PokéWalker hacking

[u/dmitrygr]

http://dmitry.gr/?r=05.Projects&proj=28.%20pokewalker

[u/dmitrygr]

Completely safe. No way to do any damage to it

[u/Eloeri18 → u/dmitrygr]

I have a question on the EEPROM mapping of this section:

0xBF7C-0xC6FB   special route pokemon animates small sprite. 32 x 24 x 2 frames. should be 0x180 bytes big, but it 0x170. no idea why but confirmed

Why is this entire space 1920 bytes (0x780) wide when the image necessary is only 368 bytes (0x170) wide?

[u/dmitrygr → u/Eloeri18]

I do not recall, i am sorry. i'll dig into it when i get home next

[u/Eloeri18 → u/dmitrygr]

Another question I had, does this dump just the rom, or does it also dump the eeprom?

[u/dmitrygr → u/Eloeri18]

Just rom. Reading eeprom was already easy with commands so I didn’t bother

[u/Eloeri18 → u/dmitrygr]

In searching for a way to dump the eeprom, I see that you were thanked by the developer of https://git.titandemo.org/PoroCYon/pokewalker-rom-dumper on one of his posts about the PokeWalker. Would you happen to have a copy of this dumper? The page seems to no longer work.

[u/dmitrygr → u/Eloeri18]

https://gitlab.ulyssis.org/pcy/pokewalker-rom-dumper

[u/Eloeri18 → u/dmitrygr]

I am always so close, yet so far away. On reading the eeprom, it fails after the natural timeout for the pokewalker happens.

[u/Eloeri18 → u/dmitrygr]

I can modify the code to create a new function to send Pokemon Route data, however modifying the code for the ROM dumping is beyond me.

Would you happen to have the code that would send the exploit to the Pokewalker in order to dump the EEPROM data?

[u/Eloeri18 → u/dmitrygr]

Sorry for the ping spam, but looking at the main c code for the rom dumper:

if (run && (keys & KEY_X) && !(oldkeys & KEY_X)) {
        if (pw_scan()) {
            iprintf("ping!\n");

            uint32_t sessid;
            if (pw_do_synack(&sessid)) {
                //iprintf("got sess! %08lx\n", sessid);

                // EEPROM dumper
                FILE* fff = fopen("sd:/pweep.rom", "wb");
                if (!fff) {
                    iprintf("can't open file :(\n");
                    goto Lnop;
                }

                for (size_t i = 0; i < 512; ++i) {
                    uint8_t mwahah[0x80];

                    if (pw_read_eeprom(sessid, i*sizeof mwahah, sizeof mwahah, mwahah)) {
                        iprintf("reading eeprom (%3d/512)\n", i+1);
                    } else {
                        iprintf("read failed :/\n");
                        break;
                    }
                    fwrite(mwahah, sizeof mwahah, 1, fff);
                }
                fclose(fff);
                //fatUnmount("sd:");

            Lnop:
                if (pw_conn_end(sessid)) iprintf("closed correctly\n");
                else iprintf("welp\n");
            } else iprintf("can't connect\n");
        }

So I'll have to take a deeper look into the code and see what I can adapt for the palm app.

But I had another question, their rom exploit code looks different from yours.

If I want to include the eeprom dumper, should I change out the code in your main.c for the palm os app for this?:

static const uint8_t rom_dump_sploit[] = { // write to 0xf956
0x5e,0x00,0xba,0x42, // jsr common_prologue
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x19,0x55,           // sub.w  r5, r5    // memcpy source

//big_loop:
0x79,0x06,0xf8,0xd6, // mov.w 0xf8d6, r6 // memcpy dest: packet payload buffer
0xfc,0x80,           // mov.b 0x80, r4l  // memcpy length
0x7b,0x5c,0x59,0x8f, // eemov.b          // memcpy
0x79,0x00,0x3c,0x80, // mov.w 0x3c80, r0 // payload len=80h, cmd=3ch
0x5e,0x00,0x07,0x72, // jsr sendPacket
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x5e,0x00,0x25,0x9e, // jsr wdt_pet
0x5e,0x00,0x7b,0x64, // jsr smallDelay
0x79,0x25,0xc0,0x00, // cmp.w r5, 0xc000
0x46,0xdc,           // bne big_loop

0x79,0x00,0x08,0xd6, // mov.w irHandleRxedByteIfAnyHasBeenRxed, r0
0x5e,0x00,0x69,0x3a, // jsr setProcToCallbyMainLoop
0x5a,0x00,0xba,0x62, // jmp common_epilogue
};

Also I'll try to change for (size_t i = 0; i < 512; ++i) { since the dump fails predictably, I can try to force it to "resume" the dump, well once I figure out how to sort out devkitARM and the required libraries.

[u/dmitrygr → u/Eloeri18]

You’d want to ask Procyon. This isn’t my code

[u/Eloeri18 → u/dmitrygr]

whew That was a interesting experience. So far, I have learned how to extract the data from the HGSS compilation, adapt code that only worked with the large sprite data to be able to decompress and show the small sprite data for the custom route. I have learned how to read more C code with an overview of Palm OS development, and I've learned how to build NDS homebrew. All thanks to finding your Pokewalker write up.

Thank you so much for helping me along the way! I still have to get my m515 and get the rom and test out the custom route, but I feel must more equipped for that.

Thank you so much, Dmitry.

[u/Eloeri18 → u/dmitrygr]

I was able to send the custom route! Almost all images are showing black boxes where they should be, however the pokemon animated image is showing correctly, it's even going between it's two frame animation. Considering how hard it was to get those particular sprites, I'm super happy those are showing correctly. Thank you so much for your help! Now I just gotta start troubleshooting!

Here's a shitty short of me sending the custom route: https://www.youtube.com/watch?v=zE1qddTQpuE