Reverse engineering a Hit Clip

God…dammit

Background

It’s hard to see a child outside today without some kind of iDevice pumping high fidelity 192kbps stereo lossless audio into their shiny white headphones, but BACK IN MY DAY, the iPod hadn’t been invented yet.  Pickings were slim.  Walkmen were outdated, CD players were pricey and would skip if bumped around despite their ESP features, MiniDisk was another stillborn Sony format, and MP3 players were still ugly and ridiculously expensive (at least Apple fixed the ugly part).

Thus, Tiger Electronics, pioneers in the high tech market of McDonald’s Happy Meal toys, invented “Hit Clips”

Hit Clips were small cheap digital audio players that could play music off of little plastic cartridges.  The audio was mono, sounded terrible, and only included a 60 second sample of a song.

Better hold on to that patent Tiger…

Still, the songs were officially licensed and included bands like The Backstreet Boys, Aaron Carter, Sugar Ray, and …Dreamstreet

The 00s were a very strange time for all of us…

Anywho, while helping my 17 year old cousin move some furniture, we came across a large collection of hit clip cartridges, but no player.  Struck with a wave of nostalgia, I asked if I could take one to do a tear down.

Thus this post.

Teardown

The hit clip cartridge has 8 metal contacts on the back:

Taking it apart, I was hoping to find some identifiable piece of hardware, but instead found the chip-on-board construction that is so popular with super-low-cost low-power electronics along with a few discrete components.

Under this blob of epoxy is a wire-bonded chip of silicon.  The song is likely hard coded directly into the silicon wafer rather than being programmed there after the fact using flash or OTP memory.  It’s cheaper that way if you make enough units.

This didn’t give me a whole lot to work from, but assuming the capacitor is a bypass capacitor (decent assumption), I at least had some idea of how to power the thing.  Poking around for a bit gave me this schematic:

I’m not sure what the two No Connect pins do, but apparently there was a version of the Hit Clip that allowed music to be recorded to special cartridges, so I’m guessing they have something to do with that.

I wasn’t sure how much voltage the part needed, but a quick search on Ebay gave me some idea:

3 AAAs means 4.5V.  Also, can you believe people are bidding $40+ for these things?

Before I could get serious about debugging, I needed some way to connect traces to the board easily.  I ended up soldering on some header pins and plugging it into a breadboard:

My original assumption was that the bottom-left pin was ground as it connected to the mystery chip more times than the other power-pin.  You’ll note the scratch-outs indicate that I was wrong.  In that configuration, the chip drew 200+mA during the half-second that I left it connected.  Presumably there’s a reverse bias protection diode that I was blowing up.

Swapping the power pins around, the current started at around 280

    \[\mu\]

A before dropping to zero.

Convinced that I had it right, I moved to the other pins.  There were four pins to chose from and a voltage measurement showed me that two of them were at the 4.5V rail while the other two were settled close to 0V.

1 High
2 Low
3 High
4 Low

Since I had already identified my two power pins, I had to assume that these four pins were used for data somehow and that the two high pins had internal pull up resistors.

Connecting Pin1 to ground sinks about 12mA from that pin.  12mA is much to high to be from a simple pull-up resistor.  My guess is that it’s some kind of output pin to tell the player that the cartridge is inserted all the way. I decided to leave it alone and move on to Pin 3.

Connecting Pin 3 to ground caused the circuit’s current draw to rise from zero up to 300

    \[\mu\]

A. Removing this short did nothing to change the current increase although it did settle down after about 60 seconds.

This is when I knew I was on to something.  60 seconds of current draw meant that this part was outputting its music sample!  I was expecting the player to need to do something more complicated like pull bytes of music off the cartridge over a SPI bus or at least provide a clock source, but it turns out that the cartridge can handle that all by itself.  I’m guessing that the two on-board series resistors are used for fine-tuning its internal clock source after the chip has been printed.

I quickly whipped out my oscilloscope and took a trace of Pin 2:

Data!

Update

While doing a similar job on a different Hit Clip (Who Let the Dogs Out by the Baha Men), I discovered different behavior.  Connecting Pin 3 to ground did nothing while commenting pin 1 to ground toggled between data and no data.  I’m not sure if there was a change in the Hit Clip design through generations, or if I took imprecise notes.  The PCB layouts of the two clips is clearly different, and it looks like pin 3 is NC on the second clip.

I noticed an intermittent square wave with a period of almost exactly 24kHz and a duty cycle that varied with time.  Pin 4 had similar data.

So there was definitely something going on here, and it was definitely digital somehow, but I needed some way to capture loads of digital data to later analyze.  Fortunately, Santa gave me an 8 bit Saleae logic analyzer for Christmas:

I actually picked up the Hit Clip while looking for a good project to test this thing out.  It’s a really nice device, and the Windows/Mac/Linux compatible software is really slick.

Anywho, with the Saleae connected to Pin 2 and Pin 4, I reactivated the circuit and took a trace at a 24MHz sample rate.  I came up with this:

It was strange at first to see how the two data lines appeared to take turns, but once I remembered that Hit Clips only output in mono, it made a lot more sense.  These two lines are encoding the same mono stream of audio.

Looking closer at the low-going blips, I noticed that they were quantized.  The length of each blip was always near some integer multiple of 0.3333

    \[\mu\]

s.

Knowing what I know about audio amplifiers, I theorized that these two outputs are meant to directly drive the push and pull FETs of a class D amplifier in real time.  In other words, a blip on one line pulls the waveform output voltage up while a blip on the other pulls it down.  The width of the blip indicates how hard (or for how long) it pulls.

Update: Redditor urquan points out that this kind of modulation is called Sigma-Delta Modulation.

While it’s technically a digital output, it’s encoded in such a way that it can be fed directly into an analog circuit.

I figured that if I could give myself a stream of this data, I could probably simulate the output digitally.  To cut down on the number of samples, I exported the trace to a CSV file that only records timestamps when something changes.

In order to make use of this data, I just needed to record how much time passed between a signal dropping low and rising up again, and I should have such data points arriving at almost exactly 24kHz.  All of the data from one pin was given a positive value while the data from the other pin was given a negative value.

I also tried quantizing the data by dividing the time delays by 0.33333

    \[\mu\]

s, and while this worked for small numbers, I noticed that some of the larger numbers fell pretty far from a solid integer.

It looked like 0.33333

    \[\mu\]

s was a bad estimate of the actual quantization time.  Thinking a little more critically, I noticed that a 24kHz wave has a period of 41.67

    \[\mu\]

s.  When divided by my quantization time, this comes out to almost exactly 125 which is pretty darn close to 128, a power of two.

Changing my quantization time to 0.3255

    \[\mu\]

s or

    \[\frac{1}{128\times 24kHz}\]

yielded much better results:

Now the question is what to do with these numbers.

My first attempt involved just pumping them into a WAV file and taking a listen.  With this setup, all of the negative numbers were negative points on the waveform.  Here’s the first 400 samples:

I took these values, gained them up to fill a 16 bit WAV file and took a listen:

Firstly, I was shocked to get anything even closely resembling audio.  Especially something so recognizable.  That being said, the audio quality isn’t the best.  The raw values out of the cartridge only extend from around -60 to +60 which leads me to believe that it’s encoded as a 7-bit signed integer (-64 to +63).  7-bit audio isn’t exactly lossless, but I wasn’t convinced that this was the best I could do.

I found two problems with the way I was decoding the audio:

Empty samples

I noticed looking at the Saleae trace that there were many periods in the 24kHz digital data stream where neither trace showed a blip.

Because my script was only looking at the blips, I simply skipped passed these data points.  The end result was that the music played slightly faster than it should have.  This was obvious when my output WAV file was shorter than my original trace.

I modified the script to detect when more than

    \[\frac{1}{24kHz}\]

passed between consecutive blips and interpolate blips at the proper places by just repeating the previous value.

Push Pull simulation

I noticed later on that I wasn’t really simulating the push-pull driver that the Hit Clip likely used.  The digital encoding is actually more of a derivative of the output waveform rather than the waveform itself.  In other words, a positive value doesn’t guarantee that the output will be positive, but rather that it will have a positive slope.  A larger value specifies a larger slope.

I modified my script to keep a running value starting from zero where the incoming value from the cartridge is added to the previous value to generate the next one.  There was a problem of DC drift because the values don’t all add up to zero.  My first time through, I found that the largest value was 1 while the smallest value was somewhere around -50,000 which overflowed my signed 16 bit WAV output.

I solved this by multiplying the output value by 0.99 before storing it.  This acts as a very simple high pass filter as DC offsets will slowly drop to zero over time.

The first 400 samples now looked like this:

And it sounded like this:

Looking forward

The audio is 100% recognizable which is much more than I thought I’d get out of this project.  It’s far from perfect, but with no base of comparison, it’s possible that Hit Clips really just sounded that bad.  There’s also probably a large amount of filtering performed by the Hit Clip player that I would have difficulty trying to replicate.  They likely mixed the tracks specifically to tailor to whichever audio stages they could make cheaply and easily, so without more information, there isn’t a whole lot I can do to fix it.

The big problem with a project like this is that audio is just so easy to pull out of a circuit.  Human ears are very good at picking signal out of noise, so it’s difficult to tell whether or not I’m doing this right.  Heck, while I was trying to get the WAV script working in Python, there were times when I had selected the wrong bit depth and produced cacophonous full scale noise, but I was still able to hear the Jackson Five playing underneath it all.

Looking at the waveform, there isn’t anything totally obvious that I could be doing wrong, and yet, I can’t get the audio to sound much better than the garbled samples you’ve heard above.

Below, I’ve provided a link where you can download a CSV file of the trace from my Saleae as well as my Python scripts.  If you have some experience with audio processing, and have an idea for how to improve the audio output, feel free to download it and give it a try.  Just make sure to report back if you figure anything out!

Update 1-2-2014

Reader Cory took up my challenge to improve the sound quality, and actually fixed it up a bunch!  He method was explained in an email to me:

Technically, the Hit Clip audio is PWM, but the principles for demodulating are the same. You need nothing more than a low-pass filter. The Hit Clip devices would have contained a pair of transistors, an RC or LC filter with a cutoff frequency around 20 kHz, and a speaker. You can also use a digital low-pass filter to achieve the same result.

I have attached a script I wrote to do exactly that. It reads in the CSV data you provided, converts ch0 and ch1 into ternary (+1, 0, -1) representation, and expands it into samples at a rate of 24*128 kHz. The expanded data is decimated to 48 kHz using SciPy, which simultaneously low-pass filters the data at the Nyquist rate of 24 kHz. That data is then written out to a WAV file for your listening enjoyment. The results are surprisingly good! It definitely sounds more like what I remember it was like as a kid.

Cory’s Python script can be downloaded here.  And here’s the result:

Sounds great!


Download the files for this project here: Hit-Clip.zip

 

41 thoughts on “Reverse engineering a Hit Clip

  1. Pingback: Reverse engineering a Hit Clip - The Unsuspecting Bit

  2. Pingback: Reverse Engineering HitClips

  3. Pingback: Belgaum news | About Belgaum | Belgaum information | Belgaum district | Belgaum city | Belgaum Hotels | Belgaum People | Belgaum tourism | Belgaum entertainment | Belgaum students | Inside facebook | Hack | make use of | technical news | | Reverse Enginee

  4. Pingback: Reverse Engineering HitClips | Hack The Planet

  5. Years ago I reversed a HitClips FM module, and like you didn’t have the matching HitClips player.

    Using your schematic nomenclature:
    The Vcc pin matches.
    Pin 2 is Gnd.
    Pin 4 and Gnd is analog audio out.

    I powered the module with a 3V CR2032 and connected a pot (for volume control) and headphones to the audio out for use as an FM radio.

    Looking at your schematic and reading your description makes me think that I could use Pins 2 and 4 for audio out and your Gnd as Gnd. I’ll need to verify if this is the case.

  6. Pingback: hackingaround – Los Hitclips de los 90

  7. My girlfriend just mentioned HitClips so I Googled around and found you’d been poking about with them mere days before! Fascinating article, the PWM method of sample playback was quite common on 80s computers that only had a buzzer for audio output like the ZX Spectrum and IBM PC: http://shiru.untergrund.net/1bit/pivot/entry.php?id=162

    My favourite example using synthesis techniques rather than streaming a sample is: http://www.youtube.com/watch?v=GRUQr457zkw

  8. Pingback: Vanishing Electronics | Tie And Jeans

  9. Pingback: Further unearthing of the Hit-Clips technology | Evan's Techie-Blog

  10. Pingback: xX_MLG_Keyboard_Xx #SWAG #YOLO #420 | ch00ftech Industries

  11. First of all nicely done with the hitclips. For years i’ve wondered if there was a way to rip these. I have another challenge for you. Do you know of or remember back in 2003/4 ish Tiger electronics released this video player aimed at kids called the VideoNow? it played cartoons and shows on small discs but the discs are encoded in a way that you can’t just drop the disc into your pc and rip it (well you can but all you’ll get is scrambled audio and noise) Theres a way to convert these but I can’t figure it out. I posted something on videohelp about this. Link is here —> http://forum.videohelp.com/threads/371489-Ripping-and-Converting-VideoNow-Discs?p=2386856#post2386856

  12. Nice work my friend! Very nice indeed!!!!
    I had actually never heard of these until a girl I am friends with brought it up the other day. So, I found one online and bought it for her. Now I have not performed any research yet (finding this forum was my first attempt) but the FM radio adapter does not work with the Hit Clips system I have which, if I’m not mistaken, is the original (1st gen) Hit Clips device. It is not the “Boombox”, the cartridges/FM radio module slides down and there is a clear plate where you can see the image of the band on the cart, then there is one singular button to play the music or if you hold it, restart the sample from the beginning.

    Anyway, does anyone know anything about the FM radio modules and how I may go about troubleshooting this device? It’s more or less for fun, no big deal really.

    But again, great work and thanks in advance for any help!

    Regards,

    PAinguIN

    • I still have a HITclips FM Radio Cartridge in its original package. The description says it is compatible with the Micro Personal Player, Rockin’ Micro Boombox and Alarm Clock Micro Music Player. The player you describe sounds like the Micro Personal Player.

      You can independently test if the FM Radio Cartridge works without the Micro Personal Player. Refer to my post above (https://ch00ftech.com/2013/12/31/reverse-engineering-a-hit-clip/#comment-200781).

      • Sorry for the late reply but thank you for responding, Leonard!

        This is going to get a laugh out of some of you without doubt… I managed to get the FM module to work.

        It turns out there is an “on/off” switch on the top in between the edge and the antenna. LOL!

        Problem solved! XD

        Cheers!

  13. Hello ch00f

    Got another challenge for you if you’re up to it.
    Ever heard of videonow? These were CD sized discs that played cartoons in special players for kids. They had a number of models the first was a black and white player, the next was a color player with new color discs, the XP model which looked like a kids DVD player, played simple games, and they also came out with a see-thru model which is like the color player but with different plastic. They made a Jr version too which is very tough. I’m not sure if you’ve heard of this media but If you’re looking for a new project to do you could try this. I am looking to rip the content on the discs to a video file on a PC. I have tons of tools but they don’t seem to work and I’ll provide these tools if you want them. I really enjoyed your hitclip project you did and I come back here often because it’s so amazing. I wonder if that could be done on all chip devices. And do I need that analyzer thing you used or no? Could I just connect to ground and + where you found the data and then just record that to a wav file?

    • That sounds super interesting!

      I did some googling, and it looks like someone has already beat me to it! Look up “VideoThen.” Someone reverse engineered the spec and figured out how to make custom discs for it.

      If you’re looking to just grab audio data off a hit clip, you could probably just grab the audio waveform off the output jack. You only need the Saleae or another logic analyzer if you’re looking to grab “pristine” digital audio.

      • Hello ch00f
        I’ve tried all that but I guess I am not smart enough for that. I was able to convert a Viva La Bam episode to VideoNow Color but with no sound using the virtualdub program.

        What I am after is not to put my own content onto a videonow disc but to rip an existing videonow disc to a video file that I can watch on my PC. For both Black and white and color discs. I know the quality of videonow is terrible and most content can be found elsewhere but I just want to know if it can be done.

        As for the hitclips I’ve recorded most of my hitclips to wav files and it’s good enough for me. I’ve moved on to recording the music from those hallmark card chips. I’m looking for a way to record the audio without taking the cards or toys or whatever apart. There’s this pickup coil sold for recording phone calls and a new speaker sold on TV that you put your phone on top and it plays.

        • can you possibly send links to your hit clip recordings? I’d like to hear them. Also, I am part of a comunity that archives toy audio. We use pickup coils that we hold or stick to the housing of the toy, usually on or near the speaker holes, to recorde audio. They just connect to any device that supports a 3.5 mm mini jack microphone input. They wree originally ment for recording phone calls to tapes, but they just pick up electro magnetic signels so they can grab the full range that the toy or device can put out, even the parts that you may not be able to clearly hear from the tinny speakers on some toys.

  14. Dude, seriously…? It’s been THREE YEARS since I sent you photos of what’s inside a Hit Clip player, and you never told anyone…?

    That’s pretty sad.

    Oh well… for the record, it’s a resistor and a cap. Whatever amp is driving this thing is in the earbud. Here’s the photos I sent ch00f in 2014 –> http://imgur.com/a/kLsHJ

    I will be glad to upload screenshots of the two email exchanges I have with ch00f, still in my records, if there is any dispute or challenge to the legitimacy of this.

    • Hello Starhawk.
      The hitclips player is just a holder for the cartridge. Some players like the personal players have a resistor on the audio out to lower the volume. I’ve modded a bunch of my players to be louder by removing this resistor. Everything is in the hitclips cartridges themselves and not the player. The “Amp” is actually in the chip itself. The resistor in the chip sets the playback speed. I’ve taken apart those musical greeting cards and you can make the music play faster by moistening a finger and placing it on the resistor.

  15. Hey not sure if you’re even going to see this but…
    How possible is it to record new audio onto a preexisting HitClip and wipe the old audio or is it possible to just rebuild a replica the circuit board with new data.
    I have an insane idea.
    Thanks,
    Tony

    • There was a Yahoo! branded HitClips recorder/player. It came with one 2 minute recordable cartridge which was nearly 3x the length of a standard cartridge but worked in any other HitClips player.

      Here’s what may be the exploitable trick. The Record and stop buttons are on the recordable cartridge, not on the recorder/player. That device has 8 contacts like all the HitClips cartridges (and discs). All the players (other than the Yahoo! Downloader) only have 6 contacts.

      If the HitClips PCBs were assembled *then* recorded it should be possible to figure out how to erase and re-record them.

      At least one HitClips cartridge has a runtime of 1:20. It could be they’re all capable of holding up to 2 minutes but the full capacity of the chip was never used except in the recordable version.

      The Yahoo! Downloader has a removable part that’s required for recording. It has a multi-pin connection to the rest of the device but audio input is via a standard 1/8″ speaker plug. That part comes off to very slightly reduce the bulk and exposes a 1/8″ headphone jack.

      So, figure out if HitClips cartridges (and discs) can be re-recorded, how to do it, and build a player with a bit of smart sound processing to improve the quality.

      Another way to improve the quality would be a sound pre-processor that adjusts the audio sort of like a programmable hearing aid.

      The person being fitted with hearing aids is put through a test to see what frequencies they have problems hearing. Then that profile is programmed into the hearing aid to provide a varied amplification to increase the volume to level out the loudness. Other processing for noise is done and I’d bet the really fancy ones can also do some frequency shifting to make sounds audible that a person cannot hear at all.

      Now think of the HitClips hardware as a particularly bad “ear” and adjust the audio being fed into it so that when it’s played back the deficiencies are at least somewhat adapted for.

      • Is there a way to trim down those big bulky Yahoo recordable chips to match the size of the original hitclips with keychain and the ability to put a picture of the artist you’ve recorded on the front, making it resemble the original hitclip as much as possible, without compromising the functionality of the Yahoo recordable chip when inserted into the boombox hitclip player? Please lmk your thoughts! Or maybe you might know a way to record a new song over the original hitclip’s song and replace that cheesy photo on the front with a cool picture of the new artist you’ve just recorded over with, personalizing the hitclip to match your style and music taste better, all while still sporting the nostalgic vibe?

  16. Thank you for diving into your curiosity and sharing it with the world. I teach college-level music production and audio engineering. I’m going to refer to this blog when I lecture on the basics of sample rates and bit depths and what they mean about audio quality. I’m 38-years-old, and I think the first time I heard about HitClips is today. One of my graduates posted a nostalgic Facebook meme about HitClips and I didn’t know what they were, so I looked them up and came across your work. Fascinating. Thank you so much for sharing.

  17. Pingback: Reverse engineering a Hit Clip (2013) | صحافة حرة FREE PRESS

  18. Pingback: Reverse engineering a Hit Clip (2013) - Down to the Block

  19. Pingback: Reverse engineering a Hit Clip (2013) - Techie Stuff PR

  20. Pingback: High-tech Reverse engineering a Hit Clip (2013) | Teenoi.Net

  21. Pingback: High-tech Reverse engineering a Hit Clip (2013) | Enigmesghisdiem

  22. Pingback: Reverse engineering a Hit Clip (2013) - JellyEnt

  23. Pingback: Reverse engineering a Hit Clip (2013) - JellyEnt

  24. Pingback: 逆向工程命中剪辑(2013) – HackBase

  25. Pingback: This Highly effective However Tiny Arm Chip Lets You Get to Grips with Your Outdated, Favourite HitClips! - Bients

    • Dude, that would be cool. I hope he can ask for the rest of the hit clips so we can archive them or somebody else could do this.

  26. The most basic hit clip players aren’t actually that expensive right now. I bought one for only $10.00 and some shipping charges on ebay.

Leave a Reply

Your email address will not be published. Required fields are marked *