following your progress!

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates