Reverse Engineering a 27mhz Rc Toy Communication Using Rtl Sdr
Posted3 months agoActive3 months ago
nitrojacob.wordpress.comTechstory
calmpositive
Debate
40/100
Reverse EngineeringRtl SdrRf Communication
Key topics
Reverse Engineering
Rtl Sdr
Rf Communication
The author reverse-engineered a 27MHz RC toy communication using RTL SDR, sparking a discussion on the simplicity of RF protocols and alternative tools for decoding RF signals.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
39m
Peak period
5
7-8h
Avg / period
2
Comment distribution20 data points
Loading chart...
Based on 20 loaded comments
Key moments
- 01Story posted
Oct 15, 2025 at 10:31 AM EDT
3 months ago
Step 01 - 02First comment
Oct 15, 2025 at 11:11 AM EDT
39m after posting
Step 02 - 03Peak activity
5 comments in 7-8h
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 16, 2025 at 2:08 AM EDT
3 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45593213Type: storyLast synced: 11/20/2025, 8:37:21 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
I had an rc submarine that could go underwater a couple feet, but I'd take an rc car's 27MHz radio and put it underwater, it'd stop working almost immediately soon as it went underwater (waterproofed). Wonder what the difference was.
Regarding "longer antenna" for submarines... -- I recently learned about this signal from https://www.sigidwiki.com/ -- which has been helpful to ID all the fun stuff you can see with RTLSDR
Corona, stuff like this, the sheer gall, it's impressive.
https://en.wikipedia.org/wiki/Project_Sanguine
https://www.dhgate.com/goods/822484606.html
seawolf Omnibearing RC Submarine - 6CH 35cm
Walmart used to sell it like 17 years ago
The "RTL" came from the company that built the hackable chip: Realtek.
Aren't you confusing that with Fresco Logic USB to VGA?
The RX2 protocol is incredibly simplistic and inefficient at the same time, something like numbers of pulses in increments of few dozens to accept one of the grand total of dozen commands. It barely allow multiple command issuance within a second and completely incapable of handling analog inputs due to that. It's truly a product of "if it works" mindset.
They take the radio input, or just digital input into the antenna pin, or photodiode for IR input, or you can just remove the chip and solder an Arduino into H bridges. The difficulties are about the same. The minor disappointment I have had with these is that the steering servo built into the chassis inthe example I had was way too roughly made that analog control was plain impossible no matter what.
It’s an amazing tool. In less than an hour I decoded my RF remotes for the fans in my house.
Whipped up a Python script (without external modules) that transmits a modulated carrier using HackRF. Now I can control fans (with lights) with scripts.
URH also really good at recognizing the pulse durations and repetitions.
All crude RG devices aren’t even ASK, it’s really OOK. The receivers don’t have an ADC!
Based on patterns ("110110110", "1010", "111011101110"), I bet bits are variable length. Long pulse for sync, medium for 1, short for 0 (or other way). So there is always the same number of bits, but the time taken is different. This makes it very easy to decode, and explains the values in the table.