Hacking a Toy - COMPLETE

Well...I may have just outdone myself as far as my custom-made annoy-a-trons go.

By interfacing an electronic toy with a Picaxe 14M2 micro-controller, I have successfully bypassed all of the original electronic logic, creating my own unique program for the toy's operation.

Then I decided to get creative.

Unfortunately, I did not have sufficient parts to do EVERYTHING that I had hoped to accomplish (locking individual wheels to make the car turn while moving forward or backward) and some features were not even possible before I modified the toy, such as the press-switch activation which was supposed to occur when the toy was placed on a surface but was manufactured to a tolerance that allows the switch to get jammed in the open position every time the vehicle is standing on its own weight.

I have, however, come up with a brand new kind of annoying.

Using the LED masking function, I manipulated the electronic logic through physical and scripted methods to achieve alternating headlamps (fashioning miniature blue LEDs in place of what was once headlights which were painted on over opaque plastic) in sync with the toy's new musical output.
I'll upload the entire Picaxe BASIC script in a separate post.

**Beefy Desktop PC not included with toy

Custom LED headlights

(JDM or EuroSpec? Who knows...)

Toy's Original Logic Board

My custom logic board

**WARNING**

Bear in mind that this toy was created with the intention of being annoying.

If the song(s) get stuck in your head or you're sensitive to loud lights and bright noises, please reconsider watching the video demonstration.

Picaxe BASIC Logic Script

Ready to be copied and pasted directly into Picaxe Programmer or AxePAD for simulation

main:
wait 1
sound B.1, (108,50)
wait 2
   for b0 = 0 to 1
high 2
sound B.1, (84,3)
sound B.1, (40,4)
low 1
low 2
pause 165
high 2
sound B.1, (84,3)
sound B.1, (40,3)
low 1
low 2
pause 165
high 2
sound B.1, (84,3)
sound B.1, (40,3)
low 1
low 2
pause 220
high 2
sound B.1, (84,3)
sound B.1, (40,3)
low 1
low 2
pause 420
high 2
sound B.1, (84,3)
sound B.1, (40,5)
low 1
low 2
pause 115
high 2
sound B.1, (74,3)
sound B.1, (28,3)
low 1
low 2
pause 165
high 2
sound B.1, (74,3)
sound B.1, (28,3)
low 1
low 2
pause 165
high 2
sound B.1, (62,3)
sound B.1, (16,3)
low 1
low 2
pause 220
high 2
sound B.1, (62,3)
sound B.1, (16,3)
low 1
low 2
pause 900
   next b0

'Party Rock Anthem 1
tune B.1, 3, 001100,($10,$10,$03,$03,$03,$03,$D3,$13,$51,$53,$D1,$8C,$08,$0A,$10,$08,$03,$0C,$03,$03,$CA,$C8,$8C,$0C,$10,$03,$03,$03,$03,$93,$D1,$8C,$08,$0A,$10,$0A,$08,$0A,$8C,$CC)

sound B.1, (124,2)
sound B.1, (84,2)
sound B.1, (40,2)
low 1
pause 135
sound B.1, (124,2)
sound B.1, (84,2)
sound B.1, (40,2)
low 1
pause 135
wait 2
sound B.1, (127,50)
sound B.1, (16,30)
sound B.1, (127,3000)
'Fail!
tune B.1, 1, 001000,($DB,$60,$62,$66,$63,$98,$60)
low 2
pause 17
high 2
pause 1333
low 2
pause 9
high 2
pause 20
low 2
pause 20
high 2
wait 2
low 2
wait 6
goto rickroll

rickroll:
high 5
pause 5
low 5
'Rollin 1
tune B.1, 3, 001100,($C5,$05,$C7,$07,$C0)
high 5
pause 5
low 5
tune B.1, 3, 001100,($C7,$07,$C9,$09,$50)
high 5
pause 5
low 5
tune B.1, 3, 001100,($4A,$09,$C5,$05,$C7)
high 5
pause 5
low 5
tune B.1, 3, 001100,($07,$C0,$04,$05,$C5)
high 5
pause 5
low 5
tune B.1, 3, 001100,($CC,$45,$05,$45,$CC)
high 5
pause 5
low 5
tune B.1, 3, 001100,($22,$24,$25,$25,$27)
high 5
pause 5
low 5
tune B.1, 3, 001100,($24,$64,$62,$20,$A0)
high 5
pause 5
low 5
tune B.1, 3, 001100,($EC,$2C,$22,$22,$24)
high 5
pause 5
low 5
tune B.1, 3, 001100,($25,$E2,$20,$00,$2C)
high 5
pause 5
low 5
tune B.1, 3, 001100,($00,$27,$A7,$2C,$22)
high 5
pause 5
low 5
tune B.1, 3, 001100,($22,$24,$25,$22,$25)
high 5
pause 5
low 5
tune B.1, 3, 001100,($27,$2C,$24,$22,$20)
high 5
pause 5
low 5
tune B.1, 3, 001100,($E0,$EC,$2C,$22,$22)
high 5
pause 5
low 5
tune B.1, 3, 001100,($24,$25,$22,$E0,$27,$27,$27)
high 5
pause 5
low 5
tune B.1, 3, 001100,($29,$E7,$EC,$A5,$25,$27,$29)
high 5
pause 5
low 5
tune B.1, 3, 001100,($25,$27,$27,$27,$29,$E7,$E0)
high 5
pause 5
low 5
tune B.1, 3, 001100,($AC,$22,$24,$25,$22,$2C,$27,$29,$27,$E7)
high 5
pause 5
low 5
'Strollin1
tune B.1, 3, 001100,($40,$42,$45,$42,$09,$49,$09)
high 5
pause 5
low 5
tune B.1, 3, 001100,($07,$C7,$40,$42,$45,$42,$07)
high 5
pause 5
low 5
tune B.1, 3, 001100,($47,$47,$07,$05,$45,$44,$02)
high 5
pause 5
low 5
tune B.1, 3, 001100,($40,$42,$45,$42,$C5,$07,$04)
high 5
pause 5
low 5
tune B.1, 3, 001100,($44,$42,$C0,$00,$C7,$85,$40,$42,$45,$42)
high 5
pause 5
low 5
tune B.1, 3, 001100,($09,$49,$49,$09,$07,$C7,$40,$42,$45,$42)
high 5
pause 5
low 5
tune B.1, 3, 001100,($D0,$04,$05,$45,$44,$02,$40,$42,$45,$42)
high 5
pause 5
low 5
tune B.1, 3, 001100,($C2,$07,$04,$44,$42,$C0,$40,$07,$0C,$C5,$CC)
'Strollin1b
tune B.1, 3, 001100,($60,$62,$65)
high 5
pause 5
low 5
tune B.1, 3, 001100,($62,$29,$69,$29)
high 5
pause 5
low 5
tune B.1, 3, 001100,($27,$E7,$60)
high 5
pause 5
low 5
tune B.1, 3, 001100,($62,$65,$62,$27)
high 5
pause 5
low 5
tune B.1, 3, 001100,($67,$67,$27)
high 5
pause 5
low 5
tune B.1, 3, 001100,($25,$65,$64,$22)
high 5
pause 5
low 5
tune B.1, 3, 001100,($60,$62,$65)
high 5
pause 5
low 5
tune B.1, 3, 001100,($62,$E5,$27,$24)
high 5
pause 5
low 5
tune B.1, 3, 001100,($64,$62,$E0)
high 5
pause 5
low 5
tune B.1, 3, 001100,($20,$E7,$A5,$60)
high 5
pause 5
low 5
tune B.1, 3, 001100,($62,$65,$62)
high 5
pause 5
low 5
tune B.1, 3, 001100,($29,$69,$69,$29)
high 5
pause 5
low 5
tune B.1, 3, 001100,($27,$E7,$60)
high 5
pause 5
low 5
tune B.1, 3, 001100,($62,$65,$62,$C0)
high 5
pause 5
low 5
tune B.1, 3, 001100,($24,$25,$65)
high 5
pause 5
low 5
tune B.1, 3, 001100,($64,$22,$60,$62)
high 5
pause 5
low 5
tune B.1, 3, 001100,($65,$62,$E2)
high 5
pause 5
low 5
tune B.1, 3, 001100,($27,$24,$64,$62)
high 5
pause 5
low 5
tune B.1, 3, 001100,($E0,$60,$27,$2C,$E5,$EC)
'Strollin1
tune B.1, 2, 001100,($40,$42,$45,$42,$09,$49,$09,$07,$C7,$40,$42,$45,$42,$07,$47,$47,$07,$05,$45,$44,$02,$40,$42,$45,$42,$C5,$07,$04,$44,$42,$C0,$00,$C7,$85,$40,$42,$45,$42,$09,$49,$49,$09,$07,$C7,$40,$42,$45,$42,$D0,$04,$05,$45,$44,$02,$40,$42,$45,$42,$C2,$07,$04,$44,$42,$C0,$40,$07,$0C,$C5,$CC)
'Strollin1b
tune B.1, 2, 001100,($60,$62,$65,$62,$29,$69,$29,$27,$E7,$60,$62,$65,$62,$27,$67,$67,$27,$25,$65,$64,$22,$60,$62,$65,$62,$E5,$27,$24,$64,$62,$E0,$20,$E7,$A5,$60,$62,$65,$62,$29,$69,$69,$29,$27,$E7,$60,$62,$65,$62,$C0,$24,$25,$65,$64,$22,$60,$62,$65,$62,$E2,$27,$24,$64,$62,$E0,$60,$27,$2C,$E5,$EC)
goto strollin

strollin:
'Strollin1
tune B.1, 1, 001100,($40,$42,$45,$42,$09,$49,$09,$07,$C7,$40,$42,$45,$42,$07,$47,$47,$07,$05,$45,$44,$02,$40,$42,$45,$42,$C5,$07,$04,$44,$42,$C0,$00,$C7,$85,$40,$42,$45,$42,$09,$49,$49,$09,$07,$C7,$40,$42,$45,$42,$D0,$04,$05,$45,$44,$02,$40,$42,$45,$42,$C2,$07,$04,$44,$42,$C0,$40,$07,$0C,$C5,$CC)
'Strollin1b
tune B.1, 1, 001100,($60,$62,$65,$62,$29,$69,$29,$27,$E7,$60,$62,$65,$62,$27,$67,$67,$27,$25,$65,$64,$22,$60,$62,$65,$62,$E5,$27,$24,$64,$62,$E0,$20,$E7,$A5,$60,$62,$65,$62,$29,$69,$69,$29,$27,$E7,$60,$62,$65,$62,$C0,$24,$25,$65,$64,$22,$60,$62,$65,$62,$E2,$27,$24,$64,$62,$E0,$60,$27,$2C,$E5,$EC)
goto strollin

Hacking a Toy pt. 3

Tonight, we continued programming and circuit-bending with our hacked toys.

I was able to find many shortcuts hidden in the Picaxe manual, namely related to functions for sound generation. This eliminates all need for guesswork in creating specific musical tones, and should cut my programming time considerably in addition to providing more musical options for the hacked toy's final software.

Picaxe Sound Function

Through experimentation and a trained ear, I found that the Picaxe Basic function "sound" provides audible notes in a range of chords starting at a frequency of 40 and increasing by one full step in increments of 6, plus or minus a value of 2--one full octave higher than tone 40 is at 84.


Equipped with this knowledge, I can begin programming basic sheet music into the picaxe's memory.




**UPDATE** 3:56pm


Using a digital tuner I was able to confirm that tone 40 and tone 84 are in fact the musical note "A"

Hacking a Toy pt. 2 -- Interfacing a Toy to User Command

A continuation of exploring possibilities for bending the original logic of an electronic-based toy.

*Original logic-board removed

A shot of the extension wires I soldered into place to take control of the sensors and outputs of the toy, keeping original color and polarity.

Soldering extension wires to the speaker proved a greater task than the other four, simply because of the low quality of the wafer attached to the base of the speaker which would flake and adhere to the solder, providing for a challenging joint.

Heat shrink was used to group wires, making it easier to visually follow their paths of execution to product (color) without opening the toy, hopefully simplifying process and  cutting down on time spent troubleshooting.

A demonstration of direct control over the motor function of the toy--pressing the switch on the breadboard would supply 5V and cause the wheels to spin on command.

In a separate demonstration, the existing program (compiled over the weekend) would provide a range of  incremental sound frequencies when the microcontroller was interfaced with the speaker.

Circuit Bending and "Hacking a Toy"

Self-explanatory experiments in bypassing the original logic of an electronic-based toy to implement our own.

Original Toy

When the power supply circuit was closed, the toy could be activated by shaking it, due to a small ball switch (orange wires) energizing the logic board to the "awake" state. The toy would emit sound from a speaker (yellow wires) and drive the rear wheel axle motor (red wires). Also included were a pressure switch attached to the front axle (purple wires), indicating that the toy was placed on the ground, and a bar switch 

(blue wires), which was included but did not appear to be attached to any mechanical interface--most likely, it  was a leftover process from another feature that the manufacturer had intended.

Logic-board exposed.

Interestingly, the rear axle of the toy is not a single-shaft direct-drive gearset. It has an "open" differential, leading to greater possibilities for hacking by locking up one wheel to make the toy turn while the motor is being driven forward or backward.

Logic Probe and Picaxe Interfacing/Programming

We finished soldering on our logic probes to be used for identifying circuit logic and stray voltages.

Once the probes were soldered, interconnected wells on the wafer had to be "cut" to match the desired paths for current.

The next stage of our projects would make heavy use of a standard serial COM port to interface our Picaxe microcontrollers with a desktop computer for programming, so one was fashioned.

A detour in exercising transistor control.

The wiring diagram for interfacing a Picaxe 08M2 with a desktop PC serial port for programming in 

Picaxe Programmer.

A successfully executed "flasher" program written in basic and downloaded to the 08M2, pulsing a red LED.

VEX Bot and Logic Probe

Taking a break from previous activities, we built basic VEX "square bots" as a precursory toward concepts of mechanical structure, build technique and creativity.

When the robot was finished

(over the weekend, at home, as class-time is now desperately needed to catch up on other activities....

and it's robots....which is like, the ultimate hobby),

it was handed over to a team of programmers who, after some technical difficulties, installed matching firmware and a basic VEX robot drive program to allow manual operation of the robot via a wireless controller. Once the robot was successfully paired with the operator controller and demonstrated to be in proper working order, it was set aside and we began building our logic probes.

After demonstrating an understanding of basic transistor theory and uses in simple circuits, we set to the task of prototyping a simple Hi-Low voltage logic probe on breadboards before be signed off to finalize the design on a small circuitboard. Sans the PWR and GND cables, the above picture represents all the hardware necessary and soldered in place.

Switches and Relays: Part 1

Using the above Single-Pole Double-Throw switches (SPDT), we constructed a simple circuit of alternating switches, per the diagram below.

However, this seemingly simple circuit provided many headaches, and troubleshooting with a multimeter to verify available voltage and continuity of the hand-built circuit pointed to a break in continuity within the bread board itself.

As it turned out, this conclusion was correct--this specific breadboard model has separate circuits for the top and bottom half of the board, noted by a small "W" stamped on the white plastic, just to the right of the ground-side of the brown wire in the picture above.

The next circuit posed more challenges, but of a different nature. Constructing the circuit manually proved to be difficult  due to the scale of the parts being manipulated and lack of finer, more precise tools. Furthermore, because the relay could not be set within the breadboard (while still achieving the desired circuit), an alternate method of attachment was devised by structuring the relay with two stiff, green, single-strand wires and its pins at a visible facing.

This structure may not have been ideal in the most ergonomic sense, but it provided a better method of troubleshooting shorts or opens in the circuit.

**This circuit and exercise is yet to be completed

Constructing and Diagnosing Simple Electronic Circuits

Using the 5VDC power supplies/transformers that we constructed during the previous session, we powered various simple circuits to demonstrate and understand Ohm's Law and the practical uses of bread-boarding circuit diagrams before building on a macro scale.

Upon completion of building a simple circuit with an LED and a resistor, Prof. Mason would then create a break in the system and we were tasked with diagnosing and repairing the fault. The purpose was to demonstrate the bane of most electronic circuit failures - no continuity. We were then instructed in the methods and applications of multimeters to check circuits for continuity, resistance, voltage and amperage.

In observing the difference between regulated vs unregulated power supplies, we were assigned with devising a method of using a resistor to create a load on a live circuit and then determining if the total available voltage decreased. In the case of our switching 5VDC power supplies, it did not.

Much magic smoke was released into the atmosphere on this evening.

Finally, to understand variable resistors (potentiometer) and "forward voltage" in LED circuits 

(which Prof. Mason was delighted to explain to me)

the simple circuit below was constructed with a linear potentiometer, a 100 Ohm resistor and a red LED. Consequently, this also demonstrated the logarithmic gain inherent of LEDs.

Soldering Technique and Building and Testing a 5V Power Supply

After first day orientation and a "brief" description of the course, we were shown to the electronics lab room and given soldering kits and assorted electronic parts to practice soldering joints to an electronic wafer.

Once the instructors were comfortable with our understanding of soldering technique (filling the pad, proper use of flux, orientation and mechanical soundness), we moved on to practice parallel butt-joint soldering.

We made a ring of four butt-joints which had to be strong enough that it could not be broken with a moderate amount of manual force. Once we were finished, heat-shrink tubing was used to protect the fresh joints from the elements.



Our final task of the night was to combine the knowledge and techniques gathered from the two previous exercises in order to craft a customized 5V power supply to be used for powering our bread board projects for the rest of our course. A 120VAC-to-5VDC power supply was provided to us and we were tasked with stripping the original proprietary device link and soldering two metal pins in its place (using the aforementioned butt joint soldering technique).