DEF CON 26 - zenofex - Dissecting the Teddy Ruxpin Reverse Engineering the Smart Bear

The Teddy Ruxpin is an iconic toy from the 1980's featuring an animatronic teddy bear that reads stories from cassette tapes to children. In late 2017, a new model of the toy was released with improvements including Bluetooth connectivity, LCD eyes, and a companion mobile application. While the new bear features a number of improvements, the Teddy Ruxpin's original ability to add new stories by replacing the included cassettes is no longer applicable, and it requires users to supply files to the bear in a proprietary format.
This presentation aims to show how the new Teddy Ruxpin was reverse engineered down to a very low level in order to create new content. I will reveal the inner workings of the hardware and software within the bear and document the process used to reverse engineer it. I will then examine the communication between the mobile application and Teddy Ruxpin as well as the custom structure of the digital books read by the bear. I will end the presentation by releasing a toolset that allows users to create their own stories followed by a demo showcasing the Teddy Ruxpin greeting the DEF CON audience.

[@CBMatt]

Does anyone happen to know how to get ahold of the TeddyRuxpwn? I'd really like to play around with it!

[@nickvuono5171]

Thanks for posting this. I've got one of these on my desk to repair for my daughter now. It powers on and the eyes light up but it won't start playing any stories so this gives me an idea what I'll find inside. The eyes light up with a default image but Teddy doesn't respond to pressing his hand to read a story. My best guess is either the hand switch is broken or the SD card isn't reading properly. The default initialization image for the eyes is likely in FLASH so it's probably getting through LCD init and then faulting. I just wish they'd implemented error codes where he could "blink 3 times to indicate flash error" or something

[@teddyruxpinchannel4906]

It is wierd that teddy is talking with grubbys part.

[@ImSnubUnfortunately]

Yea ikr I noticed that

[@JoCox4048]

The HACK THE PLANET clip that he programmed in Teddy starts at 16:40

[@GeorgeTsiros]

jesus christ that's terrifying

[@stevrgrs]

This is sick but the hardware is so cheap now you could just gut it , bypass everything, and actually make it BETTER LOL

[@Radical_person.25]

Aaaaaa