iiinova — where your digital self keeps evolving

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

CONFIG1 is pulled up to indicate an alternate mode should be used (i.e. this is a passive converter; this probably only works with DP++). AUX pins are hooked up directly to the EEPROM for I2C, and as expected, WP is pulled high.

110

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

Here's the PCB. Pretty straightforward, it's a bunch of resistors, an I2C EEPROM, a capacitor, and a LED.

110

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

The construction of this thing is fully molded plastic around a PCB, then glued and slid into a metal shell. Disassembly is somewhat destructive, particularly for the plastic.

Bag containing the metal shell and plastics from the plug, plus a loose chip and one of its metal legs separate. The plastic appears chewed up and split in half.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

I did try it and it does work. I was able to dump the EDID data out of it. Unfortunately, the EDID appears to be write-protected.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

Bit different than usual, I got some mini DisplayPort dummy plugs from Amazon for review. I thought I'd try to take one of them apart to see what's inside (usually an EEPROM). www.amazon.ca/dp/B0GX5PD3Y8

Three mini DP dummy plugs in individual bags

Front of one mini DP plug, which has a silver metal shell and is marked "4K UHD"

Back of the plug, which is not marked with anything

One side of the plug, which has a hole for anchoring a lanyard

121

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

It's really just a normal DMC hardware-wise. Nothing to really see here. Software-wise, it looks more like a PenC than a DMC. Firmware is not compatible with any other device because they changed how rendering works again.

The device opened up, with the back shell open next to the front, lengthwise. The rear of the PCB and the battery is visible. The shells and the PCB are all red.

The front of the device with the front shell open next to the back shell, along the other edge. The front of the PCB is visible along with the LCD module.

100

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

I didn't actually bother taking more photos than the front and back of the device. I guess I worked too much overtime and just wanted to get it dumped, and forgot about photographing the other sides.

Back side of the DMC Xros Wars. It's a little reflective but you can see the text molded into the back.

Another view of the back. Less reflective, so the copyright and SKU/manufacturing code can be seen.

100

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

Got my Digimon Color Digimon Xros Wars 15th Edition. Looks the same as any other DMC but with a UV print. I don't care much for Xros Wars and only got this for the firmware, so I only have this one color. The tape seems wider than usual, dunno what's up with that.

101

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

ENG LISH It drives me nuts that the LCD is misaligned compared to the lens, and it wasn't due to my disassembly. I checked a couple of her videos and they're both like this. How did Takara Tomy manage that? Also, these buttons are mushy and terrible.

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the back of the screen assembly. The LCD part number is unfortunately blurry in this photo, but it starts with GD, and has QQ in it, which I've seen a few times with screens used for vpets. Wonder what it stands for. Maybe resolution?

Back of the screen assembly, showing the one-piece construction of the buttons

An attempt at showing the part number on the LCD's flex ribbon

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Taking off the upper three screws removes the front bezel and lens. Taking off the bottom two screws frees the LCD and button assembly. The buttons are secured to the screen assembly, which makes assembly easier. The port in the corner is probably a UART, and below that is a debug port.

The back side of the PCB and also the screen assembly separated

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the main PCB The important parts are the microcontroller, a GeneralPlus GPL95101UB1-002A-QL241. The flash is a Macronix MX25L25645GM2I-08G, which is a whopping 32MB SPI NOR.

Front side of the main PCB of the device

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

After that, you can remove the rear half of the black piece. There's a bracket on each of the left and right sides, one is a motor and the other is the speaker. To take out the main assembly, remove one screw on each side towards the front. The main assembly is mounted vertically, a bit unusual.

Device with sensor layer removed, revealing the PCB and a couple of other peripherals

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

As usual, we open the thing up before trying to use it. After removing the two screws, the top shell is still clipped on. The trick here is to slide your fingernail around the device until it is beside the screen, and pull towards you so the shell starts unclipping. Do this for the other side too.

The device with the top shell removed and sitting beside it

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the battery door open, revealing spaces for an astonishing 4 AAA batteries. Why so much power?

Battery door removed and placed beside the device

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Quick look around. There's also a small leaflet, not shown, probably telling you to look at the full manual online.

Front of the device, which consists of a screen and three buttons (plus a recessed reset button)

The back of the device with an anchor point for lanyards and keychains

The top of the device, which is red, smooth, with a slight matte texture

Bottom of the device, with a battery door and a couple of screw holes

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

I finally managed to get my hands on a Pokemon Friends Pokeball. Box is smaller than expected, and appears to have been retaped (probably at the factory).

Front of the Pokemon Friends Pokeball box, showing the device

Right side of the Pokemon Friends Pokeball box

Left side of the Pokemon Friends Pokeball box

Back of the Pokemon Friends Pokeball box. There's a separate barcode sticker on top of the box

132

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

Here's v. 7 Toho Braves. This one did not give me any trouble.

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

Here's v. 6 Saiyu Warriors. It's got a red PCB. Also they managed to get a bit of glue on the peg holding in the display assembly, so that was a bit of a struggle to get loose so I can dump the flash. Also the little frame on top of the LCD panel fell off.

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

As usual, you get the device, a USB cable, and instruction leaflets inside the box

PenC v.6/7 inner tray, showing the device, USB cable, and leaflet in the back

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

My Pendulum Color ver. 6 and 7 finally arrived, after a week of mysterious movement (thanks Canada Post).

111

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

There is indeed a firmware update. This one is from 2022 instead of 2020. I'm not sure what's changed. The main code probably got rearranged due to the linker, but the data pack seems to be the same as last time.

Punitapichan displaying the version screen in factory test mode

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The inside is basically the same as before. Same slightly weird disassembly, same PCB (the only change appears to be the manufacturing date code), same GeneralPlus GPL95101UB. The 8MB flash is KH branded this time, but the original GeneralPlus brand is just a rebadge of the same chip.

Picture of the main PCB of the Punitapichan

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The device itself looks the same as the original release, except for the battery door, which has a bit of a different design. Instead of a Tapioca illustration, it has uhhhh... FCC notice. Really weird. The SKU is also lasered in instead of molded.

Rear of Punitapichan device, with the new battery door

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

Inside are the device and the manual.

Punitapichan wrapped with a plastic bag in a plastic tray

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The box looks mostly the same as the original, except the right side got replaced with warnings, in both Japanese and English (weird).

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

Finally got some stuff from Japan shipped. For the longest time Japan Post wasn't shipping to Canada. Anyway, it's another Punitapichan, specifically this year's rerelease. I mainly wanted to see if it's got new firmware.

101

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

Interesting new regulation somewhere that requires you to certify that Kaspersky is not installed on the EUT. This filing's factually incorrect with the amount of storage anyway (PAN1026 does not have accessible storage). They fixed it in the latest filing.

Declaration of storage and justification of why Kaspersky is not installed on the Bitzee Hamster Ball

000

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

That explains how the rotor and stator kept orientation, and some of the unpopulated components. Looks like originally they were using IR LEDs to figure synchronize, but they now changed it to a hall effect sensor.

Changelog from Bitzee Hamster Ball schematic V5.42

100

caralynx teardowns @teardowns.caralynx.com · 20/11/2025

I've now got a DFTP client. No upload/download yet, going to figure that out soon.

INFO and LIST commands and responses using DFTP on the LeapMove

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

I guess I got a little over-ambitious trying to connect all six SD signal lines, and managed to rip the trace off one line (not the whole thing, just from the chip to the edge of the solder mask. Ended up just using 1-bit I/O and the dumping went OK. Fixed the trace afterwards.

PCB with trace missing on pin 80 (by the white silkscreen mark in the middle)

PCB with enamel wire repairing the trace

110

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

Main chips on the circuit board: GeneralPlus GPA7650A-C03A-QLM71 Cortex-A7 SoC which can probably run up to 666MHz, and Kioxia THGBMTG5D1LBAIL, a 4GB eMMC flash chip that I don't have the equipment for resoldering (WFBGA153).

Front of the circuit board showing the main chips and connectors

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

It's actually pretty spartan inside. Main circuit board with attached button board and a camera assembly, that's it. The camera assembly can twist to remove from the shell.

Bottom of the device with the cover removed, revealing the circuit boards

The shell with the circuit boards and the camera assembly removed

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

There's a folding clamp on the bottom so you can use it to prop the device up on the top of the TV. Under the rubber pad are four screws. These are the wrong screws. Unfold the clamp to reveal the actual screws to take out.

Bottom of the device with the clamp unfolded

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

Not much to say about the device itself. It's a box with a camera/shutter on the front, a knob for angling the camera, and a USB port and HDMI port on the back.

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

Just the device, cables, and some literature inside. I didn't bother taking the cables out because apparently I need to cut some tape and get in from the bottom.

100

caralynx teardowns @teardowns.caralynx.com · 16/11/2025

Today's item: LeapFrog LeapMove. I saw this last week at Walmart, and this week after visiting the Lab Tama, I decided I might as well pick it up.

131

caralynx teardowns @teardowns.caralynx.com · 10/11/2025

Dumped the other bits of the main flash, and also dumped the Cortex-M0+ microcontroller. Thankfully RDP was not enabled. I ended up stringing wires in a kludgy way like this because I didn't have the correct pitch header.

Dupont wires plugged into a header with stranded wires soldered to it. The other end of the stranded wires are soldered to thin solid-core wires, which are hooked into the rotor board's SWD header holes.

100

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

There's now a ton of bits on my bed. I'm going to dump the flash (probably requires desoldering), then try to figure out how I can dump the bootrom from the microcontroller (really wish I have the ICE protocol figured out), then try to find the correct header to see if I can dump the ARM micro.

Various parts of the hamster ball strewn across my bed, along with some screwdrivers and a camera

110

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

For some reason Spin Master decided that they didn't need long-term confidentiality on their FCC filings, so here's the schematics to the device.

110

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

And well this is interesting. There's a Puya PY32F030K2U6-E Cortex M0+ microcontroller, and the same PAN1026. So this makes it fairly clear what's going on. Instead of the traditional rotor/stator system with multiple data brushes, it transmits the display data wirelessly.

120

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

Continuing on, I opened the front as well. There's the display arm secured with two screws. There's a spring attached to the board, presumably for power.

120

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

Here's a closer look at the PCB. Of note, it has the microcontroller name written right on it, so I don't have to guess what chip it was (I would have guessed the same chip as the original Bitzee, though this one is a GPCE500 whereas I think the original was a GPCE200 or something).

110

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

Four screws off, and the back lifts off easily. Interesting to note a PTC thermistor attached to the battery terminal. Makes sense since there's a motor in there.

The rear of the ball opened, showing a PCB, some wires, and a toothed wheel

100

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

It has a full FCC ID. Wonder what that's all about

110

caralynx teardowns @teardowns.caralynx.com · 09/11/2025

It's not a nightmare to open like the original Bitzee retail box, but there's still some plastic locks. That secures a plastic stand, which becomes waste. It comes with a proper stand.

First layer of stuff after opening the box: a notice to power cycle to take it out of demo mode

Second layer of stuff: a quick start guide and instruction sheet

Two plastic locks keeping the ball locked to the packaging

110