The Nabaztag runs a virtual machine on top of a PIC 18F. The PIC code handles all of the bootup, all the network stuff, the HTTP requests, and all of the actual hardware interface. The virtual machine gets new firmware via a type “5” HTTP response; this is the most interesting type of response. The bytecode is described in a datasheet published by Violet (which they’ve removed, so I’ve mirrored the HTML'd version; there’s also a Google translation (which has gone since Violet removed the datasheet - I’ve also mirrored the translation). The datasheet is a little sparse on details, and the translation doesn’t help - it calls the server a “waiter”, and the motors “engines”. Hmm.
The bytecode has around 90 instructions, and the virtual machine has access to 16 registers (although I think that the last one, R15, is the stack pointer). There’s an area of RAM in which the VM can store data, and up to 63 bytes which can be set remotely via a type “4” HTTP response and accessed via the “SRC” command.