Xcortech 3300w - Component boardXcortech 3300w - Component board

So I have a somewhat hopefully simple question. I'm a bit of an amateur with on-board components and am trying to figure out what kind of signals this board receives. This device is an Xcortech 3300w. Documentation is sparse outside of youtube videos that just go over basic function if that helps.

Here is how it works: This board combines with an inline mosfet unit and a separate high accuracy speed measurement device that attaches to the muzzle of electronic bb guns to do three things

  1. It measures the velocity of each shot fired and displays it on the board shown when in the right mode
  2. It tracks each shot, and has some flash memory so it can store how many rounds have been fired along with a counter up or down(tracks through reboots and keeps memory)
  3. It "pairs" with the inline mosfet so that it can SEND the mosfet a signal to cut off the battery when the bb gun is "out of ammo" according to the shot counter mentioned in #2. It appears as if this"pairing" is NOT bluetooth, or wifi.

It does all of this wirelessly, which is quite handy. I don't like the design of the box and the digital LED readout. It feels very 90s.

What I want to do: My goal was to redesign the tracker to use a micro sized TFT LCD and an ESP32 or Arduino to intercept the signals and function as the brain of the unit. The problem is that I can't seem to detect what kind of signal it's sending at all. I'm fairly certain its not bluetooth (I sometimes see a null bluetooth ID with a mac address when im at home and this thing is on, but i cant connect to it and i dont sniff any signal being sent ever so its probably not that), it's definitely not Wifi, and if it IS RF, i can't detect what frequency it's sending at (using the low-grade detection of my phone)

My question to you guys is, does anything on this board stand out as a particular kind of receiver for any kind of signal you might know about? Or even if not, do you know of any way I can sniff or even detect intermittent wireless signals of various varieties? I don't necessarily even need to read and decode them, even the fact that a signal of a particular frequency was sent is enough for me to track the information I want (namely just the shot counter functionality)

Bonus points: Links on how to decode wireless signals once I do manage to detect the signal. I know it's at least sending a 3 digit numeric value (Feet per second value). So if I can just take the binary output and brute force it in to an int somehow that would be fine. I suspect the can ONLY sends this 3 digit int value, and the computer pictured decodes that signal as "i've shot a bb, its going this fast, you can keep track of how many shots have been fired and how many per second i'm shooting"

  • \$\begingroup\$ U3 seems to be the wireless IC. What markings does it have on top? \$\endgroup\$ – Stefan Wyss Jun 4 '19 at 13:23
  • \$\begingroup\$ A better, top down picture of the board and also of the thing is pairs with would help. Unless it's using quantum entanglement it will be emitting radiation in some frequency, you're just not using the right tools to detect it. U3 is the only suspicious thing I can see from that photo. \$\endgroup\$ – hekete Jun 4 '19 at 13:30
  • \$\begingroup\$ There isn't really enough information here to make this answerable. Often your best bet is start by identifying key components, and to look up the FCC ID and find the test report. \$\endgroup\$ – Chris Stratton Jun 4 '19 at 14:40
  • \$\begingroup\$ @hekete I suspect as I mentioned that the device I was trying to use to detect the RF just wasn't picking up the right range. After looking up more research I suspect I could find/make a 300-900Mhz sniffer and just pick up what the signal frequency is that way and do some signal analysis from there. \$\endgroup\$ – Mdigibou Jun 5 '19 at 14:52

U3 is clearly associated with the antenna that you can see embedded in the PCB. It could be something like the TI CC1101, using a completely proprietary protocol.

This is a very flexible chip, so to reverse-engineer it, I would start by "snooping" its SPI control bus with a logic analyzer to try to figure out what register settings the application is using.

| improve this answer | |
  • \$\begingroup\$ That is a very useful place to start, thank you for the link to that documentation. Unfortunately I don't need to reverse engineer what this board is doing unless that is a faster way to finding out just what frequency is being transmitted. \$\endgroup\$ – Mdigibou Jun 5 '19 at 14:52
  • \$\begingroup\$ Your question implied that you want to decode and/or interact with the payload. Monitoring the chip's control bus is by far the easiest way to do that. But if all you really want is the frequency, then by all means, just pull out your spectrum analyzer. Or even just a frequency counter. \$\endgroup\$ – Dave Tweed Jun 5 '19 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.