Reverse-Engineering Electronic Letter and Number Toys

by B. Ramsey

A few years ago, I bought my young son an electronic letter and number toy that attached magnetically to the refrigerator.

Each letter had a different pattern of pins that uniquely identified it to the magnetic base.  I enjoyed mapping out these patterns, and I tried to anticipate what the entire alphabet was by only examining a few of the letters.  To my surprise, the actual pin patterns were not always intuitive.

I recently introduced this concept as a lab project in my Reverse-Engineering class.  In this lab, the students must reverse-engineer the pin patterns on blocks from electronic letter and number toys.  The students are only given one block and the toy base, from which they must identify the pin patterns of all the remaining blocks.  Students are encouraged to scour the Internet for open-source intelligence as well, from images of the blocks on eBay, to schematic diagrams in patent filings.  This seemingly straightforward activity turns out to be quite rewarding.

Example blocks from four different toys are shown in the image above.  From left to right the blocks are from:

The following are some interesting findings from reverse-engineering pin-out patterns from these four toys.

Farm Animal Mash-Up

This toy comes with 12 blocks, representing the front and rear halves of six different farm animals: pig, cow, horse, sheep, duck, and dog.

These blocks can be combined two at a time to create real animals (such as a pig), or hybrids (such as a duck-horse).  The toy generates the corresponding "oink-oink" or "quack-nay," to the amusement of all.

Each block presses down on a unique subset of four input pins on the block receiver.  A mapping of these pin patterns is shown below.  Only two pins each would have been sufficient to uniquely identify all six animals, so why does the dog block use three?  Is it because a child could too easily press the innermost four pins with their little fingers while handling the toy?  Is this also why a single pin is never used?

	  Front Block
Pig       X X
Cow         X X
Horse     X   X
Sheep       X    X
Duck      X      X
Dog       X   X  X

	  Rear Block
    X X    Pig
  X X      Cow
  X   X    Horse
X   X      Sheep
X     X    Duck
X X   x    Dog

The toy can also be placed in a diagnostic state in which all the audio files play in succession, a fact discovered only after a student spent a long time manipulating all available inputs.  To enter this diagnostic state:

  1. While the toy is off, hold the two block input spots down and the music button down, turn the device on, and then release all three.  A high pitched whistle plays.

  2. Press the music button once.  Static plays.

  3. Press the music button once.  Two beeps play.

  4. Press the music button once.  All audio files play in succession.

Interesting, huh?  And that was the most basic toy...

Lil' Speller Phonics Station

This toy's letter blocks feature subsets of six pins, for a search space of 64 possible combinations.  If the pins present are denoted as ones and the absence of pins as zeros, then the pin pattern can be read in reverse order as binary numbers.

Read this way, the 17 pin-out combinations 000000-010000 are unused, as are the six from 111010-111111.

But, the rest of the pin patterns appear fairly arbitrary.

Why is "A" 100001, "B" 100101, and "C" 101001, but "E" is 100010?

I ask the students if they would have designed the toy this way.  There are also two pin combinations for the letter "R" for some reason!

LeapFrog Fridge Phonics

This toy's blocks also feature subsets of six pins, but they include both letters and the numbers 1-10.

Unlike the Lil' Speller Phonics Station, the pin patterns on this toy tend to follow a predictable binary pattern when read in reverse order.

For example, "A" is 010001, "B" is 010010, and "C" is 010011.

The hidden letter "zed" can also be found.  The reason that "A" begins as 010001 instead of 000001 is that no block uses only a single pin.  Why might that be?

Playskool Sesame Street Cookie Monster's Find and Learn

This is the most challenging of the four toys to investigate.

The block bottoms feature patterns that press a subset of eight buttons, arranged in two rows, on the Cookie Monster base.  Each block can be positioned in four different orientations, with the outward-facing side corresponding to the sound played.

While there are some systematic patterns in the block designs, there are also a lot of arbitrary mappings as well.  The fact that blocks from the Cookie Monster are interchangeable with the Elmo and Big Bird versions adds to the challenge.

When students reverse engineer these toys, they gain insights into how engineers take different approaches to solve similar problems.  There is something thrilling about uncovering how things work in a way that most people never get to, and that is what hacking is all about.
Return to $2600 Index