The idea behind the PixMob wristband is simple — at a concert, organizers hand these out to the concertgoers, and during the show, infrared projectors are used to transmit commands so they all light up in sync. Sometimes, attendees would be allowed to take these bracelets home after the event, and a few hackers have taken a shot at reusing them.
The protocol is proprietary, however, and we haven’t yet seen anyone reuse these wristbands without tearing them apart or reflashing the microcontroller. [Dani Weidman] tells us, how with [Zach Resmer], they have laid the groundwork for reverse-engineering the protocol of these wristbands.
Our pair of hackers started by obtaining a number of recordings from a helpful stranger online, and went onto replaying these IR recordings to their wristbands. Most of them caused no reaction – presumably, being configuration packets, but three of them caused the wristbands to flash in different colors. They translated these recordings into binary packets, and Dani went through different possible combinations, tweaking bits here and there, transmitting the packets and seeing which ones got accepted as valid. In the end, they had about 100 valid packets, and even figured out some protocol peculiarities like color animation bytes and motion sensitivity mode enable packets.
The GitHub repository provides some decent documentation and even a video, example code you can run on an Arduino with an IR transmitter, and even some packets you can send out with a Flipper Zero. If you’re interested in learning more about the internals of this device, check out the teardown we featured back in 2019.
This aquatic animal thing looks interesting… Not cheap but obviously quite capable.
Override the signals at the concert and have them flash any message you like in Morse code.
I don’t see why people find that sort of thing appealing. Might as well just take an airhorn if you want to ruin a show for everyone.
It is hard to bring one in I guess
Something fun you can do with these (destructively): Their default mode of operation is to pulse using the accelerometer through different colors. If you are at a concert and want to rebel, you can simply pop open the battery port and break off the IR sensor, which is accessible, then pop the battery back in. When it powers off it (IME anyway) resets to this default operating mode. It will perma-break the IR part for you but the device will still work, and will pulse through a rotation of colors, reacting to clapping or similar jarring movements.
Depending on venue you can do this with a pen, a small enough key, or a stiff enough paperclip.
hehe, that sounds handy to know, thank you!
Hey! Sadly, the newer bracelets (past couple years) mostly don’t have the motion sensor in them, so it doesn’t work on those.
Having worked closely but never directly with pixmob in the real world (on some of the mentioned events) my understanding is that there is a “start” command at the top of the show to arm all the bracelets into receiving commands via IR. After the show there is essentially a “nuke” command sent to make the devices ignore IR and just use the accelerometer.
My other take is that these devices have per show programming on the micro and some of the FX are hardcoded. So a band from Taylor may not work with commands from Coldplay.
Hey! I’ve been able to control bracelets from old shows with even after they were (potentially) “nuke” command before. That includes taking ones from an event where they were put in motion sensitive mode after the show and making them do things (like in the video on the GitHub repo).
Regarding per-show programming, I have collected bracelets from 6 different concerts/events (over a multi-year period) and they react *mostly* the same to the commands I have found. That said, there have been some differences. My working theory is that shows send a lot of programming data before the show starts/during breaks that queue up those per-show effects, rather than having them hardcoded. Part of my evidence for that is that the IR transmitters at events are very active for much of the time, even when the bracelets are doing nothing.
Would be interesting to know what else you have heard about how these work though!
PixMob R&D dev here.
I am glad to see some reverse-engineering effort from the community.
Some of you have suspected that the effects might be hardcoded for specific shows… That is partially true, as we do not hardcode the effect, but sometimes hardcode a group ID (example: section 1 to 10 of an Arena could have wristbands with IDs 1 to 10). Then, in realtime, we can send effects to each section in order to generate a Wave going from groups 1 to 10. This kind of pre-programming is used on shows where we have a global infrared signal. On other occasion there is no need to pre-program the wristbands, and that is when we are using moving-head transmitters (or video transmitters), both emitting IR light. The directionality of these signals allow us to skip the group programming at the shop.
On the idea of trying to override our signal during a show, it is possible (in theory), but good luck trying to bring the gear inside a stadium or an arena. It’s likely that security would not let you in with a big enough device(s). Ok, assume you are able to get the gear inside (as you made it portable enough), let’s agree that your small portable IR transmitter would only work when our fleet of emitters are off. And as soon as the 12+ transmitters covering the Arena start emitting, the signal coming from our installation will likely override the signal from the small emitter. When the pixels see a mix of two signals (assuming they are the same strength), the pixel will just not react. This would mean a blackout zone on the pixels around your emitter, which would help us pinpoint from where that extra IR source is originating.
Thanks for explaining much about the process!
As I have not attended a pix mob event, or held one of those flashy thingies, I was only fantasizing about jamming them.
Interesting! Thanks very much for posting here.
Are you saying that for some events the organizers specifically give different wristbands to people in different seats? I’ve never been to a show where they did that before but I guess it makes sense.
I’m glad you’re not unhappy with us trying to figure this stuff out and that you are confident it wouldn’t be realistic to overpower your transmissions. It would be a big shame if people could easily go around ruining everyone’s fun by interfering with the pixels during shows.
Would you willing to answer any other questions about how these work? Understandable if not.
Having seen this in person last night at Coldplay, I can confirm those trasmitters are super powerful, just trying to block the IR signal to my band (to make it go black) was more of an effort than I expected.
Hey there, I just stumbled across this post today after getting a wristband at a baseball game last night. It looks like the one I got is a radio controlled one as there is no IR receiver on it. I get the feeling that this was a way to get around IR not always showing when someone is walking the halls outside of the seating area, but would also combat any IR hijacking. Cool yet simple tech!
Oh Man. So close!
I was at an event a couple of weeks ago where there were a bnch of CROWDLED bands that may have ended up in my ppossession.
I was hoping to get these guys running again and I assume it’s a similar setup with a “Start” command, “Stop” command and then lighting information.
I believe these run over 433Mhz but the protocol would be…. fun to try and find out.
Hey! Do you happen to have a Flipper Zero? I have an RF capture that /might/ work with those.
Oooh. That would be much appreciated.
I have one on order at the moment for precisely that purpose ^_^
Great :)
Here is the RF capture: https://drive.google.com/file/d/1BwcK0OlWLv8EjwzK8Z4D0c6U-QKkE1nU/view?usp=sharing
The CrowdLED bracelets are a lot simpler than the PixMob ones, I think (with less advanced effects).
It should hopefully turn the wristband on and make it red. Of course you will need fresh batteries.
(if that RF capture works I can provide many others)
Thanks for this. I shall try it once my flipper arrives ^_^
Just received my flipper and sadly this doesn’t activate them >.<
Hi Dani,
I am currently working on an Arduino based controller for the CrowdLEDs. Do you mind sharing the other RF captures with me? Additional data would help immensly for figuring out how the system works.
Thanks
@Scaley_Jencen, thanks very much for trying–sad to hear it didn’t work. This capture is from a non-CrowdLED branded generic RF LED bracelet. I thought it might be the same because the board inside the generic ones is identical to the one in this post:
https://electronics.stackexchange.com/questions/377981/how-can-i-reuse-a-crowdled-bracelet
However, maybe they have changed since or something.
Heya.
Yes. I stumbled across this stackexchange page with high hopes. But it seems to be a different board. Mine are white with side firing LEDs.
I may look at reverse engineering them and seeing if a stock MCU would fit.
@Marius Hello! That sounds like a cool project.
Did the one I linked above work? If so, I can get some more captures. If not, all the others are from the same version of bracelet so I imagine it’s a totally different protocol.
Look at this! https://github.com/UberGuidoZ/Flipper/tree/main/Sub-GHz/LED/CrowdLED (not mine)
Hi @Dani
I was not able to try it out yet since I don’t have a flipper and my approach is a lot more “barebone”. Thus I’d like to first figure out how the protocol works and which signals might be relevant. The past years I worked with such protocols and I thought from multiple captures I might be able to filter out which parts of the recordings are relevant and even maybe figure out how the data package is constructed.
Generally I would assume that the signals are the same everywhere. However, the CrowdLED hardware I have at home also have different IDs hardprinted on them. So if you captured a signal of a different ID and for example the master requested all devices with ID 3 to turn red, my device with a different ID would just ignore the signal completly.
If I would be able to figure out which part of the signal corresponds to which instruction (e.g. first 2 Bytes sync, 1 Byte ID, 2 Bytes command e.g. color) then I could maybe even create own signals for the device.
Your link to the github seems promising. I’ll further dig into it and if I manage to get it working I’m happy to share the details/code/Arduino board layout with you!
@Marius that makes sense! I’ve been trying to do similar for the PixMob IR bracelets this post is about and I’ve discovered a few things about the packet structure but not everything.
If you want, I can make and share plenty more recordings from the non-CrowdLED branded generic RF bracelets that I have (since I also have a transmitter). Regarding IDs, I should note though that these generic ones can be split up into 8 groups, and you can choose for each transmission which combination of those 8 you want it to be applied to. The one capture in the Google Drive link was set to apply to all 8. Also, the signal structure is different from the CrowdLED captures from Github based on my limited inspection in Excel (there’s definitely a better way haha). I did try to find a pattern for where group and color are specified in the signals, but I couldn’t. If you are interested in trying, I can send you recordings and some bracelets of different groups (assuming they are different from the CrowdLED ones). You might have more success!
Would you mind sharing a photo of the outside and inside of your CrowdLED bracelets?
Also, out of curiosity, what hardware are you planning to use to use with the Arduino to make the RF transmissions?
@Dani
I just realise that the recording is not explicitly for the CrowdLED, with all that many comments I somehow missed that. Would you mind sending me the other recordings? Generally I dont think that the package is the same but maybe I get some ideas (which I can share with you oc!). Especially a capture for only a single device would be interesting in comparison to all (like “red device 1” vs “red all devices”).
Here is the link for the files I can provide: https://drive.google.com/drive/folders/18wTAgD9pd9nmKHUkTOrc9l8kpW703L7u?usp=sharing
Right now there are 3 pictures (2 outside, 1 inside) and one graphic of the data I got from this reaaaally interesting repo here:
https://github.com/UberGuidoZ/Flipper/tree/main/Sub-GHz/LED/CrowdLED
which also has a IRDB version in case anyone is interested:
https://github.com/UberGuidoZ/Flipper-IRDB
Luckily I have matlab and so plotting such stuff is very simple after decoding the flipper file format which is well explained.
However, this website here:
https://my.flipp.dev/pulse-plotter
is also very nice for plotting. Try it out for yourself, it provides a nice overview.
Hardware I currently use: ESP32, stx882 – in theory this should work but yeah, not working yet so yeah.
What I learned from the repo is that CrowdLED propably uses PWM coding which I actually tried coding at Arduino (I’m running the ESP with Arduino)
here’s an old project back from 34C3, where @muellermartin provided me with some wristbands and raw captures. sadly i can’t remember the other guy’s name, who helped us out. we used a simpe 433MHz ook transitter for that
https://pastebin.com/XFVak5sC
and here are the plain color-codes: https://pastebin.com/rSnf3nAv
@c5e3 thanks so much for posting this and including the Arduino code!
@Marius thanks for the info and pictures! I tried out that plotting tool for IR stuff before I came across IrScrutinizer. I totally forgot it could be used for RF stuff too.
Here are some recordings I just made for the generic bracelets in Flipper format, as well as manuals for the two models of transmitter available (I have the small white one):
https://drive.google.com/drive/u/0/folders/1H7udC4yOhU4NFdCFKmtGcLxTsLc0e3uP
The naming scheme of the recordings are “{color}_{groups}.sub”. “Groups” here means the list of IDs/codes/areas/whatever that the transmission is set to effect. There are 8 supported groups, A-H, and you can make a transmission impact whatever combination of them you want. The “AREA” buttons on the right side of the controller have lights in them and can be each toggled on or off independently to specify the combination. The bracelets came in different bags marked with what hardcoded group they are in. I made “On_red” separate from “Red” because the controller has a button labelled “ON” that seems to do the exact same thing as the “RED” button, but maybe there is some difference.
If you (or whoever else reads this, maybe @c5e3?) want some of the generic bracelets that are definitely compatible with these recordings, send me an email with your address. My email is on my website, linked to by my name here (if I did it right!).
I also can send some photos of the insides of the bracelets and the transmitter.
Hi @c5e3
Thanks for your information! My approach was very similar (https://pastebin.com/nqLt7TJ2) but unfortunatly both versions do not work with my devices.
@Dani
I’ll dig deeper into your recordings. Thanks! Moreover, I send you a mail, hoping the adress on your CV is correct. :)
Bit late to the party here, but I heard that some of them are individually addressed over RF. For big open concerts, where they cant control where the bracelets (and attached humans) are standing, they calibrate with cameras looking at the crowd and selectively address the bands, making them flash.
I am a bit sceptical about this, as scanning through each one at a big concert would take ages.
Or maybe there is some cute algorithm that can speed the localisation process.
Or they can talk to their near neighbours.
Or, or, or
We had these at the Imagine Dragons Concert last night. There were some cool effects where some wristbands were one color like blue and others were another color like yellow, or a small number were really bright while others were dim. I’m thinking that something like this could be achieved by broadcasting a command to all units that could include a partial serial number or other unique address and the bands could each see if they are a match and apply that command if so, this way a subset of bands will show one effect while another subset will do something else. This way you could broadcast the same command to all units and create the appearance of controlling them individually.
I got a pixmob cement v1.1 at the inaugural ceremony of ASU2022, in Asunción, Paraguay. So, the only way that I can come to life is using a clip to close the circuit. So, my question is if are a way to create a controller like argb coming from pc.
Crowdled stuff is so illegal .. the RF power way over legal limit .. and no duty CYCLE .. its 433 and to get the performance needed they break RF law …
Anyone still interested in this topic should go to the Wall Street Journal website and watch the video posted on June 1, 2023 about the world of LED wristbands. Definitely worth the 5 minutes.
https://www.wsj.com/video/series/in-depth-features/the-tech-behind-how-concert-led-light-wristbands-work/EAA54145-D07A-4100-8153-2EAF8D671921?mod=Searchresults_pos1&page=1
The Tech Behind How Concert LED Light Wristbands Work
From arena-sized concerts like Taylor Swift or Coldplay to the Super Bowl halftime show: wearable LEDs have turned the audience into part of the show. WSJ goes behind the scenes with one LED company, PixMob, to see the tech behind the wristbands. Photo illustration: Madeline Marshall
Wall Street Journal
June 1, 2023 05:30 am ET
some reverse engineering for the PixMob cement v1.1:
https://github.com/sueppchen/PixMob_waveband