Reverse Engineering ME2's USB with a Heat Gun and a Knife

Background

In 2024, bjiru uploaded a video about the ME2 handheld device, a toy produced around 2008 that featured the ability to use USB to synchronize points and gems between your device and an online world. The game was extremely niche, so no software, drivers, or assets had been archived, at least until bjiru came forward with the online game client.

I am the leader of Miuchiz Reborn, an effort that started in 2015 to preserve, reverse engineer, emulate, and maintain the accessibility of a game similar to this one, with an online portion and a handheld portion connected via USB. Due to the similar vintage and type of game, the ME2 had already been brought to my attention by my Miuchiz community in 2018, since they thought (mistakenly) that they might share architectural similarities. Despite me being aware of the device's existence for years, bjiru's video finally prompted me to begin research on it.

My initial efforts were spent solely on recreating the server required to make bjiru's copy of the computer game functional again, but along the way, my attention inevitably drifted to the handheld. A recreation of the online game surely could never be complete without the mechanism to synchronize your points to and from the device. This communication between your computer and the ME2 device was the game's main gimmick, after all. I figured that my prior experience with the Miuchiz handheld devices would help me make short work of untangling whatever communication ritual they expect... as long as I could get some code to reverse engineer.

My curiosity demanded the sacrifice of ME2s. EBay demanded the sacrifice of fiat money. Before long, these specimens lay before me.

These are small units with only a couple of buttons and a female mini-USB port. There's a cable included in the box, but it's lacking any disk for software and drivers. That USB port would be the way to synchronize points between your computer and the handheld, but when I embarked on the same journey for the Miuchiz handheld device, I attained full access to its flash memory by reverse engineering how its accompanying Windows software worked. With no such software for the ME2, there is nothing to reverse engineer to figure out how to communicate with the device. Even after checking the Wayback Machine and bjiru, there were apparently no surviving copies of whatever software used to talk to these things. I think it was called ME2 Desktop Buddy, but that application was separate from the game client that bjiru recovered. The handheld does expose itself as a removable storage device, but the contents just direct you online to download the ME2 game, which is no longer available.

The way forward is clear, since there's only one option left: open the hardware.

What's inside

The main ME2 firmware is stored on an SST39VF3201, a 2 megaword (4 megabytes, with 16-bit addressable units) flash chip. The main microcontroller is... under a hard epoxy glob-top. This is known as a chip-on-board (CoB) and is usually a cost-saving measure, but it has the side effect of hiding any identifying information about the integrated circuit inside. A regularly packaged chip will usually have markings that identify it, just like the flash chip does. Since microcontrollers used in devices like these often contain an internal ROM, it's possible that parts or all of the USB code that I wanted to reverse engineer were in that ROM. Having that code in ROM has the benefit of allowing recovery of a bricked device or, if the manufacturer chooses to do so, flashing the device after assembly. That ROM would exist inside a chip which I had no way of identifying.

... continue reading