A family of PixMob bracelets being coltrolled by an ESP32 with an IR transmitter attached to it. All the bracelets are shining a blue-ish color

PixMob Wristband Protocol Reverse-Engineering Groundwork

The idea behind the PixMob wristband is simple — at a concert, organizers hand these out to the concertgoers, and during the show, infrared projectors are used to transmit commands so they all light up in sync. Sometimes, attendees would be allowed to take these bracelets home after the event, and a few hackers have taken a shot at reusing them.

The protocol is proprietary, however, and we haven’t yet seen anyone reuse these wristbands without tearing them apart or reflashing the microcontroller. [Dani Weidman] tells us, how with [Zach Resmer], they have laid the groundwork for reverse-engineering the protocol of these wristbands.

Our pair of hackers started by obtaining a number of recordings from a helpful stranger online, and went onto replaying these IR recordings to their wristbands. Most of them caused no reaction – presumably, being configuration packets, but three of them caused the wristbands to flash in different colors. They translated these recordings into binary packets, and Dani went through different possible combinations, tweaking bits here and there, transmitting the packets and seeing which ones got accepted as valid. In the end, they had about 100 valid packets, and even figured out some protocol peculiarities like color animation bytes and motion sensitivity mode enable packets.

The GitHub repository provides some decent documentation and even a video, example code you can run on an Arduino with an IR transmitter, and even some packets you can send out with a  Flipper Zero. If you’re interested in learning more about the internals of this device, check out the teardown we featured back in 2019.

PixMob LED Wristband Teardown (Plus IR Emitters And How To Spot Them)

PixMob units are wearable LED devices intended for crowds of attendees at events like concerts. These devices allow synchronized LED effects throughout the crowd. [yeokm1] did a teardown of one obtained from a preview for the 2019 Singapore National Day Parade (NDP), and in the process learned about the devices and their infrastructure.

Suspected IR emitter for the PixMob units, mounted on a lighting tower (marked here in white).

PixMob hardware has been known to change over time. This version has two RGB LEDs (an earlier version had only one), an unmarked EEPROM, an unmarked microcontroller (suspected to be the Abov MC81F4104), and an IR receiver module. Two CR1632 coin cells in series power the device. [yeokm1] has made the schematic and other source files available on the teardown’s GitHub repository for anyone interested in a closer look.

One interesting thing that [yeokm1] discovered during the event was the apparent source of the infrared emitter controlling the devices. Knowing what to look for and reasoning that such an emitter would be mounted with a good view of the crowd, [yeokm1] suspected that the IR transmitter was mounted on a lighting tower. Viewing the tower through a smartphone’s camera revealed a purplish glow not visible to the naked eye, which is exactly the way one would expect an IR emitter to look.

Sadly, there wasn’t any opportunity to record or otherwise analyze the IR signals for later analysis but it’s possible that the IR protocol might be made public at some point. After all, running custom code on an earlier PixMob board was made possible in part by asking the right people for help.

Hacking Pixmob Bands And Finding A Toolchain

The Pixmob band is an LED wrist strap, of the type often used at big concerts or other public events. Many have tinkered with the device, but as of yet, nobody was running custom code. It wouldn’t be easy, but [JinGen Lim] got down to work.

The wristbands are given out to concertgoers to create synchronized light shows in the crowd.

A teardown of a 2016 device revealed it consisted of an RGB LED, an IR sensor, a small EEPROM and a coin cell, which were all common parts. Unfortunately, the ABOV MC81F4204 microcontroller was a little more obscure. It’s a part that’s quite hard to find, and uses a proprietary programmer and an ancient IDE.

Searches online proved fruitless, and a working programmer remained outside [JinGen]’s grasp. Undeterred, he decided to simply walk into the company’s Korean headquarters and ask for help. As the part was end-of-life, they were unable to supply a programming device, but happily provided documentation for the chip that wasn’t publicly available. With this in hand, it was possible for [JinGen] to build his own programmer instead.

Booting up a copy of the ABOV IDE, with his newly-built programmer in hand, it was relatively easy to get the chip running custom code. Going the extra mile, [JinGen] even hacked the Arduino IDE to be partially compatible with the platform! A silicon error in the MC81F4204 design bricks the chips after only a few flash rewrites, so its never going to be the most useful platform, but it works nonetheless.

The Pixmob hardware has continued to evolve, and it’s unlikely modern units still use the same chip. Despite this, it’s a great example of what can be achieved by a little sleuthing and asking the right people the right questions. Others have attempted to hack similar products before, found at Disneyland and Coldplay concerts. You won’t catch this author at either, but if you’ve hacked something similar, be sure to reach out on the tip line!