CryptoTelemetry – Secure firmware to prevent drone hijacking.

The CryptoTelemetry firmware:

Due to the proven vulnerability of current telemetry modules, I’ve developed something significantly stronger.

The source is not open, because it’s not real strong, certificate-based encryption, that allows end-user to replace, create new certificates. One advantage of doing it this way, is that you can purchase more radios and add them without having to reprogram all.

The secrets are permanently stored inside, and opening the source would give glues of possible attack vectors.  I intended this to be a long time viable, secure solution.

Still – the owner have the option to get more radios that will work with his private network.


  • 433,470,863,915Mhz support.
  • Fully compatible with all ground station configuration tools.  All the common AT commands and parameters are there, there’s even a NetID that will let you make different networks within your encrypted network – should you wish.  Example, if you have 4 CryptoTelemetry radios,  you can have 3 in different UAV’s , all have the same network ID, and will speak to the same GCS, typical use is “one at a time”. Or you can set two radios with NetID different than the others, and use two GCS and two UAV simultaneously. – Note that no non-CryptoTelemetry radios will be able to communicate with these radios.
  • Locked down firmware, even if one malicious customer purchased it for analysis, it would be hard to learn anything from it.  – Then it would take some time to find your encryption key.
  • Personal encryption key.  (most tend to be 11digits) Only the customer will have the key, it is NOT stored here. To order more radios for the same network, it’s essential to provide the key so a properly encrypted firmware for your radio can be generated.
  • Your radios will operate in your network, no one else will be able to see the data, or encrypt without some extensive cryptanalysis and hacking.
  • Encryption can be disabled by disabling ECC – radios enter then a transparent mode, which is 2x the usual ECC data rate.
  • Efficient; the data rate is the the same as ECC,  (half of the non-ECC speed.)
  • ECC (Golay24) is still active, for every 12bit , up to 3 bit errors can be corrected.
  • Delivered on standard, authentic, genuine 3DR telemetry radios.
  • If customer provides radios, it can be flashed onto a several other/compatible radios.
  • Reversible – should this method be obsolete one day, it is fully possible to convert these radios to run official 3DR provided firmware.

I am using this firmware for all my commercial operations as well as hobby flights, it is well tested.

Get your radio reprogrammed with CryptoTelemetry ($85):

Buy new original 3DR Radio with CryptoTelemetry ($135):


How to hijack a drone by telemetry – and prevent it.

My professional background is network and Internet security, I quickly discovered the huge risk of an hostile takeover of UAV midair.

My experiment is based on 3DRobotics telemetry radios. but works with many more radios, based on the same, open, solution.

Please note that this is not a security risk of Ardupilot project, ArduCopter, ArduPlane is *not* to blame.  You may get an idea that some changes should not be allowed while armed, but that’s not a proper solution. Having all the options we have, after all, GCS is a device to be trusted, and the primary control during a auto mission.

Radios lack proper security, mostly due to limited processing power for proper encryption.  We are left with an simple attempt to secure the data, which is very easily worked around.

The open nature of the project, makes it impossible to truly protect the transmitted data. The radios do not have space & processing power to use  public&private  certificate based verification of data, also we would need a simple and a method of letting users selv-sign/generate such certificates for as many radios they needed in a network.

The current attempt to secure the transmission is based on radios dropping packets branded with different NetID- and the frequency hopping pattern to be seeded by the NetID.

So knowing or guessing one UAV’s (or companies) NetID, (provided it’s even changed from the default one) , enables anyone to send packets that are perfectly valid on the network.

To verify the theory, I needed an experiment:

I created a specialy crafted firmware for the stock  telemetry radio, it proved to be a trivial task, Let’s call the module for BlackSheep, it have the following features:

  • Automatic sniffing of nearby NetID (as we know, the user-set NetID is also used to seed the frequency hopping)
  • When it finds valid packet with NetID, it learns active frequencies, and changes it’s frequency hopping to the pattern of that particular NetID – locking in on it. – whole process takes ~1second.
  • By connecting BlackSheep to any GCS, we have instantly a valid connection to a nearby operating UAV.

Hijacking the drone in real life.

We can assume a low-tech drone hijacker would do it by running a GCS and just do it manually. An intermediate hacker would use scripts with MavProxy, or clicking around in GCS software – but the optimal solution, is a predefined set of commands used by a modified GCS for easy map interaction.:

This is what an takeover looks like;

  • pointlessly evil hijacker could just disarm the drone midair or send MAV_CMD_DO_FLIGHTTERMINATION – but that’s not the goal here.
  • send, and repeat a few times: SR?_* = 0  – disables all telemetry output from AP , make the radio go silent.  This will also reduce amount of packet collisions if we have 3 radios operating. (UAV is the one occupying most of the radio time) – now the victim GCS operator does not  get any more updates.
  • Then we set all control FLIGHTMODE_? to AUTO or Guided (by preference),  and disable FS_Throttle and FS_GCS , CH6 and other programmable options are disabled. The pilot with RC can’t do anything anymore.
  • Enabling SR?_EXT_STAT – gives the hijacker RAW GPS data, altitude, speed – this data is usually not visible on a GCS, so the victim can’t see it – but hijacker knows where the UAV is.
  • Uploading a mission, or Guided mode instructions sends the UAV to wherever hijacker wants – victim have no valid input, and cannot see it in GCS, all he gets is Mavlink heartbeat.
  • Finally, for the extra evil touch hijacker can inject Mavlink MAVLINK_MSG_ID_GLOBAL_POSITION_INT packets (as if autopilot was sending it) with proportionally incorrect data, so we could get the victims GCS display and log the real movement, with actual speed, but in different direction, misguiding as to where the UAV went.

I skipped a few trivial steps, like setting higher cruise-speed, and few platform dependent commands – but the short summary should be frightening enough.

What can be done to prevent such hijacking ?

  • Fly without telemetry radio, reducing mission control and control redundancy, not good.
  • Use cellular network to get TCP or UDP control, limited coverage.
  • Use wifi, very poor range.
  • Satellite modem, expensive, very low data rate, often ~2400bps
  • Continue to develop open solutions with hardware limitations that limits us to very simple security solutions, like the one in use today – very easy to circumvent.
  • Use customized, specialized, closed solution that offers good security, it is not proper certificate based encryption, but rather an odd, but very effective scrambling.  Effective mostly because the firmware is locked down, and not easy to analyze.

Final words:

Telemetry radios , 433/900Mhz are great, most aviation authority approved approved flights , professional or hobby, are within VLOS, where these radios perform great.

The fact the source i open, is not a drawback, but a strength.  It allows people like me to detect security vulnerabilities, like many other can do, and documents them, or protect against them, so others cannot silently abuse them, without users understanding what’s going on.

History of this site existed since ~1995   Originally it was a site about my buildlogs, hacks, modifications, and technical that you may call a “blog” today.

With time – I’ll restore  some more of the old articles,  most of it will be very outdated, stored just for fun.

Double DIN car computer

It’s long time since last time I published a new buildlog/project.
My new car needed a decent stereo,  it had a “iProduct” interface, but I needed something better.
Unlike my previous car computer projects, I did not wish to install an amp + carputer in the trunk, and run VGA,USB and speaker cables forth and back. I wished to have everything integrated in the dashboard.

The idea was to build according to ISO standard, then use a Toyota<>ISO-harness adapter.
Using the ISO-Toyota harness and integrating an amplifier also makes it easy to control the car’s active sub kit and active antenna, without modification.

Analysis of the resistive buttons connector in Avensis
This is the control module interface documentation, a RJ45 connector between computer & external controls.
This is the control panel itself, controls power mode (always on/always off/follow ignition) camera select and reset switch built into the ashtray,(usually closed)
Lilliput 629 (7″ touchscreen) disassembled
The resulting analysis of the proprietary connector of the display controller. Cables with proper motherboard connectors are now soldered directly to it.
The Lilliput needed to have some shielding cut off to fit better inside the (far from perfect) Double-DIN box
The display’s edges needed to be padded, to prevent the double-din frame from “touching” the touchscreen area.
Display, and display controller installed, IR sensor and buttons relocated.
Don’t repeat my mistake, while waiting for this motherboard, I built proper 2,54 connectors for VGA,USB,Audio and so on, just to discover the pin headers on this motherboard are 2.0mm !
Circuit for relay control. (provides power to display, amp, external amp(active sub), and antenna output).
Motherboard+PSU installed, the hard-drive is below motherboard
The amplifier is now installed (built around a TDA7850 (4x~50W) plus BA3121 ground isolation amplifiers.).
Radio module installed, The blue cable in the control port simulates the “usual” control-panel configuration for lab-use (follow ignition) and use reverse camera
That’s it, ISO connector compatible device. with internal radio, and amplifier.
Installed in car, displaying reflection because it’s off.
Running Centrafuse
I also modified the “hibernating” screen with a custom logo – removing windows logo feels good, looking forward to the release of Centrafuse for Linux. Picture

XBOX S-Video + SPDIF mod

This mod gives S-Video output, and SPDIF (digital audio) output, plus removes the need for the original audio+video cable

Why:  XBOX usually delivers Composite Video output + Stereo output.   With an “Advanced” cable, user can enjoy RGB video & optical SPDIF.
I wanted higher video quality then composite video delivers, and my projector (as most projectors) does not support RGB.S-Video is better then Composite, mostly because it uses 2 wires (Luminance & Chrominance) , instead of  just using one wire, as Composite does.

This mod allows XBOX to boot & work just fine without the original audio+video-cable connected.

The original cable is still working after modding this way.

This should not be necessary to say, :  This voids your XBOX warranty instantly 🙂

+The original connector/cable will still work as before.

I skip schematics – here goes the pictures…  they say it all:

Finding the signals/connecting to them:

This picture shows the solder-side of the XBOX motherboard, where the video+audio connector is mounted.
RED long wire,  goes to the center of the SPDIF connector.
WHITE wire, is the S-VIDEO Luminance line
GREEN wire, is the S-VIDEO Chrominance line
The thin RED wire that connects three solder-points , connects two sensing-points to GND, When this two points are grounded – XBOX is cheated to believing that the original cable is connected, AND  SPDIF digital audio output is enabled

TRICK:  Usually – I would also need to connect the Y-GND & C-GND lines too.  XBOX is fortunately well build and uses common ground for all I/O lines, and therefore, I will use the ground from the XBOX  chassis instead..

Now , The connectors:

This is the inside of XBOX’s rear shielding plate.,

I drilled some holes, and inserted:
One female RCA connector for the SPDIF
One female S-VIDEO connector
Both connector’s shields are soldered to the XBOX’s chassis-shield (perfect ground source, XBOX motherboard is very well grounded at several points)

Finally , Connecting the connectors:

*1  =  S-Video connector.   There are two more pins beneath the two you see.  These pins are connected to ground.
*2  =  SPDIF, ground connected by soldering shield to the XBOX shield

HINT: You can see I removed the tin-fan-grills that  were between the fan and the plastic fan-grills.  I did it to improve air-flow.

A better alternative :

Using shielded cables might give higher quality – I did not see any difference, but here’s some pictures of this mod with shielded cables…

Sublight – Powerful SCUBA lamp.

Night diving and wreck diving requires a good torch. When I asked for advice on buying a torch, most divers I told me that “30Watts are great , 50Watts are insane , and anything above is not really necessary…”

If it’s worth doing, it’s worth overdoing.  I started with interpreting what they said , It sounded to me like this: “30Watts are OK , I have it because I could not afford the 50Watts , anything over 50Watts is what I would like to have”

So… what I “needed” was :

  • 225Watts … (3 x75Watt bulbs)  
  • battery time of at least two hour at reasonably high intensity…
  • Variable intensity
  • >20Khz PWM (Pulse Width Modulation) to keep high efficiency and no noise.
  • Internal 28Volt DC-DC converter to improve efficiency of Power MOSFET’s .
  • Multiple bulbs (3), just in case one dies – there are still two left.
  • Voltage monitoring.
  • No disassembly required for charging.
  • Nice software with SOS and maybe a bottom-timer.
  • Self adjusting intensity (not implemented yet)
  • Low battery warning and battery capacity prediction. (not done yet)


So , the project resulted in:
Acrylics pipes with 22mm acrylics ends , with O-rings , 4Mhz RISC Microprocessor that works at 4-5 volts , 28Volt DC-DC pump , 2 optically isolated PWM outputs that uses the 28volts to control 50Ampére low-drop power MOS-FET’s so fast that the MOSFET’s does not require any cooling as they “never” are in linear state. A 2×16 Character LCD display had to be added.

There are no moving parts, the 3 buttons and on/off are magnetically controlled and does not represent a weak point (or should I say leak point ?)  


here is the battery case : two 12Volt 6,5Ah batteries in parallel gives 13Ah ! (could be 2×7.2Ah , but I 6.5Ah was all I had).

Here is the torch ,

the display is showing voltage and intensity. as soon one bulb is 100% on , the other 2 starts helping , that’s to distribute the bulb-burn-time so their life length will be different. those are 3x50Watts “Osram Decostar” (1×10º , and 2×24º)  halogen bulbs ,just because I did not got any 75Watts , of course , the electronics will handle 3x75W (225Watt)

The LCD display is back-lit , (green/blue) , and looks very nice under water. Now booting …


because of the massive intensity of the light , the camera could not do better , the LCD is invisible , It’s normal daylight in the room but “seeing” this bright light source , the camera made this picture so dark.


The Freeware

The design/circuit  should always be treated as freeware, you might build as many as you like , even for your friends.

The author (me) must always be credited as the author.

The compiled program is here. , It is possible to buy preprogrammed controller from me.

The schematics: (right click the picture below and “save target as”)

A little description , it should be everything you need to know:

  • U$3 is the LCD connector , any HD44780 compatible LCD goes , at least 2×16  characters.
  • PADLAMP1 is the pad (output) for lamp1 , padlamp23 is is for lamp 2and3
  • JP2 is the switch/button connector
  • use IRFZ44 or better power MOSFET (BUZ 11 is used on schematics by accident) – they are pin-compatible.


Q: Do you have the container plans ?
A: No ,I just found some material that would fit the batteries worked on it.

Q: Is there a PCB layout ?
A: Yes , I designed a two layer PCB ,but never etched it.

Q: Where did you found the O-Rings you needed ?
A: A hardware store sold them as meter-ware with a special glue, then I made the O-rings I needed.

Modifying E-Dimensional ED-Glasses (3d glasses)

This will void your warranty !

This picture shows the two dongles that are necessary needed , the big one is the controller , with infrared connector (for wireless glasses) & the other connector for wired glasses.  This controller needs +5Volt at pin #9 in order to work.

Some graphic adapters deliver +5 volt @ pin#9 , Nvidia’s reference-design based adapters does not. you will also need external +5volt if you want to use the stereo glasses on/after a KVM switch or with an extension cable.

This is when you need the power adapter , the smaller one , it’s gutted on this picture , but it’s just a PS2 keyboard male+female (pass thru) adapter that connects between the PS2 port an keyboard in order to leech some power , and then deliver it to pin #9 in the smaller VGA-VGA (DSUB15) dongle.


I thought that 2 adapters were one too much , so I chopped off the PS2/PS2 connector cable from the small dongle and found that both wires inside were connected together to +5volt (the bigger dongle is already connected to GND by the shield , and R,G,B-ground.

Then I drilled a hole in the dongle for the cable (can be seen on both pictures)


The black wire with the red shrink wrap and red wire in  center is the one , it goes straight for the second idle drilled wire-pad on the dongle’s board.

+5 Volt delivered , and only one dongle needed – less cable macaroni.

I like the product , it’s one of those gadget’s you can buy and NOT regret it the day after    – the dongle is of high quality and does NOT cause poor picture quality at high resolution/refresh rate , I just removed it for a cleaner setup.

You can also use USB connector to get the +5v .


E-D Glasses is trademark of

Extra fan sensors for Motherboard Monitor

how to add 4..16 extra tachometers to your computer

Motherboard Monitor by Alexander van Kaam is a great freeware that uses hardware monitoring chips found on most Pentium and all newer motherboards. MBM will detect and use the circuit described below.

Some motherboards have 4 monitored fan connectors ,others have only 2. They all have one thing in common: the SMBus.

Want to add 4, 8, 12  or 16 more fan sensors ?

One of my computers is a fulltower with 14 harddrives, 12port hardware RAID controller , SCSI adapter and is cooled by 5 fans in the cabinet + one on CPU , plus 2 in PSU and 2 in drive cage.

So I needed to to monitor more fans.
I choose the MAX6651 16 pin QSOP IC. (datasheet)

You can get one at
MAX6651 offers 4 fan monitors (tachometer), and five programmable I/O ports.and voltage control that could be used to control fan speed.


Resistors 10K

Please add a 10nF capacitor between GND and VCC near the chip.

ADD is the pin that sets the IC’s SMBUS address, there can be up to four MAX6651’s on the same bus and the address is set by:
-ADD Connected to GND
-ADD Connected to VCC (+5V)
-ADD Not Connected (floating)
-ADD Connected to GND using a 10K resistor.

SMBus Connector:

Motherboards SMBus connector is 5-pin and is configured like this:
2-(not used)

Most decent motherboards have such connector, if you cannot find it, or your motherboard do not have it, thengo to my “locating SMBUS” page for instructions.


Some additional info from the author of MBM:

The MAX6651 is a sensor chip only for fan readout, this sensor chip is not automatically detected by MBM because it has no device ID and it can be located on an address which a normal sensor chip uses, so if I where to auto-detect it many users would suddenly get this sensor chip in their fan list while they don’t even have it

Edit the MBM 5.ini file and find the [ADVANCED] section, add the line MAX6651=1 this will make MBM scan for it.

Please understand that the fan divider on this sensor chip counts for ALL fans and thus should be set the same for all the MAX6651’s of 1 chip found. The last one MBM sets when starting up is the one that will overrule all others


Fan 1 : MAX6651-1-1 : divider 2
Fan 2 : MAX6651-1-1 : divider 4
Fan 2 : MAX6651-1-1 : divider 8
Fan 4 : MAX6651-1-1 : divider 4

for all fans MBM will set the divider to 4 since Fan 4 has it at 4.

The challenge….

…Is to connect the small QSOP package MAX6651 comes in.

You should be happy MAX6651 is so small , with that little mass it picks up temperature changes really quick (local sensor in huge packages is always sluggish)

So all you have to do , is connect those pins , each pin is 0.25mm wide, and there is one pin each 0.6 mm.
That is : “on less than 5mm there is 8 pins to solder”.

You need a soldering iron with a small tip.

SMBus uses only weak (20mA) open collector outputs. It’s not possible to destroy I2C or SMBus by short Data and/or Clock to GND or VCC or to each other.

The easy way….

You can order a prototype QSOP PCB (*) that have large terminals and are easy to work with .

*Thanks goes to Brian Macomber for providing the link.

Some Pictures….

just a test computer – observe the “Fan 4…..Fan 7”

The black 4-pin connector is the “floppy power” connector – it’s there to provide power (+12volt) to the fans.
The double green connector is the SMBUS connector that goes to the motherboard – there are two of them (above each other) to allow chaining of more SMBUS devices , like even more fan sensors or temperature sensors.



Q: how can I make a fanbus that is able to control the fan speed/(voltage) ?
A: The MAX6651 have several outputs, but only one is “almost” suitable for controlling speed. To be able to smoothly control the voltage to each fan, a simple D/A output is not enough.


Additional Info/thnx:

Per Ullman – shows you here how he build this project by connecting to the RAM DIMM sockets, rather than soldering on the DIMM’S.

 Thanks to:

Alexander van Kaam – not only for MBM, but also for quick help and additional info.

Adding extra temperature sensors for MBM

How to connect more temperature sensors to Motherboard Monitor

Motherboard Monitor by Alexander van Kaam is a great freeware that uses hardware monitoring chips found on many Pentium and all newer motherboards. MBM will automatically detect and use the circuit described below.

Some motherboards have 3 external  temperature sensors ,other have 3 internal.
Some can monitor negative voltages , other does not. They all have one thing in common : the SMBus.

Want to add 5 , 10 or 45 more temperature sensors ?

I am using water cooling and “needed” more than my 3 temperature sensors (as one is on motherboard and the two others monitors the two CPUs) , after looking into the wide sensor support MBM offers I decided to try to attach another chip to the SMBus (Intel’s version of Philips’s I2C multimaster bus).

 MAX1668 16 pin QSOP IC. (datasheet)


You can get one at
The 1668 offers one local (on chip)  sensor and 4 diode-coupled-transistor sensors.

Transistor-sensors is what you want , a little more work , but more accurate , and they already exists in CPU’s , GPU’s and other IC’s with internal sensor.

The schematic is very easy , and needs few external components.

(*)=  2200pF capacitors –not needed if you use twisted pair wires.
(*)=  +.1uF capacitor – used for decoupling.
(*)=  200Ohm resistor – can be omitted (just use a wire instead) as you use only 5volt (SMBus)
(*)=  10K resistor –not needed, as you are not using ALERT output.

The sensors , (transistors) can be BC547 with basis connected to collector. they work only when connected correctly , there is no risk to damage anything if reverse-connected, the sensor will not work until corrected..
BC547 is a very old , cheap ,  and small transistor , and it’s body volume can be reduced to less than half with a Dremel-tool. (the copper/silicone part is really small)  There is no need to use any expensive transistors , all that really matters is that it’s a silicone (not germanium) transistor , and not a darlington coupled one.



Each MAX1668 have an 7 bit address that is unique to this SMBUS device, and no other similar device will have. The 3 LSB (least significant bits) of this adress can be changed by ADD0 and ADD1 pins.

If you want to have more than one MAX1668 on the SMBUS, each of them needs and unique address.

The table below shows the 9 possible configurations, and where to connect ADD0 and ADD1 pins:

GND Floating
Floating GND
Floating Floating
Floating VCC
VCC Floating

(Floating means “not connected”)

  …YES , It means you can have nine MAX1668 on the same SMBus at the same time with no problems , just make sure each have it’s own unique address. Just choose an address , MBM will detect any.

Any unused sensor inputs should be shorted (to prevent floating) , and shorting one tells the chip that sensor is not in use.

SMBus Connector:

Motherboards SMBus connector is 5-pin and is configured like this:
2-(not used)

Most decent motherboards have such connector, if you cannot find it, or your motherboard do not have it, thengo to my “locating SMBUS” page for instructions.

The challenge….

…Is to connect the small QSOP package MAX1668 comes in.

You should be happy MAX1668 is so small , with that little body it picks up temperature changes really quick (local sensor in huge packages is always sluggish)

So all you have to do , is connect those pins , each pin is 0.25mm wide, and there is one pin each 0.6 mm.
That is : “on less than 5mm there is 8 pins to solder”.

SMBus uses only weak (20mA) open collector outputs. Theoretically it’s impossible to destroy I2C or SMBus by short Data and/or Clock to GND or VCC or to each other.

The easy way….

You can order a prototype QSOP PCB (*) that have large terminals and are easy to work with .. or you might look for it at  , if you get such pcb , then just place the QSOP package on the PCB and heat up the terminals , no soldering needed.

*Thanks goes to Brian Macomber for providing the link.

Some Pictures….

…This is how mine MAX1668 board looks , the chip is mounted on a DIL16 socket, the 8 pins to the left are 4 connectors  for external sensors (you can see they are color-coded) , the last one has a jumper , a jumper instead of a sensor tells the chip that this input is not used , and it returns 0°C.

This is one of the “sensors” , a modified BC547 transistor , as you see it’s less than half size of a normal BC547 , I’ve made even smaller ones now. The transistors should be “diode-coupled” – it means their basis and collector is shorted.  One wire goes to the basis+collector , the other to emitter.


This picture shows the size of MAX1668 compared to some known objects , (BC547 transistor and a jumper)

“Air” – is the local on-chip sensor
“Nvidia GPU” is a transistor-sensor on the back side of PCB where the GPU is.
“Water” is usually water temperature , , showing maximum temp , because it’s disconnected to demonstrate what you see before sensor is correctly connected

Thanks to:

-Antonio , for reporting an error on this page  , and helping with a fix.
-Chris, for grammar check.

-Lee Hollis – for showing people how he accomplished this project

-Andreas Lenz – for showing people how he did it, in German

PainmakerLCD 2

Worlds most advanced paintball marker controller. (back in’97)

New electronics for Brass Eagle’s Rainmaker

-who says the standard Rainmaker must be ugly-grey  – here it is in  black(picture taken with flash)

(I do not sell them anymore – sorry)

This is what you get :
-PainmakerLCD board
-Better trigger switch , (much tighter)
-The optocoupler if you want to use the  Revolution-Starter option
-Schematics you might need.
-Shipping to anywhere on Earth

Those were sold for US$ 230.


Some facts :

  • – all electronics are inside the fore-grip , on two dual-sided PCB’s with a “bus” in-between
  • – CPU is a  20Mhz RISC processor , with 8KB Flash EEPROM  .
  • – The Source code (ver 1.0) were 3328 lines of pure assembly. (takes 48 A4 pages when printed)
  • – All settings / preferences are saved in EEPROM ,… no battery is needed to keep settings.
  • – All menus / functions are controlled by only three buttons .
  • – Electronic Safety is on when in any configuration menu. or reloading (loader lid open)
  • – It’s powered by one 9V Ni-Mh battery inside the grip , but can also take 12Volts or more.
  • – It have both a high-intensity LED and high-frequency beep (hard to localize the sound , HF sound does not travel as far as lower freq. do) , beeping  is  used for warnings/alarms/ button-confirmation + +


Features & Menus:

It all starts with Intro …


(Ready For Action: Totally fired 0015 , this round 0000 , LFT(left in loader 188 balls))

(This is the playing screen)

This is how the LCD looks like during a game. There are two independent counters that can be reset when you like , and can be saved to EEPROM and loaded at next game.


Load/Save Configuration , Painmaker LCD loads all previously saved settings at each boot, if you then make any changes they will not be saved until you save them , on the other hand , you can make some changes you are not happy with , and just load the previous  (takes only two button-presses to do that.)


(After 278 balls are fired the last round (since last RND reset), totally 278 this “day” (since last TOT reset) , and there is 13 left in loader) so the LED is lit as a warning (because warning is on (in this case) if there are <=25balls left)

(This is the playing screen)

This is ho

w the LCD looks like during a game


The loader detected that the loader lid is open ,(reloading) the display is showing this , until the loader is closed , safety is on.  , the LED is turned off.


Loader is closed , the result of the above calculation (balls left + balls in a pouch) is 116.  (This is the playing screen)


Reset menu : allows to reset total counter , and/or round counter  “-” is left button “+” is right button


Menu : Battery – Shows battery voltage ,+/- 0.01 volt ,( it’s calibrated with a Fluke.)

this is updated so fast ,  that voltage changes are “animated” on the LCD (when 46 changes to 45 both “6” and “5” are showing because the 10bit DAC cannot decide the LSB        very cool.


Low Battery Warning Menu : … user can decide when the low-battery warning (audio) should be activated, (the minimum working voltage is different for Ni-Mh , Ni-Cd & Alkaline batteries.   (+/- buttons increase/decrease this value , holding down “+” increases value fast , holding down “-” decreases value fast)

a “beep” sounds every idle 2 sec if voltage is low


If the battery is low , It’s also on the main screen…


Temperature :  a precalibrated to 0.5° C state-of-the-art IC is measuring the temperature , and sending the results serially to the CPU  ,     It’s not like the “AngelLCD” thermometer        , but a really professional (industrial) thermometer , calibrated to +/- 0,5°C .      If you live in Norway (like me) and play when it’s about 10°C     , it might be cool to know how cold it is , as the paint starts breaking really easy at that low temperatures . It might be useful at high temperatures too.

added Fahrenheit degrees , at first I wanted to calculate it , but it’s pretty difficult because of the decimals needed ,  , so I use a lookup-table , to save space the table have 60 entries , 1..60 °C  , so the Centigrade has higher resolution (0.5deg) and the Fahrenheit temperature is the same for 25°C and 25.5°C.


Configure menu is where settings like burst-size and loader capacity is set in “setup” part , and burst-on/off , fullauto and other are under “modes”  , go to left or right to continue setup from here.

Loader capacity presets the maximum Loader capacity … (+/- buttons increase/decrease this value)

188 is the space in a Revolution + it’s neck.

Pouch capacity must be known, (to add right amount of balls when loading) … (“+”/”-” buttons increase/decrease this value , holding down “+” increases value fast , holding down “-” decreases value fast)

Here is the low ammo warning configuration , it’s now set to warn me when 25 balls are left (“+”/”-” buttons increase/decrease this value , holding down “+” increases fast , holding down “-” decreases fast)


Tournament-Lock    This menu will ONLY appear if the Tournament-Lock is ON  and then NONE of the menus below will show. Causing the last selected configuration being used without any way to change it during game.

This is THE BEST Tournament-Lock feature because :  It will let me not only lock-out the coolest features , (like any Tournament-Lock does)  , but It allows to keep any settings , and only restrict changes.    Like : I’m will play in a Scenario-Game (Command & Conquer) which allows any fire-mode up to 9bps , even fully automatic  . So I can choose any mode I like , and still restrict myself from being able too choose 13bps . by selecting Tournament-Lock when rebooting  ,  , and a battery-change does NOT affect the Lock’s state.

The only way to toggle this selection is to reboot , while holding all 3 menu-buttons (beeping) depressed in about 2 seconds (during the boot & intro sequence) which is  , needless to say , not possible during the game.  (playing with battery & beeping 2 seconds will catch referees attention.) m and the process would need to be undone at end of game.

the display also shows that Tournament-Lock is active during the game , (unless when that space is used to tell important things like Low-Battery) , anyway the first “Tournament Lock is On” can be reproduced.

Dwell Adjust : 1…30 ms in 1ms steps .

  no rainmaker can shoot at speeds like 15bps ,because it will not have time enough to feed each ball , only the balls that quickly gets into place.   this is because of the low pressure controlled ram needs a minimum of time to cycle the mechanism . and at higher rate-of-fire there is very little time to feed next ball.    When this time is too long , time is wasted , precious time that could be used to feed ball… (any default configuration on any controller board  waste some time)   on the other hand ,      When this time is too short , The rainmaker will have a significant blowback , (because it’ll open the “chamber” when there is still very high pressure in the barrel) , of if this time is way-to-short , it will not fire at all , (the ram is reversed before it’s in hammer-release position)

So , this value should be set as low as possible , allowing normal function ,  this will extend the ball-loading-time.   This setting does NOT influence the rate-of-fire in any way, each ms set here is compensated for.

The optimal value of this setting will vary from rainmaker to rainmaker , because the time delay needed is dependent on : low-pressure-spring , ram , and hammer spring.

Also , having the optimal setting will save battery , the 9volt battery works pretty hard when it opens the MAC valve.  Because of the way PainmakerLCD is constructed it uses a higher voltage to control the Power-MOS-FET that opens the 6volt valve.  This gives a impressive raise-time and very “strict” MAC-valve movement.   , (anyway use Ni-Cd rechargeable battery)

To make the adjustment easier to try out , There are 2 Dwell settings that can be programmed , and then toggled.


Configuration of  “burst” or “family” mode      (“+”/”-” buttons increase/decrease this value , holding down “+” increases fast , holding down “-” decreases fast)


BurstStop = (On/Off) let’s user choose if a burst should be interrupted when trigger released , or not.



AutoBurst = (On/Off) , Similar to AutoRepeat , if on , burst repeats with a brief pause in between (until trigger released) , a three ball burst sounds like “bang-bang-bang….bang-bang-bang….bang-bang-bang….”


Autorepeat :  whatever the fire mode is (normal/burst/turbo) , when trigger is held down 250ms (0.25sec) , the Painmaker switches to fully automatic until trigger is released , good for bad situations   (and then returns to the mode it was in before) ,  (pressing “+” is “ON” , pressing “-” is “OFF”)


Burst: turns on/off the burst/family mode , which can be set to anything between 2 and 255 balls            (pressing “+” is “ON” , pressing “-” is “OFF”)


Fully-automatic : turns on/off the ammo-wasting mode.        (pressing “+” is “ON” , pressing “-” is “OFF”)

Turbo Mode menu : turns on/off the turbo mode.        (pressing “+” is “ON” , pressing “-” is “OFF”)


Fire rate , applies to all fire-modes and can be programmed to anything between 6.5 and 15** balls/s in 0.5rounds/s increments  (“+”/”-” buttons increase/decrease this value one step each click)) this setting limits the fire rate in ANY selected mode. It applies to all fire modes.

**There is no gravity-loader that will provide more than 13balls/second continuously (more than 4 shots), my tests gave me some “blanks” in between shots.  There are many things that will set the  maximum fire-rate you can achieve :  Loader, Dwell -(shorter is better) ,Low-Pressure system’s pressure (a little higher pressure will move bolt faster) , Bolt , (heavy bolt will move slower) +.

I made the selection go to 15bps in 0.5bps steps to allow everybody experiment and find your own maximum setting , my calculations (of recorded audio form Rainmaker) makes me believe that 15bps is possible with forced feed or a longer vertical feed , (if the balls are “falling”  faster into chamber there won’t be blanks) , 10 or 10.5 is the maximum of what my revolution loader can deliver continuously.


Backlit sets the intensity of the backlit when in menu mode , (backlit is always of in game mode) – 0 means off , 255 = max intensity


Those three menu-buttons (“+” ,  “Select” , “-“)      and the mini-jack connector to the Revolution-Loader


Battery is now inside the grip

… but a higher-capacity battery is recommended for trouble free , long play , go see the “PainmakerLCD Power”  page..



(Revolution-Loader mod.)

the button that detects when the lid is open , and the high-intensity-LED that’s used as a warning

button & LED in place , and also the original Revolution-loader electronics.

closed revolution-loader , with the mini-jack connector

difficult to photograph , but it’s the high intensity almost LED blending the camera to tell the ammo is low



  • Q: Is it an ADD-ON or what ?
  • A: It’s a complete replacement of ANY wires/electronics you might find inside your Rainmaker. or any compatible marker)


  • Q: Can you make it fit inside gripframe ?
  • A: ….technically yes , but not using the display I’ve programmed for (it’s too big) , I would also have to order some professional PCB’s made for  SMD (SurfaceMountedDevice) components. the size is as it is, because I did built it to be technically perfect , like : the PowerMOSFET controlling the valve is totally isolated from the CPU , using a optocoupler. , all this stuff takes some space u know.     , so…. It can fit inside , but will need a smaller display and a new PCB  , ….today , only the earlier project , the Painmaker (noLCD) can fit inside .. it has much common functionality , fire-modes/autorepeat  , on the other hand , a display inside grip us useless during play (may have little information and take some time too read)   , while when using this big LCD you can read it all very quickly by only turning the marker.


  • Q: Is it only for Rainmaker or will it fit any marker.?
  • A: It will work on ANY marker , the trigger input can handle both optical (semiconductor)) and mechanical-switch triggers , and the Valve/Solenoid output is very powerful , and can handle whatever load you need , the PowerMOSFET is driven by a higher voltage than it switches , it means the MOSFET is switching really FAST and powerful (very low internal resistance and low rise-time) NO other controller boards for any paintgun does this , as it requires a higher voltage than the CPU works at and thus a electrical isolation between PowerMOSFET and CPU  … The whole thing needs power supply between 7…24Volts.