Control RAEX Motorised blinds by emulating their 433.92MHz RF protocol.
- esp-firmware: WIP: A ESP8266 firmware for sending remote codes to blinds using an RF transmitter. Interface via MQTT.
- remote-gen: A (golang) tool to generate new remote codes and calculate the apropriate checksum.
- rf-process: A collection of tooling for converting 433MHz signal captures in WAV files to binary data for analysis and processing.
A detailed writing explaining the process I took to reverse engineer the protocol RAEX are using to control the motorised blinds.
- RF Blinds Spreadsheet A spreadsheet where I worked on analysing the processed data from the
rf-process
tool, identifying visual patterns in the bits. - sketches/receive_manchester.ino Sniff 433MHz transmissions.
- sketches/transmit.ino An early prototype of transmitting a captured remote code.
- research/initial-captures.txt Early captures taken via
receive_manchester.ino
sketch. - research/initial-captures-analysis.txt Early capture analysis of
initial-captures.txt
.
YR1526
Remote on FCCID- Reversing via dumping transmitter firmware
- Somfy blind protocol, Reversing somfy RTS
- BlindsT4 in RFXTRX
- Controlling Blinds.com RF Dooya Motors with Arduino and Vera
- 433MHz RF Modules
- ArduinoWeatherOS
- A Lesson In Blind Reverse Engineering, PDF Writeup
- Reverse Engineer Wireless Temperature / Humidity / Rain Sensors