Decoding, Then Cloning An IR Helicopter Toy’s Control Signals

[Mike Field] got his hands on this Syma S107 helicopter with the intention of hacking it. After playing around with it for a while he set out to build his own infrared controller for the toy. It seems there is some protocol information about it published in various forum posts, but he decided it would be more fun to figure it out for himself.

He started off trying to capture the IR signals using Adafruit’s tutorial which has come in handy on a number of other projects. He could get his television remote to register, but not the toy’s controller. This didn’t stop fun, instead he tore open the controller and grabbed a logic sniffer to see what’s being pushed to the IR LEDs. The signals are a bit curious. It seems two different packets are sent with each command which [Mike] thinks is for use with two different models of the toy. In addition to that the frames are not synchronized. But a bit of 10 MHz sampling helped him to figure everything out, and he believes he’s got a more accurate version of the protocol than had previously been discovered. To prove it he developed an FPGA-based controller using VHDL which he shows off in the clip after the break.


14 thoughts on “Decoding, Then Cloning An IR Helicopter Toy’s Control Signals

  1. Done, demonstrated, with lots of lulz at Defcon414 meeting a few months back. Kit available for $10ish from dc414 :)

    The unit pirates the chopper’s signals, then you take it over just like INVASION OF THE BODY SNATCHERS

    Dont ya love things like this? I sure do.

  2. Little hint, the LiPo batteries quickly degrade in storage.
    I’ve had some success doing a discharge/recharge cycle or 10 out of the helicopter, but usually the internal resistance is too high..
    Maybe replace the battery with one of those >50F supercaps?

  3. I recently did a similar thing for the RF protocol (actually the serial protocol the transmitter uses to talk to its own RF module) to write an android app that can read the control outputs from the transmitter for a Blade MSRx. (actually I didn’t even discover the protocol, I just wrote the android app) Then I bought an extra transmitter, flipped things around, and made it so I can fly the helicopter with my phone. Its very difficult not to crash, but it does technically work.

    I haven’t gotten around to documenting it properly, and the code isn’t quite ready even for a basic release, but it is on GitHub if anyone wants to mess with it. If you want more info, bug me on the youtube page and I’ll get around to documenting it.

    I had forgotten, but it looks like I did put a decent amount of info in the readme. Still, I had hoped I’d clean up the code a bit more and shoot a new video showing the flying of the heli.

    HAD if you want to post this let me know and I’ll make a video of the heli being controlled from the phone. Since this one is a “real” heli and not a toy, I think people would like to see that.

  4. Guys, be careful.
    It seems that there are serious liability issues with flying semi autonomous remote control toys outside.
    If there is interference and it goes out of control and hits someone, their insurance may not cover for injuries sustained so the liability rests with the owner of the toy.
    IIRC there has been such an incident involving an R/C robot and it resulted in a TV show being cancelled.

  5. Quick Question, I am trying to harvest the Helicopter receiver, does anyone know what Micro-controller they use, the 14 pin SMC IC has its print removed so I can not get a data sheet, I am hopeing it is an Adruino compatible Micro controller.


Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.