Reverse engineering an RF clicker
posted Jul 5th 2010 9:00am by Caleb Kraftfiled under: classic hacks, wireless hacks

[Travis Goodspeed] has pulled apart a TurningPoint response card, which is an RF device for answering quizzes, attendance checks, and casting votes in a classroom setting. After tearing it apart, he set out to reverse engineer it and managed to get quite a lot done. At this point he can spoof cards, so he could fake his or several people’s attendance. He can also sniff the packets as they are sent, opening up a plethora of opportunities to mischief. The one that was mentioned in the tip line was to simply repeat the answer that was most often sent for the quizzes. The writeup is very detailed and has great pictures. Good job [Travis].
[thanks Springuin]






I was planning on doing this with my clicker as well (brand: einstruction). It runs a Motorola cpu with a separate RF chip and firmware is on a eeprom. It also has 6 test pins labelled PROG in the battery compartment.