Hacking the Dream Cheeky Thunder

A couple of weeks ago, Atmel tweeted about some people that hacked the Dream Cheeky Thunder Missile Launcher by soldering on a Ardunino to the circuit board.

A quick Google search shows there are lots of people who done something similar, including this post.  Since I was not interested in messing around wit the circuit board, I decided to go the software hack route.  When the missile launcher arrived, I downloaded software and installed it on my Windows 7 machine.  I then used Telerik’s JustDecompile software to look at the source code.

Fortunately, the main executable is a .NET 2.0 Windows Form application.  Unfortunately, the code is a mess and it relies on user controls.  Specifically, the library that the .NET .exe consumes is called USBLib.dll which is a 23-bit Com component that creates a windows control that the main .exe uses.

When I took the code from JustDecompile and stuck it into Visual Studio (no F# option so I went with C#), it took about 2-3 hours to get all of the references set up, the resources set up, and the embedded code put into the right location, but I did manage to get a working Visual Studio solution

I then decided to build a brand new solution that controls the missile launcher without the graphical components that are baked into the app.  I added a reference to the USBLib.dll and then tried to make method calls.  No luck, it looks like the application uses Windows Event hooks to call and respond:

        protected override void WndProc(ref Message m)
        {
            this.USB.ParseMessages(ref m);
            if (m.Msg == SingleProgramInstance.WakeupMessage)
            {
                if (base.WindowState == FormWindowState.Minimized)
                {
                    base.Visible = true;
                    base.WindowState = FormWindowState.Normal;
                }
                base.Activate();
            }
            base.WndProc(ref m);
        }

Yuck!  I then did a quick search on Google to find a .NETUsbDriver that I could use because I already have the byte array values that the missile launcher is expected:

I found this but the suggestions did not compile and/or did not work.  I then found this site which in the right direction.  I added the code into my project like so:

I then wired up the main form like this:

With the code behind like this:

        MissileLauncher _launcher = new MissileLauncher();
        public Form1()
        {
            InitializeComponent();
            _launcher.command_reset();
            _launcher.command_switchLED(true);
        }

        private void upButton_Click(object sender, EventArgs e)
        {
            _launcher.command_Up(2000);
        }

        private void fireButton_Click(object sender, EventArgs e)
        {
            _launcher.command_Fire();
        }

        private void downButton_Click(object sender, EventArgs e)
        {
            _launcher.command_Down(1000);
        }

        private void rightButton_Click(object sender, EventArgs e)
        {
            _launcher.command_Right(3000);
        }

        private void leftButton_Click(object sender, EventArgs e)
        {
            _launcher.command_Left(3000);
        }

Then, when I run it, it works like a champ.  I now just need to translate the values passed into the Thread.Sleep() and have it correspond to the angles.  The author of the code was on the right track because s/he named the parameter “degree”. 

In the meantime, I ported the code to FSharp.  You can see it here and you can see the missle launcher in action here.  The major difference is that the C# code had 182 lines and the F# code has 83.