Hacking the CPU and ROM at the hardware level are pretty unlikely for the average hacker, given their single-molded blob and custom mask contruction. Replacing them with a custom PCB might be feasible, if you could reverse engineer the 12 and 25 pinouts of the daughtercards. Of course, you'd have to write your own ROMs from scratch, use a different CPU which probably wouldn't fit under the carapace, etc. If you would bother with all that, why not just start from scratch and make your own animated creature with more capabilities?

Hacking the cams and levers might be possible -- by changing the shapes of the cams and grooves in the wheels of the main gearing system, you can change when Furby's eyes open and close, mouth moves, etc. It may be possible to take the existing cams and gears and simply rotate them 90 degrees relative to their neighbors (the main shaft is square) which may have the same effect. This probably would not be very exciting, since the software will still act exactly the same. He just might start sleeping with his eyes open, leave his mouth hanging open, etc. which might just be disconcerting rather than entertaining. It'd also be pretty likely to cause more jam-ups in the already delicate workings.

HackFAQ

I've heard the Furby is Macintosh / Apple II / Linux / BeOS based...is this true?
There has been a lot of misinformation recently about this subject, leading to all kinds of wild speculation. What was said was that the Furby had the equivalent of an Apple II's processor, which was a 6502: an 8 bit, 1Mhz processor with a limited instruction set. This was the same popular processor that was used in the Vic20 and C64, the Atari 2600, and several other systems of the early 1980s. Even several years ago, the 6502 and its many derivatives were often used as microcontrollers and slave co-processors, dedicated to brain-dead discrete tasks such as disk drive control. However, there are many other microcontroller / microprocessors available in roughly the same performance range as the 6502 family, such as the 8080, Z80 and 6809 families. Many of these venerable chips' masks are readily available and commonly used in ASICs and such.

A Furby is not an Apple II, nor an Apple Macintosh. All that was said was that the Furby used a processor that was roughly equal in performance to the original 6502--which could mean any number of things: It could be any 8 bit processor running at 1Mhz, not necessarily a 6502. It could be a 4 bit microcontroller capable of roughly the same amount of raw processing. It could be a completely custom processor design.

Given the observed limited range of the Furby's behavior, its designers could have implemented the Furby software with a very simple processor. Anything more would have been inefficient, a wasteful and unnecessary added expense. Despite the current capitalistic explosion, this is a toy meant to retail for $30, which means it has to cost far less than that to make--including motors, gears, speaker, IR interface, fur, plastic, assembly costs, packaging, and shipping. Microsoft's "Actimates" toys are far more complex electronically, and thus cost more, but also have much more hacking potential.

Can I burn a new ROM for the Furby? Can I interface the Furby to X/Y/Z peripheral? Can I reprogram him to speak like Beavis?
Even if a standard processor or microcontroller design was used, the main processor chip(s) in the Furby are custom made for the Furby. Under a homely blob of opaque, protective epoxy is a single chunk of IC that includes its CPU, ROM, RAM (if any), audio data, and I/O interfaces such as driver transistors, an ADC or a DAC. The Furby's software and sound data is generally inaccessible for reading, disassembly, removal, replacement, or even examination. There are no exposed data/address busses, interrupt lines, surplus i/o lines, etc. other than what is needed to operate the Furby--making it unrealistic for end users to create a new ROM for the Furby.

Making a custom chip mask may sound expensive, but remember they are making a few million of these things: the savings in reduced assembly complexity, component supply and mark-up, circuit board size, etc. offsets the initial set-up cost. Additionally, it protects their invention from being easily copied or reverse engineered, since in order to get to the juicy bits, one needs acid, powerful microscopes, lots of time and specialized skills. (Of course, doing this would destroy the chip and ruin any hacking opportunities). For most companies, it would probably be cheaper for them to hire an engineer to design something original.

We can make some educated guesses based on rumors, common sense, clues from the circuit board labels, and the state of custom chip performance & pricing, but unless we hear from someone knowledgeable at Tiger, we won't know for sure exactly what silicon secrets are really inside those black blobs.

In the case of the Furby, there are two discreet epoxy blobs, one slightly larger than the other. There are many potential reasons this was done. They may have designed the CPU instruction ROMs as a separate chunk of silicon for easier updates to the software. Or it may be the audio data for easier foreign language support. They may have broken apart some interface functionality to a separate chip--such as audio playback. With a tool such as a logic analyzer (or at least a storage oscilloscope) and time, it may be possible to reverse engineer the exact interaction between these two epoxy chunks. If it turned out there was a bus between the two custom chips, and one were just a ROM of some sort, it may be possible to replace it with another ROM, although substantial effort would be needed to decipher the pin connections.

My best guess is the larger blob-board is the CPU, instruction ROMs, a few bytes of RAM, and digital I/O. (the audio, IR and light signals come in as single bit digital inputs, not analog signals.) The smaller blob-board is the audio playback controller, audio storage and a DAC. (thus making a French or Spanish speaking Furby would require making a new chip mask of only the ROM portion of the smaller blob-chip). Given the small storage space available and the large bandwidth requirements of audio, the Furby probably has highly (lossy) compressed sound data and good luck deciphering that format...

I don't care if the ROMs and CPU are sealed tighter than Tut's tomb, I want some details on the circuit boards and chips so I can hack Furby!
OK. On the two epoxy blobs, the larger blob is labeled U1 and its circuit board is GA305B (labels are on its surrounding circuit board) -- the smaller, unlabeled blob is board GA307A. Their connection points are labeled COB1 and COB2 respectively. The larger board has 25 pins connecting to the main board, and the smaller one has 12. Of those connecting pins, there appear to be six direct connections between the larger blob-board and the smaller one. The larger board has a 3.58Mhz ceramic resonator attached, labeled Y1, and three surface mount capacitors labeled C2-4 (most likely the processor board!).

The CPU would need to interface with: 9 inputs (IR, sound, light, motor speed, motor position, tickle, pet, feed, inversion), 2 outputs (IR, motor), power, ground, and 6 connectors to smaller blob-board (audio?). That's 19 of the 25 pins. (reset may be handled a little differently, such as power interruption, but it could also be one of the pins to the CPU).

The smaller blob-board has 12 pins, 6 of which connect to the larger board, power, ground, and 2 speaker wires. That's 10 of the 12 pins.

There are a few other chips on the main board, which appear to be standard surface mount ICs: An 8 pin chip, U2, with the markings HT93LC46 9816W4023-1 (EEPROM -- Non volatile storage for furby's "memory") A 14pin chip, U4 with markings KA324AD C827B (OpAmp) A 14pin chip, U5 with markings 74HC14D B34280PC Hnn9740. (Hex inverter) U3 appears to be missing--perhaps the unlabeled smaller blob-board?

The main board is a double sided circuit board and labeled GA306C. There's a clumping of 6 transistors, and another pair near the IR/light sensors connector, and two more near other input connectors. There's a whole bunch of surface mount capacitors, resistors, diodes, etc. Any of these components could be hacked, but I really doubt any of them would do anything particularly interesting.

By changing the bits stored in the EEPROM, one could likely change a furby's name, memory, states, crash the processor, etc. But, like the IR spoofing, you can only trigger pre-programmed behavior and not create new vocabulary or actions.

What about 'hacking' the IR communication?
Besides the basic switches and digital inputs, the Furby has a source of bi-directional I/O--the IR port. By using remote controls or any other source of IR signals, it is possible to fool the Furby's processor into responding to those signals as if it was another Furby. Of course, you can only trick the Furby into responding to one of its preprogrammed responses--you aren't going to have it speaking Mandarin or swear words this way.

By using a 'learning' remote, it may be possible to sample what signals are generated by a Furby and echo those back to Furby in hopes of getting him to respond. Of course, you would be limited to only using those signals which were previously generated by a Furby.

By using an oscilloscope, you could eavesdrop on the electrical signals driving the IR LED. This would allow you to see the exact pulse width and timing of the various Furby commands, and possibly generate them later using an IR source (such as an IR LED connected to your PC's parallel port, or your keyboard's CapsLock LED)

If you watch Furby through a camcorder, you can see the IR LED send signals.

How do I hack Furby using my Palm Pilot/Game Boy/electric nose hair trimmer/other small appliance?
We don't know, we haven't looked into the matter. As we stated elsewhere on this site, we aren't interested in hacking Furby. We have better things to do...like watch "Judge Judy", squeegee the fish tank, and watch marshmallow peeps go stale.

Can I use my laptop's otherwise useless IR port to command my army of Furbies into action?
Possibly, although keep in mind that your laptop's IR port is a SERIAL port, and doesn't really support arbitrary bit patterns, pulse widths, and timing. There is no reason why Furby's designers would have used the same communication protocols as are used by your laptop's serial port. It may (or may not) be possible to write a low level driver that controlled the IR port directly to generate IR pulses of arbitrary widths, patterns and timing, but I have not seen such a thing (yet).

Can Furby lay an "Easter egg"?
It is entirely possible that there could a certain pattern of input signals that could cause the Furby to enter a debug mode, or reveal otherwise inaccessible behavior. Personally, if I were designing the Furby, I would make such a signal to be a lengthy signal of IR pulses, as they would be the least likely to be accidentally or deliberately replicated in normal use. A Furby would likely never generate such a signal, so using a learning remote with sampled Furby IR pulses would never trigger such a mode. In order to find such a hidden command, one would need be able to send arbitrary commands to the Furby and spend a lot of time experimenting.