Tuesday 2 December 2014

Super Reverse Engineering Animal Cards

I spent the afternoon last Sunday reverse engineering the barcodes on these after helping my niece and nephew sort through the horde of them my partner and I had collected from Woolworths.

There are 108 cards in the set and each one has a unique bar code on the back. You can buy a sound card reader accessory that reads the barcode as it is swiped and plays an audio file for the specific animal on the card.



From initial inspection of a few of the cards, I worked out that there were 13 bits in the code and the top (as in top of the card - the last three to pass through the reader) 3 bits were the same for a bunch of the cards. There were only ever two combinations of these bits - 0b101 and 0b011. The remaining 10 bits are used for the ID of the card. Card number 1 is 0b0000000001, card number 2 is 0b0000000010 and so on.

I immediately realised there were way more bits than required for the 108 cards in the set and wondered if they were mapped to anything. I recently listened to an Embedded Podcast where Elecia White interviewed Jeri Ellsworth. They spoke about putting Easter eggs in their embedded product and this made me wonder if the developers of the Super Animals card reader toy decided to do the same thing.

So I explained to my 10 year old niece what I was thinking. She was initially skeptical, but we decided to have a go making a paper barcode with the next number in the series. Since I didn't know what the top 3 bits were, we just copied them from one off the other cards and encoded 109 in the 10 ID bits. I explained that binary encoding was similar to the 1's, 10's 100's columns of decimal numbers that they learn in school, except that there were only possible values in each column - 0 and 1 instead of 0 to 9 like in the decimal system. 

We swiped the hand drawn card through the reader. It didn't work.

At this point my niece wasn't overly impressed, but unperturbed I suggested that we try one of the cards in the set that they were missing. We chose card number 18 in the series. I went through the same procedure (using the same top 3 bits), this time encoding 18 in binary instead of the 109 we had just tried.

Success! Chirping bird noises! We checked the list of cards and indeed number 18 is a bird.


So now my niece was convinced I wasn't just making things up, but we had run out of time. I had to go home, but those last three bits continued to bother me so I kept working on the problem there.

I messed around with some 3 bit CRC calculations before I realised that there was no way I could only ever get only 2 combinations like on the cards. I stopped thinking about the 3 bits as a single checksum and saw that the last bit was probably a stop bit, which would make sense for a swipe barcode reader.

I had earlier decided that even or odd parity didn't make sense as I had three bits to deal with, not one. However after a bit more messing around, it finally dawned on me that the other two bits were probably even and odd parity since one was always the inverse of the other.

I had taken photos of all of the cards, so to confirm the parity theory, I used these to make a table of card IDs and 3 bit values. I wrote a quick C++ program to spit out a similar list and diffed the files. Perfect match.

Armed with the ability to generate my own barcodes, I decided to write a Qt program to render these to pdf so that I could print them out and go hunting for Easter eggs (or at the very least, some extra animal noises). 



A couple of days later I managed to get a hold of my own card reader toy, print the cards 109-117 and give it a shot. All of the cards worked. Now I just had to work out if they were duplicates or a completely different set of audio tracks.

To be continued...maybe.

(You can download the pdf for all 1023 barcodes here)

3 comments:

  1. Bits 1,2,3 are
    1=always on (stop bit)
    2 &3 = 10 if there's an even number of bits in the track
    01 if there's an odd

    Used that scheme to get myself a complete sealed set...
    Good work on the blog :-) glad I'm not the only nutter that did this

    ReplyDelete
  2. This comment has been removed by the author.

    ReplyDelete
  3. Bits 1,2,3 are
    1=always on (stop bit)
    2 &3 = 10 if there's an even number of bits in the track
    01 if there's an odd

    Used that scheme to get myself a complete sealed set...
    Good work on the blog :-) glad I'm not the only nutter that did this

    ReplyDelete