PixMob Wristband Protocol Reverse-Engineering Groundwork

A family of PixMob bracelets being coltrolled by an ESP32 with an IR transmitter attached to it. All the bracelets are shining a blue-ish color

The idea behind the PixMob wristband is simple — at a concert, organizers hand these out to the concertgoers, and during the show, infrared projectors are used to transmit commands so they all light up in sync. Sometimes, attendees would be allowed to take these bracelets home after the event, and a few hackers have taken a shot at reusing them.

The protocol is proprietary, however, and we haven’t yet seen anyone reuse these wristbands without tearing them apart or reflashing the microcontroller. [Dani Weidman] tells us, how with [Zach Resmer], they have laid the groundwork for reverse-engineering the protocol of these wristbands.

Our pair of hackers started by obtaining a number of recordings from a helpful stranger online, and went onto replaying these IR recordings to their wristbands. Most of them caused no reaction – presumably, being configuration packets, but three of them caused the wristbands to flash in different colors. They translated these recordings into binary packets, and Dani went through different possible combinations, tweaking bits here and there, transmitting the packets and seeing which ones got accepted as valid. In the end, they had about 100 valid packets, and even figured out some protocol peculiarities like color animation bytes and motion sensitivity mode enable packets.

The GitHub repository provides some decent documentation and even a video, example code you can run on an Arduino with an IR transmitter, and even some packets you can send out with a  Flipper Zero. If you’re interested in learning more about the internals of this device, check out the teardown we featured back in 2019.

18 thoughts on “PixMob Wristband Protocol Reverse-Engineering Groundwork

  1. Something fun you can do with these (destructively): Their default mode of operation is to pulse using the accelerometer through different colors. If you are at a concert and want to rebel, you can simply pop open the battery port and break off the IR sensor, which is accessible, then pop the battery back in. When it powers off it (IME anyway) resets to this default operating mode. It will perma-break the IR part for you but the device will still work, and will pulse through a rotation of colors, reacting to clapping or similar jarring movements.

    Depending on venue you can do this with a pen, a small enough key, or a stiff enough paperclip.

  2. Having worked closely but never directly with pixmob in the real world (on some of the mentioned events) my understanding is that there is a “start” command at the top of the show to arm all the bracelets into receiving commands via IR. After the show there is essentially a “nuke” command sent to make the devices ignore IR and just use the accelerometer.

    My other take is that these devices have per show programming on the micro and some of the FX are hardcoded. So a band from Taylor may not work with commands from Coldplay.

    1. Hey! I’ve been able to control bracelets from old shows with even after they were (potentially) “nuke” command before. That includes taking ones from an event where they were put in motion sensitive mode after the show and making them do things (like in the video on the GitHub repo).

      Regarding per-show programming, I have collected bracelets from 6 different concerts/events (over a multi-year period) and they react *mostly* the same to the commands I have found. That said, there have been some differences. My working theory is that shows send a lot of programming data before the show starts/during breaks that queue up those per-show effects, rather than having them hardcoded. Part of my evidence for that is that the IR transmitters at events are very active for much of the time, even when the bracelets are doing nothing.

      Would be interesting to know what else you have heard about how these work though!

  3. PixMob R&D dev here.

    I am glad to see some reverse-engineering effort from the community.

    Some of you have suspected that the effects might be hardcoded for specific shows… That is partially true, as we do not hardcode the effect, but sometimes hardcode a group ID (example: section 1 to 10 of an Arena could have wristbands with IDs 1 to 10). Then, in realtime, we can send effects to each section in order to generate a Wave going from groups 1 to 10. This kind of pre-programming is used on shows where we have a global infrared signal. On other occasion there is no need to pre-program the wristbands, and that is when we are using moving-head transmitters (or video transmitters), both emitting IR light. The directionality of these signals allow us to skip the group programming at the shop.

    On the idea of trying to override our signal during a show, it is possible (in theory), but good luck trying to bring the gear inside a stadium or an arena. It’s likely that security would not let you in with a big enough device(s). Ok, assume you are able to get the gear inside (as you made it portable enough), let’s agree that your small portable IR transmitter would only work when our fleet of emitters are off. And as soon as the 12+ transmitters covering the Arena start emitting, the signal coming from our installation will likely override the signal from the small emitter. When the pixels see a mix of two signals (assuming they are the same strength), the pixel will just not react. This would mean a blackout zone on the pixels around your emitter, which would help us pinpoint from where that extra IR source is originating.

    1. Thanks for explaining much about the process!
      As I have not attended a pix mob event, or held one of those flashy thingies, I was only fantasizing about jamming them.

    2. Interesting! Thanks very much for posting here.

      Are you saying that for some events the organizers specifically give different wristbands to people in different seats? I’ve never been to a show where they did that before but I guess it makes sense.

      I’m glad you’re not unhappy with us trying to figure this stuff out and that you are confident it wouldn’t be realistic to overpower your transmissions. It would be a big shame if people could easily go around ruining everyone’s fun by interfering with the pixels during shows.

      Would you willing to answer any other questions about how these work? Understandable if not.

  4. Oh Man. So close!

    I was at an event a couple of weeks ago where there were a bnch of CROWDLED bands that may have ended up in my ppossession.

    I was hoping to get these guys running again and I assume it’s a similar setup with a “Start” command, “Stop” command and then lighting information.
    I believe these run over 433Mhz but the protocol would be…. fun to try and find out.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.