Micah Scott replaced LELO's laggy Lyla remote with an open-source sonar controller

Micah Scott bought LELO's Lyla, a rechargeable, waterproof remote-controlled vibrator she otherwise liked. The radio range was lackluster, the controls laggy and awkward, and the tilt-based accelerometer input never felt right. The blunt options were to live with it, buy another toy, or crack open the vibrator; she decided the toy itself was good and the remote was the problem, so she would replace only the remote.

To speak the toy's radio language she started at the FCC ID database, where internal photos showed an MSP430 microcontroller and a CC2500 2.4 GHz radio, chips with published datasheets. Instead of reading or reprogramming the original firmware, she opened a sacrificial remote, soldered test wires onto the SPI bus between the two chips, and captured the initialization sequence and packet format with a small board running as a sniffer. The findings were simple: no pairing, a hardcoded channel, and a motor-strength byte repeated in every packet, sent by the stock remote at a sluggish 9 Hz.

Her replacement remote used common parts: an Arduino, a CC2500 breakout board and an ultrasonic distance sensor. Distance scales to motor power, so moving a hand or body through the air in front of the sensor drives the vibrator with no buttons to learn. It transmits about ten times as often as the stock remote, buying responsiveness and noise tolerance, and because nothing is addressed, any vibrator in range responds. Instead of custom charging electronics, she gutted a $22, 3,200 mAh phone power bank that already held battery, charger and boost converter.

She modeled a 3D-printed enclosure in Blender and published the Arduino library, firmware and enclosure files, and the finished device felt less like an appliance and more like an analog instrument: the column of air above the sensor becomes a space the body can touch, press into, or wave through, closing the feedback loop she wanted. The update to the post notes that LELO sent her a Lyla 2, which also works with the remote because the Lyla, Lyla 2 and Tiani 2 use the same radio protocol. The write-up drew 952 points and 253 comments on Hacker News after it appeared in November 2012.

Keep the good toy and replace only the remote: a sonar sensor turns the space above it into an analog control surface

FCC filing photos named the chips first, so reverse engineering started from published datasheets instead of black-box guessing.

Sniffing the SPI bus while the microcontroller sat in reset exposed the radio configuration and packets without ever modifying the toy's firmware.

No pairing and a hardcoded channel meant any CC2500 transmitter could drive the vibrator, and one protocol covered the Lyla, Lyla 2 and Tiani 2.

A no-moving-parts sonar sensor made control hands-free and analog: distance becomes intensity, so the body's own motion closes the feedback loop.

Transmitting about ten times more often bought responsiveness and noise tolerance, and a $22 phone power bank supplied battery, charger and boost without a custom board.

Hack the weakest component, not the whole product: FCC photos and a bus sniffer open a proprietary radio without firmware work, and commodity phone power banks replace custom power design

Micah Scott finished the project as an everyday device and released the Arduino LeloRemote library, firmware, enclosure files and a prototype video. The post drew 952 points and 253 comments on Hacker News in November 2012, and LELO later sent her an updated Lyla 2, which works with the same remote because the Lyla, Lyla 2 and Tiani 2 share one radio protocol. She framed the result as a beginning: toys that support the body's feedback loops rather than obstructing them, with future sensors that could predict motion instead of merely reacting to it.