More Fun with Syma 107 Reverse Engineering

Syma Reverse Engineering

[Jim] used a logic analyzer to do some in depth analysis of the Syma 107G helicopter’s IR protocol. We’ve seen work to reverse engineer this protocol in the past, but [Jim] has improved upon it.

Instead of reading the IR output of the controller, [Jim] connected a Saleae Logic directly to the controller’s circuitry. This allowed him to get more accurate timing, which helped him find out some new things about the protocol. He used this to create a detailed explanation of the protocol.

One of the major findings is that the controller used a 3 byte control packet, which contradicts past reverse engineering of the device. There’s also a new explanation of how multiple channels work. This allows multiple helicopters to be flown without the controllers interfering.

The write up is quite detailed, and explains the reverse engineering process. It also provides great information for anyone wanting to hack one of these low cost helicopters. From the details [Jim] worked out, it would be fairly easy to implement the protocol on your own hardware.

Reverse engineering a Syma 107 toy helicopter IR protocol

Half the fun of buying toys for your kids is getting your hands on them when they no longer play with them. [Kerry Wong] seems to be in this boat. He bought a Syma S107G helicopter for his son. The flying toy is IR controlled and he reverse engineered the protocol it uses. This isn’t the first time we’ve seen this type of thing with the toy. In fact, we already know the protocol has been sniffed and there is even a jammer project floating around out there. But we took a good look at this because of what you can learn from [Kerry’s] process.

He starts by connecting an IR photo diode to his oscilloscope. This gave him the timing between commands and allowed him to verify that the signals are encoded in a 38 kHz carrier signal. He then switched over to an IR module designed to demodulate this frequency. From there he captures and graphs all of the possible control configuration, establishing a timing and command set for the device. He finishes it off by building a replacement controller based on an Arduino. You can see a video of that hardware after the break.

Continue reading “Reverse engineering a Syma 107 toy helicopter IR protocol”

A Quadcopter from Scratch

Quadcopter

[AwesomeAwesomeness] wanted a low cost quadcopter, so he built one from scratch. Okay, not quite from scratch. [AA’s] cookie mix came in the form of an Arduino Uno and some motors. He started with motors and propellers from a Hubsan X4 quadcopter. Once the power system was specified, [AA] designed a frame, arms, and motor pods in Solidworks. He printed his parts out and had a sweet quadcopter that just needed a brain.

Rather than buy a pre-made control board, [AA] started with an Arduino Uno.  An Arduino alone can’t source enough current to drive the Hubsan motors. To handle this, [AA] added a ULN2003A  Darlington transistor array. The 2003A did work, but [AA] had some glitching issues. We think FETs would do much better in this application, especially when running PWM.

On the control side of things, [AA] added an MPU-6050 Triple Axis Accelerometer and Gyro breakout from SparkFun. The 6050 has 3 gyros and 3 accelerometers in one package. Plenty for a quadcopter.

All this left was the coding. Multicopters generally use Proportional-Integral-Derivative (PID) control loops to maintain stability in the air. [AA] used the Arduino PID library for his quadcopter. He actually created two PID instances – one for pitch and one for roll.

[AA] doesn’t have any videos of his quadcopter in action yet, and we’re guessing this is due in part to weight. Lifting an Uno, a perfboard, and a frame is a tall task for those motors. Going with a one of the many tiny Arduino’s out there would help reduce weight. In addition, [AA] could use a gear system similar to what is used in the Syma X series quadcopters. Stick with it – you’re on the right track!

 

Hackaday Links: February 28th, 2013

Xbox 360 control for a toy heli

links-xbox-helicopter-remote

[Jason] leveraged the IR control libraries for Arduino to use an Xbox 360 controller to fly his Syma S107G helicopter.

Windows 7 running on Raspberry Pi

links-win7-rpi

Why, oh god why? Well, the guys at Shackspace got their hands on a laser cutter that can only be driven with a Windows program. Their solution was to run Win7 on RPi as a virtual machine.

Twin-servos for your third hand

links-servo-third-hand

After growing tired of constantly flipping over the substrate being held with a third hand [Nidal] came up with a better way. He mounted his third hand on two servo motors so that it can be positioned with a joystick.

Depopulating SMD resistors

links-removing-smd-resistors

If you’ve ever tried to remove small surface mount resistors or capacitors with an iron you know it can be tricky. Take a look at the technique that [Scott] uses to remove the components.

Photographing the die of MSP430, Z80, PIC, and several other chips

links-decapping-chips

Here’s the latest work from [Michail] on photographing the die of various chips. You may remember reading his previous post on decapping chips with boiling sulfuric acid.

IR helicopter controller hacked into a Linux game pad

syma-linux-joystick

[Mike Kohn’s] Syma S107 helicopter wasn’t flying as well as it used to due to a broken gear, he figured he might as well find some use for the toy’s controller, since it was currently sitting around collecting dust. Having done a bunch of work with Syma IR protocols earlier this year, he decided it would be pretty easy to get the remote working as a game pad for his Linux desktop.

He patched an IR receiver into an MSP430 board, which decodes the incoming IR signals, sending them to his computer over a serial connection. [Mike] dug around in the Linux source for some good joystick driver code to borrow and found something that was close enough to work. After a bit of tweaking he loaded up his driver module and fired up Mame to give [Ms. Pacman] a try.

He says that the controller worked without much trouble, though as he discovered in previous projects, there are some quirks in the controller that make it somewhat less than convenient to use full time. Check out his site if you’re interested in taking a look at the code that he used to get things running.

Decoding, then cloning an IR helicopter toy’s control signals

[Mike Field] got his hands on this Syma S107 helicopter with the intention of hacking it. After playing around with it for a while he set out to build his own infrared controller for the toy. It seems there is some protocol information about it published in various forum posts, but he decided it would be more fun to figure it out for himself.

He started off trying to capture the IR signals using Adafruit’s tutorial which has come in handy on a number of other projects. He could get his television remote to register, but not the toy’s controller. This didn’t stop fun, instead he tore open the controller and grabbed a logic sniffer to see what’s being pushed to the IR LEDs. The signals are a bit curious. It seems two different packets are sent with each command which [Mike] thinks is for use with two different models of the toy. In addition to that the frames are not synchronized. But a bit of 10 MHz sampling helped him to figure everything out, and he believes he’s got a more accurate version of the protocol than had previously been discovered. To prove it he developed an FPGA-based controller using VHDL which he shows off in the clip after the break.

Continue reading “Decoding, then cloning an IR helicopter toy’s control signals”

Jam a remote helicopter

The Syma S107 IR is a popular little remote controlled helicopter. When a friend of [Michael]’s started flying one around the office he decided to try and jam the signal, creating a no fly zone. Luckily some people on the internet have already decoded the IR signals used by the flying menace. From there, a quick browsing of Mouser to source some LEDs, and to whip up some code for a TI MSP430 was all that was left.

The software on the micro controller is set to broadcast a “thrust off” signal, but [Michael] admits he is not 100% sure if the helicopter is actually receiving that, or if the signal from the no fly zone is mixing with the remote’s signal, causing garbage to be received. Either way when the helicopter gets in range of the no fly zone pad it drops from the air.

Things didn’t go perfectly though, overestimating the current capabilities of the MSP was causing the micro controller to reset and crash the debugger. But a simple rearrangement of how the signals are sent quickly solved this problem.

Join us after the break for a quick video.

Continue reading “Jam a remote helicopter”