Skip to content

NOTES.md

Latest commit

 

History

History
76 lines (45 loc) · 3.77 KB

NOTES.md

File metadata and controls

76 lines (45 loc) · 3.77 KB

Reverse the F-Machine remotes protocol.

The F-Machine devices tested (Gigolo & Tremblr) both come with a remote with 3 or 5 buttons.

Remote type A for Gigolo

They control a SC2262 encoder that sends tri-states bits (1/0/F) as fixed code commands. These are used to then control a 315Mhz RF transmitter to send these as ASK/OOK encoded.

These commands have 12 bits length. Each bit is a waveform consisting of 2 pulse cycles:

  • Bit '0': 2*(short high, long low)
  • Bit '1': 2*(long high, short low)
  • But 'F' (floating): short high, long low, long high, short low

A 'long' pulse is 3 times longer than a short one.

A command needs to also have a synchronisation bit emitted: short high, (42*short) low.

It is also worth noting that according to the reciever (2272) documentation, 2 identical commands need to be emitted for the transmission to be valid, but experimentation show that at the very least, a command needs to be emitted 5 times to make the device react.

As noted on their website, F-Machine uses 5 different types (A to E), probably with different commands, and maybe different frequencies.

Listening to the transmissions

While it is possible de deduce the commands being sent by the 2262 by looking at how the address & data pins are connected, it's funnier to just use all your shiny tools.

Using a cheap USB RTLSDR, there are two ways to listen to the communications

Easy way with rtl_433

using rtl_433 to decode the transmissions is as easy as running: rtl_433 -f 315M -d0 and pressing the buttons on the remote.

Example code for the Gigolo A remote, and the ON/OFF button:

time      : 2021-04-14 14:42:48
model     : Generic-Remote                         House Code: 21887
Command   : 48           Tri-State : ZZZZZ1110100

Hard way with gqrx

one can use gqrx to listen to the transmitted frames.

gqrx

Setting it in AM mode, transmissions can me recorded as a .wav file after clicking the Rec button.

Opening them in Audacity, we end up with the following traces for each button presses:

  • Gigolo (Remote A)

    • Up button (command FFFFF1111000) Up button
    • ON/OFF button (command FFFFF1110010) ON/OFF button
    • Down button (command FFFFF1110100) Down button

  • Tremblr (Remote A)

    • Up button (command 11FFFF001000) Up button
    • ON/OFF button (command 11FFFF000010) ON/OFF button
    • Down button (command 11FFFF000100) Down button
    • Suck Up button (command 11FFFF000001) Suck Up button
    • Suck Down button (command 11FFFF010000) Suck Down button

The .wav files for each remote can be found here (button are pressed top left to bottom-right):

Protocol

For whatever reason, after the list of tr-state bits are sent, a short "high" transmission is also transmitted.

Each command noted above, is repeatedly transmitted while the button is pressed, and a command needs to be repeated at least 6 times to be acknowledged by the machine.

A pause in transmission is required before sending another command.