Disney Frozen 2 Magic Pendant Plush Doll: Difference between revisions

From revRE Wiki
Line 22: Line 22:
|NX11M23A
|NX11M23A
|Single-Chip 32-bit MCU with CELP, SBC, ADPCM Coding & 16-ch MIDI
|Single-Chip 32-bit MCU with CELP, SBC, ADPCM Coding & 16-ch MIDI
|[https://www.nyquest.com.tw/upload/2022_05_313/NX11M2xA_v1.4.pdf Datasheet]
|[https://www.nyquest.com.tw/upload/2020_06_053/NX1_UM_v2.2.pdf Datasheet]
|-
|-
|NY9A109A
|NY9A109A
Line 32: Line 32:
|
|
|}
|}
It seems there is a need for the NX_Programmer as documented in this [https://www.nyquest.com.tw/upload/2020_03_243/Q-Writer_UM_v4%604_TC.pdf Q Writer document from Nyquest].  I suspect it could be reprogrammed in-situ but I never got this far.
It seems there is a need for the NX_Programmer as documented in this [https://www.nyquest.com.tw/upload/2020_03_243/Q-Writer_UM_v4%604_TC.pdf Q Writer document from Nyquest].  I suspect it could be reprogrammed in-situ but I never got this far. However, it seems the U4 test pads can be used with the programming input to allow SPI re-flashing.  The P10, P9 pins are for MOSI/MISO and P8 is SCK with P7 being Vpp for programming.
[[File:004.Disney Frozen2.NX11pins.jpg|alt=NX11 SPI pins|none|thumb|NX11 SPI pins]]


[[Category:Teardowns]]
[[Category:Teardowns]]

Revision as of 21:07, 6 March 2023

What child wouldn't love their plush dolls to sing to them, especially the Frozen theme songs. This is the idea behind the magic-pendent Frozen-II plush dolls. You can still buy these dolls on Amazon (Japan) and watch the video of version two on youtube. They started selling version 1 (pendant) in 2016, and version 2 (microphone) starting late 2016.

A view of both Disney Frozen 2 Magic Pendant Plush Dolls
A view of both Disney Frozen 2 Magic Pendant Plush Dolls

.

General Description

The dolls work on the concept of the pendent containing NFC chip which activates a song playback. The pendant is a simple NFC tag, whilst the plush doll body contains the RF transceiver and playback logic. There is no difference between the Anna or Elsa doll other than what is loaded into the flash eeprom.

NFC Units Teardown
NFC Units Teardown

NFC Unit

The PCB contains two logic IC, one an RF amplifier the other the ARM Cortex-M0 enabled microcontroller playback unit. The MCU unit contains 32K OTP ROM for program code, and a further 8Mb audio flash-rom.

Close up of NFC unit
Close up of NFC unit


The PCB contains the following IC:

Active Components
IC Part Description Link
NX11M23A Single-Chip 32-bit MCU with CELP, SBC, ADPCM Coding & 16-ch MIDI Datasheet
NY9A109A Low Frequency RF Amplifier Datasheet

It seems there is a need for the NX_Programmer as documented in this Q Writer document from Nyquest. I suspect it could be reprogrammed in-situ but I never got this far. However, it seems the U4 test pads can be used with the programming input to allow SPI re-flashing. The P10, P9 pins are for MOSI/MISO and P8 is SCK with P7 being Vpp for programming.

NX11 SPI pins
NX11 SPI pins