Résultats de recherche : sdr

Jan 032016

In a previous article, we had managed to snif & record RF signals, decode it and reproduce it with an arduino.

Thus, even if you can visualize the wav form in Audacity (or any other sound editor), it is not easy to « read » the signal.

The attached software (source code provided) will not only display the wave form, but also shape it as a « square » form and eventually provide a textual reading (high for xx ms, low for xx ms, …).

This makes it easier to reproduce (from an arduino) or eventually make a better guess at what the signal (or part of it) actually is.

Below :

1-the original wave form

2-the square form

3-a textual reading of the worm

Hope this helps others 🙂

 Posted by at 17 h 17 min
Sep 282014

In previous article, we managed to decode a RF433 packet using homeeasy protocol (a di-o chacon telco for a power outlet).

Next obvious step is now to replay it using our Arduino and a FS1000a rf433 chip.

Here below the arduino sketch.
(wiring is simple : data to digital 3, gnd to gnd, vcc to 3.3v)

const int transmit_pin = 3;

void setup()
   pinMode(transmit_pin, OUTPUT);
    Serial.begin(115200);	// Debugging only

void loop()
  //time to adjust
  digitalWrite(transmit_pin, LOW);
  digitalWrite(transmit_pin, HIGH);
  digitalWrite(transmit_pin, LOW);
  //datas - a manchester encoded string, sniffed with sdrsharp
char binary[]={0,1,0,1,0,1,1,0,1,0,1,0,0,1,1,0,0,1,1,0,0,1,0,1,1,0,0,1,0,1,1,0,1,0,1,0,1,0,0,1,1,0,1,0,1,0,1,0,1,0,0,1,0,1,1,0,0,1,0,1,0,1,0,1};
for (int i=0; i <64; i++){
      if (binary[i]==0) {
        digitalWrite(transmit_pin, HIGH);
        digitalWrite(transmit_pin, LOW);
      if (binary[i]==1) {
        digitalWrite(transmit_pin, HIGH);
        digitalWrite(transmit_pin, LOW);
   //the end
   digitalWrite(transmit_pin, HIGH);
   digitalWrite(transmit_pin, LOW);

Here below the generated signal which as you can see is very similar to the original one.


The original


Sep 262014

In previous article, thanks to a R820T tuner, we managed to capture some RF4333 signal (which seems to be repeated 5 times).


Zooming in one pattern, we can see high and low bits.


Googling around, it appears that my di-o chacon telco is using the homeeasy protocol.
a preamble (before data) is HIGH for 275us and a LOW for 2675us.
a 0 is HIGH for 275us and LOW for 275us.
a 1 is HIGH for 275us and LOW for 1225us.

We therefore end up with 64 bits (wired):
01 01 01 10 10 10 01 10 01 10 01 01 10 01 01 10 10 10 10 01 10 10 10 10 10 01 01 10 01 01 01 01.

Still reading the homeeasy protocol, we learn than 01=0 and 10=1 (manchester encoding).

The result is (32 bits, decoded) :

Bit 0 to 25 is the device id : 11101010010011110111110 -> 7527BE
Bit 26 is the flag group : 0
Bit 27 is on/off : 1
Bit 28 to 31 is the device code : 0000

Now re using this article, we should be able to replay that signal with the right timings.

Sep 192014

Finally received my DVB-T/DAB/FM dongle and more precisely my R820T tuner.

This, with the proper drivers (here), will allow me to « listen » to my RF433 radio devices.


Even better I can record my signal in audacity using a « virtual audio cable« . (note that are free alternatives).

Or else I can display my packets using rtl_433_win32 (although not decoded properly).


Note : ab 53 32 cb 54 d5 4b 2a 80 is a chacon remote control (to switch on/off a 220v plug outlet).

We can see in audacity the pattern repeated 5 times.


Zooming in one pattern, we can see high and low bits.


Now the challenge is the following :
-snif a RF433 packet and decode it
-replay it with my Arduino+CC1101

How fun 🙂

 Posted by at 20 h 00 min
Déc 292017

modified : rewritten _enum_drives_lv to enumerate thru volumes not drive letters (x32)
modified : selected.caption replaced with inttostr(integer(lvdisks.Selected.data)) (x32)
modified : renamed convert to vmdk/vhd to create vmdk file descriptor
modified : added raw to vhd in disk conversion
modified : GetVolumeNameForVolumeMountPoint moved to udiskmgmt
todo : move md5 hash to disk image
added : if pos(‘:\’,path)>0 then exit; in prep_src & prep_dst
added : backup/restore in mbr editor (x32)
modified : backup will now suggest a proper filename (x32)
modified : set disk ro and rw will go offline/online if disk is online (x32)
modified : VDI2RAW,vmdk2raw,vhd2raw,restore_devio,backup_devio,EWF2Drive,Drive2EWF moved to new uconvert unit (x32)
modified : createfile_devio,getfilesize_deviowrite_devio,prep_src,prep_dst,_lockdismount_vol,_unlock_vol moved to new uconvert unit (x32)
modified : vdi,LibVMDK,libVHDI,LibEWFUnit,wsck removed from umain (x32)
removed : privilege, ntdll, fmifs units
modified : GetDriveParams moved udiskmgt
removed : int13ext unit
modified : uformat renamed to ufrmformat
fixed : result set to 0 in lib._GetDosDrives
modified : Drive2RAW,RAW2Drive moved to uconvert unit (x32)
added : mode 0 in lib._EnumerateDosDevices to list all devices
added : list volume shadow copy volumes in volumes
added : add dos device in volumes
modified : renamed createvhd to umsvirtdisk
modified : renamed main to ufrmMain
modified : replaced custom wsck unit with delphi winsock unit
midified : libewf_SetCompressionValues uses LIBEWF_COMPRESS_FLAG_USE_EMPTY_BLOCK_COMPRESSION (x32)
modified : ufrvolume, definedosdevice will try DDD_RAW_TARGET_PATH and 0 (x32)
modified : drive2raw will display the offset if reafile fails (x32)
modified : xxx2RAW will propose to delete target file (x32)
todo : consider 1mB instead of 65kB for memsize in xxx2RAW functions
added : backup/restore from popup menu (x32)
added : checkbox in disk/part/disk&part popupmenu (x32)
added : offline/online after create partition (x32)
added : refresh after format (modal form) (x32)
added : try/catch in wim_logmessage
added : makeiso improvements around boot files
added : extend volume will propose the closest max size possible

 Posted by at 14 h 17 min