Lazertag hacking

My friend Nick asked if we could find a way to create enhancements to the fantastic, but no longer made Lazertag Team Ops system.

Many people believe that this was the Pinnacle of consumer lazertag, and I tend to agree. In addition to working better both indoors and out, it could host games where it kept track of the scores of multiple players.

Nick and his friend Max came over and we were totally successful! Here’s a brief video showing our results.

First we looked up what was known about the protocol. I found this:

http://web.archive.org/web/20090304155723/http://lasertagparts.com/ltto.htm

via the LTTO (LazerTagTeamOps) Yahoo group. As you can see the page is no longer in service, but the archive still has it.

Here’s the cool diagram that they created in the past, apparently based on Aaron Nabil’s reverse engineering effort:

From the Internet Archive’s record of http://www.lasertagparts.com/images/ltto_signals.gif

Of course it’s easy to say this now, but the protocol was pretty easy to decode by looking at the output on a scope. The only difficulty I had was capturing just the shot, as the dome is constantly shooting out messages saying what team, etc.

Here’s an example of a shot that is created by our program:

Lazertag shot

you can see that it uses a 38 kHz carrier (to distinguish it from random IR noise. Fortunately Ken Shirriff wrote a terrific IR Remote library for the Arduino. It’s not really well documented, but there is a sendRaw() function that we used to send the actual timings for the shot. Grab his library here. The library uses preset pin numbers for the LED output, but you can change them in the library itself, you just need to use one of the PWM pins as he uses the timer function to create the carrier frequency.

unsigned int shootOne[] = {3000,6000,3000,2000,1000,2000,1000,2000,1000,2000,1000,2000,1000,2000,1000,2000,1000};

// the one confusing thing with the irsend.sendRaw command is that the last argument is labled hz, but it’s really
// kiloherz. The lazertag team ops uses the common 38kHz frequency.
irsend.sendRaw(shootOne,sizeof(shootOne)/sizeof(int),38);

For the TV-B-Gone, I modified the original firmware to send out the appropriate pulses, similar to my previous hack for camera remotes. The V1 firmware uses uncompressed codes, so that is what I started with.

Grab the example code zip here, and let me know on google+ if you build anything with it!

Also if you want to use Git to pull the code (whether or not you want to fork) it’s all checked in to the baldwisdom github repo:

https://github.com/osbock/Baldwisdom