caralynx teardowns
@teardowns.caralynx.com
Hack all the toys. Teardowns and analysis of various toys and electronics by @sudo.caralynx.com
Interesting new regulation somewhere that requires you to certify that Kaspersky is not installed on the EUT. This filing's factually incorrect with the amount of storage anyway (PAN1026 does not have accessible storage). They fixed it in the latest filing.
November 24, 2025 at 12:57 AM
Interesting new regulation somewhere that requires you to certify that Kaspersky is not installed on the EUT. This filing's factually incorrect with the amount of storage anyway (PAN1026 does not have accessible storage). They fixed it in the latest filing.
That explains how the rotor and stator kept orientation, and some of the unpopulated components. Looks like originally they were using IR LEDs to figure synchronize, but they now changed it to a hall effect sensor.
November 24, 2025 at 12:51 AM
That explains how the rotor and stator kept orientation, and some of the unpopulated components. Looks like originally they were using IR LEDs to figure synchronize, but they now changed it to a hall effect sensor.
I've now got a DFTP client. No upload/download yet, going to figure that out soon.
November 20, 2025 at 2:27 AM
I've now got a DFTP client. No upload/download yet, going to figure that out soon.
I guess I got a little over-ambitious trying to connect all six SD signal lines, and managed to rip the trace off one line (not the whole thing, just from the chip to the edge of the solder mask. Ended up just using 1-bit I/O and the dumping went OK. Fixed the trace afterwards.
November 16, 2025 at 9:40 PM
I guess I got a little over-ambitious trying to connect all six SD signal lines, and managed to rip the trace off one line (not the whole thing, just from the chip to the edge of the solder mask. Ended up just using 1-bit I/O and the dumping went OK. Fixed the trace afterwards.
Main chips on the circuit board: GeneralPlus GPA7650A-C03A-QLM71 Cortex-A7 SoC which can probably run up to 666MHz, and Kioxia THGBMTG5D1LBAIL, a 4GB eMMC flash chip that I don't have the equipment for resoldering (WFBGA153).
November 16, 2025 at 3:47 AM
Main chips on the circuit board: GeneralPlus GPA7650A-C03A-QLM71 Cortex-A7 SoC which can probably run up to 666MHz, and Kioxia THGBMTG5D1LBAIL, a 4GB eMMC flash chip that I don't have the equipment for resoldering (WFBGA153).
It's actually pretty spartan inside. Main circuit board with attached button board and a camera assembly, that's it. The camera assembly can twist to remove from the shell.
November 16, 2025 at 3:47 AM
It's actually pretty spartan inside. Main circuit board with attached button board and a camera assembly, that's it. The camera assembly can twist to remove from the shell.
There's a folding clamp on the bottom so you can use it to prop the device up on the top of the TV. Under the rubber pad are four screws. These are the wrong screws. Unfold the clamp to reveal the actual screws to take out.
November 16, 2025 at 3:47 AM
There's a folding clamp on the bottom so you can use it to prop the device up on the top of the TV. Under the rubber pad are four screws. These are the wrong screws. Unfold the clamp to reveal the actual screws to take out.
Not much to say about the device itself. It's a box with a camera/shutter on the front, a knob for angling the camera, and a USB port and HDMI port on the back.
November 16, 2025 at 3:47 AM
Not much to say about the device itself. It's a box with a camera/shutter on the front, a knob for angling the camera, and a USB port and HDMI port on the back.
Just the device, cables, and some literature inside. I didn't bother taking the cables out because apparently I need to cut some tape and get in from the bottom.
November 16, 2025 at 3:47 AM
Just the device, cables, and some literature inside. I didn't bother taking the cables out because apparently I need to cut some tape and get in from the bottom.
Today's item: LeapFrog LeapMove. I saw this last week at Walmart, and this week after visiting the Lab Tama, I decided I might as well pick it up.
November 16, 2025 at 3:47 AM
Today's item: LeapFrog LeapMove. I saw this last week at Walmart, and this week after visiting the Lab Tama, I decided I might as well pick it up.
Dumped the other bits of the main flash, and also dumped the Cortex-M0+ microcontroller. Thankfully RDP was not enabled. I ended up stringing wires in a kludgy way like this because I didn't have the correct pitch header.
November 10, 2025 at 3:01 AM
Dumped the other bits of the main flash, and also dumped the Cortex-M0+ microcontroller. Thankfully RDP was not enabled. I ended up stringing wires in a kludgy way like this because I didn't have the correct pitch header.
There's now a ton of bits on my bed. I'm going to dump the flash (probably requires desoldering), then try to figure out how I can dump the bootrom from the microcontroller (really wish I have the ICE protocol figured out), then try to find the correct header to see if I can dump the ARM micro.
November 9, 2025 at 7:49 PM
There's now a ton of bits on my bed. I'm going to dump the flash (probably requires desoldering), then try to figure out how I can dump the bootrom from the microcontroller (really wish I have the ICE protocol figured out), then try to find the correct header to see if I can dump the ARM micro.
For some reason Spin Master decided that they didn't need long-term confidentiality on their FCC filings, so here's the schematics to the device.
November 9, 2025 at 7:46 PM
For some reason Spin Master decided that they didn't need long-term confidentiality on their FCC filings, so here's the schematics to the device.
And well this is interesting. There's a Puya PY32F030K2U6-E Cortex M0+ microcontroller, and the same PAN1026. So this makes it fairly clear what's going on. Instead of the traditional rotor/stator system with multiple data brushes, it transmits the display data wirelessly.
November 9, 2025 at 7:40 PM
And well this is interesting. There's a Puya PY32F030K2U6-E Cortex M0+ microcontroller, and the same PAN1026. So this makes it fairly clear what's going on. Instead of the traditional rotor/stator system with multiple data brushes, it transmits the display data wirelessly.
Continuing on, I opened the front as well. There's the display arm secured with two screws. There's a spring attached to the board, presumably for power.
November 9, 2025 at 7:40 PM
Continuing on, I opened the front as well. There's the display arm secured with two screws. There's a spring attached to the board, presumably for power.
Here's a closer look at the PCB. Of note, it has the microcontroller name written right on it, so I don't have to guess what chip it was (I would have guessed the same chip as the original Bitzee, though this one is a GPCE500 whereas I think the original was a GPCE200 or something).
November 9, 2025 at 7:40 PM
Here's a closer look at the PCB. Of note, it has the microcontroller name written right on it, so I don't have to guess what chip it was (I would have guessed the same chip as the original Bitzee, though this one is a GPCE500 whereas I think the original was a GPCE200 or something).
Four screws off, and the back lifts off easily. Interesting to note a PTC thermistor attached to the battery terminal. Makes sense since there's a motor in there.
November 9, 2025 at 7:40 PM
Four screws off, and the back lifts off easily. Interesting to note a PTC thermistor attached to the battery terminal. Makes sense since there's a motor in there.
It takes three AA batteries
November 9, 2025 at 7:40 PM
It takes three AA batteries
It has a full FCC ID. Wonder what that's all about
November 9, 2025 at 7:40 PM
It has a full FCC ID. Wonder what that's all about
A quick look around
November 9, 2025 at 7:40 PM
A quick look around
It's not a nightmare to open like the original Bitzee retail box, but there's still some plastic locks. That secures a plastic stand, which becomes waste. It comes with a proper stand.
November 9, 2025 at 7:40 PM
It's not a nightmare to open like the original Bitzee retail box, but there's still some plastic locks. That secures a plastic stand, which becomes waste. It comes with a proper stand.
I finally bought something non-Tamagotchi. It's a Bitzee Hamster Ball.
November 9, 2025 at 7:40 PM
I finally bought something non-Tamagotchi. It's a Bitzee Hamster Ball.
Here you can see the firmware dates. The ROM is different from the other DMCs, so you cannot just put the flash from this on to another DMC. The flash date is interesting in that it's a couple of months after the ROM date, which seems oddly long.
March 26, 2025 at 1:24 AM
Here you can see the firmware dates. The ROM is different from the other DMCs, so you cannot just put the flash from this on to another DMC. The flash date is interesting in that it's a couple of months after the ROM date, which seems oddly long.