Friday, September 30, 2011

Perl code for Light Strike decoding

Making progress on my quest to write a 'capture the flag' module for the light strike laser tag guns. Some googling found me this code from Kenneth L. Root. <http://the-b.org>. I hacked it into this the other day and am able to get this output now:




root@rwhiffen-OptiPlex-GX280:/tmp# ./light-strike.pl
Opening port: /dev/ttyUSB0
Opened port /dev/ttyUSB0
Shoot the gun at the IR Sensor
IR Code: 0xe6 0xc2 0x87 0x0d 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x40 0x12 0x40 0x12 0x40 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x3f 0x12 0x0e 0x12 0x40 0x12 0x0f 0x11 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x3f 0x12 0x0e 0x12 0xff
root@rwhiffen-OptiPlex-GX280:/tmp# ./light-strike.pl
Opening port: /dev/ttyUSB0
Opened port /dev/ttyUSB0
Shoot the gun at the IR Sensor
IR Code: 0xb9 0xc2 0x86 0x0e 0x11 0x0f 0x11 0x0f 0x11 0x0e 0x12 0x0e 0x12 0x40 0x12 0x3f 0x12 0x40 0x12 0x0e 0x12 0x0f 0x11 0x0e 0x11 0x0f 0x11 0x0e 0x12 0x0e 0x11 0x0e 0x12 0x0e 0x11 0x0e 0x12 0x0e 0x12 0x0f 0x11 0x0e 0x12 0x0e 0x12 0x40 0x12 0x0e 0x12 0x3f 0x12 0x0e 0x12 0x0e 0x12 0x0f 0x11 0x0e 0x12 0x0e 0x12 0x0e 0x12 0x40 0x12 0x0e 0x12 0xff
root@rwhiffen-OptiPlex-GX280:/tmp#


So I'm getting closer. The results are more inconsistent with the perl code than with the 'mode2 command, which makes me think I might want to do some 'expect' style perl coding with the app rather than direct. maybe something like:




open(MODE,"|mode2 --driver=usb_uirt_raw --device=/dev/ttyUSB0 --mode");


And then do all my interacting with the output via the MODE file handle. That would allow me to get some basic functionality going.


Wednesday, September 28, 2011

Light Strike IR decoding part 2

The continuing saga of my efforts to hack a light strike laser tag system by reading the infrared signals it puts out…

Ok so I just went from being totally stuck and posting that blog post, to being unstuck in about 30 minutes. Ok, so in the last post, I was thinking I needed to figure out what the bit encoding was for the pulses coming in. WHen you look at the in a long row, it's hard to see the patterns. So I was reading the man page for mode2, and it says there's another command line switch called --mode, which is helpfully described as " enable alternative display mode". Ok, what could it hurt right? So I ran it. Instead of getting the two column pulse/space list, you get a more helpful:


6700     650      900      700      900      700
900      700      900      700      900     3150
900     3150      900     3150      900      750
850      750      850      700      900      700
900      700      850      700      900      700
850      750      850      700      900      700
900      700      900      700      850      750
900     3200      850      700      900     3150
900      700      850      700      900      700
850      700      900      700      900      700
900     3200      900      700      900  1382500


Which is a lot easier to read, and makes deltas between two different settings stand out. That one was a blue, this one is a red.


6700     650      900      700      900      700
900      700      900      700      900     3150
900      700      900      700      900      700
900      700      900      700      900      700
900      700      900      700      900      700
900      700      900      700      900      700
900      700      900      700      900      700
900     3150      900      700      900     3150
900      700      900      700      900      700
900      700      900      700      900      700
900     3150      900      700      900  2267300


Notice how C2 R3 and C4 R3 change from 3150 to 700? That pattern holds for yellow and green as well. You end up with a pretty simple table:






If you count the spaces as clock ticks and the pulses as 'bits' you can then start to map things out. The last huge number in C6 R11 is the time between the last event and the next event. The last event recorded does not have this value, it is blank and can be discarded. The first pulse is a 'double-high' value which marks the beginning of a frame. This gives you effectively 32 bits. Now I just have to get a perl or python script to read the device instead of the 'mode2' command and I'm off to the races. That will have to wait for another day however, because I need to get back to work.

Light Strike laser tag

After reading a review on Ars Technica: Lawn warfare: Light Strike brings laser tag back home I decided I had to have some of these at the office. They're pretty cool, mostly gimmicks but they do work. I bought myself a D.C.R.-012. Am probably going to pick up some of the accessories as well. I've talked some co-workers into buying them, so we're almost ready to have some office warfare.

dcr-icon

The trick is, you can only 'death match' each other for so long. And most of the that would be on the honor system, since you can self-respawn quickly. So I've set out to try and make my own 'targets' or flags to play capture the flag with. I have some USB-UIRT devices. I found some Linux drivers at LIRC.org and a CPAN perl module for the driver. So far, so good. I'm able to detect gun output by running:

mode2 --driver=uirt2_raw --device=/dev/ttyUSB0

From the command line. It gives me output like this:

pulse 6650
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 3200
pulse 850
space 3200
pulse 850
space 3200
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 700
pulse 850
space 700
pulse 850
space 700
pulse 850
space 750
pulse 850
space 3200
pulse 850
space 700
pulse 850
space 3200
pulse 850
space 750
pulse 850
space 750
pulse 850
space 750
pulse 850
space 700
pulse 850
space 750
pulse 850
space 700
pulse 850
space 3200
pulse 850
space 750
pulse 850

Unfortunately subsequent firings do not give me identical values. Some times the pulses are 50 higher, so 6700 rather than 850. Perhaps worse still, the other three colors (that was a 'blue team' laser) seem to have the same values. Next I'm going to plug it into a windows machine and run Girder on it and see what that gives me.

Google wasn't very helpful, perhaps because Light Strike isn't a unique term to the laser tag guns. It's used in other contexts as well. So I think I'll pads this post with light strike hacking and other google-able terms. Light Strike IR hacking is a good example of what I was hoping to find a post about. ANyway, hopefully someone who is searching for linux IR hacking light strike guns will find me and we can team up.