Reverse Engineering A Syma 107 Toy Helicopter IR Protocol

August 27, 2012 by Mike Szczys 9 Comments

Half the fun of buying toys for your kids is getting your hands on them when they no longer play with them. [Kerry Wong] seems to be in this boat. He bought a Syma S107G helicopter for his son. The flying toy is IR controlled and he reverse engineered the protocol it uses. This isn’t the first time we’ve seen this type of thing with the toy. In fact, we already know the protocol has been sniffed and there is even a jammer project floating around out there. But we took a good look at this because of what you can learn from [Kerry’s] process.

He starts by connecting an IR photo diode to his oscilloscope. This gave him the timing between commands and allowed him to verify that the signals are encoded in a 38 kHz carrier signal. He then switched over to an IR module designed to demodulate this frequency. From there he captures and graphs all of the possible control configuration, establishing a timing and command set for the device. He finishes it off by building a replacement controller based on an Arduino. You can see a video of that hardware after the break.

Continue reading “Reverse Engineering A Syma 107 Toy Helicopter IR Protocol” →

Decoding, Then Cloning An IR Helicopter Toy’s Control Signals

March 23, 2012 by Mike Szczys 14 Comments

[Mike Field] got his hands on this Syma S107 helicopter with the intention of hacking it. After playing around with it for a while he set out to build his own infrared controller for the toy. It seems there is some protocol information about it published in various forum posts, but he decided it would be more fun to figure it out for himself.

He started off trying to capture the IR signals using Adafruit’s tutorial which has come in handy on a number of other projects. He could get his television remote to register, but not the toy’s controller. This didn’t stop fun, instead he tore open the controller and grabbed a logic sniffer to see what’s being pushed to the IR LEDs. The signals are a bit curious. It seems two different packets are sent with each command which [Mike] thinks is for use with two different models of the toy. In addition to that the frames are not synchronized. But a bit of 10 MHz sampling helped him to figure everything out, and he believes he’s got a more accurate version of the protocol than had previously been discovered. To prove it he developed an FPGA-based controller using VHDL which he shows off in the clip after the break.

Continue reading “Decoding, Then Cloning An IR Helicopter Toy’s Control Signals” →

Jam A Remote Helicopter

January 26, 2012 by Kevin Dady 39 Comments

The Syma S107 IR is a popular little remote controlled helicopter. When a friend of [Michael]’s started flying one around the office he decided to try and jam the signal, creating a no fly zone. Luckily some people on the internet have already decoded the IR signals used by the flying menace. From there, a quick browsing of Mouser to source some LEDs, and to whip up some code for a TI MSP430 was all that was left.

The software on the micro controller is set to broadcast a “thrust off” signal, but [Michael] admits he is not 100% sure if the helicopter is actually receiving that, or if the signal from the no fly zone is mixing with the remote’s signal, causing garbage to be received. Either way when the helicopter gets in range of the no fly zone pad it drops from the air.

Things didn’t go perfectly though, overestimating the current capabilities of the MSP was causing the micro controller to reset and crash the debugger. But a simple rearrangement of how the signals are sent quickly solved this problem.

Join us after the break for a quick video.

Continue reading “Jam A Remote Helicopter” →