Page 37 - Cyber Warnings

Hello Barbie main circuit board. Back side. Showing LEDs, test points, and main button.

Looking at the main circuit board, we identified a number of significant chips, modules, and
signal connections.

At the far left of the topside of the board is the AzureWave AW-CU300E 802.11 b/g/n WiFi
Microcontroller Module (M1), which builds upon the Marvell 88MW300. In a press release,
Marvell pointed out that this module ”provides both the Wi-Fi connection as well as the
microcontroller to run Hello Barbie firmware.” This means that the mainboard is composed of a
Wi-Fi MCU System-on-Chip (SoC) where everything else connected to it is a peripheral. This is
interesting because Marvell is essentially providing IoT board designers a simple Internet-ready
drop-in module for all their devices. We can imagine lots of IoT devices being designed using
these sorts of ready-made network computer modules in the future.

The Nuvoton NAU8810 24-bit audio codec (U1), is located on the lower-middle half of the
board. It provides ADC, DAC, gain, and input/output mixers for both the doll’s microphone and
speaker. It also has an I2C bus connector (J7) near the bottom-right corner. The chip to the left
of the AW-CU300E is a Gigadevice GD25Q16 16Mbit SPI Flash (U2), and is the system’s main
non-volatile memory. This is where the doll's firmware and resource files are stored.

The other chips populating the board are most likely power related (battery charger, voltage
regulator, etc.), as well as what looks like a JTAG connector (J110). We immediately focused
our attention on the flash memory chip...

Screenshot of firmware being dumped from Barbie's flash memory.

37 Cyber Warnings E-Magazine – February 2016 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide