Reversing My Tamagotchi Forever Evolution

My Tamagotchi Forever is a mobile application released in early 2018 that allows you to raise and care for your very own Tamagotchi. Like the Tamagotchi devices I’ve reversed in the past, the Tamagotchis in the game go through different stages of life (baby, toddler, teen and adult) and pursue different careers.

They also evolve into different characters as they get older, and there is a secret character that is more difficult to get than the others. There has been a lot of speculation on how to get the secret character (Gozarutuchi), but nothing seems to work consistently. The two rumors I heard was that feeding the teen nothing but grilled salmon would lead to the secret character and that feeding the Tamagotchi nothing at all as a teenager (which is really mean!) would do the same. I tried both of these, and both teens evolved into Mametchi instead. Fed up, I decided to reverse engineer the app, and find out the answer for once and for all!

So, I downloaded the APK file for the app, and unzipped it. Looking inside, it contained a large number of assets that are unusual for an APK file. In particular, it had a lot of DLL files even though it doesn’t run on Windows. Looking up some of the names of the DLLs, it turns out that the app was created using a framework called Unity, which is used to create multiplatform games.

Unity applications are written in C#, which I had no idea how to reverse engineer. Thankfully, someone asked this question on their support forums, and got an excellent answer. Loading the DLLs into dotPeek as recommended, they mostly decompiled and gave me code!

Thankfully, the app was written with descriptive variable names.

Browsing a bit, there was a class called TamagotchiID, which had a member called isSecret and also a member called onlyGainEvolutionPointsWhenItemPlaced.

This made me think that evolving the secret character involved placing an item in TamaTown (renovating TamaTown is an aspect of gameplay). But which item? Looking further, each TamagotchiID is serialized, and the object is deserialized from a hash.

Luckily, there was a file with the same name as the hash in the APK. Looking in this file, it was mostly incomprehensible, but there were six hashes in ASCII in the file. Could these be members of the TamagotchiID object, including the TownItem? Opening up the files with the same names as the hashes, one of them contained the string “Training course”. So I guess to get the secret character, you need to place the training course!

But what happens once the training course is placed? Looking for where the placement is checked, it is used to decide whether to add points for the secret character when it is fed (CanGetEvolutionPoints checks the training course placement).

What are these points used for? It looks like they are called during evolution! The following method looks like it selects the character with the most points, or returns a random character if more than one is tied.

Now I had a good idea of how evolution worked, but there was a major problem testing this. My Tamagotchi Forever only lets you raise one Tamagotchi per week, so it could take weeks to figure out whether this worked for sure! I looked at the code for a way to speed up time, and I found that there were a number of classes with the name Cheat in them. Investigating a bit more, they were reachable from a class called TweakPanel.

Unfortunately, this class kept checking a value called isDebugBuild which was false in the app. I decided to try changing this value to true. Unfortunately, the value was linked to a native bound getter, which means that the value is fetched from native code. I opened up the library that the app was getting the value from in IDA, but unfortunately, it wasn’t very clear how to change the value without learning a lot more about C# bindings. I eventually decided to stub out the check of this flag in the C# code instead. Looking up how to do this, I found a great tutorial.

Going through the steps in the tutorial, I made the method BuildHasTweakPanel always return true. I then replaced the main DLL in the unzipped APK directory with the patched one, and zipped it back up again. Then I signed and installed it. Starting up the app, it had a “Tweak Panel” button!

Pressing this button, there was a test panel!

This panel has a lot of features. It can change the current character, give you free money, increase your level and more! Everything a tester could want to test every feature of the game. Interestingly, the panel allows you to see and reset evolution points, and trigger the evolution timer. This made testing evolution a lot easier!

I then spent a lot of time feeding different teenagers different foods, and seeing the results. I eventually made this chart, which shows the effect that each food has towards obtaining each character.

To get a specific character, you have to feed it a combination of foods that make its score higher than that of any other character. I’ve explained the chart in more detail here.

So that’s it! That’s how you evolve your Tamagotchi, with seven digits of precision. And I was able to get my Gozarutchi, who immediately decided he wanted to be a hula dancer.

It turns out both of the rumors I heard about how to get the secret character were somewhat correct. Not feeding your teenage Tamagotchi will give you a random character, so it’s very possible you’ll get the secret one. Feeding your teen Tama nothing but grilled salmon will give you the secret character one third of the time if the training course is placed. So both of these probably happened.

One more fun thing I discovered while reversing. There’s a tiny easter egg in the credits screen.

If you click “My Tamagotchi Friends” three times in the credits screen, you can see the secret character, Gozarutchi in the tree behind the credits waving at you.

I’m happy to see him too!