Disney Frozen 2 Magic Pendant Plush Doll

From revRE Wiki

What child wouldn't love their plush dolls to sing to them, especially the Frozen theme songs. This is the idea behind the magic-pendent Frozen-II plush dolls. You can still buy these dolls on Amazon (Japan) and watch the video of version two on youtube. They started selling version 1 (pendant) in 2016, and version 2 (microphone) starting late 2016.

A view of both Disney Frozen 2 Magic Pendant Plush Dolls
A view of both Disney Frozen 2 Magic Pendant Plush Dolls

With this we will teardown the dolls and the pendants to see how they work, and if we can load our own audio clips.

General Description

The dolls work on the concept of the pendent containing NFC chip which activates a song playback. The pendant is a simple NFC tag, whilst the plush doll body contains the RF transceiver and playback logic. There is no difference between the Anna or Elsa doll other than what is loaded into the flash eeprom.

NFC Units Teardown
NFC Units Teardown

NFC Unit

The PCB contains two logic IC, one an RF amplifier the other the ARM Cortex-M0 enabled microcontroller playback unit. The MCU unit contains 32K OTP ROM for program code, and a further 8Mb audio flash-rom.

Close up of NFC unit
Close up of NFC unit


The PCB contains the following IC:

Active Components
IC Part Description Link
NX11M23A Single-Chip 32-bit MCU with CELP, SBC, ADPCM Coding & 16-ch MIDI Datasheet
NY9A109A Low Frequency RF Amplifier Datasheet

It seems there is a need for the NX_Programmer as documented in this Q Writer document from Nyquest and watch some introduction video on yotuube. I suspect it could be reprogrammed in-situ but I never got this far. However, it seems the U4 test pads can be used with the programming input to allow SPI re-flashing. The P10, P9 pins are for MOSI/MISO and P8 is SCK with P7 being Vpp for programming.

NX11 SPI pins
NX11 SPI pins

Pendant

The Pendant is a single NY8A051B ( 6-IO 8-bit EPROM-based MCI ) connected to a large wire coil, and a single capacitor which provides voltage storage sufficient to drive a response QFID as described in the QFID Demo Kit User Manual from NYQUEST. In the pendant C9 is C1, and C10 is C2 in the example reference design.

QFID Manual Example