3 ms·

> I dumped the ROM of a Tamagotchi using the code execution ability... I don't understand this. She could execute arbitrary code but couldn't just rip the ROM

• glurgh 13y ago
  There's a presentation of hers from what looks like last year that describes the hoops she's jumped through to try to get ROM dumps http://events.ccc.de/congress/2012/Fahrplan/attachments/2097_Tamagotchi.ppt http://events.ccc.de/congress/2012/Fahrplan/attachments/2097... There are videos of it around, it seems, from various conferences.
• danbruc 13y ago
  The ROM is mask ROM inside the microcontroller and not directly accessible. At first she was only able to modify the content of an external EEPROM for keeping game state connected via I2C and emulate another external (mask) ROM - something like a game cartridge for extending the game - containing mostly images and a single byte triggering additional game logic connected via SPI. Then she found a way to trigger a jump into the LCD RAM by messing with the later ROM and she had already control over the LCD RAM content by modifying the images on that ROM. So finally she used this code execution ability to dump the mask ROM in the microcontroller. I hope I got it right.
  • raldi 13y ago
    Thank you; that was an extremely informative yet concise reply.