I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find any info on it) draws data from a 16MB flash that contains about 4.5 hours of audio. This averages somewhere near 8kbit/sec, putting us in speech codec territory. There are 3 differnet "tracks", and I'm looking for help to identify or reverse engineer the specific audio format.
I've extracted the ROM and using a logic analyzer have determined where it gets read and how often - while playing it seems to draw down 6 bytes in rapid succession, 2 bytes after a 20μs pause, 2 more bytes 72μs later, then does a variable amount of 2 bytes reads (around 11-20ish) every 35-110μs. These cycles repeat differently for every track - 39ms for track 1, 19ms for track 2, and 39ms or so for track 3. This seems to imply that we have a variable rate codec and the tracks are of diffrent bitrates, but the same codec across all tracks.
This thing was built to cost in China so I'd be shocked if they didn't just use an off the shelf codec... I was thinking something like MP3 or maybe even G729 as the audio quality isn't exactly stellar, but I haven't been able to tease out anything recognizealbe when I try raw imports to Audacity or VLC... Looking at the data in a hex editor doesn't show any evidence of MPEG frames, but its possible that it's somehow XOR encrypted or otherwise obfuscated... All it seems to do to validate it's found a track after looking at the address table is look at the first 2 bytes, which are always 4B 00. So whatever it is isn't readily recognized on a PC.
Anyone come across this kind of thing before? ROM and logic traces are here, low production values YouTube showing the thing in detail is here - would appreciate any insights peolpe might have to help further this mission!
