The Syma S107 helicopter operates via Infra Red control. Although functioning perfectly indoors, the intensity of Infra Red radiation from the sun during the day means that this helicopter cannot be operated outside during daylight hours. To fix this, and test a proof of concept, the operation was converted to radio control using the circuitry from a radio conrolled toy car.

The Controller
In normal function, the controller sends bursts of data to Infra Red LEDS. The packets of data contain details about the three channels of throttle, yaw and forward movement. A good place to tap this signal for use is from the back of the circuit board, pin 8 of the (unlabelled) 14 pin chip. This location provides a signal which is normally LOW, except for the packet burst, HIGH, shown on the old CRO screen. These packets are sent several times every second, except when the throttle is fully down in which case no data is sent.
Since I'm not using the Infra Red LEDS any more, I'll cut the track leading to them so they dont turn on.

The Helicopter
The helicopter receives the Infra Red signal via the photodiode at the rear of the circuit board. There are three pins on it, from left to right as seen in the image below are 1.signal, 2.earth, 3.Vcc (the supply voltage, nearly 4 volts)
The signal it provides is normally HIGH with the packets being seen as LOW. Imagine the CRO image above, but inverted.
Shown below is the circuit board from inside the helicopter. Its a revision 5 board. The photodiode wasnt needed anymore so its cut off. Wires are attached to each of the three pins. The Vcc and earth is used to power the radio receiver and the signal will be injected at pin 1.

The donor car
A "40Mhz" radio controlled toy car was obtained. I probably paid too much for it, but on the other hand if it works in this new incarnation it must be good value.

The car operates at 40.685 Mhz according to the crystal on the circuit board. A google search shown this frequency is in common use with a lot of toys. Here are a few links to various places selling it online (in no particular order). Prices vary a lot, and they also seem to come in various different frequencies other than 40Mhz. I got mine in a local toy shop.

Dealextreme. Amazon. Dinodirect. Smallworld.

The transmitter
Opening up the transmitter shows the circuit board below. Red and black wires for power (fortunately running on the same 9V that the Syma controller uses, so you get the power from there), white antenna wire at top.
The grey wire for the signal is the longer story.

A close look at the board shows a SCTX2BS chip. After finding a datasheet online, it seems to be the chip that takes the joystick control values, packages up the data into digital packets and then sends it off to the transmitter part of the circuit. I dont need the chip, but the datasheet did show a typical use circuit example. Where the data comes out of the chip at pin 8 was cut, and the signal from the Syma controller is injected here.
A test with a radio scanner is good. I hear the chk chk chk chk chk chk chk chk chk of data packets from the Syma controller being transmitted on 40.685 Mhz.
To be specific, the pin 8 of the SCTX2BS chip was smashed, and the signal wire carefully soldered to the surface mount resistor.

The vast majority of the circuit board is needed for the original car controller switches and other things that are not needed for this project. All I need here is the actual 40Mhz transmitter part. Once Its up and running, I'm sure I can cut away at least 80 percent of the board for neat installation inside the Syma controller.

The receiver
Opening up the rc car eventually reveals the board for the 40Mhz receiever. A nice tiny board, about an inch on each side. Various wires are already attached for running the (rear wheel drive) motor and steering arrangement, but I dont need these, so they are cut way. I need to keep the red and black wires for power, the white antenna wire, and then also search for a way to get the received signal out in a way the helicopter will understand.

The power in the rc car is a 2.4 volt rechargable battery, but I figure that the less than 4 volts coming from the helicopter wont hurt it, so its connected directly to the place (described earlier) where the photocell used to be.

Its a double sided board, and on the other side is a chip similar to that in the transmitter. This is its receiver partner, and is described in the same datasheet as the SCTX2BS transmitter chip. It is of no use to me whatsoever, but the sample usage circuit diagram at least gives me a clue as to where a suitable signal for use might be found.
After poking about with the CRO, I find a signal that is very messy between packets with a lot of noise, but clean inside the data packet. Remember that I'll talking here about the packets of data sent from the Syma controller. I take a chance that its the right polarity (ie not an inverted signal), and that the other noise doesnt confuse the decoder chip on the helicopter. The wire is carefully soldered to a surface mount resistor.

Success. The rotors turn, and after reassembly, it takes a test flight in the living room.

Packaging.
Now to neaten everything up, make it look good and have no loose wires.
The task continues...

And after a bit of work, the controller is looking better, all electronics packed inside, and with a telescopic whip antenna.

And the helicopter looks much better also, with the receiver packed away underneath the fuselage.