Hacking at the Light Strike Laser Tag Game


My friend Jon has been working on Laser Taser tag, modifying perfectly ordinary toy laser guns to provide an electric shock when you get hit.  As he was working on this game for Makerfaire Detroit 2012, I noticed that these guns are really freaking cool.  10 years ago, I paid good teenage summer job money to play laser tag, and it wasn’t as good as this.  You can now buy a $30 toy that rivals the fanciest laser tag equipment of the previous decade.

This is one of the rifles you can buy for the Wowwee Light Strike game.  They’ve got a bunch of capacitive touch button on the side to change gun settings, LED lights to indicate health, team, and who you got hit by, a reload button, an IR receiver and transmitter, and a couple of ports for add-on accessories.  Jon did a lot of the ground work for what I’m summarizing in this post.  The guns (and accessories) send out 38 kHz IR.  The guns use a custom packet format, and each message is 32 bits.

After taking a look inside these guns, I realized that they have a lot of potential.  They’re a really great sensor platform for a laser tag game, with a great form factor, but the electronics inside don’t offer a lot of flexibility in game mode, and players have to use the honor system to keep score.  My end goal is to provide drop in replacement electronics, which allow for more teams, additional game modes, zigbee scorekeeping, custom guns, custom sounds, and provide a standard data output, so people (like Jon) can build accessories a little easier.

Light Strike rifle with all screws highlighted

These guns are really easy to get into.  Just regular phillips head screws, nothing special.  A bunch of them are hidden under the sticker on the side opposite the buttons.  These can be hard to find, so to the left is a picture with all the screws circled (click to embiggen).  Once you get inside, the main feature is a really well-labeled PCB that connects all the different sensors and outputs.  Of  course, the microcontroller is covered in a big blob of epoxy, but I’m going to replace the entire board, so it isn’t going to be a problem in the long run.

 Ultimately, I want the new electronics to be backwards compatible with the old electronics, so I need to decode all the messages that are sent out by the stock rifle.  Fortunately, the rifle comes with a little target practice toy.  Taking it apart reveals an IR decoder, RGB LED, and a speaker. I added a Teensy, wired the IR decoder in, and added an IR LED to output my own codes.  The IR decoder is connected to pin D7 on the Teensy (arbitrary choice), while the IR output is connected to pin C7 (this is the PWM output from the high-speed timer/counter on the Atmega32U4).  I started out using the Arduino IR Remote library from Ken Shirrif, just outputting raw timing values from the IR input.  This ended up being frustrating, and I used a logic analyzer to confirm.  Getting a graphical view of the IR output helped a lot.

As you can see from the logical analyzer output, there are a few different marks and spaces (marks are where the LED is active).  There’s a long header mark at the start of the message, followed by equal-length inter-bit marks, with either a short space (for 0) or a long space (for 1).  Timings are as follows:

  • Header Mark: 6750 us
  • Inter-bit Mark: 900 us
  • Zero Space: 900 us
  • One Space: 3700 us

At this point, I modified the IRRemote library to decode the incoming messages.  I had to add the mark and space timings above, and write functions for decoding and encoding data.  I also had to modify some #defines for the Teensy to tweak the outgoing IR into a 50% duty cycle, and adjust the timings: The guns send out ~37.8 kHz IR, but the default settings sent out ~38.2 kHz IR.  This shouldn’t matter, but a simple tweak made everything work as it should.  The most difficult part was getting the IR send function working.  Here’s my new IR Send:

In order to get the gun to accept the header, I had to send out a 0 length space after the header pulse, then begin sending data.  This took a while to nail down. I’ve put the code on GitHub here: https://github.com/LightStrikePlusPlus/LightStrikeDecode

Amazingly, after decoding some data packets, it appeared that everything was just a 32 bit output packet, and some obvious patterns emerged once I fired a few shots with different weapons and different teams.  Of the 4 bytes in the message, Byte 3 indicates the team (0x07 for Blue (default), 0x04 for Red, 0x05 for Yellow and 0x06 for Green), Byte 2 indicates a count of some sort (only used for the turret bomb mode.  It increases by one every time the bomb goes off, but any number of “count” will trip the gun, except 0.), and Bytes 0 and 1 indicate the weapon.  Below are the weapons:

  • Laser Strike: 0x0502
    • 12 hits to kill from full health
      Inside of the target, with the stock electronics, modified with wires for power and sensor input to the teensy.
  • Stealth Strike: 0x0602
    • 12 hits to kill from full health
  • Pulse Strike: 0x0703
    • 8 hits to kill from full health
  • Rail Strike: 0x0806
    • 4 hits to kill from full health
  • Sonic Strike: 0x908
    • 3 hits to kill from full health
  • Bomb: 0x0E18
    • MUST include a non-zero “count” field
    • 1 hit to kill
  • Sentry: 0x0F08
    • 3 hits to kill from full health
  • Health: 0x08–
    • MUST be used with team 0x08
    • Final byte is team byte for healing pulse (0x07 for blue, etc)
    • 3 hits to full health
Target with Teensy installed

Interestingly enough, the guns appear to be more particular about the codes they receive than the sentry or the target module.  Both of these devices will activate on codes that don’t activate the gun.  The target, in particular, treats team codes 0x0D, 0x0A, 0x0B and 0x0C as Blue, Red, Yellow, and Green, respectively.

Now I think I’ve got enough data to build a protocol for the new electronics that will be backwards compatible, but add a whole lot of functionality. If you’d like to mess around with this on your own, check out the Arduino code I’ve uploaded here: https://github.com/LightStrikePlusPlus/LightStrikeDecode.



  • I was playing around with this too: http://rich.whiffen.org/2011/10/light-strike-decodes-so-far.html
    My decodes are here: https://docs.google.com/spreadsheet/ccc?key=0Arz5A-6gtL3kdDRFNlVpSHdkUEhUTi1mMHhlaDU0WUE

    The pistols are different than the rifles. The ITS has other codes that probably should be handled. I haven’t picked up a target vest so so there is some more logic there with respawning team mates to find.

    Last bit, I have been in touch with a guy from Wowwee and he’s open to questions. Sounds like they want people to hack them. Unfortunately since the product appears to be winding down I’m not sure how much help he’ll me.

    I’d like to make a network aware ‘flag’ that could be captured and keep team score, and maybe some variants where you have to set X number of flags to win, etc.

    Great stuff and let me know if I can help.

  • Rich, great to hear from you! Your page is partially the reason I decided to pursue this and document it.

    If you look a little closer, you can see that I got the ITS codes. I still haven’t decoded a pistol, but that should be pretty easy now that I have my USB target!

    As soon as I get some new electronics nailed down, I intend to expand into other accessories. Hopefully the product isn’t fully winding down, but all the clearance sales are probably a sign.

  • Well, we all know that the Facebook page may not be a guarantee, but according to the PR guys responsible for social media, at least, there’s plans to release a new line next Spring. The retail interest is flagging somewhat, and the marketing for the line is, in my oppinion, less than it deserves by a long shot, but there’s definitely R&D being done over there.
    A review on the Light Strike Facebook page mentioned that the Light Sprites product, especially the wand, also interacts with the Light Strike line, so that’s another option for getting more info about what makes the guns tick.

    Also, I’m not tremendously technical. I understand that the hexidecimal numbers provided here give us the active bits in the packets sent to and from the guns, but I don’t really understand much more than that. I know it’s not necessarily fun to drag a literate but not particularly savy guy through the intracasies of what you’ve done, but I’d appreciate the attempt, if someone wants to e-mail me off this thread, I’ll gladly accept whatever clarification it brings.

    I know that there are literally millions of possible combinations that are present, or at least I think I know that, but I wonder if it wouldn’t be fruitful to set up an IR transmitter and a gun for a while and just run through the options available to try and find some patterns. If the gun, for example, is responding to the shots and making the internal decision to take off a certain amount of health each time, then there’s not much we can do to expand this. However, if, as I suspect, there’s just a lot of information, then maybe we can really design more accessories that do improve the guns themselves, as well as medkits, falgs, and what have you.

    I’m not the first person to sit down and tally up the damage of different stuff as relates to the guns and their functions, but I did pretty much go through everything. The Strikers (pistols) and ssault Strikers (rifles) seem to actually have different shielding potentials, though the manuals for both promise a fifty percent protection against damage. I’ve seen as high as that, but I’ve also seen as low as 33% protection granted. I might, I think, have seen 0 protection granted, but I could be wrong. Then there’s the bonus granted to shield regeneration under the Enemy Scanner accessory for the rifle. It might effect shielding potential, too, whether on purpose or not.

    The reason I mention this is because some of the information contained in the packet might be related to shield protection. That is, how much does a particular type of shot get blocked by shields? If this is in fact the case, then there’s a nice accessory which does nothing but boost shield protection or nullify it for others simply by modifying this bit of shield information.

    Also, the enemy scanner accessory powers up most shots to half again damage. It would be interesting to note if the packets change to reflect that and how. And the Refractor Launcher seems to have no effect on what shots are fired, which, given the way the gun resets if it’s jostled, may indicate that the launcher actually contains a full set of codes and sounds for the weapons in the Assault Strikers, or it could mean that the Assault Striker contains a full library of external mods. If the latter is the case, there’s not much hope for new stuff, which would be tremendously shortsighted for a company usually blessed with good longrange vision.

    I’ve rambled on this comment such that it’s nearly another post. I thank anyone who’s stuck with it, and I hope someone will help me understand a little better, so I’m not just mumbling in the dark.

  • Looks great! In all my free time I will have to get in a try to make a sensor vest.

    I have been unhappy with the way the LS does sensing. You only get hit in one place, you have to trust folks for dying, and you can’t change the amount of health.

    A vest with a few sensors could take care of these issues. Maybe even set up healing / respawn in base? You could add the team stats too, and not be so bound by size weight restrictions of the gun itself.

    Thanks for the great work!

  • Hey there! Awesome work here… the woman and I just picked up a TON of this stuff on major clearance from some area Wal-Marts. Got 4 strikers and 9 assault strikers, plus two ITS systems, planning to snag 1 more assault striker and 2 more strikers plus at least one more ITS. I’m planning to transplant most of the assault strikers in to some Nerf shells – going to put assault strikers unmodified in to some Stampedes, ones with the scope accessory in to some Long Strikes or Longshots. There’s this cool exploit where if you boot up an assault striker with the scope attached and then attach the rapid fire attachment you can use the scope’s super powerful fire modes at the fire rate/ammo capacity of the regular laser/stealth strike… so I’m thinking about dropping a couple of those setups in to the Nerf Vulcan.

    I think the biggest consistent complaint I’ve seen with this system is a lack of score keeping and no way to manage respawns… I think I’ve come up with a pretty simple fix/mod for this:

    Disconnect the capacitive “shield” pad, and instead connect the lead to a jack of some kind installed on the shell of the gun. You could use whatever format plug would work best for your preferences. Then a referee could carry a “key” for the guns to reactivate them.

    This also really broadens some gameplay types – we bought multiple ITS systems so we could play games with different objectives. For example, one game type we play there is an ITS in each team’s “base” set to bomb mode, and the first team to detonate the bomb in the other team’s base wins. In other game types, the ITS in each base is set to “health” and acts as a medic station. So perhaps in each base there could be a “respawn” station with the “key” tethered to it – the respawn station could be a simple electronic counter, and every time the key gets plugged in to a gun it ticks up one, so each team’s counter reflects the other team’s number of kills. This would also force players to return to their base to respawn.

    Another idea would be where each team has a “medic” that carries a key. This would also allow the medic to activate his teammate’s shields. Respawns from your medic could be “free” respawns and wouldn’t count against your team’s score. With the arduino codes here a “medic gun” could be designed that has to be placed over the sensor of a teammate’s gun and each trigger pull restores 1/3 life. The “key” could be tethered to this gun. The “medic gun” could be set up using a custom arduino board so that once a team’s medic “dies” he cannot respawn.

    Of course, there’s still some element of “honor system” attached to these ideas – there’s no truly centralized or automated score keeping. I’m also thinking up ways to prohibit a player from simply resetting power to the striker/assault striker instead of respawning – perhaps a similar plug/key setup that disables the “finger print” button as well, or some such thing. I’ve considered using magnetic normally open switches as the replacement for the finger print/shield buttons, but I need to experiment a little with them to make sure that shaking the gun wouldn’t be a way to circumvent needing a key.

    I’ve got no ideas yet on how to electronically manage a flag carrier for CTF games. Still pretty much have to work on the honor system of “if you’re dead, you drop the flag” or something similar. I’m working on dreaming up some ideas… perhaps an electronic flag could be built using what we know about the IR codes LS uses and some creative integration of other ideas. Ideas are actually popping in to my head as I type, but I’m going to stop babbling here and close up for now…

    In closing, I have to say I think LS is a GREAT platform for a fantastic system, and I think using the LS protocols and some creative Arduino coding some really phenomenal stuff could be developed. I haven’t done much Arduino yet, but now I have major incentive to learn so I can keep expanding my arsenal beyond what I’ve already got (though with an eventual total of 16 guns, 16 targets and at least 3 ITS systems that makes for the capability of some pretty epic games already). I’ve got 7.5 acres I live on, on top of a tall hill in middle TN and am already constructing an obstacle course out here that I’ll be integrating a bunch of the little targets in to. Ah, and despite my promise to quit babbling, I have to remark on one last thing: I’ve seen a few complaints about Light Strike’s range – I can tell you that most of those complaints are incorrect, and perhaps a result of poor aim. I can hit an assault striker from about 100ft. away in broad daylight, WITHOUT the scope add-on. At night I was able to make the shot from at least three times that far, again WITHOUT the scope!

    Anyone who would like to put heads together on some of this stuff, please feel free to email me!

  • Has anyone figured out if there’s some RF communication going on with these things, too? The ITS seems to be able to “kill” guns in bomb mode without LOS to the sensors, and the “refractor launch system” seems to have a wide-angle but very short-range burst, not sure how they accomplish that without a motorized lens assembly. Add in the way the enemy scanner works and I’m left wondering if there’s a set of RF communication going on here.

    I’m intensely curious about it, because I’m day dreaming about making some Light Strike “grenades.” I’ve got about 16 guns, a disgusting number of targets and two ITS units, and we’ve been playing some really, really cool scenarios here on our 7.5 acres. We don’t really have issues with people “cheating” on the “return to your base/checkpoint to respawn” rule, but that may be because everyone playing knows each other.

    Vests would be cool, but I have a specific application for them in mind. If a vest could be constructed or modified to disable the gun when the vest is “dead” though, it would significantly increase my interest in using them in broader applications.

  • I can confirm that there is no RF wizardry in the guns or turrets. I’m not sure how they achieve wide angle, but I suspect it has something to do with power modulation on the IR side. If I ever find some free time, I’ll get a o-scope on there and confirm.

  • Well, just did some additional testing and it does not look to me like the ITS is “killing” guns without LOS, I think we’ve just had them placed near surfaces that reflect IR quite well and so it has been appearing to be the case. So disregard the rambling about the RF comm.

    On the other hand, this seems to me to mean that I could pretty easily construct some “grenades”… and they’d just about be the functional opposite of the targets. Going to start looking in to making a prototype. Might be a good first project for me to start on learning arduino as well.

  • So I was originally going to wait and see if they have a new spring line coming, but with the stuff going for as cheap as it is it’s hard to pass up. How would I go about learning the skills needed to hack this stuff? My knowledge is very limited right now. I know what a resistor is and a capacitor as well as an LED and a bread board. After that it gets fuzzy. If anyone could point me in the right direction for learning this stuff I would be happy to invest some time and energy into this gear.

  • Hey I was wondering if you need Teensy to just receive the signal of the guns with your codes?

    Also could you give a little tute on how to implement your code. Thanks.

  • First of all, if I can get this to work then you are my hero. Secondly, I can’t get it to work :( it won’t compile with your version of the IRremote library. I tried the original IRremote library and it compiled. But with this IRremote library I get an error that is extremely long but at the end it says: “…\Documents\Arduino\libraries\IRremote\IRremote.cpp:599: error: ‘volatile struct irparams_t’ has no member named ‘rawlen'” any help would be greatly appreciated.

  • Over the last few days I’ve been trying to get my Arduino Uno to work with my Light Strike guns. Though I can receive codes (they seem to be slightly different from yours though), I can’t seem to get it to transmit them properly.
    I can turn our tv on/off (a sony bravia one) so it’s not the hardware. But I’m doing something wrong while transmitting for the guns.

    So what I’ve done:

    Took the latest IRremote (since the one supplied here isn’t Arduino 1.x compatible) and added the sendLS and decodeLS functions (with the necessary defines). (Note: I also tried the IRremote made for this article, and changed the include to Arduino.h from WProgram.h to make it compile, though that didn’t work either, and then I couldn’t even turn our tv on and off.)

    Tried the IRrecvDump.ino code with “07 00 0102” as input (that’s the code my gun sends when it’s a blue laser gun.) I also tried “04 00 0102” (red laser gun) and 07 00 0502 (like stated in this article) and several others. I also tried changing the middle “00” to something else, since the article said it had to be non-0 to work, even though my guns send it out as 0, but that didn’t change anything. I tried receiving with both my guns and the target thingy.
    On top of that I tried using irsend.sendLS directly: ‘irsend.sendLS(0x07110502, 32);’ also with all above stated codes, but didn’t work.

    Then I tried changing the duty cycle of my pin: ‘analogWrite(3, 128);’, though this changed nothing.

    I also tried a PWM frequency library to change the frequency of my pin to 37800: ‘SetPinFrequencySafe(3, 37800);’ but didn’t help. When I did this the receiving broke, and just always returned 0. If I commented out the line, receiving worked again.

    And that’s about as far as I got. Anyone got any idea what could be going wrong?

    Thanks a lot!

  • I’d appreciate it if anyone can explain how to shoot. I’m having same problems as Pablo.
    That is, I’m able to receive correctly but my LightStrike target and my G.A.P.024 do not “see” anything I try to shoot at them with same library. I’m using Arduino pro mini.

  • Thank you very much for creating and sharing this library!
    I think the problem Pablo sees lies in the typo in file: IRremoteInt.h line 166
    #define TIMER_DISABLE_INTR (TIMSK2 – 0)
    should be
    #define TIMER_DISABLE_INTR (TIMSK2 = 0)

    this solved the first part of my shooting problem :)

  • Could somebody provide me schematic of wowwee rifles please?
    Or pinout description of expansion connectors?
    Thank you.

  • Not sure if the original author is still interested, but here are the weapon codes for the pistol:

    Laser Strike: 0x0102
    Stealth Strike: 0x0202
    Pulse Strike: 0x0303
    Sonic Strike: 0x0406

    So it looks as if byte 1 is some weapon-specific mode code (as the pistol’s byte 1 always differs from the rifle’s values, even if the name of the strike is the same). Byte 0 indicates the damage done by a hit. Therefore, the energy max level is a numerical value of 24, and each hit costs you as much energy as indicated by byte 0.

  • Im a complete newbie and way out of my depth with code, but am eager to learn and build LS system to be more “professional”. I have around 30 rifles and 50 pistols (initially for friends) that we now use for small kids parties. The goal was to introduce a new generation to laser games as all major LT companies have shut down years ago.

    Buying a pro system is not an option and learning that upgrades/hacks are possible excites me!

    I was thinking of a few things or hacks to build and see many others have similar or even the same ideas!

    Here is the first change:

    Firstly, I want to remove cheating from the game and replace the on/off switch with a key (I like the magnetic idea mentioned above).
    Secondly, to dedicate guns to teams (or assign a permanent team colour to a gun)

    Then the medic gun came up and I love the idea! One person per team can be assigned as a medic. This medic should be able to respawn a “dead” player without the need to reset (if thats even possible) .

    Two things happen this way (as I see it). The objective to kill/protect the medic becomes a part of the games and medic guns ultimately are used for scoring. So if the medic dies, eliminate the rest of the team without loosing yours.

    Then the second hack:

    Adding a lightduino type display.

    I understand that the LS is discontinued, but there are still many of them available and enhancing/hacking them seems like an awesome way to bring the experience to kids again (without actually buying a complete new or pro system)