Reverse Engineering a Missile Launcher Toy's Interface

nitro writes "A fairly in-depth technical report by the security researchers at TippingPoint was released on how to reverse engineer the proprietary protocol for controlling a USB missile-launching toy system. They develop an iPhone application to control the device. 'The hardware is coupled with a simple GUI controller written in Delphi (MissileLauncher.exe) and a USB Human Interface Device (HID) interface written in C++ (USBHID.dll). The toys lost their allure within minutes of harassing my team with a barrage of soft missile shots. That same night I thought I would be able to extend the fun factor by coding up a programmatic interface to the launchers in Python. ... One interesting thing is that we have a lot more granular control of the turret movement now than we did with the original GUI. I wrote two simple loops to count the number of possible horizontal and vertical ticks and the results were 947 horizontal and 91 vertical versus 54 and 10 from the original GUI respectively. Granular control allows you to slowly and quietly reposition the turret for stealthy attacks.'"

Comments

Rememer Robot Wars?

[anorlunda]

Oh wow. I was one of the enthusiastic fans of Muse Software's Robot Wars for the Apple ][. It sounds to me like Soulskill has invented a way to re-create Robot Wars in a more real and more fun way.

Here's a description of the original game.

Create code for a robot using the provided programing language, limited to 256 lines of code. Test your robot on the test bench by examining the code line by line and determining whether the bot performs as intended. Then put your finished robot in the arena with up to four other bots, set the number of battles, and watch them fight it out in a top-down view. Computer Gaming world had annual contests for several years in which readers could send their bots on disk to participate in the match, with results and prizes reported in the magazine.

Done that

[Space cowboy]

Get a 'Striker' laser-target-enabled missile launcher ($40, I think). Then get a webcam or IP-enabled camera (I got one of these from Ebay for ~$70).

Use the camera to detect motion and generate a centroid of motion; use the (high-intensity of red) laser-spot to detect where the missile is pointed (again from the camera image), and move the missile to make the centroid and laser-spot coincident.

It's actually pretty trivial, but it looks pretty cool to have people walk into the office and have two missile-launchers automatically track them.

I also have the think-geek big-red-button box, which I modified to allow the button to control a USB port. Now I can fire the (auto-targetting :) missiles by hitting the big-red-button :)

It's actually only slightly harder to get the system to track two independent targets... The next step is to build in target-recognition by accessing the company's person-directory (we all have pictures)... Don't shoot the VP. Only directors and below are valid targets :)

Simon