[HN Gopher] Reverse engineering a 27MHz RC toy communication usi...
___________________________________________________________________
Reverse engineering a 27MHz RC toy communication using RTL SDR
Author : austinallegro
Score : 70 points
Date : 2025-10-15 14:31 UTC (8 hours ago)
(HTM) web link (nitrojacob.wordpress.com)
(TXT) w3m dump (nitrojacob.wordpress.com)
| ge96 wrote:
| Tangent
|
| I had an rc submarine that could go underwater a couple feet, but
| I'd take an rc car's 27MHz radio and put it underwater, it'd stop
| working almost immediately soon as it went underwater
| (waterproofed). Wonder what the difference was.
| doug_life wrote:
| It is likely that that the sub had it's antenna tuned to work
| well in water while the RC car antenna was tuned for open air.
| The two different mediums will change the antenna impedance.
| ge96 wrote:
| Interesting does say shorter antenna, I could see that, I
| think the RC sub's antenna was like 4in long vs. an rc car's
| antenna that's usually like a foot
| iancmceachern wrote:
| Yeah, my basic understanding of submarine communications is
| that lower frequencies penetrate the water better. Lower
| wavelength needs a longer antenna. The system US subs use
| is a very low frequency from what I understand.
| jasonjayr wrote:
| > TACAMO (take charge and move out) is the back up
| communications system to the US nuclear submarine fleet
| in case an attack on land based transmitters disables
| them. A rotating fleet of Navy E6 jets equipped with 200
| KW transmitters and two 21/2-mile-long trailing wire
| antennas (TWA) at 35,000 ft altitude to provide 24/7
| coverage. Short pings are transmitted every few seconds.
|
| Regarding "longer antenna" for submarines... -- I
| recently learned about this signal from
| https://www.sigidwiki.com/ -- which has been helpful to
| ID all the fun stuff you can see with RTLSDR
| iancmceachern wrote:
| Delicious, 2.5 mile long antennas behind airplanes
|
| Corona, stuff like this, the sheer gall, it's impressive.
| janzer wrote:
| Sadly the 6000 mile antenna never got built, but they did
| get a few tens of mile long ones built.
|
| https://en.wikipedia.org/wiki/Project_Sanguine
| mschuster91 wrote:
| The cost of that must be _insane_ - the price tag of
| being about the only military force on this rock capable
| of projecting force and delivering utter devastation 24
| /7/365 any place any time even if the entirety of the US
| got glassed.
| mmmlinux wrote:
| was the submarine remote RF or IR?
| ge96 wrote:
| it's RF this one
|
| https://www.dhgate.com/goods/822484606.html
|
| seawolf Omnibearing RC Submarine - 6CH 35cm
|
| Walmart used to sell it like 17 years ago
| Peteragain wrote:
| Software defined radio but what is LTR?
| papercrane wrote:
| I believe the RTL in RTL-SDR is "Realtek Limited", the
| manufacturer of the chips used in the early days of SDR. I
| don't think the chips these days are exclusively Realtek, but
| the name has persisted.
| jandrese wrote:
| The original low cost SDR was a European TV tuner USB stick. A
| driver developer noticed that it was possible to turn off the
| built-in vertical and horizontal blank suppression to get a raw
| I/Q dump from a device that was available for $20 retail. This
| revolutionized the hobbyist SDR community as the purpose built
| devices cost hundreds or thousands of dollars.
|
| The "RTL" came from the company that built the hackable chip:
| Realtek.
| RicoElectrico wrote:
| > A driver developer noticed that it was possible to turn off
| the built-in vertical and horizontal blank suppression
|
| Aren't you confusing that with Fresco Logic USB to VGA?
| theamk wrote:
| Having different number of bits in very similar commands (up vs
| down) is very unusual in low cost RF devices. Those things are
| built as simply as possible using underpowered CPUs, so I would
| not expect any sophistication.
|
| Based on patterns ("110110110", "1010", "111011101110"), I bet
| bits are variable length. Long pulse for sync, medium for 1,
| short for 0 (or other way). So there is always the same number of
| bits, but the time taken is different. This makes it very easy to
| decode, and explains the values in the table.
| janwl wrote:
| All that audio engineering expertise and you can't remove the
| background noise from your microphone.
| numpad0 wrote:
| In similar manners to how lots of optical mouse sensors are
| Agilent command compatible, many RC cars are built on clones of
| Realtek TX2/RX2 chipsets. Ironically designed originally by the
| same company as the RTL2832U.
|
| The RX2 protocol is incredibly simplistic and inefficient at the
| same time, something like numbers of pulses in increments of few
| dozens to accept one of the grand total of dozen commands. It
| barely allow multiple command issuance within a second and
| completely incapable of handling analog inputs due to that. It's
| truly a product of "if it works" mindset.
|
| They take the radio input, or just digital input into the antenna
| pin, or photodiode for IR input, or you can just remove the chip
| and solder an Arduino into H bridges. The difficulties are about
| the same. The minor disappointment I have had with these is that
| the steering servo built into the chassis inthe example I had was
| way too roughly made that analog control was plain impossible no
| matter what.
___________________________________________________________________
(page generated 2025-10-15 23:00 UTC)