Introduction: Pixecutor - Run Software on a Mattel JuiceBox

This hack will allow user-written software to be run on a JuiceBox media player toy. It works by tricking the built-in picture viewer application to run code contained in a .JBP picture file that starts with a specific 8-byte sequence. Normal operation of the JuiceBox is not affected, other than the 1-out-of-18-quintillion chance of a real picture containing the trigger sequence.

You will need the following items and equipment:

  • A JuiceBox, either 2MB or 8MB. (To tell the difference: only 2MB units have a power-on LED, located above and to the right of the REWIND button.) Note that an 8MB unit does not necessarily allow larger programs to be run, the top 6MB normally just goes to waste.
  • A SD/MMC card adaptor for the JuiceBox, either the official one that came with the MP3 Starter Kit, or a homemade one as numerous people have built; a SD or MMC card of no more than 512MB capacity; and some way of copying files onto that card from a computer. Basically, you have to be able to use the built-in picture viewer application.
  • A soldering iron with a fine tip.
  • At least some knowledge of how to USE that soldering iron - I wouldn't recommend this as your first soldering project. You will need to be able to solder pins that are spaced 1/20" apart without bridging them.
  • Solder, preferrably of small diameter - I use 0.020" solder for fine work like this.
  • Tweezers and/or needle-nose pliers.
  • Wire cutters.
  • Small Phillips and flat-tip screwdrivers.
  • Electrical tape.
  • A magnifying glass would be very helpful.
  • Modding your JuiceBox to add a serial port is necessary for some Pixecutor programs (such as the one that gives you shell access), but there are still things you can do without a serial port.
  • A PIC microcontroller, specifically a PIC12F508-I/SN, programmed with the Pixecutor code found here: http://www.elinux.org/wiki/JuiceBoxPixecutor (try http://moin.elinux.org/wiki/JuiceBoxPixecutor if that site doesn't have the info). This is not something you're likely to be able to do yourself; even if you had a PIC programmer, you probably don't have the adapter needed to handle a SOIC-8 chip (and those aren't exactly cheap). I now sell programmed chips for those of you who aren't equipped to do it yourself. If anybody else out there wants to offer preprogrammed chips at a reasonable price, I'd be happy to link to you.

(So why didn't I use a DIP-8 chip that is compatible with readily-available PIC programmers? Two reasons: First, only a SOIC chip has the right pin spacing to sit directly on top of the pads it needs to connect to - a DIP chip would be a lot more work to install. Second, there simply isn't enough room available for a DIP - you'd have to cut a big hole into the battery compartment, forcing AC adaptor use only. If you weren't planning on ever using battery power anyway, and have a PIC programmer, feel free to use a DIP part (PIC12F508-I/P). The picture notes on step 2 should contain all the info you need for wiring it up.)

Step 1: Open Case, Remove Foil

Start by removing the four screws in the corners of the back cover. You don't need to remove the screw that holds the battery cover in place.

Carefully separate the two halves of the case - keep in mind that they're still connected together by wires at the bottom edge. (You could disconnect these wires and entirely separate the halves, but that's probably not worth the extra effort.) Make sure you find the little piece of plastic that just flew across the room - it's needed to hold the flip-up screen cover in place.

Position the unit as shown - LCD screen face down, cartridge slot to the right. All subsequent steps will show the unit in this same orientation.

You need to peel away at least part of the shielding foil on the back of the circuit board, starting in the corner between the volume control and headphone jack. Make sure you get the underlying layer of clear plastic, too, not just the copper foil. Make sure there are no slivers of foil left behind that could short something out.

Step 2: Prepare Pads

Locate six exposed pads on the circuit board that were underneath the removed foil - five in a rough line, plus one off by itself. These constitute a JTAG port, which the manufacturer uses for testing the board - and we can use for more nefarious purposes.

Get your soldering iron heated up, and apply a little bit of solder to four of these pads - the standalone one, and the center three of the row of five. DO NOT apply solder to the pads at the ends of the row, no connections are going to be made to them.

Unfortunately, the manufacturer did not anticipate that we were going to be soldering a microcontroller to these pads, and failed to provide pads with the necessary power supply. We are therefore going to have to use two short wires to bring power to the PIC from nearby traces. Clipped-off leads from a resistor (or other electronic component) work well for this, since they're designed for optimum solderability, but any fine-gauge wire should work. Locate the two spots indicated in the picture, and scrape off the soldermask in those areas - a small flat-tip screwdriver should work. Solder the wires flat to the board - they're probably too large to fit through the holes, and you don't know what's on the other side of the board at those points anyway. You want the wires to be headed more or less towards the bottom of the picture.

Step 3: Check Your Work So Far

After the previous step, the board should look something like this. Get out your magnifying glass, and look for shorts between any two pads or traces. (Yes, the top two JTAG pads look like they're connected in this image, but they really aren't - they're just too shiny for my scanner.) Fix any problems now, you may not be able to access them later.

Step 4: Prepare PIC

Now we need to do a bit of work on the PIC chip before it's ready to be soldered in place.

First, a note on pin numbering, in case you're not familiar with the subject. Pin 1 is indicated by a recessed dot on one corner of the top of the chip; the rest are sequentially numbered, going counter-clockwise around the chip. If you don't see a dot in one corner, you're probably looking at the bottom of the chip - flip it over!

These before & after pictures show the pin 1 dot in the upper left - however that is NOT the orientation in which it will be installed in the JuiceBox. Pay attention to the pictures! A PIC installed upside-down will probably not kill your JuiceBox, but neither is it going to accomplish anything...

Using needle-nose pliers, gently bend pins 1, 4, and 8 until they point straight outwards from the chip. The idea is to keep them from touching anything on the circuit board when the rest of the pins are soldered into place.

Apply a bit of solder to the top sides of pins 1 and 8 - that will probably be easier to do now rather than later. Don't bother with pin 4, it will not be connected to anything.

Step 5: PIC Placement

Now comes the moment of truth - soldering the PIC in place. Note that the pin 1 dot is now at the lower right of the picture!!!

The three unbent pins on the left side will individually connect to the three JTAG pads in a row that you applied solder to earlier. The two pins on the right side will both connect to the standalone JTAG pad - actually, only pin 3 needs to be connected, but there isn't anything better to do with pin 2, and it shouldn't be left floating. The PIC will line up with all these pads a bit better if tilted slightly to the left, as shown.

You should not need to apply any more solder in this step. The idea is to hold the PIC in place with tweezers, and apply a slight downward pressure while heating the pins on one side. As soon as the existing solder melts, remove the iron, but keep holding the PIC motionless with the tweezers until the solder resolidifies. Repeat with the other side.

Check your work again with the magnifier. There shouldn't be any solder bridges, except for the intentional one between pins 2 and 3. There shouldn't be anything touching any part of the circuit board that you weren't instructed to apply solder to. There should be three PIC pins that are completely unconnected at this point.

Step 6: The Last Two Connections

Cut the two wires if they're too long, and bend them so that their ends just touch PIC pins 1 and 8.

Solder the wires to the pins. You'll want to hold the wires in the middle with the pliers (to keep them from moving, and also to act as a heat sink). Apply the iron for as short a time as you can - the idea is to keep the wire from heating up to the point where the solder at the other end melts. That's why I have the wires loop around like this, longer than is strictly necessary - if they took the shortest possible path, it would be impossible to deal with only one end at a time.

Time for a last check with the magnifier - the wires shouldn't be touching ANYTHING other than the endpoints to which they are soldered. You may want to slide a piece of electrical tape underneath them to help ensure this. There should be one unconnected PIC pin left, and it's going to stay that way.

Step 7: Troubleshooting

Time to test your work! Grab the Pixecutor demo programs from here ( or http://moin.elinux.org/wiki/JuiceBoxPixecutor if that doesn't work). Copy them to your memory card (root directory only - the picture viewer doesn't support folders). Insert card and adapter into JuiceBox. Install batteries or plug in the AC adapter, and bravely turn it on!

If the JuiceBox doesn't work normally, check the soldering of pin 5 first. If that isn't it, you've probably managed to make an accidental connection to some pad or trace you shouldn't have touched at all. No other likely mistake involving only the pads you were supposed to solder to would have this effect. Checking your work again, perhaps with a better magnifying glass, is all I can really suggest if this happens.

At this point, you should be in the picture viewer (or perhaps a menu that allows you to choose either the picture viewer or the MP3 player). Select one of the demo programs as if it were a picture - TINYGL_SPIN, perhaps.

You will, at least briefly, see a screen that's mostly garbage - after all, these programs aren't REALLY pictures. If that screen remains, and contains text that reads "REQUIRES PIXECUTOR", the Pixecutor completely failed to trigger. Perhaps you have a solder bridge, or one of the PIC pins isn't actually soldered to the pad beneath it. (Pin 6 seems to be the most likely place for this to happen, since it's between two other pins. Try wiggling it gently with a small screwdriver tip - if it can move from side to side, it's obviously not soldered.)

If the screen contains garbage, but no "REQUIRES PIXECUTOR" message, then the program actually ran - the first thing the programs do is clear that message from the screen. If the screen stays that way, perhaps the program crashed for some reason, or it simply wasn't intended to display anything. For example, the SHELLY program launches a command shell on the serial port. Unless you have a serial port mod installed, and use it to issue some command that affects the screen, nothing is going to appear to happen on the JuiceBox.

Generally, the way to exit a Pixecutor program is to turn the JuiceBox off and back on. It's possible for programs to be written that can exit back to the picture viewer when done, but this limits what they can do, so I doubt there will be many such programs.

If for some reason you want to completely disable the Pixecutor, this can be done without completely desoldering it. Just connect PIC pin 4 (the one that's not currently connected to anything) to ground - a nearby area of the shielding foil will work. This will keep the PIC permanently in a reset state, so any remaining effects on JuiceBox operation have to be due to soldering-related problems.

Step 8: Closing Up

Ok, your Pixecutor is hopefully working now, time to put the case back together.

Before you do so, it's critical that you put a piece of electrical tape over the PIC - otherwise, it will be shorted out by the conductive coating on the inside of the back cover.

If you have a Dremel or similar tool, you may want to grind away some of the back plastic at the point where the PIC would touch it. (You can get the case back together without doing this, but it's a tight fit.) You don't necessarily have to cut all the way through the plastic, just make it a bit thinner in that area.

Fit the case halves together, ignoring the flip-up cover for now. Put that little piece of plastic back in at the last moment; it's one of the pegs that the cover pivots on. Note that it goes in upside-down relative to the peg on the other side (that's held in place with a screw). Replace the four screws you removed. Snap the screen cover back onto the pegs, assuming that you want to use it. Enjoy your juicier JuiceBox!

If you'd like to write your own JuiceBox software, the available info on doing so can be found at http://www.elinux.org/wiki/JuiceBoxPixecutor/PixecutorDevelopment .