How To Turn On Pixmob Bracelet

PixMob IR Contrary Engineering Project

Hacking the PixMob infrared protocol to enable control of PixMob wristbands at dwelling.

A huge thanks to Zach Resmer (@zacharesmer) for his help in figuring out the parcel structure of the IR transmissions; Steve and Remco from Reddit for making some initial in-the-wild IR indicate Flipper recordings; and Dan (@hckrdan) for some crafty raw recordings done with a signal analyzer.

Skip downwardly to "Instructions" if you are non interested in the total write-upwardly and simply want to light upward your bracelet(s)!

demo_video.mp4

Background

PixMob bracelets are LED wristbands distributed to every member of the audience at large events which all lite up in sync to create massive, distributed light shows. The wristbands react to infrared commands from various types of fixed and moving transmitters. The wristbands have been used by various sports teams (including during the Super Bowl) and touring bands such as Coldplay, Shawn Mendes, Taylor Swift, Bad Bunny, The Weeknd, and Lady Gaga, to produce light shows that take reward of the line-of-sight nature of IR light/"signals" to brand light effects that vary past physical location in an issue venue. After the event, bracelets are sometimes collected for reuse/recycling, just often attendees are left to take dwelling house the inactive bracelets.

Some prior work has been done to "reactivate" the PixMob bracelets after the determination of the result they were used in, to express levels of success. Certain erstwhile models of PixMob bracelets tin be put into a permanent movement-sensitive mode past soldering or unsoldering a pad on the PCB, simply this doesn't allow the bracelet to be controlled in sync with other bracelets wirelessly. Another project was able to upload custom firmware onto a PixMob bracelet board, just this requires taking apart the bracelet and having specialized equipment, and no IR-controlled lighting custom firmware has been released. 1 person has posted a video online wherein they demonstrate being able to turn their bracelet a couple different colors past pressing buttons on a TV remote (coincidentally generating "valid" codes), but the make and model of the Tv remote were not specified and (as far as I'm enlightened) no reports of reproduction have been made.

This project set out to actually reverse-engineer the product PixMob bracelet IR protocol then that PixMob devices can exist controlled via IR at home, simply as they are during an event.

Hardware Notes:

We tested with six unlike versions of PixMob bracelets manufactured between 2014 and 2021 from various events including Portland Trail Blazers games, Superbowl LIV, and concerts of Taylor Swift, Coldplay, and The Weeknd. Each bracelet has an IR receiver and RGB LEDs along with pseudo random number generation capabilities and persistent memory. Some models also contain a movement sensor for motion-activated effects. Feel free to open up an upshot if yous want more specific hardware information or teardown photos. A public FCC filing for one of the models of IR transmitters used at PixMob-equipped events confirms that they piece of work on 940nm infrared light. There is some bear witness that the bracelets enter a slumber way when not in use for a while.

Methods:

A Flipper Zippo device was used at a Coldplay "Music of the Spheres" concert and a Weeknd "After Hours Til Dawn" concert to record some of the IR commands sent to the PixMob bracelets worn by the audience. The Flipper device was so afterwards used to re-transmit each of the recorded signals to PixMob bracelets of various generations, and their reactions were observed. Of over 100 recorded signals, only 3 acquired immediate responses on the PixMob bracelets outside of the event. It is inferred that the majority of the codes are used to transmit "programming" information to the bracelets, to inform how they will react to late cue signals.

Of the three initially-discovered signals:

• One produces a single yellow flash that fades out slowly
• I produces a single white flash that fades out speedily
• One produces a very deadening yellow-orange fade in and out event, but but sometimes (the remainder of the transmissions leave the bracelet off).

The raw IR betoken files recorded by the Flipper were inspected and analyzed. Information technology was plant that the IR signals accept a carrier frequency of 38 kHz. The times between each high/depression change were graphed for the signals, producing plots like the one below:

Through trial and error, it was adamant that the betoken recording actually contained multiple "copies" of the white flash signal, and the recording tin can exist cropped downwardly significantly and nevertheless produce the same effect. The minimum necessary segment of the recording required to elicit the white flash bracelet effect spans the samples betwixt each of the ~6300 dots on the graph above.

From plots like this, we noticed that the transition intervals cluster around multiples of 700 microseconds. With this knowledge, nosotros translated the signals into a binary representation, with each bit representing a 700 microsecond fourth dimension interval.

All recorded signals (even those which did not immediately produce an result when retransmitted) independent the same "1000000000" start sequence. From experimentation, we adamant that the "1000000000" offset sequence is non required if only sending i betoken at a time without repetition—it is just used to carve up individual IR codes/betoken transmissions (and maybe to "wake" inactive bracelets, though transmitting any valid IR packet twice will besides accomplish this). Every bit such, the leading 1000000000 is removed from the IR signals included in this repository.

With these binary representations in hand, we wrote a program to "creature-forcefulness" IR signals in a targeted manner, where we selected specific ranges of bits to brute-strength based on inferences made from known signals. This was done with an ESP32 development lath with and IR transmitter.

By repeatedly running animate being force processes, observing results on bracelets, and re-evaluating which $.25 to target, we were able to discover many functional IR codes to produce:

• Flashes of many different fix colors and durations
  • Some fade in or out, some sharply only plough on and off
• Motion activated mode
  • Display colour or bike through rainbow colors equally the bracelet is moved (persistent to battery removal and reinsertion)
• Random color furnishings
  • Probabilistic control that will turn on a bracelet only some of the time information technology's transmitted. This would exist used in events to create "twinkle" effects, or effects that highlight a random set of attendees.
• Fades between multiple colors
• Blink betwixt two dissimilar colors
  • Seems to adjust to how often the signal is re-transmitted, so a strobe issue of varying speed can be produced
• More complicated effects:
  • Signals that the bracelets volition but react to the first of multiple consecutive transmissions
  • Signals that cycle through one of multiple colors in a set up order each fourth dimension they are sent
  • Signals to which bracelets will only respond if a sure amount of time has elapsed since the previous time the bespeak was sent
  • Signals that brand it such that futurity light effects shown on the bracelet pb to a fade towards a gear up colour before turning off until a stop betoken is sent
  • Signals that change the colors used in certain parts of other effects until a end signal is sent.
  • Ane betoken makes it so a blink event volition concord its color for threescore seconds

Notably, one of the bracelets used in testing reacted to many commands by blinking between multiple colors. Another bracelet would enter a mode where it blinked cherry-red twice every few seconds after a period of not receiving any signals. It is presumed that these modes were entered based on boosted programming signals sent during the event they were initially distributed at, and then far we have not discovered what those signals are or how to utilise near of them.

In reviewing the creature force results, we discovered that some of the lite effects packets tin be separated into two parts, a kickoff part that specifies what colour the effect should be, and an optional 2nd part that specified if the colour should be faded in and out, every bit well as if every bracelet should show the effect every time the code is sent or if random logic should be used to determine whether or not to show the issue. If the 2d part is omitted, the bracelets will just show the colour briefly with no fading.

Limitations:

• Due to time limitations, but a few different parcel structures were targeted for the beast force process. About fauna force runs were done to fine packets of lengths of 39, 63, or 73 bits, with some $.25 hardcoded to values that were seen to work in other signals. Every bit such, the list of codes discovered is very far from exhaustive.
• We've but been able to reliably notice codes that produce an immediate consequence to bracelets. We know that there are many more complicated means these bracelets are used in the wild that involves transmitting programming/light choreography information earlier a long calorie-free effect and then triggering those effects to run in some way.

Side by side steps:

• Learn more near the IR packet structure.
• Make the documentation more complete.
• Write a standalone Arduino library for controlling the bracelets without a calculator.
• Write an installable Python library for controlling the bracelets directly on a device that runs Python lawmaking with GPIO pins (east.g. Raspberry Pi).
• Further streamline the brute force process.
  • Point a camera at the bracelets and automatically record signals that lead to effects?

References and links:

• PixMob Wash transmitter FCC filing: https://fccid.io/2ADS4WASH
• Another project that tried to brute force PixMob IR signals but was not successful: https://github.com/yeokm1/reverse-engineering-ndp2016-wristband. Presumably this is considering the author did not accept whatsoever initial valid signals to work off of, then they could non make any inferences about packet structure or on/off timing information.
• A project reverse technology the less-common Bluetooth Low-Energy based PixMob bracelets: https://github.com/MustBeArt/PIXMOB-reversing
• Another project that does the equivalent of this one, but for Xylobands, a different brand of LED bracelet that uses RF instead of IR: https://github.com/StefanKrupop/XyloShield

Updates (equally of 12/sixteen/2022)

In that location has been a lot of really good activity and progress in this repo since I starting time posted it! I am so beholden of all the help from community members here.

• /u/remco has contributed some more raw recordings from a Flipper at a Coldplay concert (now we've got two sets of Coldplay recordings)
• @hckrdan made some recordings using a point analyzer with a Raspberry Pi and IR receiver at an Imagine Dragons evidence
• I recorded some signals from the Cleveland Cavaliers 2022 flavor home opener
• Based on @alexmoen955's feedback, we at present take a script that lets you configure a fashion to repeat commands to hold bracelet colour without copying and pasting a bunch.
• @JSMSolns gear up a super crafty method of [controlling the bracelets with Vixen via an Arduino (#five)
• @ibrunops and I have gotten a proof-of-concept for decision-making the bracelets from an Android phone with an IR blaster through the irplus app.
• @lasry1, @JulioC, and I made information technology so we can control the bracelets via Broadlink smart home IR devices.
• AND, concluding but not least, @sean1983 has made tons of progress discovering many more codes, assigning RGB values, investigating bundle structure, and more!

Instructions

If y'all have a Flipper Zero device and you would just like to transmit some pre-divers signals without a computer or Arduino, see this repository instead: https://github.com/danielweidman/flipper-pixmob-ir-codes.

Code and structure:

This projection consists of two lawmaking components:

1. Python code which tells an Arduino-compatible microcontroller (via serial) what IR signals to transmit.
2. Arduino code that listens for IR betoken data over serial and transmits said signals with an IR emitter.

You will demand:

1. An Arduino-compatible microcontroller.
2. A 940nm IR emitter for the Arduino. You could set up a raw IR led or utilise a board like the transmitter slice of this.

Basically, the steps are:

1. Connect an IR LED/transmitter to the Arduino board.
2. Connect the Arduino to a figurer past USB.
3. Upload the sketch from "arduino_sender" to the Arduino. You may need to install the IRremote or IRremoteESP8266 library offset. Brand sure to set the IR tranmitter information pin variable and annotation down the port/device address (COM port on Windows) of the Arduino.
4. Set the ARDUINO_SERIAL_PORT at the top of "python_host/demo_single_effect.py" or "python_host/demo_multiple_effects.py" script. If using a lower-power Arduino device similar an Arduino Nano, as well set WAIT_BEFORE_SEND to True.
5. Run the script. Your PixMob device(s) should light up!

More specific instructions are in the README files in the relevant folders. Feel free to open an Issue if you need aid.

Replacing the batteries:

You volition, of course, need non-empty batteries in your PixMob bracelet/other device to make it piece of work. If you received the bracelet at an event more than a few days ago, you will nigh likely demand to replace the batteries. The procedure for doing this differs past bracelet blazon. This is easier on some models than others.

• Some bracelets have a round bombardment cover with an indent that one tin can insert a money into and turn counter-clockwise to remove. These accept ii CR2032s batteries.
• Some bracelets accept a white plastic rectangular module embedded in a black rubber wristband. The module tin be opened by pulling the 2 tabs on the sides outwards. After that, the batteries can exist removed by inserting a pen on the lesser side of the module to push button the batteries out the top. These take ii CR1632 batteries.
• Other bracelets may unfortunately need to pried open up and potentially taped dorsum together.

Contributing

Feel free to open an issue or pull request if yous have any improvements to make or if you lot are able to glean anything new and action-worthy about the IR packet construction. I'chiliad also happy to reply whatever questions about how to become things upward and running.

Source: https://github.com/danielweidman/pixmob-ir-reverse-engineering

Share this post