Attempting to decode RF PixMob wristband (Cement v1.1 Waveband)

electronicsknowledge, future

I recently went to a concert that used RF based PixMob wristbands. These are given to the attendees, and allow light effects to play across the entire arena, with each person being a single RGB pixel. Very cool effect in my opinion.

We were told multiple times that the wristbands are assigned to each seat, and would not know if you moved. This is different than the IR based ones used in Taylor Swift’s recent tour for example. RF wristbands are controlled from a central location, with a single “shoebox sized” transmitter (from PixMob website). IR wristbands are controlled through focused IR beams blasted from above, allowing specific areas to be hit and light up. So IR bands don’t care if you move or not.

Since the RF ones are assigned to a seat, and are receive only, they very likely have a unique ID held inside each one. A calibration procedure, where a camera is pointed down at the arena after placing the bands at each seat, would learn the location of the bands and store those locations in a database with the unique IDs. This process likely works similar to the Twinkly light string calibration process, where all of the lights are precisely flickered on and off based on their IDs, and the video from the camera above is used to see which pixels are on when certain IDs are told to light up.

In my attempts to get the wristband to light up again, here is what I’ve found. I have not yet successfully lit the LEDs via radio control, but will definitely post again if I’m successful.

For the CEMENT V1.1 PixMob circuit:
RF Frequency in use is 915 Mhz, based on the 26.1522 MHz crystal on board.

Radio IC is a CMT2210LH receiver, using OOK demodulation

SOT23-5 chip marked AK19T is likely an I2C EEPROM

Unmarked chip is a microcontroller, directly driving the LEDs with pins 5,6,7

My next step is to attempt reading from the EEPROM to determine the unique ID, then I will try sending commands that include it to see what happens.

Stay tuned!

EDIT: Found this awesome github of reverse engineering efforts, including several RF recordings from concerts! I’ve successfully used the recorded codes from here to get my RF wristband to light up.
Will follow up later with another post and possibly a full project.
https://github.com/danielweidman/pixmob-ir-reverse-engineering

DIY Baymax Halloween Costume

life

This Halloween I made a Baymax costume! For those who don’t know, Baymax is the medical robot in the Disney movie Big Hero 6. I built the costume with 2mm thick trash compactor bags from Walmart, clear tape, cardboard, and a powerful computer fan I found on Ebay (the BFB1012VH). The fan runs continuously, and is powered by a lipo battery in my pocket. The mask has some mesh between the eyes for me to see through.

Dancing Wiimote-Controlled Roomba!

Uncategorized

Wii remote controlled Roomba bot I made for a talent/variety show. The main processor is a Raspberry Pi. It connects to the Wiimote through Bluetooth, and to the Roomba with a serial connection. The servos are standard pulse width modulation. The light bar is several shift registers stringed together.

Code is a bit messy, but here it is. Someday I’ll clean it up. 🙂 Needs pigpio for the servo control and cwiid for Wii remote control. I got the initial wii code working with help from https://www.theraspberrypiguy.com/raspberry-pi-how-to-use-a-wiimote/.

Here is my main code and the separate light bar code that can run simultaneously. Feel free to ask questions!

WiiRoombaRobowarner

Recovering Data Off Shattered Android Phone

repair

I recently helped a friend recover files off of his shattered Samsung Galaxy s5. Having been run over by a car, the screen was black and the touchscreen entirely unresponsive. The volume, power, and home button still worked.

Here are some tips for getting data off Android phones like this one. The goal is to get a screen mirror or valid USB connection going.

If your phone simply needs to be unlocked to use USB, try these:

  • Connect a USB OTG cable and use a mouse to enter your pattern code. Hold a pencil to the mouse while trying to find the 9 dots for the pattern. I held the phone in one hand to feel vibrations so I could map out the dots. First drag the mouse all the way to one corner, then slowly move it to where you think the dots are, holding the pencil down. Dots will produce a faint vibration when you click and drag lines between them, just like using the touchscreen. Mark each dot location you find, and enter your pattern.
  • If you have a PIN or password, simply plug in a keyboard and type it in, hit enter when done.
  • If you have a pattern, but your phone locks you out after to many incorrect tries, use the mouse to click the “enter backup PIN” button in the lower right area of the screen. Then plug in the keyboard and type your code in. Once in, the phone will ask for a new lock screen setup, simply hit the home button to get out of this (or Esc on keyboard). Feel for vibration while typing to get an idea if you’re close to getting in (short vib for each keypress, long vib when incorrect PIN entered).

Here are Android Mouse and Keyboard shortcuts from http://paperlined.org

Back Esc
Home Alt+Esc
Windows+Esc
Menu Context Menu key
Ctrl+Esc
Search hold Context Menu key
Windows+Space
Quick Launch Windows key + <letter>
Volume multimedia keys

Additional shortcuts:

  • Alt+Tab — switch between recently-run apps
  • Ctrl+Alt+Del — forcible ungraceful reboot

PC mouse equivalents to Android keys

screen tap Left click
Back Right click
Left side button
Home Middle click

 

Try using the volume keys (or inline volume control on a pair of Samsung earbuds), if the ringtone volume increases, you’re in! Try plugging in to a computer to get your files.

If your phone needs more permissions to see it as a drive on a computer, and you have no idea where to click onscreen to allow them, keep reading.

TalkBack

The holy grail of shattered screen use is to get TalkBack turned on. This built in Android feature will speak everything onscreen, and allow easy control with a keyboard using arrow keys and enter.

If the phone is new enough, hold down the home button to active Google Assistant (unless disabled, it is on by default). Say “Open Accessibility Settings”. Use keyboard and navigate to Vision->Talkback. Flip TalkBack switch. Press OK on both popup screens, phone should speak something like “TalkBack on”.

Ideally, practice going through these menus on a second working phone to get a feel for keyboard navigation. When selecting an area to click with the arrow keys, the selection does not cycle back to the top when it hits the bottom of the menu, which is great.

USB Debugging

With TalkBack on, navigating settings to turn on developer mode and USB debugging is trivial. To turn on developer mode go to settings->about device. You can access settings by navigation, or open Assistant (hold down home) and say “Open Settings”. Hit “build number” area at least 7 times quickly (use enter key). Now developer mode should be on. Navigate to it (right above “about device”) and turn on USB debugging. When you first turn it on, there will be a popup, click OK. USB debugging is now on!

Screen Mirror

Download a screen mirror application on your computer. I use the Chrome extension called “Vysor”. With Vysor installed and USB debugging turned on, Vysor should recognize the phone being plugged in. One last step is to click the OK button on the authorization prompt on the phone. This will allow Vysor full access so it can screen mirror and control the phone.

Unfortunately, you can’t use a keyboard to click the button as the phone is connected to the computer! You will need to connect a bluetooth keyboard.

First reconnect your OTG cable and regular keyboard to the phone, navigate to settings->bluetooth, turn it on, and connect your bluetooth keyboard. This should be easy if you have TalkBack turned on! Practice on a working phone.

Now plug the phone back into the computer and wait for Vysor to detect it. Using the bluetooth keyboard hit the right arrow a couple times, then hit enter. Vysor should start mirroring the screen. You can now control the phone on your computer through Vysor!

Have fun getting your files back!

Leave a comment if you have any questions or tips.