Reverse Engineering a Missile Launcher Toy's Interface

nitro writes "A fairly in-depth technical report by the security researchers at TippingPoint was released on how to reverse engineer the proprietary protocol for controlling a USB missile-launching toy system. They develop an iPhone application to control the device. 'The hardware is coupled with a simple GUI controller written in Delphi (MissileLauncher.exe) and a USB Human Interface Device (HID) interface written in C++ (USBHID.dll). The toys lost their allure within minutes of harassing my team with a barrage of soft missile shots. That same night I thought I would be able to extend the fun factor by coding up a programmatic interface to the launchers in Python. ... One interesting thing is that we have a lot more granular control of the turret movement now than we did with the original GUI. I wrote two simple loops to count the number of possible horizontal and vertical ticks and the results were 947 horizontal and 91 vertical versus 54 and 10 from the original GUI respectively. Granular control allows you to slowly and quietly reposition the turret for stealthy attacks.'"

Comments

Legal implications

[CRCulver]

Just as Phil Zimmermann famously had to distribute PGP internationally in print form to avoid violating munitions laws, wouldn't these guys have to be really careful about their elite missle launching software? If this code makes it to Syria or Iran, we're in for a mildly annoying attack with state of the art styrofoam weaponry.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Good work.

[curtinparloe]

Now you need to incorporate webcam target recognition and create an automated firing application.

You could call it "Skynet".

Re:Good work.

[drinkypoo]

Actually, this seems like an almost ideal platform for sentry gun research. It's small, cheap, relatively harmless, can be operated in an office environment, and is probably wildly inaccurate which means that if you can make this work, actually shooting targets with some kind of accurate weapon will be trivial. I'd very much like a sentry gun that would squirt the @#$%@#@ deer with water (at least) when they come to eat the plants on the front porch.

Re:Good work.

[diskis]

Why go for the complex solution?
A motion sensor connected to a air horn should do the trick.

Re:Good work.

[drinkypoo]

That sounds fantastic. I'd love to jump out of bed at 3 am wondering where the iceberg is. And I won't need to squirt the deer with water, either; I just sleep on the porch, and when I fucking piss myself I can hose them down, too.

Re:Good work.

[Ihmhi]

Aren't there more than a few "Paintball turrets" floating around on the 'net that basically do this already? I recall seeing one that was already for sale as a package.

I'd love to have one of these to get rid of the animals that poop in my backyard. Better biodegradable paint than cat shit.

And with a little hacking into an alarm system and replacing paintballs with ball bearings...

"Get the HELL out of my house! You have FIVE seconds to comply. FIVE. FOUR. ONE." *bam* *bam* *bam*

Re:Good work.

[Anonymous Coward]

I'd love to jump out of bed at 3 am wondering where the iceberg is.

      Thanks to global warming, there are no icebergs anymore. Oh, wait-

Shit, an iceberg got him!

Re:Good work.

[Hanyin]

What kind of geek are you? Just make a project out of it ;-)

Re:Good work.

[Cyberax]

I recommend landmines. Just don't forget where you put them :)

Pft.

[Spatial]

No wireless. Less ammunition than an AH-64. Lame.

Re:Python?

[Clueless Moron]

His python code is here. It implements a HTTP web server (as well as a command line and direct socket server mode) that directly invokes a DLL to control the unit. And so in the video he can control the thing using the web browser in his cellphone.

All the code is only 283 lines and easy to understand. I don't see anything awkward about it.

In what way exactly would Lua be better at doing that?

Rememer Robot Wars?

[anorlunda]

Oh wow. I was one of the enthusiastic fans of Muse Software's Robot Wars for the Apple ][. It sounds to me like Soulskill has invented a way to re-create Robot Wars in a more real and more fun way.

Here's a description of the original game.

Create code for a robot using the provided programing language, limited to 256 lines of code. Test your robot on the test bench by examining the code line by line and determining whether the bot performs as intended. Then put your finished robot in the arena with up to four other bots, set the number of battles, and watch them fight it out in a top-down view. Computer Gaming world had annual contests for several years in which readers could send their bots on disk to participate in the match, with results and prizes reported in the magazine.

Re:Cops and Robbers or Global Armageddon ?

[drinkypoo]

I was thinking of some joke a little more limp-wristed, which is what I always thought when I saw some kid talking about "Rouge Squadron". They fly the pink X-Wings, right?

Re:Hacking somethign that did not need a hack.

[woolpert]

These have been "hacked" for years now. I had one running under linux in my cubicle 4 years ago using a webcam for auto targeting coworkers.

The code. Put up or shut up, AC.

Re:Cops and Robbers or Global Armageddon ?

[cleatsupkeep]

I was thinking of some joke a little more limp-wristed, which is what I always thought when I saw some kid talking about "Rouge Squadron". They fly the pink X-Wings, right?

Pink 5 standing by... And FABULOUS

Re:Hacking somethign that did not need a hack.

[kostmo]

It's true. http://code.google.com/p/pyrocket/wiki/RelatedWork I hacked the thing about a year ago and started this google code project. You will be able to apt-get this package in Ubuntu Jaunty.

Re:Python?

[Jurily]

Oblig.

Re:Squirting deer...

[Sir_Lewk]

Personally, I don't see why we need any more justification for shooting deer than how damn good they taste. :)

Done that

[Space cowboy]

Get a 'Striker' laser-target-enabled missile launcher ($40, I think). Then get a webcam or IP-enabled camera (I got one of these from Ebay for ~$70).

Use the camera to detect motion and generate a centroid of motion; use the (high-intensity of red) laser-spot to detect where the missile is pointed (again from the camera image), and move the missile to make the centroid and laser-spot coincident.

It's actually pretty trivial, but it looks pretty cool to have people walk into the office and have two missile-launchers automatically track them.

I also have the think-geek big-red-button box, which I modified to allow the button to control a USB port. Now I can fire the (auto-targetting :) missiles by hitting the big-red-button :)

It's actually only slightly harder to get the system to track two independent targets... The next step is to build in target-recognition by accessing the company's person-directory (we all have pictures)... Don't shoot the VP. Only directors and below are valid targets :)

Simon

Alternatively

[phoebe]

You can just download the developers guide from the manufacturer: http://www.dreamcheeky.com/dream/forum/viewtopic.php?f=13&t=102