So want to see something that's really neat and also completely infuriating?
CHECK OUT THESE ALPHABET BLOCKS FOR THE TINY BABIES!

So, they're double-sided. Here's the other side.
Anyone spot what's happening here?

It's rot-13! A-N, B-O, C-P, D-Q?
So this is a toy to teach your kids to encode spoilers on usenet!

and that's really cool, right?

EXCEPT... I cheated. two blocks are missing.
Why would I do that?

BECAUSE THEY FUCKED THEM UP.
It's actually rot13 EXCEPT for L-F/Y-S

So, I saw these on sale at walmart the other day, and here's why I got them:
They're not just letter blocks... they're letter blocks plus a Special Device that can tell which one you put in it!

I was thinking they were NFC like amiibos and the like, but it turns out they're way simpler: each block has a set of holes cut into it...

and the player thing has a bunch of little microswitches which get pressed/not pressed by them.

so naturally I had to buy them, and I'm gonna decode them all, including the blocks I don't have, and then turn this into a keyboard!

and you might wonder why there are so many bits if this is just letters (you only need 5 for that: they have 8)
Well, it turns out it's not just letters! There's other blocks too that don't correspond to letters:

a side note: girl/bed/cat/boy/worm/flower/dog/love/bike/bird/music/butterfly/leaf/bunny IS the canonical list of all 14 genders, accept it, it's basic biology.

So this is the Leap Frog LeapBuilders system. It's available in a lot of different sets. This one is the "ABC Smart House".

You can see that one comes with "20 learning blocks", which are the blocks that have the codes on them.
The rest of the blocks are just for building, since it's a Duplo-esque building toy system.

Other sets are things like the Fruit Fun Elephant, which is a smaller set that only includes 10 Learning Blocks, so it can't have a full set of letters. (it doesn't actually have any: just fruit)

Here's a possible wrinkle: Check out the Safari Animals set.
See how the little reader-block has green pegs on top, and two buttons (music and question mark)?

Compare that to the reader-block from my ABC Smart House set.
The pegs on top are red, and there's 1-2-3 buttons as well as Music/Question.

So it's possible (but, I think, unlikely) that each set's reader-block can only read the blocks that come with it.

This would be VERY FOOLISH but it's possible. So I can't rule it out yet.

Also, notice that red thing at the bottom of the "scanner" bay? that might also be how it detects if there's a piece inserted. I assumed it was that 9th pin on top, here:

if the 9th pin isn't used for piece-detection, it could mean we have an extra bit for encoding the values on the pieces.

but let's get the obvious theory out of the way.
If you were making these toys, and you needed to encode letters into 8 bits, what would you use?
ASCII, right? (or UTF-8... but they're the same for the 7 bits we care about)
So are these just ASCII?

Well here's the block for R/E:
It's 0101 1011 (or 1010 0100).
And those may be swapped around, depending on what direction the bits go in.
Does that match the encoding of R or E?

R is 82, or 01010010
E is 69, or 01000101
r is 108, or 01110010
e is 101, or 01100101

It could maybe be encoding E, if you read it this way?
0100 0101

Let's grab another letter and check if that one seems to match. This one is Q/D:
That's D: 68 01000100
or Q: 81 01010001

and no, this encodes as 01000000 or 00000100 using the above method.
Neither of those match.

So here's ABCDE (or NOPQR)
This should be counting in binary... it doesn't look like it is.
Too many bits are changing.

and I think that's because they can't simply use a "dumb" binary encoding, for one simple reason:
the pieces can be inserted two ways, and mean different things.
So you can't have two codes that are the rotation of each other, or the thing can't tell them apart.

actually... maybe it can sense orientation.
So all the pieces have this little hole on them here. I thought this was for something related to manufacture, right?

But if we look close at the scanner-thing, there's a little hole approximately there. I can't see anything in there, but there could be a photodiode...

and these blocks are hollow, and there's two places at the bottom where it could be shining an (infrared) LED up the block.
so if it can see the LED light, it knows it's facing one way, if it can't, it's the other way.

obvious test: let's grab some electrical tape, cover up that hole, and see if it confuses the sensor-block

Sometimes being a scientist is just about using electrical tape to confuse a toy for children into thinking a rabbit is a dog.

ok so that theory has been invalidated!
The device reads it correctly as DOG/RABBIT even with the tape on it.

Here, btw, is my collection of learning blocks, all with consistent orientation (using that neck-hole, which is facing towards the top in this picture)

one thing I note about the encoding:
having one half be all-holes seems to be fine (top left has it) but they never have an all-filled half.

So, a few tests:
A fully covered block is detected, but doesn't report as anything.
it just makes insertion noises and then goes "sad noise" or laughs.

Similar results for covering just one hole. It just sort of sad-noises at you.
So apparently not all combinations are valid blocks! good to know...

weirdly if I cover one half of the holes, it identifies it as "orange block". (I'm assuming the fruit block, not the color?) but sometimes it still plays the sad-noise FIRST.

Another thing about the encoding: all of them have at least 3 holes punched.
And my next question: is there one of the blocks I could turn into another block by covering a hole? I'd like to test that.

here we go!
the one on the right can become the one on the left by covering the second-from-the-left bottom hole.

So that's G/T and I/V. I'm gonna modify the I/V into G/T...

LEAPFROG LEAPBUILDERS: HACKED!!!!

one thought I'm not sure how to test right now:
they might be doing a form of frequency modulation on the bits.
So instead of encoding the bits as is, they're encoding a change from 0->1 or 1-> as a hole, and no hole as no change.

also apparently the scanner-block is called the "Smart Star". I can tell because it keeps yelling at me to "put a LearningBlock™ on the SmartStar™"

I'm not seeing any obvious patterns looking at the encoding.
it may be that there isn't one: they just have a table in ROM that lists all valid blocks, and they ensured they only used half the valid space

so like when they assign 11111010 to A, they automatically assign 01011111 to N. No need for a pattern, just a table.
and it's not like they don't have room for a big table, there's only 256 of these at most, and this thing TALKS. it clearly has storage.

so I could take it apart now, but that sounds too interesting.
Let's instead do the most exciting part of science:
BOOKKEEPING!

So I'm gonna go through all the blocks (that I have) and document what they are and what bit patterns are encoded onto them.
This sounds like a job for a 3 year old!
but I don't have any handy, so I'll have to make due with the next best thing: my under-the-weather brain.

you know it's getting real when you have to bust out the spreadsheet

I'm not an educator but I think somewhere in the "how to teach letters to the tiny babies" guide, it says something about not confusing them with homophones.

X, for "gutted fish"

ok I've completed the list and exported them to a google sheet. https://docs.google.com/spreadsheets/d/1_bNFY7z4muBBC8HdTCMgLrrv7dPIiHVV_OfEsnAKbLY/edit?usp=sharing

which means it's time to grab a screwdriver and disassemble it.
Step one: batteries. It's powered by two (included) TIANQIU Super Heavy Duty AAA cells.

4 screws on the bottom and that piece pops off easily. Looks like it's a sort of sandwich design, with a single large PCB in the middle.

4 more on the back (and two underneath the red bit) and it opens up.
The left most piece is the back: it's just a speaker and battery compartment.
Middle PCB is the main one, the right part is just those 3 buttons.

I thought this was another speaker but it's wired to "sensor".
Interesting.
I think this thing mentioned on the box that it's motion-sensing? So maybe this is related to that.

Here's where that red lever on the bottom of the block-area went: there's no electronics here, just a spring. So it doesn't use that to detect blocks, it's just there for physical reasons.

So we flip over the main PCB, revealing... A big ol' anonymous blob!

BOOOOOOOOOO

There's four membrane buttons but they just correspond to the two front buttons (question and music).
They doubled up on buttons so you can press it at the top or the bottom and have it work, I think.

Next up is the block-identification PCB.

It's one module, the block-IO module.

The back.
OH MY GOD IT'S DOUBLE SIDED! they paid extra for this one.
We've got some LEDs here for lighting up through the grill on the front.

also this screw was partially out.
I didn't do that, it came that way. huh.

So let's disassemble the module.
So the bottom part looks like this:
A weird looking 9-legged octopus.

And as the blocks are inserted, they push up different legs.

Here's those legs on their own. They're rounded off so that they'll smoothly slide in and out of the holes on the blocks.

Sitting on top of those octopus-legs is this set of metal fingers.

And here they are on their own

And on the PCB, we have a big metal pad at the top, and separate tabs for each of the fingers.
So when a finger is pressed down, it bridges the contact between the top pad and the finger-pad, and the circuit can detect that it was pushed in.

What's very interesting about this PCB is that it labels the pins! BP20/101, BP22/103, etc.
The top-right one is BP16/Confirm.

OK, what else can we take apart... the top bit!
those three buttons are apparently button 2, button 3, and ANONYMOUS BUTTON

Also the other PCBs said copyright VTech 2019, this one says 2018. Huh. Maybe this was recycled off an earlier design?
Also: Pinao-keys.
I'm sure that's some highly technical term I don't know about and they didn't just typo "Piano-key"

They also soldered 3 of the wires from the back and one from the front.
I don't know any particular reason why you'd do this, other than "they screwed up".

The final bit I can disassemble is that sensor.
It's just a disc, I can't see any writing on it because the tape is on really tight and I don't want to damage it, and the other side is blank.
So I think this is a piezo vibration sensor.

I wonder if they went for the white solder mask just to make this thing more annoying to reverse engineer.
Because the traces are clearly there, they're just hard to see.

So... what's next?
well, chop off the sensing module, replace it with an arduino or something.
see if I can just enumerate all values of blocks. see what it says they are.
also, hook up that same microcontroller to the sensing module, sense my own blocks, make it a keyboard.

BTW, did you notice the two rows of sensing pins are offset?

That's to avoid a spurious half-signal while it's being inserted.
The bottom row of holes doesn't line up with the top row of switches, so they'll not be triggered, and also it'll slide in smoother as they're not inserting and then ejecting.

Close up of the module while a block is in there.
You can see how some pins have been pushed up by the block, while the two on the right haven't.
So the switch turns "on" when there's no hole, and "off" when there is a hole.

which means my 1/0 notation for the spreadsheet is probably backwards... oh well.

my direction is definitely wrong.
Based on the numbering on the PCB, they aren't read left-to-right, top-to-bottom, they instead zigzag top-bottom, right to left:

YOU WOULDN'T DOWNLOAD A FRUIT-BLOCK....

Time for some of my patented pinout-documentation-using-MS-Paint:

I was thinking they might be doing that trick where you wire two LEDs in opposite polarity, and therefore you can control two colors with only 2 wires by reversing the direction of the current, but NOPE! Same polarity, and they're both yellow.

the first step in any arduino sketch: BLINK

Got it reading them!

This is using the sensors native "zig-zag" ordering. The "218" value is reading it with the C facing out, and the 091 is reading it with the P facing out.

so now I need to take my spreadsheet and correct the ordering.
basically, if the old ordering is ABCDEFGH, I need to swap it around to be EAFBGCHD ordering.

There we go.

now I can stuff that data back into my arduino sketch and now it can tell you what block you put in it!

henllo

ok clearly it needs some work. I think I need to add a delay:
wait for a while after the confirmation pin is activated, in order to be sure the other pins have had time to drop into their respective locations.

I also need to shiny this up a bit.
With a longer cable and some soldering, I can fit the teensy back into the closed StarThing device, instead of a weird breadboard on my desk

I also haven't mapped all the non-alphabetical blocks yet.
I can make some of them emojis, I imagine? but I should make at least one of them SPACE and another BACKSPACE.

those emojis are:

emoji input works.