Introduction: Hacking the Spy Video Trakr With Frickin' Laser Beams...And Missiles!

By Square Root of Not
About: You can try my projects AT YOUR OWN RISK. There's infinite ways to damage or destroy persons and property. I can't think of them all. Kids use adult supervision. I've lost count of the number of items that I h…


Courtesy of CPT Hans.

I bought a USB-powered foam missile launcher, which has pan & tilt, and even a targeting laser! I'm powering it from the Trakr's internal USB port, and controlling it with the GPIO lines.

Step 1:

The original control board was quite sophisticated

It has an IC that receives USB commands from the windows application and outputs control voltages on several different pins to control the motors, etc.

I'm going to use an H-bridge IC and a few transistors to accomplish the same task. It will certainly be much simpler than the 15 transistors, 20 resistors, and 9 capacitors that the original circuit contains!

I have all the wiring figured out, and have tested the control circuits...I'm just waiting on the H-bridge chips.

I wish the remote had more buttons. As it is now, you have to move into firing position, then stop and run the launcher app. The two joysticks on the remote control pan and tilt, button A toggles the laser on and off, and each press of button B fires a missile.

Since it's a stop-and-shoot situation rather than shoot-on-the-move, it's more like artillery than tank vs tank combat.

Step 2:

Here's a photo of the circuit on the breadboard, and connected to the Trakr and missile turret.

Some of the peculiarities of the Trakr's GPIO (see the Interfacing GPIO topic in the forums) compelled me to add some additional resistors to isolate and bias the inputs to the H-bridge chips. Overall, the component count isn't bad, and the circuit is not very complex. Using the H-bridge chips instead of a pile of transistors really helped.

Step 3:

Here's a close-up of the circuit itself.

Don't let all the wires scare you! I have eight GPIO lines, as well as USB power coming from the Trakr. There are several motor wires, limit switches (so you don't strip out the gears), control wires, and a pair of wires for the laser that come from the turret.

The top H-bridge chip runs UP/DOWN and FIRE MISSILES. The lower H-bridge controls LEFT/RIGHT and LASER. Moving down and right, just above the Trakr's rear wheel, is a 2.5v regulator circuit. This provides DC power for the laser, as well as the GPIO inputs. Just below that, next to the Trakr's wheel, is a transistor circuit to control the laser. It switches on and off power (2.2v) to the laser in the missile turret. Even though the laser is rated for 3v, 2.2v is what the original circuit powered the laser with, so I stuck with that.

Step 4:

here's a photo of the completed circuit board

The present component list is:
1 2N2222 or equiv NPN transistor
2 SN754410 quad half H-bridge chips
1 LM317 voltage regulator
1 10uf capacitor
18 resistors
...so about $20 worth of stuff.

Here's a short video of the whole thing in action: http://player.vimeo.com/video/33758255


This hack is not too expensive (the most costly part is buying the actual turret) or overly complex, but does require a degree of soldering ability. Circut construction for this hack requires soldering several components and wires. If you are not comfortable with soldering, you may want to get some practice first, or have someone help you who can solder well.

I used a Radio Shack #276-150 perfboard for circuit construction. I could have made the layout much more compact than I did, but it would have made the soldering even more difficult for others who might try to build this. The Radio Shack board already has lands and traces etched on it (indicated by the white silk-screening in the photo), making layout and assembly somewhat easier.

Step 5:

Here's the circuit schematic.

Step 6:

On the layout, the green lines show where I made connections with component leads or solder bridges on the bottom of the board. The red lines are jumper wires on top of the board.

For the Trakr's wiring, I found several connectors at a local R/C hobby shop. I used a 4-pin connector to get power from the USB port. For the GPIO lines, I took two 4-pin connectors, sanded their adjoining edges (to fit the pin spacing), and epoxied them together to make an 8-pin connector. The connectors came with about 4" of wire attached; I think all together, I paid $6 for them.

Step 7:

Here's a photo of the circuit board with the Trakr wiring soldered on. The top connector is for power from the USB (I just clipped out the two unused data lines), the right connector is the GPIO lines.

Step 8:

All these wires may seem confusing, but if you look at the schematic and carefully follow the layout, you shouldn't have any difficulty.

Once everything was wired up, installing the board inside the turret was not difficult at all. I snipped off two corners of the circuit board (where the holes for mounting screws are) so it would fit better in the round base. Also, the particular turret I used was originally molded to house 3 AA batteries in the base. A change in the design meant that as shipped, the turret was wholly powered by the USB port; the turret's instruction manual and stickers on the base all advised that batteries were no longer needed. I took a high-speed rotary tool, and cut the battery box out to leave more room for the circuit board. The board fit nicely, and I did'nt even have to bend any components down to make things fit!

Here's a short video of the whole hack in action. 'Agent T' of a rival spy clan must be taken out! The MissileTrakr rolls in to do the job. After some laser ranging, the MissileTrakr puts one shot in Agent T's neck, another in his gut, and then offs one of his clanmates for good measure before retreating!

Ok, maybe I'm overselling it a bit. Here it is: http://player.vimeo.com/video/33759324

MissileTrakr in a backyard attack: http://player.vimeo.com/video/33760352

It took quite a bit of time to design the circuit and develop the best board layout. Actual construction of the hack is not bad, and it's pretty fun to play with.

Step 9:

The main elements of the app are:
-Scanning the remote's keys
-Turning GPIOs on and off
-Reading input from GPIOs
-Displaying screen graphics that depict the key states

This app will run fine without the hardware attached, so you can see the on-screen responses. Be aware though, that without the circuit board connected, GPC7 floats somewhere between 0v and 2.5v, and you may get an occasional "Out of Missiles" message

C Langugae code for Trakr Missile Launcher:

/* This app was written and tested with the 'Striker II' foam missile launcher.
This turret launches three foam missiles, and has a targeting laser.

The turret's original USB interface board is replaced by a driver board that
is connected to the Trakr's GPIO lines.  This app should work with almost any
similar desktop missile launcher.
GPC0=tilt up
GPC1=tilt down
GPC2=pan left
GPC3=pan right
GPC4=fire laser
GPC5=fire missile
GPC6=missile fired (a cam in the firing mechanism engages a microswitch after
each missile is fired.  This keeps the software referenced to the position of
the launching hardware
GPC7=reload (out of ammo)

The GO button serves as a 'function shift' key (thanks for the idea, RorschachUK!).
When the GO button is held, the remote's key functions are shifted to 'missile control' as follows:
Lforward=tilt up
Lback=tilt down
Rforward=pan left
Rback=pan right
B(Input2)=fire laser
C(Menu)=fire missile

Note that all missile control functions are momentary, except for 'fire missile',
which starts a complete sequence to fire a single missile.

Special thanks to RorschachUK for explaining the bitmap manipulation routines.
I ended up using bitmaps exclusively, but left the DrawText commands for
demonstration purposes

This app could also be easily modified to control a robot arm*/

#include "svt.h"
#include "JAPI.h"

#define GPC0 (1<<0)  //bitmask for pin GPC0 = 00000001
#define GPC1 (1<<1)  //bitmask for pin GPC1 = 00000010
#define GPC2 (1<<2)  //bitmask for pin GPC2 = 00000100
#define GPC3 (1<<3)  //bitmask for pin GPC3 = 00001000
#define GPC4 (1<<4)  //bitmask for pin GPC4 = 00010000
#define GPC5 (1<<5)  //bitmask for pin GPC5 = 00100000
#define GPC6 (1<<6)  //bitmask for pin GPC6 = 01000000
#define GPC7 (1<<7)  //bitmask for pin GPC7 = 10000000

/*The names of these variables are generated by the compiler and are based on
the filename of the image being compiled.  They're used to calculate the length
of the .bmp images when they're converted to data arrays*/
extern char _binary_Images_bkgndimg_bmp_end[];
extern char _binary_Images_bkgndimg_bmp_start[];
extern char _binary_Images_up_bmp_end[];
extern char _binary_Images_up_bmp_start[];
extern char _binary_Images_down_bmp_end[];
extern char _binary_Images_down_bmp_start[];
extern char _binary_Images_left_bmp_end[];
extern char _binary_Images_left_bmp_start[];
extern char _binary_Images_right_bmp_end[];
extern char _binary_Images_right_bmp_start[];
extern char _binary_Images_firemissile_bmp_end[];
extern char _binary_Images_firemissile_bmp_start[];
extern char _binary_Images_firelaser_bmp_end[];
extern char _binary_Images_firelaser_bmp_start[];
extern char _binary_Images_missile_bmp_end[];
extern char _binary_Images_missile_bmp_start[];
extern char _binary_Images_fins_bmp_end[];
extern char _binary_Images_fins_bmp_start[];
extern char _binary_Images_on_bmp_end[];
extern char _binary_Images_on_bmp_start[];
extern char _binary_Images_standby_bmp_end[];
extern char _binary_Images_standby_bmp_start[];

unsigned char pins;  //define variable 'pins' for reading GPIO inputs

Color white, green, red, blue, black, grey, yellow; //colors to be used for text;

//handles from the image register
int bkgndimg;  
int up;
int down;
int left;
int right;
int firemissile;
int firelaser;
int missile;
int fins;
int on;
int standby;

bool bgstate;  //variable for background redraw state

//RGBColor - returns a color struct
Color RGBColor(unsigned char R, unsigned char G, unsigned char B, unsigned char T) {
   Color ret;
   ret.R=R;
   ret.G=G;
   ret.B=B;
   ret.Transparent=T;
   return ret;
}

void Splash() //defines a splash screen routine
{
   OpenGraphics(); //Take control of screen
   ClearScreen();
   SetTextColor(white);
   DrawText(1, 30, "Missile Control v1.3");
   SetTextColor(yellow);
   DrawText(15, 60, "by CPT_Hans");
   Show();
   Sleep(3000);
   ClearScreen();
   SetTextColor(green);
   DrawText(20,15,"Press and hold");
   DrawText(20,30,"the GO key to");
   DrawText(20,45,"enable missile");
   DrawText(20,60,"controls");
   Show();
   Sleep(3000);
   ClearScreen();
   SetTextColor(green);
   DrawText(35,15,"L joystick =");
   DrawText(35,30,"up/down");
   DrawText(35,55,"R joystick =");
   DrawText(35,70,"left/right");
   Show();
   Sleep(4000);
   ClearScreen();
   SetTextColor(green);
   DrawText(35,15,"B key =");
   DrawText(35,30,"fire laser");
   DrawText(35,55,"C key =");
   DrawText(35,70,"fire missile");
   Show();
   Sleep(3000);
}

void Start()
{
JAPI_SetIoOutputMode(GPC0+GPC1+GPC2+GPC3+GPC4+GPC5); //Set output mode for pins GPC0 thru GPC5

JAPI_SetIoInputMode(GPC6+GPC7); //Set input only mode for pins GPC6 and GPC7

bgstate=1; //set flag to draw initial background

//Register the images - takes a start address and a size, which we calculate given the end address minus the start address
   OpenImageRegister();
   bkgndimg = RegisterImage(_binary_Images_bkgndimg_bmp_start,_binary_Images_bkgndimg_bmp_end - _binary_Images_bkgndimg_bmp_start);
   up = RegisterImage(_binary_Images_up_bmp_start,_binary_Images_up_bmp_end - _binary_Images_up_bmp_start);
   down = RegisterImage(_binary_Images_down_bmp_start,_binary_Images_down_bmp_end - _binary_Images_down_bmp_start);
   left = RegisterImage(_binary_Images_left_bmp_start,_binary_Images_left_bmp_end - _binary_Images_left_bmp_start);
   right = RegisterImage(_binary_Images_right_bmp_start,_binary_Images_right_bmp_end - _binary_Images_right_bmp_start);
   firemissile = RegisterImage(_binary_Images_firemissile_bmp_start,_binary_Images_firemissile_bmp_end - _binary_Images_firemissile_bmp_start);
   firelaser = RegisterImage(_binary_Images_firelaser_bmp_start,_binary_Images_firelaser_bmp_end - _binary_Images_firelaser_bmp_start);
   missile = RegisterImage(_binary_Images_missile_bmp_start,_binary_Images_missile_bmp_end - _binary_Images_missile_bmp_start);
   fins = RegisterImage(_binary_Images_fins_bmp_start,_binary_Images_fins_bmp_end - _binary_Images_fins_bmp_start);
   on = RegisterImage(_binary_Images_on_bmp_start,_binary_Images_on_bmp_end - _binary_Images_on_bmp_start);
   standby = RegisterImage(_binary_Images_standby_bmp_start,_binary_Images_standby_bmp_end - _binary_Images_standby_bmp_start);
   CloseImageRegister();

//Define colors for screen text  
   white=RGBColor(255,255,255,0);
   green=RGBColor(0,255,0,0);
   red=RGBColor(255,0,0,0);
   blue=RGBColor(0,0,255,0);
   black=RGBColor(0,0,0,0);
   grey=RGBColor(128,128,128,0);
   yellow=RGBColor(255,255,0,0);

//Call splash screen on initial startup
   Splash();
   Sleep( 2000 );
   ClearScreen();
   Show();
   CloseGraphics(); //release control of screen
}

bool Run()
/* The arrangement of nested if/else loops below may seem odd, but it
ensures the proper operational sequence of the associated hardware.
Changes to this structure may be necessary when using different hardware. */
{
  if( GetRemoteKeyStatus( KEY_HOME ) ) //Check for program exit
    return false;
   //Scan state of GO key to enter missile control subloop
  if (GetRemoteKeyStatus(KEY_RUN)==1)
   {
   bgstate=1; //set flag to redraw background screen upon loop exit
   OpenMotors(); //This keeps the motors still while we pan and tilt the missile launcher
   OpenGraphics(); //Take control of screen
   ClearScreen(); //Erase screen
   //SetTextColor(red);
   //DrawText(20, 20, "Missile CTL ON"); //Notify that remote's button functions have changed
   DrawImage(bkgndimg,0,0,black); //Draw bkgndimg image
   DrawImage(missile,70,80,black); //Draw white missile body
   DrawImage(fins,72,89,black); //Draw red fins
   DrawImage(on,30,20,black);
   Show();
   CloseGraphics(); //release control of screen
   pins = JAPI_GetIoInput(); //bitwise representation of all 8 pins
      if (pins & GPC6)
         {
         JAPI_SetIoLow(GPC5);
         }
      if (pins & GPC7)
         {
         OpenGraphics(); //Take control of screen
         DrawImage(bkgndimg,0,0,black); //Draw bkgndimg image
         SetTextColor(blue);
         DrawText (20,80, "Out of Missiles!");
         Show();
         CloseGraphics(); //release control of screen
         }
   if (GetRemoteKeyStatus(KEY_INPUT2)) //Fire laser command sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(firelaser,110,85,black); //Draw laser splash
      DrawImage(on,30,20,black);
      //SetTextColor(red);
      //DrawText(5, 20, "Firing Laser!");
      Show();
      CloseGraphics(); //release control of screen
      JAPI_SetIoHigh(GPC4);   //Set GPC4 pin high (3.3v)
      }
      else
      {
      JAPI_SetIoLow(GPC4);   //Set GPC4 pin low (0v)  
      }
   if (GetRemoteKeyStatus(KEY_LEFT_FORWARD)) //Elevate turret command sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(up,75,70,black); //Draw up arrow
      DrawImage(on,30,20,black);
      //SetTextColor(white);
      //DrawText(5, 35, "Raising Missiles");
      Show();
      CloseGraphics(); //release control of screen
      JAPI_SetIoHigh(GPC0);   //Set GPC0 pin high (3.3v)
      }
      else
      {
      JAPI_SetIoLow(GPC0);   //Set GPC0 pin low (0v)        
      }
   if (GetRemoteKeyStatus(KEY_LEFT_BACK))  //Depress turret command sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(down,75,100,black); //Draw down arrow
      DrawImage(on,30,20,black);
      //SetTextColor(white);
      //DrawText(5, 35, "Lowering Missiles");
      Show();
      CloseGraphics(); //Take control of screen
      JAPI_SetIoHigh(GPC1);   //Set GPC1 pin high (3.3v)
      }
      else
      {
      JAPI_SetIoLow(GPC1);   //Set GPC1 pin low (0v)        
      }
   if (GetRemoteKeyStatus(KEY_RIGHT_FORWARD)) //Traverse turret left command sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(left,60,85,black); //Draw left arrow
      DrawImage(on,30,20,black);
      //SetTextColor(white);
      //DrawText(5, 50, "Rotating Left");
      Show();
      CloseGraphics(); //release control of screen
      JAPI_SetIoHigh(GPC2);   //Set GPC2 pin high (3.3v)
      }
      else
      {
      JAPI_SetIoLow(GPC2);   //Set GPC2 pin low (0v)        
      }
   if (GetRemoteKeyStatus(KEY_RIGHT_BACK)) //Traverse turret right command sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(right,90,85,black); //Draw right arrow
      DrawImage(on,30,20,black);
      //SetTextColor(white);
      //DrawText(5, 50, "Rotating Right");
      Show();
      CloseGraphics(); //release control of screen
      JAPI_SetIoHigh(GPC3);   //Set GPC3 pin high (3.3v)
      }
      else
      {
      JAPI_SetIoLow(GPC3);   //Set GPC3 pin low (0v)        
      }
   if (GetRemoteKeyStatus(KEY_MENU)) //Missile firing sequence
      {
      OpenGraphics(); //Take control of screen
      ClearScreen();
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg
      DrawImage(missile,70,80,black); //Draw white missile body
      DrawImage(fins,72,89,black); //Draw red fins
      DrawImage(firemissile,60,96,black); //Draw missile exhaust
      DrawImage(on,30,20,black);
      //SetTextColor(red);
      //DrawText(5, 65, "Firing Missile!");
      Show();
      CloseGraphics(); //release control of screen
      JAPI_SetIoHigh(GPC5);   //Set GPC5 pin high (3.3v)

      /*It is necessary to pause here, to let the launcher's camshaft
      rotate away from the microswitch; a mechanical limitation
      of the hardware */
      Sleep(1500);      
      }
   }
  else
   {
   pins = JAPI_GetIoInput(); //bitwise representation of all 8 pins
   if (pins & GPC6)  //Check for position of camsshaft
      {
      JAPI_SetIoLow(GPC5);  //Turn off signal to fire missile motor
      }
   if (bgstate==1) //check to see if background redraw is required
      {
      CloseMotors();
      OpenGraphics(); //Take control of screen
      ClearScreen();
   //SetTextColor(green);
   //DrawText(20, 20, "Missile CTL OFF"); //Notify that remote's button functions are normal
      DrawImage(bkgndimg,0,0,black); //Draw bkgndimg image
      DrawImage(standby,25,20,black);
      Show();
      CloseGraphics(); //release control of screen
      bgstate=0; //reset flag so that background does not need to be redrawn
      }
   }
  {
    Sleep(200);// wait for 200ms
  }
  return true;
}

void End()
{
CloseMotors()
CloseGraphics()
}



Here are some additional resources you might find useful when hacking the Spy Video Trakr:

Spy Video Trakr Wiki

http://www.trakrhakr.com/wiki/index.php?title=Main_Page

Official Spy Video Trakr forums:

http://www.spygear.net/forum/viewforum.php?f=18

Fun With Snap Circuits Hacks:

http://funwithsnapcircuits.wordpress.com/2011/03/17/and-now-for-something-completely-different/

Disobedient Tiger hacks:

http://disobedienttiger.blogspot.com/search/label/Spy%20Trakr

Hack a Day First Hack:

http://hackaday.com/2010/09/02/spy-video-trakr-software-and-first-hack/

FCC REFERENCE (CIRCUIT DIAGRAMS, EXTERNAL PICTURES, INTERNAL PICTURES):

FCC reference for Trakr remote:

https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=545152&fcc_id='N3ESPYVIDEOTRAKR1'

FCC reference for Trakr:

https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=884190&fcc_id='N3ESPYVIDEOTRAKR2'



OTHER REFERENCE MATERIAL:

W55VA91 Design Guide:

http://docs.google.com/viewer?url=http%3A%2F%2Fdl.dropbox.com%2Fu%2F4295670%2FW55VA91_DesignGuide%2528fullset%2529%2520-%2520A4.pdf

nRF24L01 (Radio Transceiver Chip):

http://www.nordicsemi.com/eng/Products/2.4GHz-RF/nRF24L01

ARM926EJ-S Technical Reference Manual:

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0198e/index.html

W9864G6IH 8 MByte SDRAM:

http://www.winbond.com/hq/enu/ProductAndSales/ProductLines/SpecialtyDRAM/SDRAM/W9864G6IH.htm



HARDWARE SPECIFICATIONS:

Two ARM 9 processors (Nuvoton W55VA91: ARM926EJ core running @ 192 MHz, and hardware-assisted JPEG codec)
8 MB of on-board RAM – for sophisticated, memory-intensive, user-generated apps (programmed in C).
SD card slot – for removable, high-capacity program, video, audio and image storage.
Accessible USB host port – for connection of USB devices.
USB device port – for connecting to a computer for reprogramming and communication.
Omni Vision VGA camera – potential frame rate of 30 frames a second (the TRAKR is set for 15 fps). (Enables programming for real-time image processing.)
Nordic 2.4 GHz radio – for low-power wireless communication.
Dual, high current (2A) H-Bridges with current sensors – enables advanced motor control.
QVGA screen & speaker on remote with 5 buttons and 2 joysticks – potential to be reassigned for different tasks.
Audio block with polyphonic synthesizer – includes support for speech synthesis.
Operating System:Lunix OS
IR LED is illuminated by switching on an SS8050 transistor.
FLASH/SPI/USB Boot


BLEEDING EDGE TRAKR HACKING:

http://www.trakrhakr.com/wiki/index.php?title=Bootstrapping

http://www.trakrhakr.com/wiki/index.php?title=I2C_library