Hacking the CPU and ROM at the hardware level are pretty unlikely for the average hacker, given their single-molded blob and custom mask contruction. Replacing them with a custom PCB might be feasible, if you could reverse engineer the 12 and 25 pinouts of the daughtercards. Of course, you'd have to write your own ROMs from scratch, use a different CPU which probably wouldn't fit under the carapace, etc. If you would bother with all that, why not just start from scratch and make your own animated creature with more capabilities?
Hacking the cams and levers might be possible -- by changing the shapes of the cams and grooves in the wheels of the main gearing system, you can change when Furby's eyes open and close, mouth moves, etc. It may be possible to take the existing cams and gears and simply rotate them 90 degrees relative to their neighbors (the main shaft is square) which may have the same effect. This probably would not be very exciting, since the software will still act exactly the same. He just might start sleeping with his eyes open, leave his mouth hanging open, etc. which might just be disconcerting rather than entertaining. It'd also be pretty likely to cause more jam-ups in the already delicate workings.
I've heard the Furby is Macintosh / Apple II / Linux / BeOS based...is this true?
A Furby is not an Apple II, nor an Apple Macintosh. All that was said was that the Furby used a processor that was roughly equal in performance to the original 6502--which could mean any number of things: It could be any 8 bit processor running at 1Mhz, not necessarily a 6502. It could be a 4 bit microcontroller capable of roughly the same amount of raw processing. It could be a completely custom processor design.
Given the observed limited range of the Furby's behavior, its designers could have implemented the Furby software with a very simple processor. Anything more would have been inefficient, a wasteful and unnecessary added expense. Despite the current capitalistic explosion, this is a toy meant to retail for $30, which means it has to cost far less than that to make--including motors, gears, speaker, IR interface, fur, plastic, assembly costs, packaging, and shipping. Microsoft's "Actimates" toys are far more complex electronically, and thus cost more, but also have much more hacking potential.
Can I burn a new ROM for the Furby? Can I interface the Furby to X/Y/Z peripheral? Can I reprogram him to speak like Beavis?
Making a custom chip mask may sound expensive, but remember they are making a few million of these things: the savings in reduced assembly complexity, component supply and mark-up, circuit board size, etc. offsets the initial set-up cost. Additionally, it protects their invention from being easily copied or reverse engineered, since in order to get to the juicy bits, one needs acid, powerful microscopes, lots of time and specialized skills. (Of course, doing this would destroy the chip and ruin any hacking opportunities). For most companies, it would probably be cheaper for them to hire an engineer to design something original.
We can make some educated guesses based on rumors, common sense, clues from the circuit board labels, and the state of custom chip performance & pricing, but unless we hear from someone knowledgeable at Tiger, we won't know for sure exactly what silicon secrets are really inside those black blobs.
In the case of the Furby, there are two discreet epoxy blobs, one slightly larger than the other. There are many potential reasons this was done. They may have designed the CPU instruction ROMs as a separate chunk of silicon for easier updates to the software. Or it may be the audio data for easier foreign language support. They may have broken apart some interface functionality to a separate chip--such as audio playback. With a tool such as a logic analyzer (or at least a storage oscilloscope) and time, it may be possible to reverse engineer the exact interaction between these two epoxy chunks. If it turned out there was a bus between the two custom chips, and one were just a ROM of some sort, it may be possible to replace it with another ROM, although substantial effort would be needed to decipher the pin connections.
My best guess is the larger blob-board is the CPU, instruction ROMs, a few bytes of RAM, and digital I/O. (the audio, IR and light signals come in as single bit digital inputs, not analog signals.) The smaller blob-board is the audio playback controller, audio storage and a DAC. (thus making a French or Spanish speaking Furby would require making a new chip mask of only the ROM portion of the smaller blob-chip). Given the small storage space available and the large bandwidth requirements of audio, the Furby probably has highly (lossy) compressed sound data and good luck deciphering that format...
I don't care if the ROMs and CPU are sealed tighter than Tut's tomb, I want some details on the circuit boards and chips so I can hack Furby!
The CPU would need to interface with: 9 inputs (IR, sound, light, motor speed, motor position, tickle, pet, feed, inversion), 2 outputs (IR, motor), power, ground, and 6 connectors to smaller blob-board (audio?). That's 19 of the 25 pins. (reset may be handled a little differently, such as power interruption, but it could also be one of the pins to the CPU).
The smaller blob-board has 12 pins, 6 of which connect to the larger board, power, ground, and 2 speaker wires. That's 10 of the 12 pins.
There are a few other chips on the main board, which appear to be standard surface mount ICs: An 8 pin chip, U2, with the markings HT93LC46 9816W4023-1 (EEPROM -- Non volatile storage for furby's "memory") A 14pin chip, U4 with markings KA324AD C827B (OpAmp) A 14pin chip, U5 with markings 74HC14D B34280PC Hnn9740. (Hex inverter) U3 appears to be missing--perhaps the unlabeled smaller blob-board?
The main board is a double sided circuit board and labeled GA306C. There's a clumping of 6 transistors, and another pair near the IR/light sensors connector, and two more near other input connectors. There's a whole bunch of surface mount capacitors, resistors, diodes, etc. Any of these components could be hacked, but I really doubt any of them would do anything particularly interesting.
By changing the bits stored in the EEPROM, one could likely change a furby's name, memory, states, crash the processor, etc. But, like the IR spoofing, you can only trigger pre-programmed behavior and not create new vocabulary or actions.
What about 'hacking' the IR communication?
By using a 'learning' remote, it may be possible to sample what signals are generated by a Furby and echo those back to Furby in hopes of getting him to respond. Of course, you would be limited to only using those signals which were previously generated by a Furby.
By using an oscilloscope, you could eavesdrop on the electrical signals driving the IR LED. This would allow you to see the exact pulse width and timing of the various Furby commands, and possibly generate them later using an IR source (such as an IR LED connected to your PC's parallel port, or your keyboard's CapsLock LED)
If you watch Furby through a camcorder, you can see the IR LED send signals.
How do I hack Furby using my Palm Pilot/Game Boy/electric nose hair trimmer/other small appliance?
Can I use my laptop's otherwise useless IR port to command my army of Furbies into action?
Can Furby lay an "Easter egg"?