I sourced a lot of micro RC cars at ebay to use them for DIY projects.
The cars are from Enertec. The call the product "MICRO FLASH CHARGER, Formula 1". The product box contains batteries for the transmitter and the charging box, the transmitter box, a charging box and the car. There are 27Mhz and 40Mhz versions of the product.
The control of the systems contains functions to drive forward, backward, left, right and to drive "turbo" forward. All these functions are not proportional.
The motor is mounted in a small gearbox and drives both back weals at once. For the changing of the driving direction there front weels can be pulled left ore right. this is done by small coils that pull a magnet to the left or to the right. The magnet is mounted on the guidance mechanic.
I was interrested in using the electronic for simple remote switching purposes. For this project I only need the two pcb's. The other parts, like the motors are kept for later projects.
Step 1: Analyzing the circuit
The transmitter is the easy part.
The receiver is more complex. I need some switching outputs. The easy part are the two coils that change the driving direction. Fine copper wires are soldered to the pcb and lead to the coils. The two transistors that switch the coils carry the SMD code 1P. Searching around the internet I found out that these transistors are NPN of the type MMBT2222A. Thinking about standard switching circuits I assumed that the transistors are connected to GND with the emitter connections and that the coils are directly connected to VCC. Some measurement on the PCB confirmed that. Only thing to do ist connect some LED to the switching outputs.
Doing further reverse engineering I found out that the transistors marked 1AM are MMBT3904L. These transistors are connected via resistors to the receiver ic (BA97). The transistors are NPN types, but the emitter connections are not directly connected to GND. I decided to simply remove the rest of the transistors and use the 1AM as the switching outputs.