Reverse Engineering Lego Technic CyberMaster C2

[Toastie]

Some more findings others may have already figured out!

The 4-byte header behaves a bit weird - so far ;) 

1. For sure, the two "0x00" are just arbitrary numbers - any will work, tested. This seems to hint to some temporal check, the PIC does? This represents a 2x (1 start + 8 data + 1 parity + 1 stop bit) delay at 2400 Baud, if I am not mistaken, @BrickTronic is much better than I on this. 
2. The first byte may be FE or 3E - the same holds true for the fourth byte; they also can be both 3E. There may be other combinations that work. Have not checked any further, but again, this may hint to a temporal measurement, the PIC does. This needs close inspection of the bit train coming in, with some focus on MSB/LSB and slopes. 

When working with PICs and Baud rate timing, I did the same thing ages ago: Detect any kind of "slope", count-up some variable, check again for H/L after some time. If not matching correct Baud rate data pattern, ignore.

I love this kind of "tracing" ...

All the best
Thorsten 

 

[AndyInTheCloud]

I am new to the forum - but found this out of a desire to do exactly what Chris is wanting to do. I am also on a Mac, using a USBToSerial cable (https://www.amazon.com/dp/B07589ZF9X?ref_=ppx_hzsearch_conn_dt_b_fed_asin_title_1&th=1) and using DosBox-X to run Windows 95. With both the original Mindstorms software and Bricx I get both the tower and mobile unit flashing - but both software claiming the mobile unit is not talking back to the tower (or rather brick not found in the Bircx case). I have an IBM PS/2 Model 57SX (486) with an physical serial port running Windows 95 - I am going to try Bricx on tomorrow - will report back. I am really hoping my hardware is not broken - especially the mobile unit... 

Edited July 15, 2025 by AndyInTheCloud

[AndyInTheCloud]

Ok with an actual physical serial port on my IBM PS/2 57SX (486) running Windows 95, IE4, SHFolder and Bricx - it connects! This is with the same serial cable (original) I used with the USB2Serial adapter above on my Mac. Alas my IBM cannot run the Cybermaster software as its to slow (ironic). But this at least confirms in my case it was/is the USB2Serial adapter. I am currently consider this cable - as it claims to be a real RS232 adapter and outputs the correct voltages - https://www.amazon.co.uk/gp/product/B07Y33RHB2/ref=ox_sc_act_title_1?smid=AFEETNPD33C0Z&th=1 - thoughts?

Edited July 16, 2025 by AndyInTheCloud

[Toastie]

That seems to be a good one - although the other adapter you were actually using also sounded not too bad. I'd go for it - should it not work, you can use it for other troubleshooting purposes as it has these LEDs which will help a lot!

Good luck!

Best
Thorsten

[AndyInTheCloud]

Thanks for getting back to me - appreciated! Yeah the other one I was using was not working - I think I can try the second one and return it via Amazon if not. Will keep everyone posted - it would be good to get this thread populated with working vs non-working brands / chipsets. 

Just also busy repairing my 9v cables from the set! This is a great video btw - 

 

[Toastie]

Yeah, threads from @BatteryPoweredBricks are reference threads ...

On another thought: It may also be a "long way" from BricxCC via DosBox-X to the Mac hardware through a USB2Ser adapter to the RF tower talking to the PBrick in half duplex at 2400 Baud, 8 bit, odd parity ... could it be that on that long way some things may actually take a wrong turn?

We'll see. Very interesting!

Best
Thorsten

  

[Chris Hocking]

I'll also try get my hands on another/better RS232 adapter and see what I can uncover.

[BrickTronic]

Hello,

Sorry for repeating, but can you check voltages on DTR (Pin 4) and RTS (Pin 7) of Sub-D connector at RF-Tower ?

See Schematic
There is needed +12V on DTR and -12V on RTS

Jo

[AndyInTheCloud]

I just did a quick test (on an older mac - as alas my new mac took some water damage recently!) - also sad to say the adapter i linked above - is also not working. I need to break off now -but will be back when I have more time to test the voltages. And will also try to eliminate the user of DosBox - at least to do a basic connection test from the Mac itself. Thanks and back soon!

[AndyInTheCloud]

My hopes got lifted when I found this https://www.amazon.co.uk/dp/B00QUZY4UG?ref=ppx_yo2ov_dt_b_fed_asin_title&th=1 - with a feedback comment showing a scope displaying 12v! Alas nada again for me. Sorry folks. I just got my Mac Book Pro back after some damange and kinda reluctant to go probing connected devices for risk of shorts. Pretty frustrating. If those that have working adapters can share links/or make/models that might help - but for now I'll send these two back. 

[Toastie]

51 minutes ago, AndyInTheCloud said:

Pretty frustrating. If those that have working adapters can share links/or make/models that might help

Yeah, this is pretty frustrating. 

Is there a chance that you have access to a Win10/11 computer with USB ports, install BricxCC, put any of your USB2Ser adapters on COM1 ... 8 and then try to connect to the PBrick? The thing is, all my USB2Ser adapters (rated "stone age") work flawlessly on a DELL 7530 laptop/Win11-64bit machine. This way you can find out, whether the adapters are working ...

I absolutely don't know, but my gut feeling says: It is the Mac OS - DOSBox-X - Win95 - BricxCC - USB2Ser adapter - RF Tower pipeline that screws things up. And within this pipeline the Mac-OS - DOSBox-X - Win95 - BricxCC part. From your Win computer experiment, you know that the RF tower is working, the PBrick is working, the communication protocol is working.

Best
Thorsten

[AndyInTheCloud]

Yeah I just compiled nqc on my mac native and its borking opening the port even. But yes its good to know the Lego stuff works - thats a positive! :-) Alas I don't have other computers. 

[AndyInTheCloud]

Ok I did find an old Win7 Pentium laptop ...

It didn't run Cybermaster (grrh) - but it did run and connect to the brick via BricxCC - using... the very same USB2Serial adapter above!

So ....

1/ the cable, tower and brick work (confirmed via IBM PS/2 - alas 486 so does not run Cybermaster software, but slowly runs BricxCC)

2/ the USB2Serial adapter works (confirmed via Win7 machine) with the same cable, tower and brick above (alas no Cybermaster support)

3/ the USB2Serial adapter (s) seem not to work on Mac (in my case Mac Book Pro M4) - at all - even with a fresh build of ngc. 

I am putting things aside for now - maybe one day I'll find a small retro Pentiun PC with a real serial and have ago again! 

Hope all this helps someone avoid wasting time at least. 

:-) 

Edited July 23, 2025 by AndyInTheCloud

[Chris Hocking]

Legend, thanks for the update!

As per a previous post, I did try my Cybermaster on a PC, and whilst there was communication happening (i.e. lights flashing on the receiver) I couldn't get it to connect. I tried messing with lots of settings, and I wasn't able to get it working.

However, I'll try again at some point - and also try and hunt down the original Lego software to try that too.

[Toastie]

7 hours ago, Chris Hocking said:

I did try my Cybermaster on a PC, and whilst there was communication happening (i.e. lights flashing on the receiver) I couldn't get it to connect.

Hi Chris,

which software were you using to connect? As far as I can tell, BricxCC is a favorable way to do that.

Best
Thorsten

Edited July 24, 2025 by Toastie

[AndyInTheCloud]

8 hours ago, Chris Hocking said:

Legend, thanks for the update!

As per a previous post, I did try my Cybermaster on a PC, and whilst there was communication happening (i.e. lights flashing on the receiver) I couldn't get it to connect. I tried messing with lots of settings, and I wasn't able to get it working.

However, I'll try again at some point - and also try and hunt down the original Lego software to try that too.

Most welcome. The original Cybermaster ISO is on InternetArchive 

[Chris Hocking]

1 hour ago, Toastie said:

which software were you using to connect? As far as I can tell, BricxCC is a favorable way to do that.

 

I tried BricxCC test_release20120724 on Windows 11 Home (24H2).

I tried using COM3 and COM4 (one of my USB to RS232 adapters has two ports). I tried adjusting the settings as per HughC's suggestions too.

There was communication happening - both the transmitter and receiver were flashing away - which is something I've never seen before on my Mac.

[Toastie]

1 hour ago, Chris Hocking said:

There was communication happening - both the transmitter and receiver were flashing away

Ah, sorry, I believe you posted that already further above.

In this case, I'd try another single USB2Ser adapter. The one with the LEDs on it, @AndyInTheCloud found on Amazon, would be perfect, as then you can further check whether DTR and RTS are set appropriately by the adapter, as suggested by @BrickTronic.

As the PBrick was at least reacting to a 27 MHz RF carrier (otherwise it would not blink), this suggests that the RF tower TX -> PBrick RX link is "alive". But all further speculation (e.g., checking somehow the PBrick TX -> RF tower link) should be done after you tested another USB2Ser adapter. 

All the best
Thorsten   

 

[Chris Hocking]

Thanks! I've ordered the DriverGenius USB232A-E-C | 1-Port USB-C to Serial / RS232 (DB9) Adapter – for PLC Programming, Data Collection, Embedded Systems | Compatible with Windows 11, macOS 15 - so will see how that goes when it arrives.

[HughC]

Hello again all, I had a bit more of a play.

The tower doesn't seem to need +/- 12V levels to work. Measuring voltages on the USB to serial cable I was using earlier with no tower connected, TX and RTS were at -6.31 V, and DTR was at +7.01 V.

It also seems OK with 0 and 5 V. I now have a USB to serial adapter like this one talking to the Cybermaster from my Windows 7 laptop: https://www.keyestudio.com/products/ftdi-basic-program-downloader-usb-switch-ttl-ft232-with-the-fcc-certification-for-arduino

The tower does need a bit of extra electronics to work with that simple adapter though - the RX and TX levels need to be inverted. To do that, I've used a 4049 hex inverter on a breadboard. The RTS and DTR pins don't need to change - those set the levels of the RX pin coming back into the PC. With RTS at 0 V and DTR at 5 V, the levels into the 4049 are good enough. I tied RTS to ground and DTR to 5 V from the USB to serial converter. BricxCC happily talks to the brick with that wiring. (I would guess Lego used RTS and DTR this way to avoid needing to generate a voltage other than 5 V inside the tower? This way the PC that is receiving the data can set the voltage levels it wants to get?)

The brick doesn't respond without some initialisation - all it reacts to is ping (0x10). Sending the UnlockFirmware LASM instruction (0xA5, followed by "Do you byte, when I knock?") gets it responding to other commands - 51 05 for a beep. NQC's source code was helpful here, especially around lines 209 to 217 of RCX_Link.cpp, which calls a function at line 453 of RCX_Cmd.cpp to get the unlock code. The full packet to send for UnlockFirmware is

FE 00 00 FF AD 52 44 BB 6F 90 20 DF 79 86 6F 90 75 8A 20 DF 62 9D 79 86 74 8B 65 9A 2C D3 20 DF 77 88 68 97 65 9A 6E 91 20 DF 49 B6 20 DF 6B 94 6E 91 6F 90 63 9C 6B 94 3F C0 8D 72

(Or A5 rather than AD - it doesn't seem to matter).

Did you manage to try with the new cable @Chris Hocking?

(And that video by @BatteryPoweredBricks has been very helpful for fixing up many wires. If only light sensors were easier to open!)

[Toastie]

4 hours ago, HughC said:

The tower doesn't seem to need +/- 12V levels to work.

Well, I guess TLG actually adhered to the RS232 level definitions back then - as back then, things were rather "straight". So actually +/- 3V should do the trick (as per ANSI/EIA). Which is good to know! My USB2Ser adapters do generate voltage levels all over the place - and all do work with CM towers - but they never go below/above +3/-3V.

4 hours ago, HughC said:

The tower does need a bit of extra electronics to work with that simple adapter though - the RX and TX levels need to be inverted.

This is really strange - any chance to upload a schematic of your working circuit?

Best
Thorsten

 

 

[HughC]

14 hours ago, Toastie said:

Well, I guess TLG actually adhered to the RS232 level definitions back then - as back then, things were rather "straight". So actually +/- 3V should do the trick (as per ANSI/EIA). Which is good to know! My USB2Ser adapters do generate voltage levels all over the place - and all do work with CM towers - but they never go below/above +3/-3V.

This is really strange - any chance to upload a schematic of your working circuit?

Hi @Toastie, happy to share a thrown together schematic. It's pretty simple, an inverter on RX and TX and a lot of other stuff tied to +5V or ground.

 

[Toastie]

2 hours ago, HughC said:

happy to share a thrown together schematic

@HughC thank you very much! I believe that I now get it - the USB converter is USB2TTL, right? 

I am on vacation right now, but will check that out, when back home. 

Thanks again and all the best
Thorsten

[HughC]

1 hour ago, Toastie said:

@HughC thank you very much! I believe that I now get it - the USB converter is USB2TTL, right? 

I am on vacation right now, but will check that out, when back home.

Correct, it's the Keyestudio one which I think is pretty much a bare FT232RL. 5 V for idle, 0 V for active. Flipping those around to 0 V idle and 5 V active with the inverter seems close enough for the tower.

Enjoy your trip!