433Mhz Reverse Engineering Part 2 - Burning Questions are Answered

13 Apr 2016

I couldn't help but wonder, based on the previous posting and the discussion, exactly how did the 1 million combinations come about? Also, what are the functions of the fixed bits? Are they fixed pre-amble as my experience would suggest? Are there more hidden channels in the equipment than are used by the senders and that I know of? Can it cope with over-speed transmissions, shortened repetition delay times, less repetitions?

I embarked on a journey of "knowledge" by building myself a generic 433Mhz ASK/OOK transmitter that took a string of the following variables:

zero pre-low (us), zero high (us), zero low (us), one pre-low (us), one high (us), one low (us), delay (us), repetitions, data

I figured that, by using these timing variables, almost all my ASK/OOK fixed code protocols can be represented, thus a serial to ASK/OOK "universal" bridge was born. This was used to probe the switches and find the truth.

The answers are in my blog post at http://goughlui.com/2016/04/13/reverse-eng-pt-2-watts-clever-easy-off-wsmart-box-es-aus1103/

Top Comments

Parents

Gough Lui over 9 years ago

mcb1, as usual, I have to thank you for your spreadsheet that put these thoughts into my head and made me try and find out what the fixed bits actually mean.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
mcb1 over 9 years ago in reply to Gough Lui

I never tried the 'fixed' bits as there were plenty available for the purpose.

It was found that bit 25, namely the last fixed bit, appears to be a do-not-care bit. No matter whether it is 0 or 1, regardless of what it was when learnt, the command will be executed.
I wonder if the devices are actually two channels, with the last bit used for the night light.
If you check the spreadsheet you'll see that the light uses bit 24 on the ones I had.

I picked up a Kambrook version of these on your side of the ditch.
It had 4 banks, but since they weren't available here (even though Bunnings is) I never tried 'hacking' it.

Mark
- Cancel
- Vote Up +1 Vote Down
- Sign in to reply
- More
- Cancel
Gough Lui over 9 years ago in reply to mcb1

I don't think my versions were available with Night Light, as the SMART Box it comes paired with always sets the bit to 1. That being said, either zero or one actuates the main relay, so I would suspect if it was for night-light, it probably shouldn't have the same effect (i.e. toggles a not-connected output instead).

Interesting - I've never even realized Kambrook had this 4 banks x 5 channels system, although I can't find it from my local Bunnings, I'm guessing it wasn't entirely inexpensive?

- Gough
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
mcb1 over 9 years ago in reply to Gough Lui

I'm guessing it wasn't entirely inexpensive?
No it wasn't.

Not sure if it was old stock when we brought it way up at Coloundra a few years back.

Looks like they might have these
http://www.bunnings.com.au/arlec-remote-control-power-outlet-3-pack_p4331240

I found this while searching if they are still available.
Might help someone with a RPi they want to use to automate.
Controlling Kambrook Wireless Outlets using an... - Addicted to Pi Tech Blog

Mark
- Cancel
- Vote Up +1 Vote Down
- Sign in to reply
- More
- Cancel
mcb1 over 9 years ago in reply to mcb1

A little more searching found these useful links
Reverse engineering the RF protocol on a Kambrook Power Point Controller - BeyondLogic

Kambrook Remote Power Outlet & Arduino - working

https://discuss.ninjablocks.com/t/remote-power-points-in-au/152

So I might need to look at some alternative versions next week ...
- Cancel
- Vote Up +1 Vote Down
- Sign in to reply
- More
- Cancel