Comments (4)
Portisch
commented on July 18, 2024
The main problem on this protocol is the inverse high/low of the bit 0 & 1.
The bit decoding implemented is triggering on a rising edge. So this can't be used for these HT6P20 devices.
You can retransmit the received buckets with the 0xB0 command. But I am a little bit confused because here is also the sync bucket marking in the bit data missing like here: #21
from rf-bridge-efm8bb1.
alexandre-leites
commented on July 18, 2024
@Portisch
These are the readings from my garage door HT6P20
17:49:23 MQT: stat/RF-Bridge1/RESULT = {"RfRaw":"ON"}
17:49:23 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AAA055"}}
17:49:39 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DA 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
17:49:46 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 04 01DB 03BD 078A 2AC6 0100110101010100110010101100101010110010110101001011001100 55"}}
17:49:49 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01D4 03C7 2AC6 0100110101010100110010101100101010110010110101001011001100 55"}}
17:49:57 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DE 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:06 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DB 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:06 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01E1 03BA 2A9E 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:08 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DC 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:08 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DC 03BB 2A94 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:08 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01D9 03BF 2A94 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:19 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01D9 03BC 2A8A 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:19 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DA 03BB 2A9E 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:36 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DB 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:36 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 03 01DC 03BF 2A9E 0100110101010100110010101100101010110010110101001011001100 55"}}
17:50:45 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 02 0172 1284 00 55"}}
17:50:46 MQT: tele/RF-Bridge1/RESULT = {"RfRaw":{"Data":"AA B1 02 0122 159A 55"}}
I tried to send the raw back using the #21 instructions but nothing happens.
rfraw 0xAAB0280501152C065602C101773DDD012332233223323232322332323232323232322055
rfraw 0xAAB10301DC03BF2A9E010011010101010011001010110010101011001011010100101100110055
rfraw 0xAAB01D0301DB03BC2A80010011010101010011001010110010101011001011010100101100110055
rfraw 0xAAB10301DB03BC2A80010011010101010011001010110010101011001011010100101100110055
I'm missing something from converting the B1->B0 data?
from rf-bridge-efm8bb1.
Portisch
commented on July 18, 2024
This is the code of the garage? No rolling code? Not very save, isn't?
I checked the datasheet of HT6P20D:
There is a sync of 23 clocks.
1 clock is bucket 0: 0x01DB
Sync should be 23 x 0x01DB = 0x2AAD what is almost matching the sniffed data 0x2A80.
Than there is one sync bit (clock), 20 address bits, 4 data bits and 4 anti-code bits.
On your example:
"Data":"AA B1 03 01DB 03BC 2A80 0100110101010100110010101100101010110010110101001011001100 55"}}
It should be:
0 | 10 01 10 10 10 10 10 01 10 01 01 01 10 01 01 01 01 10 01 01 | 10 10 10 01 | 01 10 01 10 | 0
SYNC bit | address buckets | code buckets | anti buckets | SYNC bucket
The anti-code bits are matching.
So I think there is a bug in the firmware with the sync bucket number. It should look like this:
0 | 10 01 10 10 10 10 10 01 10 01 01 01 10 01 01 01 01 10 01 01 | 10 10 10 01 | 01 10 01 10 | 2
Please try this 0xB0 command:
AA B0 xx 03 14 01DB 03BC 2A80 0 10 01 10 10 10 10 10 01 10 01 01 01 10 01 01 01 01 10 01 01 10 10 10 01 01 10 01 10 2 55
This will repeat 20 (0x14) times the code. Maybe less repeats are also working...
And here is the len (xx) replaced by 37 (0x25):
AAB025031401DB03BC2A80010011010101010011001010110010101011001011010100101100110255
But I am also unsure about the low/high order. The 0xB0 command will transmit high/low.
from rf-bridge-efm8bb1.
alexandre-leites
commented on July 18, 2024
I tested with the following raw and it worked fine:
0xAAB025031401DB03BC2A80010011010101010011001010110010101011001011010100101100110255
Thanks, I wasn't able to convert myself.
from rf-bridge-efm8bb1.
Related Issues (20)
- Reading Klik Aan Klik Uit (KAKU) devices HOT 2
- online converter is down HOT 5
- Compiling firmware alternative
- Help adding custom protocol for Novy Extractor HOT 1
- Sniffing Warema Shutter HOT 38
- Newby question
- Arno fan protocol HOT 1
- protocols information of our outdoor weather transmitter, please add
- I've been told by someone on a discord server that I can't use Portisch with the Sonoff RF Bridge in the white box HOT 2
- B1 to B0 problems HOT 1
- Codes convertion HOT 1
- Sonoff RF Bridge R2 V2.2 HOT 2
- Smart Home DC-104 RF remote HOT 1
- Compiling Firmware needs Keil license HOT 1
- Create command from Scope Plot
- How to recognise kaku wall switch buttons with RFBridge
- Dooya DD remote version support HOT 12
- 1byOne doorbell not being picked up HOT 1
- portisch stops responding after random amount of time
- Some sniffing help appreciated. I'm now completely stuck.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rf-bridge-efm8bb1.