Hacking at the Light Strike Laser Tag Game

These guns are really easy to get into.  Just regular phillips head screws, nothing special.  A bunch of them are hidden under the sticker on the side opposite the buttons.  These can be hard to find, so to the left is a picture with all the screws circled (click to embiggen).  Once you get inside, the main feature is a really well-labeled PCB that connects all the different sensors and outputs.  Of  course, the microcontroller is covered in a big blob of epoxy, but I’m going to replace the entire board, so it isn’t going to be a problem in the long run.

 Ultimately, I want the new electronics to be backwards compatible with the old electronics, so I need to decode all the messages that are sent out by the stock rifle.  Fortunately, the rifle comes with a little target practice toy.  Taking it apart reveals an IR decoder, RGB LED, and a speaker. I added a Teensy, wired the IR decoder in, and added an IR LED to output my own codes.  The IR decoder is connected to pin D7 on the Teensy (arbitrary choice), while the IR output is connected to pin C7 (this is the PWM output from the high-speed timer/counter on the Atmega32U4).  I started out using the Arduino IR Remote library from Ken Shirrif, just outputting raw timing values from the IR input.  This ended up being frustrating, and I used a logic analyzer to confirm.  Getting a graphical view of the IR output helped a lot.

As you can see from the logical analyzer output, there are a few different marks and spaces (marks are where the LED is active).  There’s a long header mark at the start of the message, followed by equal-length inter-bit marks, with either a short space (for 0) or a long space (for 1).  Timings are as follows:

• Header Mark: 6750 us
• Inter-bit Mark: 900 us
• Zero Space: 900 us
• One Space: 3700 us

At this point, I modified the IRRemote library to decode the incoming messages.  I had to add the mark and space timings above, and write functions for decoding and encoding data.  I also had to modify some #defines for the Teensy to tweak the outgoing IR into a 50% duty cycle, and adjust the timings: The guns send out ~37.8 kHz IR, but the default settings sent out ~38.2 kHz IR.  This shouldn’t matter, but a simple tweak made everything work as it should.  The most difficult part was getting the IR send function working.  Here’s my new IR Send:

void IRsend::sendLS(unsigned long data, int nbits)
{
  enableIROut(38);
  mark(LS_HDR_MARK);
  space(0);
  for (int i = 0; i < nbits; i++) {
    if (data & TOPBIT) {
      mark(LS_BIT_MARK);
      space(LS_ONE_SPACE);
    } 
    else {
      mark(LS_BIT_MARK);
      space(LS_ZERO_SPACE);
    }
    data <<= 1;
  }
  mark(LS_BIT_MARK);
  space(0);
}

In order to get the gun to accept the header, I had to send out a 0 length space after the header pulse, then begin sending data.  This took a while to nail down. I’ve put the code on GitHub here: https://github.com/LightStrikePlusPlus/LightStrikeDecode

Amazingly, after decoding some data packets, it appeared that everything was just a 32 bit output packet, and some obvious patterns emerged once I fired a few shots with different weapons and different teams.  Of the 4 bytes in the message, Byte 3 indicates the team (0x07 for Blue (default), 0x04 for Red, 0x05 for Yellow and 0x06 for Green), Byte 2 indicates a count of some sort (only used for the turret bomb mode.  It increases by one every time the bomb goes off, but any number of “count” will trip the gun, except 0.), and Bytes 0 and 1 indicate the weapon.  Below are the weapons:

• Laser Strike: 0x0502
  • 12 hits to kill from full health

    

<li>
  Stealth Strike: 0x0602 <ul>
    <li>
      12 hits to kill from full health
    </li>
  </ul>
</li>

<li>
  Pulse Strike: 0x0703 <ul>
    <li>
      8 hits to kill from full health
    </li>
  </ul>
</li>

<li>
  Rail Strike: 0x0806 <ul>
    <li>
      4 hits to kill from full health
    </li>
  </ul>
</li>

<li>
  Sonic Strike: 0x908 <ul>
    <li>
      3 hits to kill from full health
    </li>
  </ul>
</li>

<li>
  Bomb: 0x0E18 <ul>
    <li>
      MUST include a non-zero &#8220;count&#8221; field
    </li>
    <li>
      1 hit to kill
    </li>
  </ul>
</li>

<li>
  Sentry: 0x0F08 <ul>
    <li>
      3 hits to kill from full health
    </li>
  </ul>
</li>

<li>
  Health: 0x08&#8211; <ul>
    <li>
      MUST be used with team 0x08
    </li>
    <li>
      Final byte is team byte for healing pulse (0x07 for blue, etc)
    </li>
    <li>
      3 hits to full health
    </li>
  </ul>
</li>

Interestingly enough, the guns appear to be more particular about the codes they receive than the sentry or the target module.  Both of these devices will activate on codes that don’t activate the gun.  The target, in particular, treats team codes 0x0D, 0x0A, 0x0B and 0x0C as Blue, Red, Yellow, and Green, respectively.

Now I think I’ve got enough data to build a protocol for the new electronics that will be backwards compatible, but add a whole lot of functionality. If you’d like to mess around with this on your own, check out the Arduino code I’ve uploaded here: https://github.com/LightStrikePlusPlus/LightStrikeDecode.