I have a gas fireplace that is controlled via a RF transmitter/receiver that operates at 303.8MHZ. According to the manual, each remote has a unique code (1 out of 1,048,576) that is set at the factory. The receiver can learn up to two remotes. I want to be able to control the fireplace using a Raspberry Pi with an RF transmitter.

I was thinking I might be able to create my own remote with the Pi (I haven't the foggiest on how to do that), but then I thought wouldn't it be easier if I could use the Pi to "learn" the on/off commands from the original remote and then I wouldn't have to bother with having to "create" a 2nd transmitter and then having to pair it with the receiver.

Besides the Pi, I would need a RF transmitter doohickey along with a RF receiver (for learning the original remote's codes). Do you think this would work? Any suggestions on where I could learn how to clone the codes and then send them out from the Pi? The manual doesn't tell me much about the security involved. I don't think it uses rolling codes like a garage remote, because the pairing process is different.

BTW, there is no power source where the receiver is located. It is battery operated.

ETA: I want to use the Pi to control the fireplace using Amazon Echo, or some home automation tool. So I'm not interested in having a physical remote.

I guess what I'm looking for is a learning remote that also learns/sends RF (303.8Mhz) commands and can be controlled from a Raspberry Pi. Is there such a product?

  • 2
    \$\begingroup\$ I don't think it uses rolling codes like a garage remote, because the pairing process is different. That is not a good reason, I have an RF remote here which pairs "normally" yet has rolling /changing codes. Although your project is feasible if 1) you can get 303.8 MHz transmitter and receiver 2) manage to get those to talk to the RPi 3) the codes are indeed not rolling. Also an RPi is overkill for this, an Arduino can do this as well with 2 fingers in nose. Anyway, you'd be much better of just buying a 303.8 MHz remote which can learn codes. These are replacement remotes for cars. \$\endgroup\$ – Bimpelrekkie Dec 7 '16 at 11:09
  • \$\begingroup\$ Do you have a spare remote? (Can you buy one?) I would 'press' the buttons with the RPi. Other way would be to listen to the communication with a SDR and repeat the message with the RPi. Last but not favorable. Reverse engineer or Brute force the code. Its only 20bit, it can be done in a few days. \$\endgroup\$ – JWRM22 Dec 7 '16 at 11:09
  • \$\begingroup\$ I want to use this in home automation. So I don't need a remote that I would use manually \$\endgroup\$ – WhiskerBiscuit Dec 7 '16 at 14:34

Do it the easy way - just use the remote as the transmitter. Open up the remote control, solder some wires to the contacts of each of the buttons and drive those signals from your RasPi.

Could not be simpler, and also gets around all that nasty encoding/decoding business.

Also, if you do this sensibly, you can still press the buttons yourself (eg. with a standard, calibrated finger) while the RasPi is attached ;)


That's a bit of a bigger question.

There's different kinds of systems, with different kinds of mechanisms to identify the transmitter. You know, effectively, your thing could as well do something technically very similar to an encrypted WiFi, let the remote open a TCP connection over that, talk to a HTTPs server over TLS, each side checking certificates, and then issue the command. No way you're going to overwhelm that level of security.

Luckily, also no way a cheap RF control system like that will have that level of security.

Now, in the easiest case, the remote – actor communication is one-way only. In that case, the system might be wide open for so-called replay attacks. It's exactly what the name suggests – you fake the remote by recording its signal and playing it back, and you're done.

It might also be the case that the remote uses what is called rolling codes, a method that effectively hashes (encrypts) a continuous counter + a secret ID, and thus, the receiver can simply try out doing the same thing on his side, with the same secret and the last known counter value (and a few successive ones, in case the remote was pressed out of reach). That's actually often surmountable security (See Bastian Blössl's excellent work on this that long preceded the "car keys are insecure" hype this autumn...), but not as simple to do without a bit of time, and some experience.

Then, of course, there's two-way communicating devices. And those might be doing anything: from simply asking "hey, can I turn on your switch", "yes, but only if you promise that you're my remote", "sure,sure, pinky promise!" to actual cryptographically secure handshakes.

By looking at the frequency alone, we can't tell what your remote is doing. You might be able to figure out more by reading the manual very carefully and looking for any hints whether the receiver can also transmit, looking at PCBs and most importantly things like the BNetzA/OFCOM/FCC/… records of your device.

However, be warned that in the general case, you'd need something that is able to record the RF spectrum as "it is on the air", so that you can analyze it, because you know nothing yet – you know the center frequency, but you don't know which kind of modulation they use, the bandwidth used, the coding used, the kind of data they exchange …

Devices that are able to receive arbitrary signal "as it is on the air" and do the same in transmit direction, synthesizing an arbitrary signal, as long as its sufficiently band-limited, are called Software Defined Radio devices.

You can buy those – for receive-only, the infamous RTL-SDR

  • \$\begingroup\$ To supplement Marcus Müller's answer, you can determine if it is rolling code, or static, by recording with gqrx/sdr#/foo in raw IQ/no demodulation mode, and picking through each sample with a hex editor or some signal plotting program - even Audacity works if you save to an audio format in your SDR program. These samples can be replayed in various ways (piTx perhaps, it is fairly cheap option, and can transmit raw IQ samples - perhaps unmodulated). See github.com/F5OEO/rpitx and rtl-sdr.com/… . \$\endgroup\$ – user400344 Dec 7 '16 at 14:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.