More Fun with Syma 107 Reverse Engineering

Syma Reverse Engineering

[Jim] used a logic analyzer to do some in depth analysis of the Syma 107G helicopter’s IR protocol. We’ve seen work to reverse engineer this protocol in the past, but [Jim] has improved upon it.

Instead of reading the IR output of the controller, [Jim] connected a Saleae Logic directly to the controller’s circuitry. This allowed him to get more accurate timing, which helped him find out some new things about the protocol. He used this to create a detailed explanation of the protocol.

One of the major findings is that the controller used a 3 byte control packet, which contradicts past reverse engineering of the device. There’s also a new explanation of how multiple channels work. This allows multiple helicopters to be flown without the controllers interfering.

The write up is quite detailed, and explains the reverse engineering process. It also provides great information for anyone wanting to hack one of these low cost helicopters. From the details [Jim] worked out, it would be fairly easy to implement the protocol on your own hardware.

Reverse engineering a Syma 107 toy helicopter IR protocol

Half the fun of buying toys for your kids is getting your hands on them when they no longer play with them. [Kerry Wong] seems to be in this boat. He bought a Syma S107G helicopter for his son. The flying toy is IR controlled and he reverse engineered the protocol it uses. This isn’t the first time we’ve seen this type of thing with the toy. In fact, we already know the protocol has been sniffed and there is even a jammer project floating around out there. But we took a good look at this because of what you can learn from [Kerry’s] process.

He starts by connecting an IR photo diode to his oscilloscope. This gave him the timing between commands and allowed him to verify that the signals are encoded in a 38 kHz carrier signal. He then switched over to an IR module designed to demodulate this frequency. From there he captures and graphs all of the possible control configuration, establishing a timing and command set for the device. He finishes it off by building a replacement controller based on an Arduino. You can see a video of that hardware after the break.

Continue reading “Reverse engineering a Syma 107 toy helicopter IR protocol”

Controlling A Micro Helicopter with a PS2 Controller

The Syma S107G is a venerable stalwart of the micro helicopter market. Affordable, robust, and ubiquitous, the S107G relies on infrared to receive its control signals. Emboldened by the prior work of others, [Robert] set out to control his with a Playstation 2 controller.

In this project, [Robert] is standing on the shoulders of giants, so to speak – we’ve seen others reverse engineer the S107G’s communications protocol before. [Robert] combined the efforts of several others to understand how to send commands to the helicopter, including use of two separate channels for controlling two at once.

With the knowledge of the necessary protocols, it’s then a matter of hooking up 3 LEDs in a somewhat unconventional series arrangement with a 9 volt supply, to be switched by an Arduino hooked up to a computer. A Javascript application running on the computer reads the state of a Playstation 2 controller, and spits it out over serial to the Arduino, which flashes the LEDs.

It’s not the neatest, most lightweight way of building a new controller for your remote control toy, but it does show how quickly one can throw together a project in a weekend by combining modern hardware and software tools. Plus, it’s a great learning experience on a platform that’s been experimented with the world over.

A Quadcopter from Scratch


[AwesomeAwesomeness] wanted a low cost quadcopter, so he built one from scratch. Okay, not quite from scratch. [AA’s] cookie mix came in the form of an Arduino Uno and some motors. He started with motors and propellers from a Hubsan X4 quadcopter. Once the power system was specified, [AA] designed a frame, arms, and motor pods in Solidworks. He printed his parts out and had a sweet quadcopter that just needed a brain.

Rather than buy a pre-made control board, [AA] started with an Arduino Uno.  An Arduino alone can’t source enough current to drive the Hubsan motors. To handle this, [AA] added a ULN2003A  Darlington transistor array. The 2003A did work, but [AA] had some glitching issues. We think FETs would do much better in this application, especially when running PWM.

On the control side of things, [AA] added an MPU-6050 Triple Axis Accelerometer and Gyro breakout from SparkFun. The 6050 has 3 gyros and 3 accelerometers in one package. Plenty for a quadcopter.

All this left was the coding. Multicopters generally use Proportional-Integral-Derivative (PID) control loops to maintain stability in the air. [AA] used the Arduino PID library for his quadcopter. He actually created two PID instances – one for pitch and one for roll.

[AA] doesn’t have any videos of his quadcopter in action yet, and we’re guessing this is due in part to weight. Lifting an Uno, a perfboard, and a frame is a tall task for those motors. Going with a one of the many tiny Arduino’s out there would help reduce weight. In addition, [AA] could use a gear system similar to what is used in the Syma X series quadcopters. Stick with it – you’re on the right track!


Hackaday Links: February 28th, 2013

Xbox 360 control for a toy heli


[Jason] leveraged the IR control libraries for Arduino to use an Xbox 360 controller to fly his Syma S107G helicopter.

Windows 7 running on Raspberry Pi


Why, oh god why? Well, the guys at Shackspace got their hands on a laser cutter that can only be driven with a Windows program. Their solution was to run Win7 on RPi as a virtual machine.

Twin-servos for your third hand


After growing tired of constantly flipping over the substrate being held with a third hand [Nidal] came up with a better way. He mounted his third hand on two servo motors so that it can be positioned with a joystick.

Depopulating SMD resistors


If you’ve ever tried to remove small surface mount resistors or capacitors with an iron you know it can be tricky. Take a look at the technique that [Scott] uses to remove the components.

Photographing the die of MSP430, Z80, PIC, and several other chips


Here’s the latest work from [Michail] on photographing the die of various chips. You may remember reading his previous post on decapping chips with boiling sulfuric acid.

IR helicopter controller hacked into a Linux game pad


[Mike Kohn’s] Syma S107 helicopter wasn’t flying as well as it used to due to a broken gear, he figured he might as well find some use for the toy’s controller, since it was currently sitting around collecting dust. Having done a bunch of work with Syma IR protocols earlier this year, he decided it would be pretty easy to get the remote working as a game pad for his Linux desktop.

He patched an IR receiver into an MSP430 board, which decodes the incoming IR signals, sending them to his computer over a serial connection. [Mike] dug around in the Linux source for some good joystick driver code to borrow and found something that was close enough to work. After a bit of tweaking he loaded up his driver module and fired up Mame to give [Ms. Pacman] a try.

He says that the controller worked without much trouble, though as he discovered in previous projects, there are some quirks in the controller that make it somewhat less than convenient to use full time. Check out his site if you’re interested in taking a look at the code that he used to get things running.

Decoding, then cloning an IR helicopter toy’s control signals

[Mike Field] got his hands on this Syma S107 helicopter with the intention of hacking it. After playing around with it for a while he set out to build his own infrared controller for the toy. It seems there is some protocol information about it published in various forum posts, but he decided it would be more fun to figure it out for himself.

He started off trying to capture the IR signals using Adafruit’s tutorial which has come in handy on a number of other projects. He could get his television remote to register, but not the toy’s controller. This didn’t stop fun, instead he tore open the controller and grabbed a logic sniffer to see what’s being pushed to the IR LEDs. The signals are a bit curious. It seems two different packets are sent with each command which [Mike] thinks is for use with two different models of the toy. In addition to that the frames are not synchronized. But a bit of 10 MHz sampling helped him to figure everything out, and he believes he’s got a more accurate version of the protocol than had previously been discovered. To prove it he developed an FPGA-based controller using VHDL which he shows off in the clip after the break.

Continue reading “Decoding, then cloning an IR helicopter toy’s control signals”