Erwan's Blog

In previous article, we managed to decode a RF433 packet using homeeasy protocol (a di-o chacon telco for a power outlet).

Next obvious step is now to replay it using our Arduino and a FS1000a rf433 chip.

Here below the arduino sketch.
(wiring is simple : data to digital 3, gnd to gnd, vcc to 3.3v)

const int transmit_pin = 3;

void setup()
{
   pinMode(transmit_pin, OUTPUT);
    Serial.begin(115200);	// Debugging only
    Serial.println("setup");
}

void loop()
{
  //time to adjust
  digitalWrite(transmit_pin, LOW);
  delayMicroseconds(5000);
  //preamble
  digitalWrite(transmit_pin, HIGH);
  delayMicroseconds(275);
  digitalWrite(transmit_pin, LOW);
  delayMicroseconds(2800);
  //datas - a manchester encoded string, sniffed with sdrsharp
char binary[]={0,1,0,1,0,1,1,0,1,0,1,0,0,1,1,0,0,1,1,0,0,1,0,1,1,0,0,1,0,1,1,0,1,0,1,0,1,0,0,1,1,0,1,0,1,0,1,0,1,0,0,1,0,1,1,0,0,1,0,1,0,1,0,1};
for (int i=0; i <64; i++){
      if (binary[i]==0) {
        digitalWrite(transmit_pin, HIGH);
        delayMicroseconds(275);
        digitalWrite(transmit_pin, LOW);
        delayMicroseconds(275);
      }
      if (binary[i]==1) {
        digitalWrite(transmit_pin, HIGH);
        delayMicroseconds(275);
        digitalWrite(transmit_pin, LOW);
        delayMicroseconds(1225);
      }
   } 
   //the end
   digitalWrite(transmit_pin, HIGH);
   delayMicroseconds(275);
   digitalWrite(transmit_pin, LOW);
  delayMicroseconds(5000);
  //
delay(1000);      
  }

Here below the generated signal which as you can see is very similar to the original one.

The original

In previous article, thanks to a R820T tuner, we managed to capture some RF4333 signal (which seems to be repeated 5 times).

Zooming in one pattern, we can see high and low bits.

Googling around, it appears that my di-o chacon telco is using the homeeasy protocol.
a preamble (before data) is HIGH for 275us and a LOW for 2675us.
a 0 is HIGH for 275us and LOW for 275us.
a 1 is HIGH for 275us and LOW for 1225us.

We therefore end up with 64 bits (wired):
01 01 01 10 10 10 01 10 01 10 01 01 10 01 01 10 10 10 10 01 10 10 10 10 10 01 01 10 01 01 01 01.

Still reading the homeeasy protocol, we learn than 01=0 and 10=1 (manchester encoding).

The result is (32 bits, decoded) :
00011101010010011110111110010000

Bit 0 to 25 is the device id : 11101010010011110111110 -> 7527BE
Bit 26 is the flag group : 0
Bit 27 is on/off : 1
Bit 28 to 31 is the device code : 0000

Now re using this article, we should be able to replay that signal with the right timings.