Follow Slashdot stories on Twitter


Forgot your password?
Hardware Hacking Networking Toys Build

Reverse Engineering a Missile Launcher Toy's Interface 118

nitro writes "A fairly in-depth technical report by the security researchers at TippingPoint was released on how to reverse engineer the proprietary protocol for controlling a USB missile-launching toy system. They develop an iPhone application to control the device. 'The hardware is coupled with a simple GUI controller written in Delphi (MissileLauncher.exe) and a USB Human Interface Device (HID) interface written in C++ (USBHID.dll). The toys lost their allure within minutes of harassing my team with a barrage of soft missile shots. That same night I thought I would be able to extend the fun factor by coding up a programmatic interface to the launchers in Python. ... One interesting thing is that we have a lot more granular control of the turret movement now than we did with the original GUI. I wrote two simple loops to count the number of possible horizontal and vertical ticks and the results were 947 horizontal and 91 vertical versus 54 and 10 from the original GUI respectively. Granular control allows you to slowly and quietly reposition the turret for stealthy attacks.'"
This discussion has been archived. No new comments can be posted.

Reverse Engineering a Missile Launcher Toy's Interface

Comments Filter:
  • by CRCulver ( 715279 ) <> on Saturday February 14, 2009 @11:47AM (#26856055) Homepage
    Just as Phil Zimmermann famously had to distribute PGP internationally in print form [] to avoid violating munitions laws, wouldn't these guys have to be really careful about their elite missle launching software? If this code makes it to Syria or Iran, we're in for a mildly annoying attack with state of the art styrofoam weaponry.
    • by Chih ( 1284150 )
      Iran already has styro nukes. We can't let this tech get into the hands of the terrorists. We'll have to confiscate all models under the guise of national security. Now all you guys have to do is slashdot the site.
    • by mc1138 ( 718275 )
      If only when we had gone into Iraq we thought to raid the coffee counters for any Weapons of Mass Flotation.
    • The US munitions regulations that Zimmermann was arguing with were repealed many years ago.

    • Re:DIADS (Score:3, Funny)

      by Tiger4 ( 840741 )

      Not such a joke. Look up DIADS, Digital integrated Air Defense (amazingly, not in Wikipedia!). This guy has just hacked the rudiments of Fire Control system. Which is approximately half of a DIADS. The other half being the radar and sensor integration. Which is handled by the many Open projects on sonar and video camera applications. Put them all together, and Our Sandbox Conquering Overlords will have all the tools they need to take them to Playground Domination.

      • You are just an alarmist. Counting ticks on microcontrollers is a basic part of any modern CNC(computer numerical control) manufacturing system. Are you saying this software [] is a modified air defense software platform?
    • by amori ( 1424659 )
      Wonder if our missile defense system can handle this ?
  • by conner_bw ( 120497 ) on Saturday February 14, 2009 @11:49AM (#26856069) Journal


  • Good work. (Score:5, Funny)

    by curtinparloe ( 1477273 ) on Saturday February 14, 2009 @11:49AM (#26856075) Homepage
    Now you need to incorporate webcam target recognition and create an automated firing application.

    You could call it "Skynet".
    • Re:Good work. (Score:5, Insightful)

      by drinkypoo ( 153816 ) <> on Saturday February 14, 2009 @12:01PM (#26856151) Homepage Journal

      Actually, this seems like an almost ideal platform for sentry gun research. It's small, cheap, relatively harmless, can be operated in an office environment, and is probably wildly inaccurate which means that if you can make this work, actually shooting targets with some kind of accurate weapon will be trivial. I'd very much like a sentry gun that would squirt the @#$%@#@ deer with water (at least) when they come to eat the plants on the front porch.

      • Re:Good work. (Score:5, Insightful)

        by diskis ( 221264 ) on Saturday February 14, 2009 @12:27PM (#26856325)

        Why go for the complex solution?
        A motion sensor connected to a air horn should do the trick.

      • Re: (Score:3, Interesting)

        Wouldn't an ultrasonic loud speaker be more effective and less likely to miss?

        Or perhaps a pop up scarecrow.

        Problem is deer are usually smart enough to figure out what is and is not dangerous. If they get squired a few times they'll just assume they're setting off your sprinkler system. And I've seen deer walk right through sprinklers without a care in the world.

        • Re: (Score:3, Funny)

          by wisty ( 1335733 )

          Who says the squirt gun has to use water?

        • Squirting deer... (Score:3, Insightful)

          by Firethorn ( 177587 )

          It also depends on how hungry a deer is and the relative quality of the food. A stuffed deer can afford to be very, very skittish. One that hasn't eaten it's fill in a couple days/weeks is going to start taking chances - including eating the plants off your back porch, especially if they're tasty to the deer.

          That's why we need hunters to actually reduce the deer population. If all everybody does is scare them off, eventually there will be so many deer that the non-scary food sources are exhausted and the

        • by Tycho ( 11893 )

          Perhaps pepper spray sprayed a wide arc would work. Or maybe one could lob miniature tear gas canisters at the deer. Or just use VX nerve gas on them, those deer really do deserve it. If disposing of deer carcasses in order to avoid uncomfortable questions from game wardens, or even disposing of dead wardens is an issue, gas the deer with either Chlorine Trifluoride or Hydrogen Fluoride from lawn sprinklers. The deer will wander off, but will die in a couple of hours. Seal your house well and spraypain

      • by Anonymous Coward
        Those are already commercially available. Search for motion-activated sprinkler.
      • Re:Good work. (Score:4, Interesting)

        by Ihmhi ( 1206036 ) <> on Saturday February 14, 2009 @01:22PM (#26856693)

        Aren't there more than a few "Paintball turrets" floating around on the 'net that basically do this already? I recall seeing one that was already for sale as a package.

        I'd love to have one of these to get rid of the animals that poop in my backyard. Better biodegradable paint than cat shit.

        And with a little hacking into an alarm system and replacing paintballs with ball bearings...

        "Get the HELL out of my house! You have FIVE seconds to comply. FIVE. FOUR. ONE." *bam* *bam* *bam*

        • Wasn't that in a movie with a robot?
          • Wasn't that in a movie with a robot?

            sigh Robocop.
            Motiondetection, bionic arms, waving aluminium foil: wouldn't that scare the animals away?

            • by Ihmhi ( 1206036 )

              Yes, but it'd be boring when I put the video up on YouTube.

              And as for a counter to home invasion, what do you expect me to do? Hook up a bunch of cardboard cutouts to a model train set?

      • Increase your venison consumption. Studies show that increased hunting decreases deer trying to each your porch plants. Some good recipes to get you started: [] :P
        • Do you have any idea what it costs to get hunting licenses in California? It's cheaper to buy meat.

      • Re: (Score:3, Funny)

        by Hanyin ( 1301045 )
        What kind of geek are you? Just make a project [] out of it ;-)
      • by mmontour ( 2208 )

        I'd very much like a sentry gun that would squirt the @#$%@#@ deer with water (at least) when they come to eat the plants on the front porch.

        You can get something like that here [], although it's just a simple motion sensor rather than an active tracking platform.

      • Re: (Score:1, Redundant)

        by mweather ( 1089505 )

        I'd very much like a sentry gun that would squirt the @#$%@#@ deer with water (at least) when they come to eat the plants on the front porch.

        Like this? []

      • Surely your laser isn't so busy keeping squirrels off the bird feeder that it doesn't have time to shoot the occasional deer near the porch.
      • by Kozz ( 7764 )

        Go buy yourself a cheap, bulk container of cayenne pepper. Sprinkle liberally on plants. That may deter the deer as well as rabbits, etc).

      • by Cyberax ( 705495 ) on Saturday February 14, 2009 @06:16PM (#26859047)

        I recommend landmines. Just don't forget where you put them :)

      • by swb ( 14022 )

        Your solution is called a compound bow.

        Totally silent and you will solve the problem.

    • And knocking it down the speaker attached from it should say "I don't hate you".

    • by enFi ( 1401137 )

      You mean the automatic pellet turret []?

    • Done that (Score:5, Interesting)

      by Space cowboy ( 13680 ) * on Saturday February 14, 2009 @04:14PM (#26858071) Journal

      Get a 'Striker' laser-target-enabled missile launcher ($40, I think). Then get a webcam or IP-enabled camera (I got one of these from Ebay for ~$70).

      Use the camera to detect motion and generate a centroid of motion; use the (high-intensity of red) laser-spot to detect where the missile is pointed (again from the camera image), and move the missile to make the centroid and laser-spot coincident.

      It's actually pretty trivial, but it looks pretty cool to have people walk into the office and have two missile-launchers automatically track them.

      I also have the think-geek big-red-button [] box, which I modified to allow the button to control a USB port. Now I can fire the (auto-targetting :) missiles by hitting the big-red-button :)

      It's actually only slightly harder to get the system to track two independent targets... The next step is to build in target-recognition by accessing the company's person-directory (we all have pictures)... Don't shoot the VP. Only directors and below are valid targets :)


  • Seriously, what kid wants to play a cop when they can play Leader of a Rouge nation bent on sending missiles against their uh, playmates? Attach a diaper to it and you have a playful way to play "Biological Warfare"
  • Nigan: He does fit the profile perfectly. He's intelligent, but an under-achiever; alienated from his parents; has few friends. Classic case for recruitment by the Soviets.

    Arthur Cabot: Now what does this say about the state of our country, hmm? I mean have you got any insight as to why a bright boy like this would jeopardize the lives of millions.
    [the General rolls his eyes]

    Nigan: No sir. He says he does this sort of thing for fun.

    Arthur Cabot: What!

  • Pft. (Score:5, Funny)

    by Spatial ( 1235392 ) on Saturday February 14, 2009 @12:03PM (#26856163)
    No wireless. Less ammunition than an AH-64. Lame.
  • Rememer Robot Wars? (Score:5, Interesting)

    by anorlunda ( 311253 ) on Saturday February 14, 2009 @12:22PM (#26856309) Homepage

    Oh wow. I was one of the enthusiastic fans of Muse Software's Robot Wars for the Apple ][ []. It sounds to me like Soulskill has invented a way to re-create Robot Wars in a more real and more fun way.

    Here's a description of the original game.

    Create code for a robot using the provided programing language, limited to 256 lines of code. Test your robot on the test bench by examining the code line by line and determining whether the bot performs as intended. Then put your finished robot in the arena with up to four other bots, set the number of battles, and watch them fight it out in a top-down view. Computer Gaming world had annual contests for several years in which readers could send their bots on disk to participate in the match, with results and prizes reported in the magazine.

    • by Anonymous Coward

      I thought I was the only one that loved this game.

    • Me and a work mate have a battle every couple of months with Robocode []. Winner gets bragging rights.

      It is as difficult or as easy as you want to make it. There are also world wide comps with 256 byte codes. Makes you also brush up on your high school trig. Awesome fun.

    • by Rich0 ( 548339 )

      Sounds like this game [] which I loved as a kid.

      It is really a timeless concept - it could probably be successful if it were launched again on a more modern platform.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        Looks like someone did launch it again on a more modern platform... :) []

        • by Rich0 ( 548339 )

          I've tried it - haven't been impressed. It is a bit limited, and I don't like the fact that it doesn't really allow for procedural programming. It is more of a stimulus-response feedback loop design.

    • It sounds to me like Soulskill has invented a way to re-create Robot Wars in a more real and more fun way.

      I was thinking of getting two launchers and recreating Scorched Earth. [] To each his own.

  • by Anonymous Coward

    I don't Phone anyone so I stopped reading at "iPhone"

  • Cheap Toys (Score:1, Funny)

    by Anonymous Coward

    I watch Woot on pretty much a daily basis and as a result I frequently end up purchasing toys that I really don't need. Most recently I picked up this silly pair of USB Missile Launchers for just under 40$ shipped.

    Presumably this is how the guy ended up with an iPhone.

  • Hiring? (Score:1, Funny)

    by Anonymous Coward

    It must be fun to reverse engineer toys at a computer security company and get paid.

  • Hello? Hak5 (Score:1, Informative)

    by Anonymous Coward

    Hak5 [] did this a while back. They also did a few videos about it []. The code [] has been around for a while.

    You can even control it yourself from the web [], if it's not Slashdotted, over at the Hak House [].

  • timestamp:Feb. 14 2009 14:47:32
    return: false



  • If you really wanted to be slick, you'd use the webcam to capture where the projectile landed. Then create an algorithm to adjust the targeting system based on previous attacks.
  • Alternatively (Score:5, Informative)

    by phoebe ( 196531 ) on Saturday February 14, 2009 @10:03PM (#26860397)
    You can just download the developers guide from the manufacturer: []
    • The first thing a good developer does when confronted with a new problem is ask 'is there an appropriately-licensed library I can use to solve this?' The answer in this case would be 'yes, pymissile is BSD licensed'. Unfortunately, it's difficult to write an article explaining how great you are for buying some off-the-shelf hardware and used some off-the-shelf software to control it.
  • by ciryon ( 218518 ) on Sunday February 15, 2009 @09:58AM (#26862849) Journal

    I am seriously considering to hook up one of these USB Missile Launchers to our continuos integration server at work. When someone checks in code that doesn't compile or breaks tests the launcher targets the offending developer (using pre-determined login aiming mapping) and fires a couple of rounds at him. That'll certainly increase code quality!

  • Wouldn't it be so awesome if Iran developed an Intercontinental Ballistic Nerf Missile?

    One day the US gets an ICBM alert and they're going oh shit oh shit oh shit! Then it lands on the White House lawn and smashes a garden gnome or something. And then President Amjsnfsjfmed from Iran calls up Obama and tells him to look outside onto the front lawn, giggling, so Obama looks out, sees the nerf missile, replies with "ahhhhh you little terrorists!" with a big smile and maybe pointing a finger fonz-style.

Friction is a drag.