Help decoding SZ Funpower RF 433 DC Fan Controller Remote about rf-bridge-efm8bb1 HOT 7 CLOSED

Replaying any of the data raw doesn't result in the hoped for beep from the base unit.

from rf-bridge-efm8bb1.

Example:
23:48:31 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0380 012A 163A 01010110101010100110100110011010011010101010010110 55"}}

The last bit is sometimes wrong because of a bug in the firmware. It have to be every time the index number of the last bucket (sync bucket). So here are 3 buckets and the data should be:
01010110101010100110100110011010011010101010010112 instead of
01010110101010100110100110011010011010101010010110

Then you choose your number of repeats: a number of 20 (0x14) should be enough.

Assemble the 0xB1 data for the 0xB0 comand:
AA B0 xx 03 14 0380 012A 163A 01010110101010100110100110011010011010101010010112 55

Determine the length "xx":
03 14 0380 012A 163A 01010110101010100110100110011010011010101010010112 == 0x21 bytes

0xB0 complete:
AA B0 21 03 14 0380 012A 163A 01010110101010100110100110011010011010101010010112 55

The other way would be to decode the 24 bit of data for each command like:
010101101010101001101001100110100110101010100101 | 12 (sync) data
1 1 1 0 0 0 0 0 1 0 0 1 0 1 0 0 1 0 0 0 0 0 1 1 binary
E09483 hex

As the bucket timing is 75 & 25% duty cycle you can use also comand 0xA5 or comand 0xA8. 0xA5 is the simple one:
AA A5 163A 012A 0380 E09483 55

from rf-bridge-efm8bb1.

Am still struggling ; tried with your strings but no dice.

Here is some more dump of On / Off. Note that there seems to be an answer that comes back from the base unit (the second entry) after I press the on button on the remote (have not pressed it for some time). Is this part of the keying?

08:26:20 CMD: RfRaw 177
08:26:20 RSL: RESULT = {"RfRaw":"ON"}
08:26:20 RSL: RESULT = {"RfRaw":{"Data":"AAA055"}}
08:26:24 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 037F 012F 1644 01010110101010100110100110011010101010101010010110 55"}}
08:26:25 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0385 0129 163A 01010110101010100110100110011010011010101010010110 55"}}
08:26:27 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0382 012E 1644 01010110101010100110100110011010101010101010010110 55"}}
08:26:27 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0389 012B 1630 01010110101010100110100110011010011010101010010110 55"}}
08:26:34 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 037F 012F 1644 01010110101010100110100110011010101010101010010110 55"}}
08:26:55 CMD: RfRaw 176
08:26:55 RSL: RESULT = {"RfRaw":"ON"}
08:27:30 CMD: RfRaw AA B0 21 03 14 0380 012A 163A 01010110101010100110100110011010011010101010010112 55
08:27:30 RSL: RESULT = {"RfRaw":"ON"}

from rf-bridge-efm8bb1.

and a bunch more repeated on/off

08:38:32 CMD: RfRaw 177
08:38:32 RSL: RESULT = {"RfRaw":"ON"}
08:38:32 RSL: RESULT = {"RfRaw":{"Data":"AAA055"}}
08:38:34 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 037F 012F 1644 01010110101010100110100110011010101010101010010110 55"}}
08:38:40 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 037F 012F 1644 01010110101010100110100110011010101010101010010110 55"}}
08:38:47 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0384 012E 1644 01010110101010100110100110011010101010101010010110 55"}}
08:38:52 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0387 012B 1644 01010110101010100110100110011010101010101010010110 55"}}
08:38:58 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0385 0129 164E 01010110101010100110100110011010101010101010010110 55"}}
08:39:02 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0387 0129 164E 01010110101010100110100110011010101010101010010110 55"}}
08:39:19 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0380 012A 1644 01010110101010100110100110011010101010101010010110 55"}}
08:39:23 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0385 0129 164E 01010110101010100110100110011010101010101010010110 55"}}
08:39:27 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0385 012C 1644 01010110101010100110100110011010101010101010010110 55"}}
08:39:34 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0385 0129 164E 01010110101010100110100110011010101010101010010110 55"}}
08:39:53 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0381 0129 1644 01010110101010100110100110011010101010101010010110 55"}}
08:39:57 RSL: RESULT = {"RfRaw":{"Data":"AA B1 03 0386 0128 1644 01010110101010100110100110011010101010101010010110 55"}}

from rf-bridge-efm8bb1.

@aenertia try this:

$ python ./BitBucketConverter.py "AA B1 03 0381 0129 1644 01010110101010100110100110011010101010101010010110 55" 20
'RfRaw AAB02103140381012916440101011010101010011010011001101010101010101001011055'

raw-sniffing-procedure

B1 to B0 tool

from rf-bridge-efm8bb1.

Thanks will give it a shot when I get back home from my overseas work trip.!

from rf-bridge-efm8bb1.

As I have written here: #25 (comment) it looks like old firmware or a bug. The sync bucket is missing...

@aenertia try this:

$ python ./BitBucketConverter.py "AA B1 03 0381 0129 1644 01010110101010100110100110011010101010101010010110 55" 20
'RfRaw AAB02103140381012916440101011010101010011010011001101010101010101001011055'

This should not work because bucket 2 is missing!

This maybe work:
AAB02103140381012916440101011010101010011010011001101010101010101001011 2 55

from rf-bridge-efm8bb1.