What software use to hack wireless protocol ( logic analyze ) USBee

Q: What software do you use for logic analyze?

Why: I try to hack(reverse engineering) my home wireless heating system control to make my own central control unit.

Wireless: My heating system uses the CC1101 chip to communication between wireless thermostat and floor heating control unit.

Capture: I use Usbee and Sigrok Pulseview to capture logic communication between MCU and CC1101. But pulseview is really "stupid" it can't print captured data even or export it to excel or export is as image.

How I do it: Manual read data from pulseview -> write it to excel -> and manually analyze communication in excel.

What I need: For example put data horizontal side by side to compare the difference in communication on different commands?

• The OpenHAB project has worked out protocols for a huge variety of home automation protocols. Have a look there first. – Transistor Aug 10 at 9:56
• Thanks It looks mutch more than my custom control software. But it is no question here.. This hardware do not have any network connection. So I need create my own transmiter to program(turn off,turn on) heating in any room. But this project looks like perfect main control software thanks a lot. – Fires_CZ Aug 10 at 10:13
• Well, honestly, pulseview is pretty awesome, and the fact that you want it in excel means that you have to sit down and write a few lines of code in your favourite scripting language; something that you'll have to do anyways. – Marcus Müller Aug 10 at 10:28
• Do you mean write custom decoder? Or how you export data from pulseview? If you look at link there is one of my analyze in pulseview. – Fires_CZ Aug 10 at 10:42

I use Saleae's Logic tool which allows exporting data - it is compatible with certain logic analyzers but should only be used with their devices.

Realterm (https://sourceforge.net/projects/realterm/) can also help you peak in on communication using a FTDI like cable (or two cables FTDI cables to observe both the RX and TX signals at the same time using the RX inputs on the cables).

For your need, one of the things that you can do is use a software radio receiver (SDR) and softw,are to extract the data from it. There are some cheap RTL radios out there (you can get them for about \$20).

Looking for "cc1101 gnuradio" in your favorite online search service will give some results, but the CC1101 is actually quite generic and will either emit FSK or OOK so anything that decodes that will do.

Despite its name, RTL-433 (https://github.com/merbanan/rtl_433) decodes more than just 433MHz signals and you can add your own decoder.

Sigmira (http://www.saharlow.com/technology/sigmira/) also decodes various signals. While RTL-433 can identify signals more or less by itself, sigmira requires you to configure it with the right numbers, but you can get the data in real time.

• The downside of over the air capture is that you have to deduce intention from noise. In capturing the electrical signals to the radio IC, particularly in the transmitter, you get a much cleaner picture. Of course the upside is that you don't have to get multiple probes onto the board of the product you are analyzing. – Chris Stratton Aug 10 at 14:53
• Thanks a lot. All software looks great and I will use it in future for sure. But they are mostly for realtime analyze. I just need software to import my captured data and compare them. For example : 1 sample with TURN OFF command send, 1 SAMPLE with TURN ON command send .. And see the difference something like winmerge just for logic captured data :D – Fires_CZ Aug 10 at 15:41
• @Fires_CZ - massaging data is ultimately a type of programming problem. When I was doing a lot of this work a while back, I actually often ended up using sed and uniq but there are many ways. – Chris Stratton Aug 10 at 15:53
• @ChrisStratton: It is not so hard to deduce intention from noise as the antenna is close enough to the emitter here. The upside of capturing over the air is that you analyse what is actually emitted rather than deducing it from the commands sent to the IC. The upside of capturing the IC commands is that you get an idea of how to program the device. When doing both you can relate one to the other and get a better understanding of the whole faster. – le_top Aug 12 at 0:04
• @Fires_CZ : I thought that you needed a tool that would write the captured data to a file. Excel can be a good tool - I've used Excel myself for such purposes; it is efficient to organize data as you go. - In this case I would list all the registers from the datasheet in the excel file and find out what settings they receive (which should remain constant) - and find out what data is sent. A tool using your usual scripting tool could extract the varying data field from the captures, or more generally list the configuration the registers receive. – le_top Aug 12 at 0:20

PulseView is a GUI front end for the sigrok system.

sigrok-cli is a command line tool within that system for operating analyzers which can stream to files or write to standard output, optionally passing through low and high level decoders first. You can also write you own decoder in other languages.

Note that unfortunately some click-install PulseView packages do not include sigrok-cli. You may need to get a fuller installation or build from source.