Reverse Engineering Lego Technic CyberMaster C2

BrickTronic · Friday at 09:54 AM

14 hours ago, AJB2K3 said:

Hay guys, did you get anywhere further with this?
I'm building a Blockly variant for the legacy Bricks and would like to get the cybermaster included.

...

Hello,

Cybermaster us an "Tower" with RS232 Interface to PC and 27MHz Radio Frequency Interface to Cybermaster

Pictures of the Tower :
http://www.brickshelf.com/cgi-bin/gallery.cgi?i=604134 & http://www.brickshelf.com/cgi-bin/gallery.cgi?i=604133

and further http://www.brickshelf.com/cgi-bin/gallery.php?f=66485

Schematic you can find https://fccid.io/document.php?id=23750

Note that RTS = -12V and DTR=+12V is used for GND -> 5V to RS232 Level shift

Programmable Prick	Baudrate	0-Bit	1-Bit
RCX 1.0 / 1.5 RCX 2.0	2.400Bd, Start- 8 Data-, Odd Parity- & Stop- Bit 4.800Bd, Start- 8 Data-, Odd Parity- & Stop- Bit	38kHz / 50% 76kHz / 25%	Light OFF Light OFF
Scout	2.400Bd, Start- 8 Data-, Odd Parity- & Stop- Bit	38kHz / 50%	Light OFF
Spybotic	4.800Bd, Start- 8 Data-, Odd Parity- & Stop- Bit	Light ON	Light OFF
Cybermaster	2.400Bd, Start- 8 Data-, Odd Parity- & Stop- Bit	AM 26,995MHz

Programmable Prick	Header		Remark
RCX	3 Byte	0x55 0xFF 0x00
Scout	3 Byte	0x55 0xFF 0x00
Spybotic	tbd	tbd
Cybermaster	4 Byte	0xFE 0x00 0x00 0xFF	Command to Cybermaster
Cybermaster	1 Byte	0xFF	Reply from Cybermaster

Programmable Prick	Command Frame
RCX	0x55 0xFF 0x00 Cmd Cmd D0 D0 .. Dn Dn Chk Chk
Scout	0x55 0xFF 0x00 Cmd Cmd D0 D0 .. Dn Dn Chk Chk
Spybotic	tbd
Cybermaster	0xFE 0x00 0x00 0xFF Cmd Cmd D0 D0 .. Dn Dn Chk Chk

Programmable Prick	Reply Frame
RCX	0x55 0xFF 0x00 Cmd Cmd D0 D0 .. Dn Dn Chk Chk
Scout	0x55 0xFF 0x00 Cmd Cmd D0 D0 .. Dn Dn Chk Chk
Spybotic	tbd
Cybermaster	0xFF Cmd Cmd D0 D0 .. Dn Dn Chk Chk

Jo

Chris Hocking · Saturday at 09:22 AM

Sorry for the lack of contact - things got busy!

I did end up getting a new RS232 adapter, but I haven't actually had a chance to try it out yet. Will give it another shot soon, and let you know!

AJB2K3 · 2026-02-08T05:39:09Z

I changed my adapter, moved back to raw python and sent

0xFE 0x00 0x00 0xFF

but got back

0x00

Before on the pl2303 adapter I was just getting

b\''

I cant find the opp/bytecodes in NQC, can someone send me the link to them please?

I've also loopback tested all my cables and they work, its just sorting out coms.

Edited yesterday at 06:16 AM by AJB2K3

BrickTronic · 2026-02-08T18:50:34Z

13 hours ago, AJB2K3 said:
I changed my adapter, moved back to raw python and sent
0xFE 0x00 0x00 0xFF
but got back
0x00
Before on the pl2303 adapter I was just getting
b\''
I cant find the opp/bytecodes in NQC, can someone send me the link to them please?

I've also loopback tested all my cables and they work, its just sorting out coms.

Hello,

Did you also send unlock after power-up and periodic "Alive" ?
And does you Toggle Command when sent miltiple time in sequence ?

3	9	13	17	23	29	34	39	45	51	57	62	68	74	80	86	92	98	104	109	115	120	126	132	138	144	150	156	162	167	173	178	184	190	196	202	208	214	220	226	232	237	243	248	254	259	265	271	277	283	289	295	301	306	312	318	324	329	335	341	347
0xFE	0x00	0x00	0xFF	0xA5	0x5A	0x44	0xBB	0x6F	0x90	0x20	0xDF	0x79	0x86	0x6F	0x90	0x75	0x8A	0x20	0xDF	0x62	0x9D	0x79	0x86	0x74	0x8B	0x65	0x9A	0x2C	0xD3	0x20	0xDF	0x77	0x88	0x68	0x97	0x65	0x9A	0x6E	0x91	0x20	0xDF	0x49	0xB6	0x20	0xDF	0x6B	0x94	0x6E	0x91	0x6F	0x90	0x63	0x9C	0x6B	0x94	0x3F	0xC0	0x85	0x7A
				#NV		D		o				y		o		u				b		y		t		e		,				w		h		e		n				I				k		n		o		c		k		?

3	9	14	20	25	31	37	43	49	55	61	67	72	78	83	89	94	100	105	111	117	123	129	135	140	146	152	158	164	170	176	182	187	193	199	205	211	217	223	229	234	240	245	251	257	263	269	275	280	286	292	298	303	309	315	320	326	331	337	342	348	354	360	365	371	376	382	388	393	399	404
0xFF	0x5A	0xA5	0x4A	0xB5	0x75	0x8A	0x73	0x8C	0x74	0x8B	0x20	0xDF	0x61	0x9E	0x20	0xDF	0x62	0x9D	0x69	0x96	0x74	0x8B	0x20	0xDF	0x6F	0x90	0x66	0x99	0x66	0x99	0x20	0xDF	0x74	0x8B	0x68	0x97	0x65	0x9A	0x20	0xDF	0x62	0x9D	0x6C	0x93	0x6F	0x90	0x63	0x9C	0x6B	0x94	0x21	0xDE	0xE8	0x17	0xFF	0x46	0xB9	0x46	0xB9	0xFF	0xEF	0x10	0xEF	0x10	0xFF	0xB5	0x4A	0xB5	0x4A
		#NV	J		u		s		t				a				b		i		t				o		f		f				t		h		e				b		l		o		c		k		!					177 Set power down delay (minutes)

																																																														231 Alive				66 Set sensor mode (sensor, code) where code=mode,slope

Documentation on available Opcodes are in the SDK Package available at Philo's Page (it is a selfextracting EXE-File) Inside this Zip-Container there is File RCX2 LASM byte codes.pdf in Folder .\L

EGOMindstormsSDK25.exe\\program files\LEGO\LEGO Mindstorms SDK\Doc\

Without Unlock Sequence after Cybermaster Power-On no communicatiion passible.
when Alive not received periodically, loss of communication (Time-Out -> Watch-Dog)

Jo

Edited 15 hours ago by BrickTronic
Add Hint

AJB2K3 · 2026-02-08T18:55:36Z

Hmm gemini is loosing patience with this now.

import serial
import time

PORT = '/dev/cu.usbserial-24110' # Update this to your port

def send_nqc_style(ser, channel, opcode, data=[]):
    # 1. Prepare Inner RF Data with Complements
    # Every byte (opcode, data, and inner sum) is followed by its NOT
    inner_raw = [opcode] + data
    inner_sum = sum(inner_raw) & 0xFF
    
    rf_body = []
    for b in inner_raw + [inner_sum]:
        rf_body.append(b)
        rf_body.append(b ^ 0xFF) # Complement
        
    # 2. Add Channel (usually not complemented)
    full_payload = [channel] + rf_body
    
    # 3. Calculate Outer Tower Checksum
    # Tower logic: Sum includes the Length byte + the payload
    length_byte = len(full_payload)
    outer_sum = (length_byte + sum(full_payload)) & 0xFF
    
    # 4. Construct Final Frame
    packet = [0x02, length_byte] + full_payload + [outer_sum, 0x03]
    
    print(f"\nTX: {bytes(packet).hex(' ')}")
    ser.write(bytes(packet))
    
    time.sleep(0.6) # Required for RF turnaround
    
    if ser.in_waiting > 0:
        res = ser.read(ser.in_waiting)
        print(f"RX: {res.hex(' ')}")
        return res
    print("RX: [No Response - Brick didn't reply]")
    return None

try:
    ser = serial.Serial(PORT, 2400, parity=serial.PARITY_ODD, timeout=2)
    
    # Critical: The CyberMaster often ignores commands unless a 
    # 'Keep Alive' or 'Link' has been established recently.
    print("--- Polling Battery (The 'NQC' Way) ---")
    # Expected TX for Opcode 0x10: 02 05 00 10 ef 10 ef fd 03
    send_nqc_style(ser, 0, 0x10)

    time.sleep(1)

    print("\n--- Sending Beep ---")
    # 0x51 is beep, 0x02 is the sound type
    send_nqc_style(ser, 0, 0x51, [0x02])

    ser.close()
except Exception as e:
    print(f"Error: {e}")

this python code causes the brick to flash in receiving but the function calls don't work.

Toastie · 2026-02-08T19:48:02Z

46 minutes ago, BrickTronic said:

Without Unlock Sequence after Cybermaster Power-On no communicatiion passible.
when Alive not received periodically, loss of communication (Time-Out -> Watch-Dog)

I saw exactly the same behavior: No unlocking, no communication (LEDs blinking or not is not any sign of logical communication. The tower LED blinks regardless which bytes are fed to it. Sometimes the CM brick's LED flashes, but no true communication.

My test for a known good CM brick: I use BricxCC to unlock the CM brick (this way, you get a visual confirmation in the IDE that "the link" is established, then end BricxCC, then use a terminal program on the same port, and then manually send commands for some time. I believe sending a command also resets the time-out counter on the CM brick.

52 minutes ago, BrickTronic said:

Toggle Command

Equally important: When sending, e.g., "beep" repeatedly, you need to flip the toggle bit each time. Or, just send another command; the next beep can then be identical to the first beep.

If that works, then I know that tower+CM brick are actually working.

Regards,
Thorsten

AJB2K3 · 2026-02-08T20:15:40Z

1 hour ago, BrickTronic said:

Hello,

Did you also send unlock after power-up and periodic "Alive" ?
And does you Toggle Command when sent miltiple time in sequence ?

3 9 13 17 23 29 34 39 45 51 57 62 68 74 80 86 92 98 104 109 115 120 126 132 138 144 150 156 162 167 173 178 184 190 196 202 208 214 220 226 232 237 243 248 254 259 265 271 277 283 289 295 301 306 312 318 324 329 335 341 347

0xFE 0x00 0x00 0xFF 0xA5 0x5A 0x44 0xBB 0x6F 0x90 0x20 0xDF 0x79 0x86 0x6F 0x90 0x75 0x8A 0x20 0xDF 0x62 0x9D 0x79 0x86 0x74 0x8B 0x65 0x9A 0x2C 0xD3 0x20 0xDF 0x77 0x88 0x68 0x97 0x65 0x9A 0x6E 0x91 0x20 0xDF 0x49 0xB6 0x20 0xDF 0x6B 0x94 0x6E 0x91 0x6F 0x90 0x63 0x9C 0x6B 0x94 0x3F 0xC0 0x85 0x7A

#NV D o y o u b y t e , w h e n I k n o c k ?

3 9 14 20 25 31 37 43 49 55 61 67 72 78 83 89 94 100 105 111 117 123 129 135 140 146 152 158 164 170 176 182 187 193 199 205 211 217 223 229 234 240 245 251 257 263 269 275 280 286 292 298 303 309 315 320 326 331 337 342 348 354 360 365 371 376 382 388 393 399 404

0xFF 0x5A 0xA5 0x4A 0xB5 0x75 0x8A 0x73 0x8C 0x74 0x8B 0x20 0xDF 0x61 0x9E 0x20 0xDF 0x62 0x9D 0x69 0x96 0x74 0x8B 0x20 0xDF 0x6F 0x90 0x66 0x99 0x66 0x99 0x20 0xDF 0x74 0x8B 0x68 0x97 0x65 0x9A 0x20 0xDF 0x62 0x9D 0x6C 0x93 0x6F 0x90 0x63 0x9C 0x6B 0x94 0x21 0xDE 0xE8 0x17 0xFF 0x46 0xB9 0x46 0xB9 0xFF 0xEF 0x10 0xEF 0x10 0xFF 0xB5 0x4A 0xB5 0x4A

#NV J u s t a b i t o f f t h e b l o c k ! 177 Set power down delay (minutes)

231 Alive 66 Set sensor mode (sensor, code) where code=mode,slope

Documentation on available Opcodes are in the SDK Package available at Philo's Page (it is a selfextracting EXE-File) Inside this Zip-Container there is File RCX2 LASM byte codes.pdf in Folder .\L

EGOMindstormsSDK25.exe\\program files\LEGO\LEGO Mindstorms SDK\Doc\

Without Unlock Sequence after Cybermaster Power-On no communicatiion passible.
when Alive not received periodically, loss of communication (Time-Out -> Watch-Dog)

Jo

I'm on OSX, cant extract .exe's.

Toastie · 2026-02-08T20:40:05Z

22 minutes ago, AJB2K3 said:

I'm on OSX, cant extract .exe's.

Would a zip file do? If so, here's a link to my universities cloud server - the file is the exe Jo referenced, stored as zip file:

https://uni-wuppertal.sciebo.de/s/ebemboGYrrimRWk

Best
Thorsten

AJB2K3 · 2026-02-09T07:36:28Z

10 hours ago, Toastie said:

Would a zip file do? If so, here's a link to my universities cloud server - the file is the exe Jo referenced, stored as zip file:

https://uni-wuppertal.sciebo.de/s/ebemboGYrrimRWk

Best
Thorsten

Thanks dude.

AJB2K3 · 2026-02-09T08:38:04Z

Update
Managed to get the Cybermaster brick's LED to flash with:

import serial
import time

PORT = ''

def sweep_channels(ser):
    # We use the Opcode 0x10 (Battery Poll) because it's proven to work.
    # We will try Channel 0 (A6), Channel 1 (A7), and Channel 2 (A8).
    # Math: Length(05) + Sync + Opcode(10) + Op_Comp(EF) + Opcode(10) + Op_Comp(EF)
    
    channels = {
        "Ch 0 (A6)": 0xA6,
        "Ch 1 (A7)": 0xA7,
        "Ch 2 (A8)": 0xA8
    }

    for name, sync in channels.items():
        # Calculating checksum: (Length + Sync + 10 + EF + 10 + EF)
        # Note: 10+EF = FF. So: 05 + Sync + FF + FF
        checksum = (0x05 + sync + 0xFF + 0xFF) & 0xFF
        
        packet = bytes([0x02, 0x05, sync, 0x10, 0xEF, 0x10, 0xEF, checksum, 0x03])
        
        print(f"--- Testing {name} ---")
        print(f"TX: {packet.hex(' ')}")
        
        ser.reset_input_buffer()
        ser.write(packet)
        time.sleep(0.5)
        
        if ser.in_waiting > 0:
            res = ser.read(ser.in_waiting).hex(' ')
            print(f"RX: {res}")
        else:
            print("RX: [Accepted]")
        
        time.sleep(1.0) # Gap to let the Brick reset

try:
    ser = serial.Serial(PORT, 2400, parity=serial.PARITY_ODD, timeout=2)
    sweep_channels(ser)
    ser.close()
except Exception as e:
    print(f"Error: {e}")

Edited 20 minutes ago by AJB2K3

Toastie · 2026-02-09T09:38:41Z

59 minutes ago, AJB2K3 said:

Cybermaster brick to flash

What does that mean? Flashing as it turns its LED on and off (but that is it), or actually executing a command?

Best
Thorsten

AJB2K3 · 2026-02-09T10:01:26Z

22 minutes ago, Toastie said:

What does that mean? Flashing as it turns its LED on and off (but that is it), or actually executing a command?

Best
Thorsten

When the green light flashes it means its received the transmission.

Sign In

Reverse Engineering Lego Technic CyberMaster C2

Recommended Posts

BrickTronic

Chris Hocking

AJB2K3

BrickTronic

AJB2K3

Toastie

AJB2K3

Toastie

AJB2K3

AJB2K3

Toastie

AJB2K3

Join the conversation

Recently Browsing 1 member

Portal

Forums

Info & General

Themes

Special Interests

Community

Activity

Info

Social Media