Monday, 8 December 2014

The revenge of the Super Animal cards

Since my last post:

  1. I've continued tinkering with this a bit.
  2. Woolworths announced this weekend an extra 72-card Christmas themed set, as a special gift too all parents out there who weren't already at their limit because of the first 108 cards that their children "must have".
So it turns out that at least 72 of my generated cards are from this new set. But which ones? What about the rest of the IDs - do they trigger a sound?


Earlier in the week I managed to get a hold of a card reader and took it apart to have a look it how it works.



 The card slot contains an infrared (IR) LED and sensor.

The card reader strip with IR LED and sensor

The LED is turned on by a simple switch when the user starts pulling the card through the slot. As the card continues to pass through, infrared light is reflected off the white parts of the card, but not the black parts and since the plastic behind the card is also white, the only non-reflected portions are the barcode. The micro controller (Mactronix 25L1605D) inside the device receives this information from the IR sensor and interprets the lack of reflections as the barcode.

UPDATE: In my rush to get things done I didn't bother to read the spec sheet. U1 is actually just the flash chip. The big black dot on the board is the micro. This process is called chip-on-board.

I might have to mess with this later...

My boss pointed out that this would be easy to spoof programmatically with an Arduino. Since I already had a couple of boards lying around I started on a simple sketch based on the basic blinking LED example provided by the Arduino team.

Humans can't see infrared light. Most digital cameras (such as the one in your phone) are able to detect the infrared light, so you can use a camera to view it, but I decided it would be easier to just do my development with a regular LED and switch over to and infrared LED later on. Conveniently the Arduino board I decided to use has a LED on the board connected to pin 13.

You can find the code here.

After making sure the lights blinked nicely at a speed that felt similar to swiping a card through the reader, I wired up my bread board. I was a bit lazy laying out the circuit and just chose a 330 Ohm resister I had handy to protect the LED. There's heaps of tutorials on the net about using Ohms law to calculate the resistor value correctly, but...well, I'm pretty lazy and was doing most of this in the 20 min before bed so I pretty much couldn't be bothered.

For the IR LED, I pulled the transmitting part out of a QRD1114 I had lying around.


The program that I uploaded to the Arduino cycles through all ID values starting at 1 and working through to 1023. I found that if I held the card reader's IR sensor over the LED and messed around triggering the switch, I would eventually trigger it at the right time to scan for the barcode and it would play the sound.

So my proof of concept worked. However, in order to improve things, I'd needed a way to trigger the switch programmatically as well - and despite all of the components I've collected over the years I don't own a relay. Time for a trip to Jaycar.

I swung by before work and picked up 2 TRR1A05D00 5 Volt reed relays (always good to have a spare). Wiring these up is pretty easy. I connected PIN 2 on the relay to one of the Arduino digital outputs. I connected PIN 6 of the relay to ground. PINS 14 and 8 get connected to each side of the open switch on the animal card reader.

The whole circuit precariously resting and held together with duct tape

I modified my Arduino sketch to trigger the relay before the barcode is simulated using the IR LED. I messed around with the timing a bit until I managed to get a sound out of the reader. At this point my program was cycling from 181 through to 1023. A few random animal noises later, I finally hear what I've been waiting for:

"Better luck next time"

video

In an American female voice. Success! There is an Easter egg! ID 191 is the Easter egg.

There appear to be additional animals from 181 through to 190 - so maybe there'll be another "special edition" card extension sometime soon.

In the meantime, I look forward to showing my nice what I've found when I see her this week :)

UPDATE: As I was writing this post, I left the program running on the Arduino. A good chunk of the way through I heard a beep and what sounded like a camera shutter sound. I guess I'll have to do a more thorough check at a later date.

6 comments:

  1. Have you considered just dumping that flash chip? Looks like SPI flash from the datasheet so it should be pretty easy to hook up to the Arduino and dump it.

    I'd imagine the sound data is most likely just normal uncompressed PCM audio.

    Awesome to see someone doing this - I've seen the cards and the reader and I had the "I wonder how that works, I'm tempted to buy one just to reverse engineer it"... just haven't had the time recently.

    ReplyDelete
    Replies
    1. Hey Geordie, playing with the board is my next step. I wanted to find out what the main micro was but after discussing it with some guys at work, it seems unlikely that there will be any identifier under the glob. So yeah, that leaves the flash. I plan to dump the contents to file. This would give me a chance to learn about SPI - which as you said appears to be what it's using.

      Thanks for the tip about the audio encoding :)

      Delete
  2. I only got as far as trying to copy one of the cards code onto a piece of paper, and then flipped a bit. I should have kept going by the looks of things!
    Good on you for following through with it!

    ReplyDelete
  3. I do not see the Flyback/Freewheeling diode for the relay on your breadboard. The diode is "used to eliminate flyback, which is the sudden voltage spike seen across an inductive load when its supply voltage is suddenly reduced or removed."

    Every time you connect a relay, you should use a diode to protect the rest of your circuit.

    More info can be obtained from google:
    https://www.google.ca/search?q=freewheeling+diode

    ReplyDelete
    Replies
    1. Hey David, I saw that some of these relays come packaged with a diode but didn't look into it in great detail. Thanks for the name for this though. I'll look into it some more.

      Delete
  4. Perhaps the "Better luck next time" message is part of a competition so that sometime soon they'll give out the 191 cards as a part of a promotion and the person that has the "Congratulations, you've won $1,000,000" message wins $1m worth of shopping :)

    ReplyDelete