The Syma S107 IR is a popular little remote controlled helicopter. When a friend of [Michael]’s started flying one around the office he decided to try and jam the signal, creating a no fly zone. Luckily some people on the internet have already decoded the IR signals used by the flying menace. From there, a quick browsing of Mouser to source some LEDs, and to whip up some code for a TI MSP430 was all that was left.
The software on the micro controller is set to broadcast a “thrust off” signal, but [Michael] admits he is not 100% sure if the helicopter is actually receiving that, or if the signal from the no fly zone is mixing with the remote’s signal, causing garbage to be received. Either way when the helicopter gets in range of the no fly zone pad it drops from the air.
Things didn’t go perfectly though, overestimating the current capabilities of the MSP was causing the micro controller to reset and crash the debugger. But a simple rearrangement of how the signals are sent quickly solved this problem.
Join us after the break for a quick video.
39 thoughts on “Jam A Remote Helicopter”
What about a spread signal? A continuously looping signal? I know from the airhog heli’s that simple direct sunlight will mess with them. So, maybe some artificial sunlight in the office? Maybe it will make your coworkers a little happier too.
Good hack though! Got one to disable only text msgs at the workplace?
Most IR communications are modulated at something like 39kHz. Anything without the carrier signal is rejected by the IR receiver itself.
That’s the theory. But as danmanalready said: A lot of sunlight will interfere with the IR communication of those helicopters.
As for the hack itself: It would be sweet to have a function do decrease the thrust slowly to land the annoying thing gently at the press of a button.
or go full thrust, and take it as high as it will go!
Think Kiosk in a large mall, these helicopters buzzing around anoyingly, all of a sudden the helicopter makes a break for the skylight trying to escape!
The reason bright sunlight blocks it is it overloads the sensor, so it can’t receive the modulated signal. For an example of this that you can observe, take a small, red night light bulb. Right next to it, put a 100W flood light. Stand back a ways. Have someone control if the night light is on or not. You will notice that it is virtually impossible to tell if the night light is on or not, as the spotlight is overdriving your inputs.
@trebu: LOL now that would be awesome!
Yes, but that’s assuming no other input.
The background ‘noise’ is added to the modulated signal. If the sensor is ‘overloaded’ then you can’t “hear” the modulated signal to begin with.
Imagine your receiver could handle anything up to 10 lumens. Your modulated signal was 0 to 2 lumens. Now, try and operate this in a room with 9 lumens of ambient light… you’re only going to get half the waveform. Bring that even higher and you lose even more – beyond 10 lumens ambient you can’t see it at all.
Funnily enough or maybe to be expected the protocol seems to be the same one used for the Syma026 helicopter:
(and here’s a dedicated board for this protocol:
I have a coworker who is always buying these “for his kids” and bringing them to the office. Does he let anyone else have a go? Nope!
Jam it? Boooooring! Shoot it down!
Yeah, isn’t that what those USB Missile Launchers are for? Office SAM site?
Is the helicopter receive only or does it emit a signal of some kind the SAM can lock on to? Maybe use a directional microphone to listen for that tell-tale buzzing. Not sure if that would provide enough resolution for a hit though…
Yea, they are usually RX only.
Sounds like a good use for that cheap phased array radar MIT built.
He used a high gain transistor…yet put a 100ohm resistor in the base….which draws 25mA out of the micro for nothing. That resistor can easily be 20 times higher, that is what the transistor is there for. Given the 4.7 ohm resistor in series with the led the current through it is >300mA, higher than the allowable.
Also the reset might be caused by a missing 100n capacitor across the micro. (it might be somewhere hidden, but it does not appear in the schematic).
Apart from this, the IR receiver sensors are mounted incorrectly, their sensitivity is higher in another direction.
Criticism aside, i need one of these for the same purpose, but i think things can be simplified: just sent the OFF command continuously through high power IR LEDs, no IR receivers, or even better some sort of bursts which will ruin the commands received.
Very much this, though I think I see where things went wrong. when looking at the Hfe tables I noticed this model is rated for 70HFE(high current worst case) all the way up to 1500HFE. but in this case the beta would be around 450. I think he just made an assumption for the worst though that value is off. also on the protoboard there are two caps not shown on the schematic, look right above the linear regulator.
I haven’t done any analysis so this may or may not have anything to do with his problems but the wire from the bypass capacitor at the output of the linear regulator to the micro has some inductance. This will slow instantaneous current available to the micro when it’s switching loads. That could cause an instantaneous drop in voltage at the micro. Do the TI parts have low-voltage detection and reset?
In general one should bypass both at the regulator (for stability of its internal feedback circuits) and at the micro itself.
Bogdan, thank you for pointing that out. I way mis-calculated that resistor or accidentally grabbed the wrong resistor when soldering. I’ll change it and see how it does. Btw, if you’re referring to the LED taking >300mA being bad… I believe the spec sheet says the LED can do 100mA continuous and up to 1A pulsed. Since I’m pulsing this quite a bit, I’m going over 100mA on the LED.
All you need is a 555 timer set for the carrier frequency and some high output LED with a transistor to create a jammer. To generate high current output for an led use a darlington arrangement for the transistors.
So thats how Iran downed that U.S. drone a while ago.
I have aways wanted to do the same thing with a xbox 360 controller. has anyone done that yet?
From what I’ve come to understand 360 uses a non-standard bluetooth setup which makes it impossible to connect with normal bluetooth devices (sadly) and I’d assume this also implies it uses frequency hopping to avoid being jammed. not impossible but you’d likely be jamming other signals all around as well.
The right antenna and some FFT work and you can step your jammer to the frequency the controller switches to.
Even more interesting since this discovery:
This would fit right in – you have a normally relatively empty spectrum with a pair of spikes for the controller (one RX, one TX) – lock on and jam away!
Ah, I forget. Since you’re generating the jamming signal, you can cancel it out on the jammer’s RX with some tuning. Meaning, all the power you spew to stuff the controller won’t deafen your own ear ;)
Does the Syma s107 have the same ir codes as the World Tech Toys s107 helicopter. The transmitter and the helicopter aren’t different looking. I wanted to control the helicopter from a Wii nunck and an Uno.
Someone should try and do a “cluster hack” which allows a single transmitter to control multiple helicopters in formation with each one staying on set position within the formation.
That would be badass…
Flying POV anyone?
That would only work assuming each copter was physically the same, and experienced the same exact airflows.
You’d have to have some kind of positional feedback, and send “trimming” inputs to each individual copter. At that point, you might as well just control each individually, using the computer to direct them to their appropriate positions.
HelicopterBgone? Just like tvBgone technology doesn’t address the underlying problem(s). A supervisor, and/or fellow employees that puts up with such nonsense. Personally I would have taken a lower tech, more satisfying approach, an over sized flyswatter. I’d think the lower tech high tech method would be to flood an area with enough IR energy as to desensitize the copter’s IR receiver. In this case I’d make the entire room a no fly zone
someone know how to make a mod to stabilize and fly a routine in times of “Rx downtimes?”
Just use a Tennis Racket, easier, and way way way more effective.
i have a ir helicopter but the remote of that thing turn my tv and cabelbox do things. it turn it off or go to next chanel.
but i have the idee why decode the ir
if you can take a old mic cabel take the mic off and put the ir led on it. put it in your mic poort from your pc and rec the nois it pick up.
now put the cabel in the audio and play the sound rec from the ir. i think it will work.
i see thinks for the iphone work that way that you can buy in stors
I have done a tvBgon type of “IR Bomb” before that is driven by a PIC that transmits as many IR remote “off” commands that I could find. I use a mosfet and a mosfet driver to get the higher current needed to drive several IR LEDs. You just have to know the duty cycle that the LEDs can handle at what current and stay below that with your current limiting scheme. The timing of the “off” signals and as many as there are can make things a bit slow though cycling till there is a hit for a particular TV or device.
I have also built a tester for my Laser Jammer thats on my car for those pesky State troopers that simply mimics the pulse profile for several models of lidar guns to make sure it’s at least rx’ing IR. It’s based around some of the same ideas as the tv remote spoofer, but there is no “carrier” frequency and it just simply pulsing at a few set frequencies. The Jammer itself is a store bought model and uses laser diodes. There are a lot of guys that are trying to build their own Jammers using LEDs or laser diodes, but find the switching speeds, current and IR output to be a major challenge. I’d like to see some progress there, as the cost of the professional jammers is a little steep.
Cool project, However; I just hope no one gets wacked in the face with an out-of-control toy helicopter!
That’s what I was thinking; a no-fly zone could quickly become a crash zone with such a jammer. If the range is sufficiently large, the helicopter would probably crash before reaching you, but I doubt your co-workers who a inside a ring-shaped crash zone around you would appreciate it.
Regarding the maximum LED current; many remote controls use about 25% duty cycle (so 25% on, 75% off at the carrier frequency of 36-40kHz) to preserve battery power, and to allow for higher LED peak currents. Also, most protocols (like RC5, RC6, and other manchester-encoded schemes) only transmit the carrier 50% of the time, at a reasonably high bitrate, with fairly long periods between the messages, so the average LED power is still fairly low.
You’re doing it wrong… Scale it down to one emitter, highly directional, where some skill is required to shoot the things down. Get it as small as the little video cameras on some of these things and have dogfights.
That’s an awesome idea!
I have so many IR remote(each remote can control only its brand by switchable to A,B,C band). I am looking for 1 IR remote which it can control all of them. Does any one have a solution.
you should make it and sold online ;)
Please be kind and respectful to help make the comments section excellent. (Comment Policy)