[HACKS] uC & Arduino Library: reverse engineering 433mhz signals of Velleman P8078 and Holtek HT46R01T3 or HT48R01T3
I reverse engineered a 433mhz signal of the 4xR01T3v130 / 46R01T3v130 / 48R01T3v130 chips which are commonly used by Tevion (Aldi product in Germany). As I normally use an Arduino uC I hacked a small library that is capable to sniff the air for interesting packets.
The cause I needed to write it on my own and not using the various libs out there was: they just do not work (VirtualWire, RCSwitch, RemoteSwicth etc. etc.) as they are only for specific protocol types (called 1,2,3). I wanted to have a library that is capable to reverse EVERY 433mhz signal. That being said I proudly present my RxTx lib to you.
The basic principle behind it:
Measure the duration of changes of RX interrupts (high/low and low/high) and look for a so called “sync period” or “pausing duration”. These are steps you have to do manually.
//#include "RxTx.h" //RxTx* rxtx; //rxtx->Sniff();
If you found a proper sync period e.g. 36000 micro seconds you can sniff for packets:
If you found all the ranges/durations (e.g. min 200, max 400 for a short flank & min 500, max 700 for a long flank) you can decode the packets with:
//rxtx->SniffEstimatedPacketSize(36000, 200, 400, 500, 700, 35000, 40000);
You will see something like: “SSLLSLSSLLSSLLSSLLSSLLSSLSLLSLSSLSLLSSLSLLSLSLSSLLSLSLSLSSLLSLSSLF” which represents the chain of period lengths of your signal. Also keep in mind that you will start with a high flank. So the flank pattern is always something like: “101010101010101010101010101010101010101010101010101010101010101010″ this looks a little bit confusing, because it does not represent the data it only represents the state of the TX Pins output signal flank at a given time.
I decided to grab the signal directly from the DOUT to get exact signal patterns and tested them against the signals received by my XD-RF-5V RX unit.
The orange cable it connected to the DOUT of the 48R01T3v130 and pulled down with a 1kOhm resistor. I verified my reversed signals with a DSO
The reversed signals can then be send via a FST FS100A like this:
//char* off_c = new char;
//String off_s = “SSLLSLSSLLSSLLSSLLSSLLSSLSLLSLSSLSLLSSLSLLSLSLSSLLSLSLSLSSLLSSLLSF”;
//rxtx->SendMessage(off_c, 600, 300, 36000, 4);
Arduino Lib: Download ArduinoRxTxLib