Reverse-Engineering the ME2's USB with a Heat Gun and a Knife

To restore the USB sync method of the ME2 handheld, the flash chip was first removed from the device to dump it, then the internal structure was examined.

The main MCU was hidden under an epoxy glob-top, making identification difficult through normal methods. Even Ghidra couldn't decode it directly, so in the end, a heat gun and a knife were used to remove the glob-top and obtain a die shot.

As a result, it was determined that the chip belonged to the GeneralPlus GPL162002A/B family, and the firmware was analyzed based on the corresponding datasheet and μ'nSP instruction set materials.

During the analysis, it was confirmed that the key was not a standard path that looked like USB mass storage, but rather a vendor-specific command inserted by the manufacturer.

• read: reads flash contents
• program: writes to flash
• erase: resets bits in a specific region to 1

Userland code was written to call these commands directly via libusb/rusb, communicating with the device, and by comparing flash dumps from different score states, the points storage location was found.

In the end, it became possible to freely modify the handheld's score from a PC, successfully reviving the ME2's USB language without the lost dedicated software.