This document discusses reverse engineering infrared remote controls through analyzing the timing of infrared signals. It provides examples of decoding protocols for a Syma 107G helicopter, Syma 107N helicopter, and Lego car remote control. The protocols are broken down into header, data bits for controls like yaw, pitch and throttle, and footer bits. Decoding the signals allows generating code to replicate the controls with an Arduino and infrared LED.

1. IR REVERSE ENGINEERING
Nadav Yahav, Asher Yanai

2. • Decoding infrared transmission using remote
control signals.
• Actually, we are using the decoder to “timing” all
possible signals (bit 0/1, header, footer).
• That’s allowed us to verify and graphs all of the
possible control configuration, establishing a
timing and command set for the device.
• After understanding the graphs, and each
transmission, we generate a code for the specific
protocol. That code will replace the controller
using the Arduino and IR LED transmitter.
WHAT IS REVERSE
ENGINREERING?

3. • IR frequency transmitter can transmit in wide
range of frequencies(38 kHz, 50 kHz).
• Usually at 38 kHz
• Each bit represented by constant time of LED
on and LED off.
• We produced this frequency by turning on and
off the LED for 13 microseconds. (this is just
for the ON state)
IR TRANSMIT

4. IR TRANSMIT

5. OSCILLOSCOPE EXAMPLE

6. DVD EXAMPLE PAGE-1

7. DVD EXAMPLE PAGE-2

8. DVD EXAMPLE PAGE-3

9. • DVD EXCEL SIGNALS EXAMPLE
• DVD Example
DVD EXAMPLE PAGE-4

10. 107G HELICOPTER

11. 107G HELICOPTER
Protocol:
• The Syma 107G is a 3-channel (Yaw, Pitch,
Throttle) helicopter which utilizes Infrared (IR)
• The transmission of a control packet is
contingent on the application of throttle.
• There are four passible symbols-Header ,
Footer , 0’s , 1’s.

12. 107G HELICOPTER
The IR Decoder results on the 107G remote
controller.
107G

13. 26 microsec
300 microsec- on 300 microsec- off
0 bit
107G HELICOPTER

14. 26 microsec
300 microsec- on 700 microsec- off
1 bit
107G HELICOPTER

15. 26 microsec
1960 microsec- on 1860 microsec- off
header
107G HELICOPTER

16. 26 microsec
300 microsec- on 1400 microsec- off
footer
107G HELICOPTER

17. 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
h
e
a
d
e
r
0 yaw 0 pitch c
h
a
n
n
e
l
Throttle 0 Trim f
o
o
t
e
r
The control packet consists of a header symbol, 32-bits of
control information, and a footer symbol.
107G HELICOPTER

18. 107G HELICOPTER
• Protocol:
• Yaw- represented by bits 0-7.
• Yaw control the turning of the Helicopter-
• Values between 0 and 127, centered on 63.
• For example sharp turn left will send number
of value 127.

19. 107G HELICOPTER
• Protocol:
• Pitch - represented by bits 8-15.
• Pitch control the flying forward and backwards
- range: 0-127,
• Bit number 16-Represent the Chanel of the
Helicopter(AB).

20. 107G HELICOPTER
Protocol:
Throttle is represented by bits 17-24 between 0
and 127.
Throttle control the speed of the rotors (go up
and down or hover).

21. 107N HELICOPTER

22. 107N HELICOPTER
The only difference between the two helicopters
is the timing of the 4 symbols represented.
• Working with the same frequency (38 kHz)
• Has the same protocol (3-channels, 32 bit
package)
107n signals example
107n Code 107G Code

23. 107N HELICOPTER
Time off (µsec)Time on (µsec)symbol
19002060header
340440zero
740440one
24240440footer
Time off (µsec)Time on (µsec)symbol
18801960header
300300zero
680300one
14000300footer

24. THE LEGO CAR

25. THE LEGO CAR
The Remote control of the Lego car
The IR receiver of the Lego car works with 4
channels, He receives a packet of 16 bits.
Depending of the packet, he sends the commands
to two engines working in synchronization. If a
legal command is received, The receiver will blink
yellow LED, indicates that the command in being
executed.

26. 0 1 2 3 0 1 2 3 4 5 6 7 0 1 2 3
header BBBB AAAA LLLL footer
The control packet consists of a header symbol, 16-bits of
control information, and a footer symbol.
THE LEGO CAR
channel
Nibble 1 Nibble 2 Nibble 3
Error
detectionConstant bits
of 01
Engine B Engine A

27. THE LEGO CAR
Protocol:
BBBB-
Left
Engine:
ACTUAL MOVEBITS
No movement0000
Forward speed 10001
Forward speed 20010
Forward speed 30011
Forward speed 40100
Forward speed 50101
Forward speed 60110
Forward speed 70111
Brake1000
ACTUAL MOVEBITS
Backward speed 71001
Backward speed 61010
Backward speed 51011
Backward speed 41100
Backward speed 31101
Backward speed 21110
Backward speed 11111

28. THE LEGO CAR
Protocol:
AAAA-
Right
Engine:
ACTUAL MOVEBITS
No movement0000
Forward speed 10001
Forward speed 20010
Forward speed 30011
Forward speed 40100
Forward speed 50101
Forward speed 60110
Forward speed 70111
Brake1000
ACTUAL MOVEBITS
Backward speed 71001
Backward speed 61010
Backward speed 51011
Backward speed 41100
Backward speed 31101
Backward speed 21110
Backward speed 11111

29. THE LEGO CAR
Protocol:
LLLL- 4 bits of Error detection.
The 4 bits will be –
0xF xor Nibble 1 xor Nibble 2 xor Nibble 3.

30. THE LEGO CAR
Time off (µsec)Time on (µsec)symbol
960182header
230182zero
500182one
960182footer

31. THE LEGO CAR
A code is added, writing by Nadav Yahav and Asher
Yanai.
Press here to get the code
Press commands using the serial port:
W- moving forward
Z or X - moving backward
A - turn left.
D - turn right.

32. THE LEGO CAR

33. - THE END -