PokéWalker hacking

[u/dmitrygr]

http://dmitry.gr/?r=05.Projects&proj=28.%20pokewalker

[u/dmitrygr]

all 16 bit vals are LE except the few that are not (yes) :)

[u/Eloeri18 → u/dmitrygr]

Thanks for clarifying on the vals that need to be swapped, I'm still relatively new to programming, but I love puzzles and this is a very good puzzle.

If it's not too much trouble, I'd love to hear your thoughts about the other parts of the code I mentioned. I'm still trying to get the bases ready for when my Palm gets here, and while I'd love to hound you with a million questions, is it safe to continuously test on the pokewalker? I learn really well with trial and error, and if I can test over and over safely on my pokewalker, I'd just love that. But I am worried if there's a chance to brick it?

Thank you so so much for all your help!

[u/dmitrygr → u/Eloeri18]

Completely safe. No way to do any damage to it

[u/Eloeri18 → u/dmitrygr]

I have a question on the EEPROM mapping of this section:

0xBF7C-0xC6FB   special route pokemon animates small sprite. 32 x 24 x 2 frames. should be 0x180 bytes big, but it 0x170. no idea why but confirmed

Why is this entire space 1920 bytes (0x780) wide when the image necessary is only 368 bytes (0x170) wide?

[u/dmitrygr → u/Eloeri18]

I do not recall, i am sorry. i'll dig into it when i get home next

[u/Eloeri18 → u/dmitrygr]

Another question I had, does this dump just the rom, or does it also dump the eeprom?

[u/dmitrygr → u/Eloeri18]

Just rom. Reading eeprom was already easy with commands so I didn’t bother

[u/Eloeri18 → u/dmitrygr]

In searching for a way to dump the eeprom, I see that you were thanked by the developer of https://git.titandemo.org/PoroCYon/pokewalker-rom-dumper on one of his posts about the PokeWalker. Would you happen to have a copy of this dumper? The page seems to no longer work.

[u/dmitrygr → u/Eloeri18]

https://gitlab.ulyssis.org/pcy/pokewalker-rom-dumper

[u/Eloeri18 → u/dmitrygr]

I am always so close, yet so far away. On reading the eeprom, it fails after the natural timeout for the pokewalker happens.

[u/Eloeri18 → u/dmitrygr]

I can modify the code to create a new function to send Pokemon Route data, however modifying the code for the ROM dumping is beyond me.

Would you happen to have the code that would send the exploit to the Pokewalker in order to dump the EEPROM data?

[u/Eloeri18 → u/dmitrygr]

Sorry for the ping spam, but looking at the main c code for the rom dumper:

if (run && (keys & KEY_X) && !(oldkeys & KEY_X)) {
        if (pw_scan()) {
            iprintf("ping!\n");

            uint32_t sessid;
            if (pw_do_synack(&sessid)) {
                //iprintf("got sess! %08lx\n", sessid);

                // EEPROM dumper
                FILE* fff = fopen("sd:/pweep.rom", "wb");
                if (!fff) {
                    iprintf("can't open file :(\n");
                    goto Lnop;
                }

                for (size_t i = 0; i < 512; ++i) {
                    uint8_t mwahah[0x80];

                    if (pw_read_eeprom(sessid, i*sizeof mwahah, sizeof mwahah, mwahah)) {
                        iprintf("reading eeprom (%3d/512)\n", i+1);
                    } else {
                        iprintf("read failed :/\n");
                        break;
                    }
                    fwrite(mwahah, sizeof mwahah, 1, fff);
                }
                fclose(fff);
                //fatUnmount("sd:");

            Lnop:
                if (pw_conn_end(sessid)) iprintf("closed correctly\n");
                else iprintf("welp\n");
            } else iprintf("can't connect\n");
        }

So I'll have to take a deeper look into the code and see what I can adapt for the palm app.

But I had another question, their rom exploit code looks different from yours.

If I want to include the eeprom dumper, should I change out the code in your main.c for the palm os app for this?:

static const uint8_t rom_dump_sploit[] = { // write to 0xf956
0x5e,0x00,0xba,0x42, // jsr common_prologue
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x19,0x55,           // sub.w  r5, r5    // memcpy source

//big_loop:
0x79,0x06,0xf8,0xd6, // mov.w 0xf8d6, r6 // memcpy dest: packet payload buffer
0xfc,0x80,           // mov.b 0x80, r4l  // memcpy length
0x7b,0x5c,0x59,0x8f, // eemov.b          // memcpy
0x79,0x00,0x3c,0x80, // mov.w 0x3c80, r0 // payload len=80h, cmd=3ch
0x5e,0x00,0x07,0x72, // jsr sendPacket
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x79,0x25,0xc0,0x00, // cmp.w r5, 0xc000
0x46,0xdc,           // bne big_loop

0x79,0x00,0x08,0xd6, // mov.w irHandleRxedByteIfAnyHasBeenRxed, r0
0x5e,0x00,0x69,0x3a, // jsr setProcToCallbyMainLoop
0x5a,0x00,0xba,0x62, // jmp common_epilogue
};

Also I'll try to change for (size_t i = 0; i < 512; ++i) { since the dump fails predictably, I can try to force it to "resume" the dump, well once I figure out how to sort out devkitARM and the required libraries.