Sunday, June 23, 2013


In the Hacker Lounge at Open Source Bridge last week, the well-stocked LEGO table caught my eye. In particular, I spotted an antenna protruding from the pile, and I followed it down to a radio-controlled LEGO car platform! The controller was quickly located, a battery replaced, and I found that it worked pretty well.

The controller was clearly marked with a sticker indicating operation at 27 MHz (FCC ID: NPI71646). That would have been my first guess anyway as it is a very popular frequency for radio-controlled toys. Since several of us were having a HackRF party, I decided to see if I could control the car with my HackRF Jawbreaker.

After verifying that the car worked with the original controller, I recorded several waveforms with the hackrf-transfer utility. I made eight separate recordings, one for each active controller state: forward, backward, left, right, forward/left, forward/right, backward/left, and backward/right.

The recordings were quite clean even though 27 MHz is below Jawbreaker's official operating range (30 MHz to 6000 MHz). In fact, I had captured some apparently good recordings of NFC transactions at 13.56 MHz just the day before. The major drop-off in performance I've observed on Jawbreakers I've tested has been just below 10 MHz.

The first HackRF transmission I tried was by building a small flowgraph in GNU Radio Companion to replay the captured waveforms with my Jawbreaker one at a time. With the car's controller switched off, I was able to make the car move with a simple replay! The best waveform worked at a distance of up to 20 meters even though I put very little effort into cleaning up the waveform or adjusting the power level.

Although I didn't have much time left before I had to catch my flight home, I wanted to see if I could synthesize control transmissions in software on my laptop instead of replaying captured waveforms (that included received noise and minor defects such as quantization and DC offset).

The first step toward synthesizing control transmissions was to analyze the captured waveforms. I found that each transmission consisted of a series of pulses at 27.145 MHz. The pulses were all at the same power level. Each pulse lasted one of two durations and was followed by a pause of consistent length. It looked like On-Off Keying (OOK) with data encoded in the number of consecutive short pulses.

Each transmission featured a repeated pattern of four long pulses (each 1.875 ms long, separated by 0.625 ms pauses) followed by some number of short pulses (each 0.625 ms long, separated by 0.625 ms pauses). The repeated pattern continued for as long as the controller was held in a particular state. The number of consecutive short pulses depended on the state of the controller:

  • forward: 10 short pulses
  • forward/left: 28 short pulses
  • forward/right: 34 short pulses
  • backward: 40 short pulses
  • backward/left: 52 short pulses
  • backward/right: 46 short pulses
  • left: 58 short pulses
  • right: 64 short pulses

That's as far as I got.


will said...

super excited about the commercial hackrf!!

Anonymous said...

Great is fantastic. I hope to see other example for this device. I would like to see also RFID 13.56MHz

Karon@ cheap gadgets said...

It's really gonna be cool stuff and my kids will be so happy to have this one.

Ace Maxs Daun Sirsak said...

thank you for youe information

kpreid said...

Applying (count - 4) / 6 to your list of pulse counts produces [1,4,5,6,8,7,9,10], which is a nice bunch of consecutive integers, but doesn't look further structured except in a "someone wrote down a mostly sensible enumeration" way.

Neversphere said...

I tried doing a simple capture and playback with HackRF but using a simple hackrf_transfer -r / hackrf_transfer -t doesn't appear to work. Looking at GitHub it seems that there's a bug with hackrf_transfer -t. Any chance you can post a super simple GNU Radio Companion graph for playback?

Neversphere said...

I see you added it to the list:


Anonymous said...

What You did found is coding used by nearly all cheap radio toys.
Datasheet of some of those chips:

Michael Ossmann said...

Anonymous: Thanks for the link to the datasheet! I've definitely seen the same encoding used in other toys, but that is the first matching datasheet I've seen.

Anonymous said...

cool blog. Check out mine at

silverk said...

Son got RC car for christmas. So I decided to study GNU radio during holidays. (Because we have no snow. Only rain and mud.)
I used RTL stick for reception. It works well.

I got 16 pulses for forward and 40 backward.

Thanks for giving idea, what can be done with SDR.

Dad said...

As you are naming HackRF and open source project which I found is misleading. I checked the zip files and checked all schematic and pcb files which are incomplete. I could not tracked down any proper link so that the firmware and the software could be downloaded with well documentation

Michael Ossmann said...

Dad: The complete HackRF design files and source code are located on github:

I can assure you that the information is complete. People other than me have used that information to build and use HackRF boards.

Anonymous said...

I have a car commands which has a PT8A977B
and has the same trasmission.
Thank you for help to understand.

Lego Table said...

HackRF LEGO Car. In the Hacker Lounge at Open Source Bridge last week, the well-stocked LEGO table caught my eye. ...

Diane Cain said...

The online shopping platform for remote controlled toys. Choose from a collection of a wide range of RC planes, RC helicopters and Bikes.Shop online.
Affordable Remote Control Cars

Agen Bola Terpercaya said...

i am really love this website Agen bola terpercaya

Agen Bola said...

Agen Bola

Piyush sandiya said...

Hi Dear,

i Like Your Blog Very Much..I see Daily Your Blog ,is A Very Useful For me.

Speed Muscle Remote Control RC Buggy 2.4Ghz 1:16 Scale Truggy Ready to Run w/ Suspension Toy (Green Color) …

Visit Now -

Remote Control Car

Kelly Byrnes said...

Looking to sell a used car? Check out Cash For Car Brisbane, free for members of the public to quickly and efficiently sell your car. Valuing and selling is simple and easy.
toyota wreckers Brisbane

Julia Sam said...

All Cars Buyers as it offers the most ideal approach to sell your unwanted auto, truck, van, SUV, 4×4, ute or Jeep. You call us, and we’ll give you a money offer you can’t refuse.
car for cash brisbane

Julia Roach said...

Wonderful post!!! Genuinely loved this kind of post. Although I want much more information on like precious subject matter.
cash for cars caboolture
caboolture cash for cars
caboolture scrap car
scrap car removal caboolture
cash for cars brisbane
junk your car for money
junk car buyers

Krystal Nielson said...

junk cars redcliffe offers a prompt and professional service. We buy all used and end of life scrap vehicles, all vehicles are paid for in cash. Free collection guaranteed.

Margret Ruch said...

All Cars Removal is a long-time and leading specialist in the collection of scrap cars removal in Brisbane giving unbeatable cash amount in return!
Contact US: 0424668110
Visit: car removal logan

alman araba markalar─▒ said...

very nice blog thanks

german car brands said...

all call brands for german car brands

Kim Lopez said...

Some really useful content here. I've been looking for something like this to help with a research piece I've been working on.
Scrap Metal Recycler
car disposals brisbane
car removal south brisbane
car removal east brisbane
car removal north brisbane
Free car removal brisbane
scrap metal sunshine coast
scrap metal brisbane
scrap metal ipswich
scrap metal north brisbane
scrap metal south brisbane

Jenny Hatcher said...

Hello admin! This is the remarkable article as well as it is valuable for the entire person and I want to say that I would like to write on this subject too. You have an interesting written on this topic.
buy wrecked cars brisbane
cash for scrap cars brisbane
brisbane scrap car buyers
cash for cars south brisbane
used car buyer brisbane
cash for cars
scrap cars for cash brisbane
cheap used cars for sale
cash for used cars
cash for old cars
Scrap car Redcliffe
cash for cars Redcliffe
cash for used cars Redcliffe
sell car Redcliffe
Best place to scrap a car
cash for old cars

Janice Marshall said...

Excellently written article, if only all blogger offered the same level of content as you, the internet would be a much better place. Please keep it up!.Great tips, I would like to join your blog anyway.Waiting for some more review.Thank you
Cash for Used Cars Redcliffe
cash for used cars brisbane
Cash for junk cars Recliffe
Cash for scrap Cars Caboolture
Cash for Cars Recliffe
cash for used cars brisbane
car body removal brisbane
unwanted car removal brisbane
scrap cars for cash brisbane
cash for cars caboolture
scrap auto removal
auto scrap removal brisbane
scrap car removal brisbane
auto scrap dealers
car removal for cash Redcliffe

Crystal Coleman said...

While marketing can be tricky, it is the content that makes the site important. If you provide informative content that serves the needs of your visitors, word will spread.
mazda wreckers brisbane
brisbane wreckers
car wreckers brisbane
wreckers brisbane
auto recyclers brisbane
brisbane holden wreckers
mazda wreckers sunshine coast
4x4 wreckers brisbane
scrap cars brisbane
cash for cars brisbane
cash for car gold coast
Best place to scrap a car
cash for junk cars brisbane
toyota wreckers Brisbane
brisbane cash for car
cash for scrap cars brisbane
nissan 4x4 wreckers brisbane

Janice Berry said...

This is the nice post which I was waiting for such an article and I have gained some useful information.
car recycling brisbane
Scrap cars Brisbane
cheap spare parts for cars
Cheap Car Parts Brisbane
car wreckers brisbane
cash for cars brisbane
Mazda wreckers brisbane
cash for car brisbane
cash for car
Cash for Cars
cash for cars brisbane
Ford wreckers brendale
Toyota Wreckers brendale

Soniya David said...

Excellently written article, if only all blogger offered the same level of content as you, the internet would be a much better place. Please keep it up!.Great tips, I would like to join your blog anyway.Waiting for some more review.Thank you
cash for scrap cars brisbane
best wreckers brisbane
car wrecker Brisbane
brisbane wreckers
Mazda Wreckers brisbane
wreckers north brisbane
wreckers brisbane northside
car wreckers north brisbane
north brisbane wreckers
cash for car brisbane
Cash For Cars Redcliffe
Scrap Cars Logan
Junk Cars Caboolture
cars wrecker Redcliffe
Cars Tyre Redcliffe
Cash for Junk Cars Redcliffe
Scrap Car Removal
Broken Car Removal Brisbane
Old car Removals
auto cheap part
Unwanted Car Removal
brisbane car removals

Mick Angelo said...

Thanks for the great content. It is nice to go through the process at a high level.
cash for cars caboolture
scrap car removal brisbane
scrap car removal gold coast
sell wrecked car brisbane
cash for unwanted cars brisbane
scrap cars for cash brisbane
scrap car removal brisbane
broken car removal
broken car collection
scrap car removal ipswich
car removal redcliffe
car removal logan
sell my car for cash brisbane
brisbane cash for cars
cash for unwanted cars brisbane
scrap car removal in brisbane
all cars removal
cash for cars caboolture
cash for scrap cars brisbane
Used Cars Buyer Brisbane
Cash For Old Cars Brisbane
cars removal brisbane

Hazel Donovan said...

Excellent post. I will certainly come back to read more of the articles about food. We love to try new receipts.
car removal brisbane
scrap car removal caboolture
car removal brisbane
cash for cars caboolture
caboolture scrap car
caboolture cash for car
cash for car caboolture
cash for cars ipswich
cash for cars brisbane
cash for cars redcliffe
cash for scrap cars caboolture
cash for scrap cars ipswich
cash for unwanted cars ipswich
car removal logan
car removal caboolture