From Camp_2015_Wiki
Jump to: navigation, search

Description Analysis, reverse engineering and innovation of sex toys for the internet of sexytimes
Has website IRC: hackint Channel: #teledildonics "IRC" has not been listed as valid URI scheme.
Persons working on Team Teledildonics
Self-organized sessions
Tags teledildonics, cybersex, massage, sex toy hacking, hardware, electronics, software, rad1o, cryptography, security, privacy, networking, social, augmented reality, music, bitbanging, screw-it-yourself, arduino
Other projects... ... further results


Artistic impression of the project

Teledildonics is probably the best term for our area of research into remotely controlled sex toys such as dildos. Kyle Machulis (aka qDot) has been prolific in the documenting of and commenting on the first steps that have been taken so far in this field. While his excellent opendildonics wiki has sadly been down for a while, he posts regular updates on the state of the art on his blog, MetaFetish. I think this is the best introduction to the topic, because Wikipedia seems to think it's all about bringing people to orgasm.

Beyond this point it is assumed you accept the inherent lewdness of this topic.


(Trans)gender emulation

During our workshop at the camp we were humbled to be approached by representatives from the LGBT(QQIAAP) community who brought it to our attention that there are some severe shortcomings in the way current prosthetics for female-to-male transgenders can emulate a pleasurable experience of penetration that is comparable to that of cis males.

After we all recovered from learning this shocking bit of information, the participants unanimously agreed this is a sexual injustice that needs fixing ASAP. Because we feel so strongly about this we are considering giving it special attention and even priority over other projects for now.

This is also a very challenging, multi-disciplinary project and we feel overwhelmed. Luckily our small community is quickly growing with supporters that have applicable skills in at least the technical backgrounds such as hardware/software that we as technologists are familiar with. As thrilling as this response has been, we feel we must do some more research and seek out expert advice from other people in related fields before we continue with development. Sexologists, neuroscientists and people familiar with sex reassignment are high on our list of people we'd also like to actively involve in the project.

We will keep you posted.

Hacking off-the-shelf sex toys: Wireless massage eggs

These remote control wireless massage eggs are somewhat ubiquitous as sex toys that come in minor variations, they are sold around the internet and in local sex shops. We sold over 50 at camp for the bulk price plus shipping expenses, but are now out of the sex toy retail business until further notice. If you would like to order your own, the cheapest single item deals appear to be at AliExpress for about 2.50 Euro per set. Beware of sellers with low feedback scores and look out for sales. Also be aware of the difference between 'items' and 'sets' and the sneaky/subtle way it gets exploited in ads for these products.

These seem legit:

As you can see there are variations in features and design, but the eggs are mechanically and electronically the same as far as we know. The number of vibration patterns is defined by the software.

Radio protocol

The radios are tuned to 433.92 MHz, the modulation is simply ASK/OOK (amplitude modulation) and the data rate is 600 baud. There are three commands on the remote, encoded with Non-Return-to-Zero (NRZ) or 'raw' coding. The commands are as follows (highest, leftmost bit transmitted first):

 Command prefix: 0xf1145
 Step up/on:     either 0x511115 or 0x454511 or 0x514451
 Step down:      either 0x444455 or 0x515511 or 0x151445 or 0x445151
 Max power/off:  either 0x544445 or 0x551111

The commands are normally transmitted 8 times with an interval of 0.72 ms (720 us) to account for bad reception, and for the next same button press an alternate command code will be sent.

Hardware analysis

Wireless massage egg PCB
The PCB inside the egg

Disassembly of the egg is fairly easy, once you've carefully removed and slid down the rubber plug that keeps the antenna wire water proofed (otherwise you might snap it off, which is also not a big deal). It's probably easiest for later re-assembly if you don't take it off the wire completely. Once you have enough of the wire cleared and moving freely, you can simply slide the battery/motor enclosure out of the egg part and access the tiny PCB on top. The pinning of the MCU in the little SOIC-8-N package is as follows:

    VCC 1  8 GND
 UHF IN 2  7 GND
    GND 4  5 GND

We think, purely by making an educated guess from how the MCU is wired, the chip might be a PIC12F675. Any help with dumping or reflashing of these chips would be greatly appreciated. We are not sure how they are programmed in-circuit yet.


Is now all hosted at [4], including an Arduino remote control sketch and GRC sketches that will work with the hackRF/rad1o badge (or other SDRs) - Thanks to Ikarus for adding the GNURadio TX control.



How about putting our own PCB inside off-the-shelf vibrators?

  • Cooler connectivity (BT/WLAN/etc)
  • Sensors!
  • Overdrive motors!

Sensors (internal)

  • Heartbeat
  • Accelerometer/magnetometer
  • Temperature sensor

Sensors (external)

  • (Thermal) camera
  • Sound sensor
  • EEG


  • Draw massage patterns as waveforms
  • Music-synced massage (WIP)
  • Haptic feedback for movies/music/games
  • Better security (easy :))
  • Heuristics on use/response
  • Self-learning algorithms to improve massage based on sensor feedback
  • Integration into innovative sexy mobile/social apps and (VR) games for augmented reality
  • Write plugin modules for Buttplug
  • vStroker-enabled 1-track Frets on Fire (cf. cock hero videos)
  • HTML5 Gamepad interface compatibility for easy installation-free javascript/web2.0/webrtc control


  • Leakage-resistant cryptographic solutions for the secure communication of mutual kinks. This problem can be classified as Private Set Intersection, and luckily appears to have been tackled in the academic sphere. In other words we can build this technology on existing public research. We've drafted a (novelty) proof-of-concept implementation.

Share your ideas

Feel free to add your own suggestions to this section or on our Talk page!

Available Hardware

This section used to contain a list of available hardware and claims to buy it from us. Camp was as chaotic as it should be so if you somehow did not get what you wanted during the confusion, please get in touch with us on IRC and we can sort you out before our next event.

Private Hardware

We want to work on these devices, but you can't buy them from us. Feel free to bring your own devices and add them to the list!

  • WeVibe III : One-Button-remote, probably doesn't offer too many options, should still reverse protocol. Toy itself is silicone-coated for waterproofing, don't want to open it. (Appears to operate in the 2.4GHz band according to the FCC ID.)
  • vStroker : 3d axis readout, contains a TI CC2510F32 next to an unpopulated SPI header, works with TI CC2500 USB controller using HID driver for wireless control, open source support for that in libvstroker
  • Mattel Mindflex toy : Should give us EEG-like sensor input when wired and hopefully at high speed too. Normally only sends filtered data over 2.4GHz radio supposedly similar to Bluetooth. Did not arrive before camp. :(
  • Hitachi Magic Wand (fake)
    • Q: is it battery or mains powered? Any equipment to PWM it, e.g. appropriately rated (solid-state) relays?
    • A: mains powered (110V). I'll hopefully manage to get to conrad before the camp to get a proper relay.
  • Nintendo Wii Nunchuck + breakout board with pin header : 3d axis readout + analog stick + trigger button, I2C
  • HMC5883L magnetometer modules : 3d axis readout, I2C


We got some (unexpected) media coverage from the Independent.

Our friends from the Crazy Cybersex Camp blogged about all the fun they had on cybersex-blog.