iiinova — where your digital self keeps evolving

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

So at some point I'll get to the Tamagotchis again. Probably after I mess around with the PixTube more, which I did take photos of and I'm in the process of trying to dump its sprites (which I have tools for since it's the same engine as Punirunes, but locating associated data is a chore).

000

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

BTW, I've mentioned that I have the second and third wave Tamagotchi Paradise to tear down. I still need to do that. I was holding off until a tripod accessory I ordered arrived, and that took a month, but when it arrived it worked poorly and I got frustrated and gave up.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

However, it's connected to the HPD pin, so if you have a mini DP breakout board, you can tie that pin to ground and it should allow you to reprogram it.

000

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

CONFIG1 is pulled up to indicate an alternate mode should be used (i.e. this is a passive converter; this probably only works with DP++). AUX pins are hooked up directly to the EEPROM for I2C, and as expected, WP is pulled high.

110

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

Here's the PCB. Pretty straightforward, it's a bunch of resistors, an I2C EEPROM, a capacitor, and a LED.

110

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

The plastic also pulled the EEPROM chip off, and when I tried to free the chip itself the plastic flexed and twisted the chip's legs sideways, resulting in them getting mangled and a couple coming off. So if you want to disassemble this, be careful.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

The construction of this thing is fully molded plastic around a PCB, then glued and slid into a metal shell. Disassembly is somewhat destructive, particularly for the plastic.

Bag containing the metal shell and plastics from the plug, plus a loose chip and one of its metal legs separate. The plastic appears chewed up and split in half.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

I did try it and it does work. I was able to dump the EDID data out of it. Unfortunately, the EDID appears to be write-protected.

100

caralynx teardowns @teardowns.caralynx.com · 10/08/2026

Bit different than usual, I got some mini DisplayPort dummy plugs from Amazon for review. I thought I'd try to take one of them apart to see what's inside (usually an EEPROM). www.amazon.ca/dp/B0GX5PD3Y8

Three mini DP dummy plugs in individual bags

Front of one mini DP plug, which has a silver metal shell and is marked "4K UHD"

Back of the plug, which is not marked with anything

One side of the plug, which has a hole for anchoring a lanyard

121

caralynx teardowns @teardowns.caralynx.com · 03/06/2026

Sprites are banked in a way where there's several copies of the sprite pack spread across different banks, and there's repeated assets so common sprites can be accessed without having to give them new IDs. Bit of a waste of space, but whatever.

000

caralynx teardowns @teardowns.caralynx.com · 03/06/2026

I think I forgot to follow up since I lost interest rather quickly in this (the gameplay is not very good), but the sprite format is roughly the same as modern Tamagotchis, however I don't think they are using the rest of the engine with all the animation formats and stuff.

100

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

Evolution guides and manual here. Took a bit longer than last time to figure out due to the new features and previously mentioned overtime, but it's done. bsky.app/profile/humu...

010

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

It's really just a normal DMC hardware-wise. Nothing to really see here. Software-wise, it looks more like a PenC than a DMC. Firmware is not compatible with any other device because they changed how rendering works again.

The device opened up, with the back shell open next to the front, lengthwise. The rear of the PCB and the battery is visible. The shells and the PCB are all red.

The front of the device with the front shell open next to the back shell, along the other edge. The front of the PCB is visible along with the LCD module.

100

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

I didn't actually bother taking more photos than the front and back of the device. I guess I worked too much overtime and just wanted to get it dumped, and forgot about photographing the other sides.

Back side of the DMC Xros Wars. It's a little reflective but you can see the text molded into the back.

Another view of the back. Less reflective, so the copyright and SKU/manufacturing code can be seen.

100

caralynx teardowns @teardowns.caralynx.com · 05/03/2026

Got my Digimon Color Digimon Xros Wars 15th Edition. Looks the same as any other DMC but with a UV print. I don't care much for Xros Wars and only got this for the firmware, so I only have this one color. The tape seems wider than usual, dunno what's up with that.

101

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

ENG LISH It drives me nuts that the LCD is misaligned compared to the lens, and it wasn't due to my disassembly. I checked a couple of her videos and they're both like this. How did Takara Tomy manage that? Also, these buttons are mushy and terrible.

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

As usual, flash dumped. I'm not sure which engine this is using at a glance, but probably the one in Punitapi-chan (some of the sound effects seem identical). I don't think they're actually using the full 32MB of flash in the base firmware, but maybe they are using it for the journal.

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the back of the screen assembly. The LCD part number is unfortunately blurry in this photo, but it starts with GD, and has QQ in it, which I've seen a few times with screens used for vpets. Wonder what it stands for. Maybe resolution?

Back of the screen assembly, showing the one-piece construction of the buttons

An attempt at showing the part number on the LCD's flex ribbon

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Taking off the upper three screws removes the front bezel and lens. Taking off the bottom two screws frees the LCD and button assembly. The buttons are secured to the screen assembly, which makes assembly easier. The port in the corner is probably a UART, and below that is a debug port.

The back side of the PCB and also the screen assembly separated

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Also notable is an AnalogTek AT8568S, which is an RTC. Not sure why there's a separate one because the GPL951 has one built in, with generally amazing accuracy. Maybe for interrupts?

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the main PCB The important parts are the microcontroller, a GeneralPlus GPL95101UB1-002A-QL241. The flash is a Macronix MX25L25645GM2I-08G, which is a whopping 32MB SPI NOR.

Front side of the main PCB of the device

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

After that, you can remove the rear half of the black piece. There's a bracket on each of the left and right sides, one is a motor and the other is the speaker. To take out the main assembly, remove one screw on each side towards the front. The main assembly is mounted vertically, a bit unusual.

Device with sensor layer removed, revealing the PCB and a couple of other peripherals

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

The top layer has a number of capacitive pads, and is held in place by two screws. There's not much slack on those wires, so the assembly kind of hangs off and gets in the way.

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

As usual, we open the thing up before trying to use it. After removing the two screws, the top shell is still clipped on. The trick here is to slide your fingernail around the device until it is beside the screen, and pull towards you so the shell starts unclipping. Do this for the other side too.

The device with the top shell removed and sitting beside it

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Here's the battery door open, revealing spaces for an astonishing 4 AAA batteries. Why so much power?

Battery door removed and placed beside the device

120

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

Quick look around. There's also a small leaflet, not shown, probably telling you to look at the full manual online.

Front of the device, which consists of a screen and three buttons (plus a recessed reset button)

The back of the device with an anchor point for lanyards and keychains

The top of the device, which is red, smooth, with a slight matte texture

Bottom of the device, with a battery door and a couple of screw holes

110

caralynx teardowns @teardowns.caralynx.com · 27/02/2026

I finally managed to get my hands on a Pokemon Friends Pokeball. Box is smaller than expected, and appears to have been retaped (probably at the factory).

Front of the Pokemon Friends Pokeball box, showing the device

Right side of the Pokemon Friends Pokeball box

Left side of the Pokemon Friends Pokeball box

Back of the Pokemon Friends Pokeball box. There's a separate barcode sticker on top of the box

132

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

BTW I managed to find the western release at Barnes and Noble, and according to the box everything is still in Japanese. Only the instructions are in English.

000

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

All of the data mining was done a couple of days after the devices released, and now that I've got mine, I've updated the hash checker accordingly. The new versions are also supported in the sprite tool.

010

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

Here's v. 7 Toho Braves. This one did not give me any trouble.

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

Here's v. 6 Saiyu Warriors. It's got a red PCB. Also they managed to get a bit of glue on the peg holding in the display assembly, so that was a bit of a struggle to get loose so I can dump the flash. Also the little frame on top of the LCD panel fell off.

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

As usual, you get the device, a USB cable, and instruction leaflets inside the box

PenC v.6/7 inner tray, showing the device, USB cable, and leaflet in the back

110

caralynx teardowns @teardowns.caralynx.com · 23/01/2026

My Pendulum Color ver. 6 and 7 finally arrived, after a week of mysterious movement (thanks Canada Post).

111

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

Misspoke about the warning panel on the right side of the box. It's actually Chinese and English.

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

I guess the only thing left is to play it and see if there's anything different.

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

There is indeed a firmware update. This one is from 2022 instead of 2020. I'm not sure what's changed. The main code probably got rearranged due to the linker, but the data pack seems to be the same as last time.

Punitapichan displaying the version screen in factory test mode

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The inside is basically the same as before. Same slightly weird disassembly, same PCB (the only change appears to be the manufacturing date code), same GeneralPlus GPL95101UB. The 8MB flash is KH branded this time, but the original GeneralPlus brand is just a rebadge of the same chip.

Picture of the main PCB of the Punitapichan

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

FWIW if I'd have bought this sooner, I would have noticed that the text probably meant a US release, which did happen. You can buy Puni Boba-chan at Barnes & Noble. Still, I don't understand why there's FCC text on the Japanese version. Surely the US SKU is different?

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The device itself looks the same as the original release, except for the battery door, which has a bit of a different design. Instead of a Tapioca illustration, it has uhhhh... FCC notice. Really weird. The SKU is also lasered in instead of molded.

Rear of Punitapichan device, with the new battery door

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

Inside are the device and the manual.

Punitapichan wrapped with a plastic bag in a plastic tray

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

The box looks mostly the same as the original, except the right side got replaced with warnings, in both Japanese and English (weird).

100

caralynx teardowns @teardowns.caralynx.com · 11/12/2025

Finally got some stuff from Japan shipped. For the longest time Japan Post wasn't shipping to Canada. Anyway, it's another Punitapichan, specifically this year's rerelease. I mainly wanted to see if it's got new firmware.

101

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

Interesting new regulation somewhere that requires you to certify that Kaspersky is not installed on the EUT. This filing's factually incorrect with the amount of storage anyway (PAN1026 does not have accessible storage). They fixed it in the latest filing.

Declaration of storage and justification of why Kaspersky is not installed on the Bitzee Hamster Ball

000

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

I guess that solution's fine, but the force of the rotating arm is probably throwing the accelerometer off a bit and not making the orientation of the screen totally stable.

100

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

That explains how the rotor and stator kept orientation, and some of the unpopulated components. Looks like originally they were using IR LEDs to figure synchronize, but they now changed it to a hall effect sensor.

Changelog from Bitzee Hamster Ball schematic V5.42

100

caralynx teardowns @teardowns.caralynx.com · 24/11/2025

The FCC Equipment Authorization Electronic System is finally back online, and I'm downloading the exhibits. Looks like there's a third ID for the hamster ball filed recently. Meanwhile, I found the third page to the schematics that I was wondering about in the original filing. It's a changelog.

100

caralynx teardowns @teardowns.caralynx.com · 20/11/2025

The client syncs app installation status with the web service, but it doesn't seem to acknowledge any extra apps that are not licensed. It just doesn't report on it for some reason.

000

caralynx teardowns @teardowns.caralynx.com · 20/11/2025

They were nice enough to leave in Mbed TLS' testing functions that obviously identified the cipher family. The LDI file is generated by the web service, so theoretically there's nothing to hack on the client, but the system app is easy to locate and download, so that didn't really stop anything.

100

caralynx teardowns @teardowns.caralynx.com · 20/11/2025

The LDI file is pretty simple, it's just a comma-separated list of package IDs bookended by header and footer strings, encrypted with AES-256-CBC. The key is the SHA-256 hash of the device serial and a static string, and the IV is another static value.

100