My friend Jon has been working on Laser Taser tag, modifying perfectly ordinary toy laser guns to provide an electric shock when you get hit.  As he was working on this game for Makerfaire Detroit 2012, I noticed that these guns are really freaking cool.  10 years ago, I paid good teenage summer job money to play laser tag, and it wasn’t as good as this.  You can now buy a $30 toy that rivals the fanciest laser tag equipment of the previous decade.

This is one of the rifles you can buy for the Wowwee Light Strike game.  They’ve got a bunch of capacitive touch button on the side to change gun settings, LED lights to indicate health, team, and who you got hit by, a reload button, an IR receiver and transmitter, and a couple of ports for add-on accessories.  Jon did a lot of the ground work for what I’m summarizing in this post.  The guns (and accessories) send out 38 kHz IR.  The guns use a custom packet format, and each message is 32 bits.

After taking a look inside these guns, I realized that they have a lot of potential.  They’re a really great sensor platform for a laser tag game, with a great form factor, but the electronics inside don’t offer a lot of flexibility in game mode, and players have to use the honor system to keep score.  My end goal is to provide drop in replacement electronics, which allow for more teams, additional game modes, zigbee scorekeeping, custom guns, custom sounds, and provide a standard data output, so people (like Jon) can build accessories a little easier.

Light Strike rifle with all screws highlighted

These guns are really easy to get into.  Just regular phillips head screws, nothing special.  A bunch of them are hidden under the sticker on the side opposite the buttons.  These can be hard to find, so to the left is a picture with all the screws circled (click to embiggen).  Once you get inside, the main feature is a really well-labeled PCB that connects all the different sensors and outputs.  Of  course, the microcontroller is covered in a big blob of epoxy, but I’m going to replace the entire board, so it isn’t going to be a problem in the long run.

 Ultimately, I want the new electronics to be backwards compatible with the old electronics, so I need to decode all the messages that are sent out by the stock rifle.  Fortunately, the rifle comes with a little target practice toy.  Taking it apart reveals an IR decoder, RGB LED, and a speaker. I added a Teensy, wired the IR decoder in, and added an IR LED to output my own codes.  The IR decoder is connected to pin D7 on the Teensy (arbitrary choice), while the IR output is connected to pin C7 (this is the PWM output from the high-speed timer/counter on the Atmega32U4).  I started out using the Arduino IR Remote library from Ken Shirrif, just outputting raw timing values from the IR input.  This ended up being frustrating, and I used a logic analyzer to confirm.  Getting a graphical view of the IR output helped a lot.

As you can see from the logical analyzer output, there are a few different marks and spaces (marks are where the LED is active).  There’s a long header mark at the start of the message, followed by equal-length inter-bit marks, with either a short space (for 0) or a long space (for 1).  Timings are as follows:

  • Header Mark: 6750 us
  • Inter-bit Mark: 900 us
  • Zero Space: 900 us
  • One Space: 3700 us

At this point, I modified the IRRemote library to decode the incoming messages.  I had to add the mark and space timings above, and write functions for decoding and encoding data.  I also had to modify some #defines for the Teensy to tweak the outgoing IR into a 50% duty cycle, and adjust the timings: The guns send out ~37.8 kHz IR, but the default settings sent out ~38.2 kHz IR.  This shouldn’t matter, but a simple tweak made everything work as it should.  The most difficult part was getting the IR send function working.  Here’s my new IR Send:

In order to get the gun to accept the header, I had to send out a 0 length space after the header pulse, then begin sending data.  This took a while to nail down. I’ve put the code on GitHub here: https://github.com/LightStrikePlusPlus/LightStrikeDecode

Amazingly, after decoding some data packets, it appeared that everything was just a 32 bit output packet, and some obvious patterns emerged once I fired a few shots with different weapons and different teams.  Of the 4 bytes in the message, Byte 3 indicates the team (0×07 for Blue (default), 0×04 for Red, 0×05 for Yellow and 0×06 for Green), Byte 2 indicates a count of some sort (only used for the turret bomb mode.  It increases by one every time the bomb goes off, but any number of “count” will trip the gun, except 0.), and Bytes 0 and 1 indicate the weapon.  Below are the weapons:

  • Laser Strike: 0×0502
    • 12 hits to kill from full health

      Inside of the target, with the stock electronics, modified with wires for power and sensor input to the teensy.

  • Stealth Strike: 0×0602
    • 12 hits to kill from full health
  • Pulse Strike: 0×0703
    • 8 hits to kill from full health
  • Rail Strike: 0×0806
    • 4 hits to kill from full health
  • Sonic Strike: 0×908
    • 3 hits to kill from full health
  • Bomb: 0x0E18
    • MUST include a non-zero “count” field
    • 1 hit to kill
  • Sentry: 0x0F08
    • 3 hits to kill from full health
  • Health: 0×08–
    • MUST be used with team 0×08
    • Final byte is team byte for healing pulse (0×07 for blue, etc)
    • 3 hits to full health

Target with Teensy installed

Interestingly enough, the guns appear to be more particular about the codes they receive than the sentry or the target module.  Both of these devices will activate on codes that don’t activate the gun.  The target, in particular, treats team codes 0x0D, 0x0A, 0x0B and 0x0C as Blue, Red, Yellow, and Green, respectively.

Now I think I’ve got enough data to build a protocol for the new electronics that will be backwards compatible, but add a whole lot of functionality. If you’d like to mess around with this on your own, check out the Arduino code I’ve uploaded here: https://github.com/LightStrikePlusPlus/LightStrikeDecode.

 
 
 
 
 
 
 
 

Comments on this entry (19 comments)

Did you like this post? You can share your opinion with us! Simply click here.

tekrat

I’m getting 404 on the LightStrikeDecode on GITHub.

Reply
Andreas

so to the left is a picture with all the screws circled (click to embiggen).

left? :)

Reply
Rich Whiffen

I was playing around with this too: http://rich.whiffen.org/2011/10/light-strike-decodes-so-far.html
My decodes are here: https://docs.google.com/spreadsheet/ccc?key=0Arz5A-6gtL3kdDRFNlVpSHdkUEhUTi1mMHhlaDU0WUE

The pistols are different than the rifles. The ITS has other codes that probably should be handled. I haven’t picked up a target vest so so there is some more logic there with respawning team mates to find.

Last bit, I have been in touch with a guy from Wowwee and he’s open to questions. Sounds like they want people to hack them. Unfortunately since the product appears to be winding down I’m not sure how much help he’ll me.

I’d like to make a network aware ‘flag’ that could be captured and keep team score, and maybe some variants where you have to set X number of flags to win, etc.

Great stuff and let me know if I can help.

Reply

Rich, great to hear from you! Your page is partially the reason I decided to pursue this and document it.

If you look a little closer, you can see that I got the ITS codes. I still haven’t decoded a pistol, but that should be pretty easy now that I have my USB target!

As soon as I get some new electronics nailed down, I intend to expand into other accessories. Hopefully the product isn’t fully winding down, but all the clearance sales are probably a sign.

Reply
Dakotah Rickard

Well, we all know that the Facebook page may not be a guarantee, but according to the PR guys responsible for social media, at least, there’s plans to release a new line next Spring. The retail interest is flagging somewhat, and the marketing for the line is, in my oppinion, less than it deserves by a long shot, but there’s definitely R&D being done over there.
A review on the Light Strike Facebook page mentioned that the Light Sprites product, especially the wand, also interacts with the Light Strike line, so that’s another option for getting more info about what makes the guns tick.

Also, I’m not tremendously technical. I understand that the hexidecimal numbers provided here give us the active bits in the packets sent to and from the guns, but I don’t really understand much more than that. I know it’s not necessarily fun to drag a literate but not particularly savy guy through the intracasies of what you’ve done, but I’d appreciate the attempt, if someone wants to e-mail me off this thread, I’ll gladly accept whatever clarification it brings.

I know that there are literally millions of possible combinations that are present, or at least I think I know that, but I wonder if it wouldn’t be fruitful to set up an IR transmitter and a gun for a while and just run through the options available to try and find some patterns. If the gun, for example, is responding to the shots and making the internal decision to take off a certain amount of health each time, then there’s not much we can do to expand this. However, if, as I suspect, there’s just a lot of information, then maybe we can really design more accessories that do improve the guns themselves, as well as medkits, falgs, and what have you.

I’m not the first person to sit down and tally up the damage of different stuff as relates to the guns and their functions, but I did pretty much go through everything. The Strikers (pistols) and ssault Strikers (rifles) seem to actually have different shielding potentials, though the manuals for both promise a fifty percent protection against damage. I’ve seen as high as that, but I’ve also seen as low as 33% protection granted. I might, I think, have seen 0 protection granted, but I could be wrong. Then there’s the bonus granted to shield regeneration under the Enemy Scanner accessory for the rifle. It might effect shielding potential, too, whether on purpose or not.

The reason I mention this is because some of the information contained in the packet might be related to shield protection. That is, how much does a particular type of shot get blocked by shields? If this is in fact the case, then there’s a nice accessory which does nothing but boost shield protection or nullify it for others simply by modifying this bit of shield information.

Also, the enemy scanner accessory powers up most shots to half again damage. It would be interesting to note if the packets change to reflect that and how. And the Refractor Launcher seems to have no effect on what shots are fired, which, given the way the gun resets if it’s jostled, may indicate that the launcher actually contains a full set of codes and sounds for the weapons in the Assault Strikers, or it could mean that the Assault Striker contains a full library of external mods. If the latter is the case, there’s not much hope for new stuff, which would be tremendously shortsighted for a company usually blessed with good longrange vision.

I’ve rambled on this comment such that it’s nearly another post. I thank anyone who’s stuck with it, and I hope someone will help me understand a little better, so I’m not just mumbling in the dark.

Reply
George

Looks great! In all my free time I will have to get in a try to make a sensor vest.

I have been unhappy with the way the LS does sensing. You only get hit in one place, you have to trust folks for dying, and you can’t change the amount of health.

A vest with a few sensors could take care of these issues. Maybe even set up healing / respawn in base? You could add the team stats too, and not be so bound by size weight restrictions of the gun itself.

Thanks for the great work!

Reply
Matt

Hey there! Awesome work here… the woman and I just picked up a TON of this stuff on major clearance from some area Wal-Marts. Got 4 strikers and 9 assault strikers, plus two ITS systems, planning to snag 1 more assault striker and 2 more strikers plus at least one more ITS. I’m planning to transplant most of the assault strikers in to some Nerf shells – going to put assault strikers unmodified in to some Stampedes, ones with the scope accessory in to some Long Strikes or Longshots. There’s this cool exploit where if you boot up an assault striker with the scope attached and then attach the rapid fire attachment you can use the scope’s super powerful fire modes at the fire rate/ammo capacity of the regular laser/stealth strike… so I’m thinking about dropping a couple of those setups in to the Nerf Vulcan.

I think the biggest consistent complaint I’ve seen with this system is a lack of score keeping and no way to manage respawns… I think I’ve come up with a pretty simple fix/mod for this:

Disconnect the capacitive “shield” pad, and instead connect the lead to a jack of some kind installed on the shell of the gun. You could use whatever format plug would work best for your preferences. Then a referee could carry a “key” for the guns to reactivate them.

This also really broadens some gameplay types – we bought multiple ITS systems so we could play games with different objectives. For example, one game type we play there is an ITS in each team’s “base” set to bomb mode, and the first team to detonate the bomb in the other team’s base wins. In other game types, the ITS in each base is set to “health” and acts as a medic station. So perhaps in each base there could be a “respawn” station with the “key” tethered to it – the respawn station could be a simple electronic counter, and every time the key gets plugged in to a gun it ticks up one, so each team’s counter reflects the other team’s number of kills. This would also force players to return to their base to respawn.

Another idea would be where each team has a “medic” that carries a key. This would also allow the medic to activate his teammate’s shields. Respawns from your medic could be “free” respawns and wouldn’t count against your team’s score. With the arduino codes here a “medic gun” could be designed that has to be placed over the sensor of a teammate’s gun and each trigger pull restores 1/3 life. The “key” could be tethered to this gun. The “medic gun” could be set up using a custom arduino board so that once a team’s medic “dies” he cannot respawn.

Of course, there’s still some element of “honor system” attached to these ideas – there’s no truly centralized or automated score keeping. I’m also thinking up ways to prohibit a player from simply resetting power to the striker/assault striker instead of respawning – perhaps a similar plug/key setup that disables the “finger print” button as well, or some such thing. I’ve considered using magnetic normally open switches as the replacement for the finger print/shield buttons, but I need to experiment a little with them to make sure that shaking the gun wouldn’t be a way to circumvent needing a key.

I’ve got no ideas yet on how to electronically manage a flag carrier for CTF games. Still pretty much have to work on the honor system of “if you’re dead, you drop the flag” or something similar. I’m working on dreaming up some ideas… perhaps an electronic flag could be built using what we know about the IR codes LS uses and some creative integration of other ideas. Ideas are actually popping in to my head as I type, but I’m going to stop babbling here and close up for now…

In closing, I have to say I think LS is a GREAT platform for a fantastic system, and I think using the LS protocols and some creative Arduino coding some really phenomenal stuff could be developed. I haven’t done much Arduino yet, but now I have major incentive to learn so I can keep expanding my arsenal beyond what I’ve already got (though with an eventual total of 16 guns, 16 targets and at least 3 ITS systems that makes for the capability of some pretty epic games already). I’ve got 7.5 acres I live on, on top of a tall hill in middle TN and am already constructing an obstacle course out here that I’ll be integrating a bunch of the little targets in to. Ah, and despite my promise to quit babbling, I have to remark on one last thing: I’ve seen a few complaints about Light Strike’s range – I can tell you that most of those complaints are incorrect, and perhaps a result of poor aim. I can hit an assault striker from about 100ft. away in broad daylight, WITHOUT the scope add-on. At night I was able to make the shot from at least three times that far, again WITHOUT the scope!

Anyone who would like to put heads together on some of this stuff, please feel free to email me!

Reply

Has anyone figured out if there’s some RF communication going on with these things, too? The ITS seems to be able to “kill” guns in bomb mode without LOS to the sensors, and the “refractor launch system” seems to have a wide-angle but very short-range burst, not sure how they accomplish that without a motorized lens assembly. Add in the way the enemy scanner works and I’m left wondering if there’s a set of RF communication going on here.

I’m intensely curious about it, because I’m day dreaming about making some Light Strike “grenades.” I’ve got about 16 guns, a disgusting number of targets and two ITS units, and we’ve been playing some really, really cool scenarios here on our 7.5 acres. We don’t really have issues with people “cheating” on the “return to your base/checkpoint to respawn” rule, but that may be because everyone playing knows each other.

Vests would be cool, but I have a specific application for them in mind. If a vest could be constructed or modified to disable the gun when the vest is “dead” though, it would significantly increase my interest in using them in broader applications.

Reply

I can confirm that there is no RF wizardry in the guns or turrets. I’m not sure how they achieve wide angle, but I suspect it has something to do with power modulation on the IR side. If I ever find some free time, I’ll get a o-scope on there and confirm.

Reply

Well, just did some additional testing and it does not look to me like the ITS is “killing” guns without LOS, I think we’ve just had them placed near surfaces that reflect IR quite well and so it has been appearing to be the case. So disregard the rambling about the RF comm.

On the other hand, this seems to me to mean that I could pretty easily construct some “grenades”… and they’d just about be the functional opposite of the targets. Going to start looking in to making a prototype. Might be a good first project for me to start on learning arduino as well.

Reply
Raymond

So I was originally going to wait and see if they have a new spring line coming, but with the stuff going for as cheap as it is it’s hard to pass up. How would I go about learning the skills needed to hack this stuff? My knowledge is very limited right now. I know what a resistor is and a capacitor as well as an LED and a bread board. After that it gets fuzzy. If anyone could point me in the right direction for learning this stuff I would be happy to invest some time and energy into this gear.

Reply
Chris

Hey I was wondering if you need Teensy to just receive the signal of the guns with your codes?

Also could you give a little tute on how to implement your code. Thanks.

Reply
Taboy

First of all, if I can get this to work then you are my hero. Secondly, I can’t get it to work :( it won’t compile with your version of the IRremote library. I tried the original IRremote library and it compiled. But with this IRremote library I get an error that is extremely long but at the end it says: “…\Documents\Arduino\libraries\IRremote\IRremote.cpp:599: error: ‘volatile struct irparams_t’ has no member named ‘rawlen’” any help would be greatly appreciated.

Reply
Taboy
Pablo

Over the last few days I’ve been trying to get my Arduino Uno to work with my Light Strike guns. Though I can receive codes (they seem to be slightly different from yours though), I can’t seem to get it to transmit them properly.
I can turn our tv on/off (a sony bravia one) so it’s not the hardware. But I’m doing something wrong while transmitting for the guns.

So what I’ve done:

Took the latest IRremote (since the one supplied here isn’t Arduino 1.x compatible) and added the sendLS and decodeLS functions (with the necessary defines). (Note: I also tried the IRremote made for this article, and changed the include to Arduino.h from WProgram.h to make it compile, though that didn’t work either, and then I couldn’t even turn our tv on and off.)

Tried the IRrecvDump.ino code with “07 00 0102″ as input (that’s the code my gun sends when it’s a blue laser gun.) I also tried “04 00 0102″ (red laser gun) and 07 00 0502 (like stated in this article) and several others. I also tried changing the middle “00″ to something else, since the article said it had to be non-0 to work, even though my guns send it out as 0, but that didn’t change anything. I tried receiving with both my guns and the target thingy.
On top of that I tried using irsend.sendLS directly: ‘irsend.sendLS(0×07110502, 32);’ also with all above stated codes, but didn’t work.

Then I tried changing the duty cycle of my pin: ‘analogWrite(3, 128);’, though this changed nothing.

I also tried a PWM frequency library to change the frequency of my pin to 37800: ‘SetPinFrequencySafe(3, 37800);’ but didn’t help. When I did this the receiving broke, and just always returned 0. If I commented out the line, receiving worked again.

And that’s about as far as I got. Anyone got any idea what could be going wrong?

Thanks a lot!

Reply

Add Your Comment