Re: Where can I buy a cheap transponder?

Product info says: "Compatible with Westhold Timing Systems ONLY."

So answer is No, they do not work with mylaps system. 
Interesting, as I have never heard of them, wonder if they are recent?  like last 10 years.

Rough Knuckles wrote:

does anyone know if these work with the MyLaps system? Their website says they work with competitor system and are not subscription based.

https://www.fmiracing.com/products/gb/B … kcQAvD_BwE

Re: Where can I buy a cheap transponder?

gus wrote:

@Spank - I'll definitely take you up on that offer. Worst case I can't make it work, best case I can repair it, get what I need, then return it!

I'll derail this thread just a bit more since there's some interest. The only difference between the 160 and the 260 in hardware is a jumper that sets RF power output. The firmware is also slightly different as the 160 has a 3 ms update rate and the 260 has a 20 ms update rate. It's likely that if the decoder is set to accept the 260/X2-Car it get's confused by a 160 and all it's extra packets, it's possibly also a slightly different packet that it sends that just causes the decoder to just go into a error state.

@Guildenstern:
At best a clone/compatible transponder would be indistinguishable from a genuine one, that's the real goal. These are just 1's and 0's transmitted in a defined sequence. It's a very basic digital signal modulated onto a carrier frequency using a simple analog circuit. There's no handshaking or challenge/response or analog RF magic. The RC drone and car guys have had clone/compatible transponders for years that the AMB decoders can't distinguish and I think we could too.

Did anything ever become of this? I think you're overthinking it. The older 160s/260s are just CW transmitters according to the FCC filing. Speculating here, but each transmitters unique ID is simply FSK-CW encoded and sent on the carrier?

Either way... my planned attack vector was/is to use SDR and simply clone one... but I need to start with a working one for this smile

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

Re: Where can I buy a cheap transponder?

derekste wrote:

Did anything ever become of this? I think you're overthinking it. The older 160s/260s are just CW transmitters according to the FCC filing. Speculating here, but each transmitters unique ID is simply FSK-CW encoded and sent on the carrier?

Either way... my planned attack vector was/is to use SDR and simply clone one... but I need to start with a working one for this smile

I hand delivered one while at Buttonwillow. Of course it was before the race, and my timing is impeccably bad, which is why I mostly just stay in my own paddock space all weekend. But I braved the great outdoors and walked it over after the driver meeting.

29 (edited by gus 2019-12-16 09:28 AM)

Re: Where can I buy a cheap transponder?

derekste wrote:

Did anything ever become of this? I think you're overthinking it. The older 160s/260s are just CW transmitters according to the FCC filing. Speculating here, but each transmitters unique ID is simply FSK-CW encoded and sent on the carrier?

Either way... my planned attack vector was/is to use SDR and simply clone one... but I need to start with a working one for this smile

I have the transponder Spank handed to me, but I’ve been travelling for work since Buttonwillow so haven’t taken a look at it yet unfortunately. Hopefully over the holidays I’ll get to take it apart.

Even the X2 is just FSK-CW, except the payload is encrypted and contains the precise number of “slots” that the next message will be transmitted, which is randomized. There’s also a sequential counter in there somewhere, so every single packet is different. I have a setup for recording the bitstreams but apart from a few header bits the rest is encrypted noise.

They key to figuring out the X2 system is finding the encryption key and method, everything is simple after that.

The older ones just transmit the unique ID, but if they’re anything like the AMB RC or motorcross ones they will do some “encoding” (not really encryption) on the ID that’s being sent.

Re: Where can I buy a cheap transponder?

gus wrote:
derekste wrote:

Did anything ever become of this? I think you're overthinking it. The older 160s/260s are just CW transmitters according to the FCC filing. Speculating here, but each transmitters unique ID is simply FSK-CW encoded and sent on the carrier?

Either way... my planned attack vector was/is to use SDR and simply clone one... but I need to start with a working one for this smile

I have the transponder Spank handed to me, but I’ve been travelling for work since Buttonwillow so haven’t taken a look at it yet unfortunately. Hopefully over the holidays I’ll get to take it apart.

Even the X2 is just FSK-CW, except the payload is encrypted and contains the precise number of “slots” that the next message will be transmitted, which is randomized. There’s also a sequential counter in there somewhere, so every single packet is different. I have a setup for recording the bitstreams but apart from a few header bits the rest is encrypted noise.

They key to figuring out the X2 system is finding the encryption key and method, everything is simple after that.

The older ones just transmit the unique ID, but if they’re anything like the AMB RC or motorcross ones they will do some “encoding” (not really encryption) on the ID that’s being sent.

sounds like you got this under control. hit me up if you want to share notes or bounce some ideas around!

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

Re: Where can I buy a cheap transponder?

derekste wrote:

sounds like you got this under control. hit me up if you want to share notes or bounce some ideas around!

I was toying with a similar idea. Didn't think about hitting you up, but you're the perfect man for the job. ;-)

My idea was to build a database of existing Lemons-friendly X1 IDs and just clone those with consideration of not duplicating the same IDs during a weekend. Or... fuck it, put the same ID on multiple transceivers and watch Roland's head implode when a 1971 Simca sets a new track record with a 1:12 lap at Gingerman.

Do you know anybody with a spectrum receiver that can watch the frequency and then plot the data transmission on an O-scope? We'd also need to know what the stimulus message (if any is) from the master controller.

The Pentastar whisperer

Re: Where can I buy a cheap transponder?

FWIW, I have a few o-scopes I would love to find a home for.

1990 RX7 "Mazdarita"  1964 Sunbeam Imp (IOE 2013 Sears Pointless) 2002 Jaguar x-type (Winner C-Class 2021 Sears Pointless)
Gone bye-bye
1994 Jaguar XJ12 (Winner C-Class 2013 Sears Pointless)  1980 Rover SD1 (I Got Screwed 2014 Return of Lemonites)

33 (edited by derekste 2019-12-29 09:01 AM)

Re: Where can I buy a cheap transponder?

Bayley wrote:

My idea was to build a database of existing Lemons-friendly X1 IDs and just clone those with consideration of not duplicating the same IDs during a weekend. Or... fuck it, put the same ID on multiple transceivers and watch Roland's head implode when a 1971 Simca sets a new track record with a 1:12 lap at Gingerman.

Do you know anybody with a spectrum receiver that can watch the frequency and then plot the data transmission on an O-scope? We'd also need to know what the stimulus message (if any is) from the master controller.

so my software defined radio can record (and play back) any radio signal below 6 GHz, as long as it is less than 100 MHz wide -- kinda like a VCR from the days of yore, but one that can record every TV channel at once!

once I have a recording of an older 160 or 260, I will see if I can play it back and effectively clone it (some minor technical obstacles to this due to the [relatively] low frequency these operate at)

next step is to throw that data into universal radio hacker (https://github.com/jopohl/urh) and see if we can tease out the data being transmitted, giving us a blueprint to synthesize arbitrary transponder IDs at will. you know that number you enter into the Lemons registration page when you BYO transponder? I suspect the transmitted data is nothing more than that (or some hash of it)... for the older transponders anyways... which Lemons still supports the use of! (don't see why you would want to clone one of the subscription-based models, frankly. edit: unless X1 refers to something else)

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

34 (edited by gus 2019-12-29 01:42 PM)

Re: Where can I buy a cheap transponder?

derekste wrote:

(...) (don't see why you would want to clone one of the subscription-based models, frankly.(...)

It's mostly because the X1 is the current production model and the 160/260 is "legacy". Someone publishing details on cloning a 160/260 would be just the excuse MyLabs needs to make the 160/260 "unsupported" in the next release of their timing software. A move like that would upset a lot of people, but there's no alternative so MyLaps would get away with it.

Re: Where can I buy a cheap transponder?

mikehutchinson09 wrote:

Yeah renting is the right choice in my opinion.

Registered: 2019-12-29
Last post: 2019-12-29 11:38 AM
Posts: 1

just found this to be an... interesting first post.

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

Re: Where can I buy a cheap transponder?

derekste wrote:
mikehutchinson09 wrote:

Yeah renting is the right choice in my opinion.

Registered: 2019-12-29
Last post: 2019-12-29 11:38 AM
Posts: 1

just found this to be an... interesting first post.


Agreed. A succinct, concise post; directly on point, and unambiguous. No thread drift at all.

Re: Where can I buy a cheap transponder?

Lemon_Newton-Metre wrote:
derekste wrote:
mikehutchinson09 wrote:

Yeah renting is the right choice in my opinion.

Registered: 2019-12-29
Last post: 2019-12-29 11:38 AM
Posts: 1

just found this to be an... interesting first post.


Agreed. A succinct, concise post; directly on point, and unambiguous. No thread drift at all.

I did a search online and found this profile info was used on a few totally unrelated forums with similar single posts over the last month. Very likely someone setting up usernames to sell to spammers. ZAP. Gone from this forum at least.

Re: Where can I buy a cheap transponder?

i just snatched a working Tranx160 off ebay for $250... will post some RF spectrum eye candy later

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

Re: Where can I buy a cheap transponder?

If you look at their patent, it says they modulate the 'magnetic' field and not the electric field,
which I did not understand at all, but from what they say, this is different the normal wireless, which modules the E field.  shrug.

BTW, I have a new race series, and we are going to be using the transponders I developed for r/c racing.
Amb can shove it!!

Re: Where can I buy a cheap transponder?

Except you can't really separate those two since its Electro-Magnetic radiation. smile

But the wording is simple enough. Suggests its inductively coupled instead of capacitively coupled. Thats actually better for the loop of wire buried under the track.

41 (edited by derekste 2020-01-15 09:52 AM)

Re: Where can I buy a cheap transponder?

here's what a transponder looks like on a spec annie.

I need to capture this on my SDR, and then get my hands on a second transponder (teammate has one) so I can do a differential analysis.

https://drive.google.com/file/d/1e3TLoO … sp=sharing

"THE WONDERMENT CONSORTIUM"
Everything dies baby that's a fact,
But maybe everything that dies someday comes back?

Re: Where can I buy a cheap transponder?

Bump for some enthusiasm to stick it to mylaps.

I know nothing about the hardware/programming involved. But i suspect there might be some sort of time component within the software of the x2.  Considering you have to plug it into a computer to activate a new subscription, once that timer runs out on the chip it'll "deactivate" the transponder.  The x2 certainly doesn't trip any signals when the subscription is out, confirmed that last weekend. So i guess one potential option is hacking the damn thing, which i'm sure is possible but probably prohibitively difficult.