BE Modded: Exploring and hacking the Vital Bracelet ecosystem

The Vital Bracelet series, active from 2021 to 2024, was a line of toys that revolved around a number of fitness bracelets that encouraged exercise by raising characters from the Digimon series, and expanding into tokusatsu and popular anime characters later. Think of it as Tamagotchi, but nurturing through exercise instead of button presses. In this presentation, we'll look at the different parts of this series' ecosystem, how they work, and the different ways to circumvent various security measures and customize the devices' behavior. We start by looking at the first Vital Bracelet, with a quick introduction to hardware reverse engineering and how to dump firmware out of flash. Following that, we will take a look at the microcontroller used in the devices, and its obscure instruction set architecture. This will lead into an exploration of how to reverse engineer code when you are missing a significant portion of it, and how the embedded ROM was dumped. After this, we will look at the DRM applied to content, and how it was circumvented. Next, the device's NFC capabilities will be explored. With the release of the Vital Bracelet BE, which introduced upgradable firmware, came new challenges and opportunities. We will take a look at the new content format and additional DRM measures it incorporated, plus how the device's bootloader was dumped despite its signature verification scheme. Finally, we will take a look at the process for modding the various Vital Bracelet releases, and some techniques to use while writing patches. The material in this talk can be applied beyond just the Vital Bracelet series, and can be useful if you want to explore other electronic toys, or just hardware reverse engineering in general.