2
\$\begingroup\$

I bought a cheap set of remote controlled power sockets and I want to integrate them into my home automation system. So I got a 433 MHz receiver for 1€, connected it to my Arduino and tried to decode the signal from the remote using the rc switch library. This gave me ambiguous codes (and pulsewidths and "protocols") as output if I pressed the same button multiple times. My device is probably not compatible with this library.

So I hooked the receiver up to my soundcard and recorded the raw signal with 48 kHz in Audacity. This is the result for pressing the "D off" button:

1 bit = 72 samples = 1.5 ms
24 bit = 1728 samples = 36 ms

zero bit = 12 samples high + 60 samples low
one bit  = 42 samples high + 30 samples low

[3x] 010100110100100101110010 0 + 55 samples low
[4x] 010100110100100101110010   + 140 samples high + 360 samples low
[1x] 010100110100100101110010 0 + 55 samples low

[3x] 010110110000101010110010 0 + 55 samples low
[4x] 010110110000101010110010   + 140 samples high + 360 samples low
[1x] 010110110000101010110010 0 + 55 samples low

[3x] 010100001011000100110010 0 + 55 samples low
[4x] 010100001011000100110010   + 140 samples high + 360 samples low
[1x] 010100001011000100110010 0 + 55 samples low

[3x] 010101111100100001000010 0 + 55 samples low
[4x] 010101111100100001000010   + 140 samples high + 360 samples low
[1x] 010101111100100001000010 0 + 55 samples low

repeat

So I was wondering:

  1. Why would the manufacturer decide to send 4 different codes for a single button?
  2. Why in this weird pattern?
  3. What's up with the extra zero on the short lines?

I'll probably be able to do this analysis for each button and get the transmitter to send the codes. (Although it's a lot of work.) I'm just curious if there is a logic or a pattern behind this that I'm not seeing. Maybe someone has a hint to how I can achieve my goal more easily.

Also maybe interesting to know: The sockets "learn" which of the buttons (A-D) they are associated with. They listen to the first ON button you press after plugging them in. To unset the link, you have to press the OFF button after plugging them in.

\$\endgroup\$
  • 1
    \$\begingroup\$ "So I hooked the receiver up to my soundcard" that may be part of the problem. These receivers typically toggle in the absence of signal. Try either using something that doesn't (RTLSDR dongle, actual superhet receiver from Ti or SiLabs) or try getting the actual transmission, for example coupling the remote's battery voltage sag into your soundcard via a DC blocking capacitor or a small transformer. \$\endgroup\$ – Chris Stratton Jul 15 '18 at 17:21
  • \$\begingroup\$ Thanks. So you're saying the codes I recorded are not the codes the remote actually sends? \$\endgroup\$ – HeikoS Jul 15 '18 at 17:34
  • 1
    \$\begingroup\$ I'm saying it would be good to have more confidence that they are, and to separate the actual codes from the after dribbles which may be a receiver artifact. Also it's not entirely clear if the data you posted is raw samples or already partially decoded. When I was working with this stuff a couple of years back, I ended up doing a lot with a little run-length histogram program I threw together. Or to put it another way, rolling code schemes exist - but a lot of what initially looked like novel codings ultimately turned out to be wrong bit slicing assumptions. \$\endgroup\$ – Chris Stratton Jul 15 '18 at 17:42
  • \$\begingroup\$ Manufacturers of remotely-controlled power appliances make all possible efforts for the transmission to be free from interference, be secure, and be non-hackable. It is very likely that the methods and encoding/encrypting techniques are not not for grabs by DIY strangers, and are kept very confidential. You are trying to reverse engineer a secure control system, which is not what it is supposed to be, "reverse-engineerable". Good luck. \$\endgroup\$ – Ale..chenski Jul 15 '18 at 17:55
  • 5
    \$\begingroup\$ @AliChen - having reverse engineered dozens of these, no, most basic products and especially outlet relays like shown in the asker's link are not designed to be secure, but rather to be inexpensive. It's typically only access control things like garage door openers that make an attempt at security. Is a rolling or otherwise secure code possible? Yes. Likely? No. \$\endgroup\$ – Chris Stratton Jul 15 '18 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.