xor_decode.py

import os
import sys

# nibble decode table
flash_table_decode = [0x0a, 0x03, 0x01, 0x0c, 0x0d, 0x07, 0x0f, 0x06, 0x00, 0x08, 0x0b, 0x0e, 0x09, 0x02, 0x05, 0x04];

# test messages (8 byte payload at the end of the radio message)
msgs = [[0x54, 0xF4, 0xEE, 0xBC, 0x6C, 0xDE, 0xA4, 0x02],
        [0xC3, 0xD6, 0x5F, 0x3A, 0x49, 0x85, 0xC3, 0x91],
        [0xAA, 0x82, 0x25, 0x04, 0xAA, 0x72, 0x66, 0xBE],
        [0x40, 0xB1, 0x17, 0x96, 0xC0, 0xF1, 0x4B, 0x35],
        [0x7C, 0xEF, 0x32, 0x28, 0x84, 0x43, 0xFC, 0xC9],
        [0x69, 0x3E, 0x48, 0x72, 0x53, 0x04, 0x19, 0x0C],
        [0x99, 0x17, 0xD8, 0x6D, 0xB3, 0x1B, 0x09, 0x50],
        [0x25, 0x05, 0x61, 0xF1, 0xE6, 0x96, 0x2A, 0x8A],
        [0x05, 0x29, 0x81, 0x4F, 0x36, 0x29, 0x9A, 0xE3],
        [0x17, 0x9C, 0xCD, 0xDE, 0x1B, 0xBC, 0x50, 0xB4],];

# helper to print out messages in HEX format
def print_msg(msg):
    for i in range(0, len(msg)):
        print('0x{:02X} '.format(msg[i]), end='');
    print('');
    
# translate nibbles using flash_table_decode
def decode_nibbles(msg):
    for i in range(0, len(msg)):
        nh = (msg[i] >> 4) & 0x0F;
        nl = msg[i] & 0x0F;
        
        dh = flash_table_decode[nh];
        dl = flash_table_decode[nl];
        
        msg[i] = ((dh << 4) & 0xFF) | ((dl) & 0xFF);
        
# subtract a value from each nibble in payload between [start; start+len]
def sub_r20_from_nibbles(msg, r20, start, length):
    for i in range(start, length):
        d = msg[i];
        
        ln = (d - r20) & 0x0F;
        hn = ((d & 0xF0) - (r20 & 0xF0)) & 0xFF;
        
        msg[i] = hn | ln;
        
        r20 = (r20 - 0x22) & 0xFF;

# xor the msg bytes with 2 values
def xor_2byte_in_array(msg, xor_b0, xor_b1):
    for i in range(0, len(msg), 2):
        msg[i + 0] = msg[i + 0] ^ xor_b0;
        msg[i + 1] = msg[i + 1] ^ xor_b1;
        
        
#decode a message 
def decode_msg(msg):
    decode_nibbles(msg);
    sub_r20_from_nibbles(msg, 0xFE, 0, 2);      # subtract initial value always 0xFE
    xor_2byte_in_array(msg, msg[0], msg[1]);
    sub_r20_from_nibbles(msg, 0xBA, 2, 8);      # 0xBA is just 0xFE - 2*0x22
    
    
if __name__ == "__main__":
    #for i in range(0, len(msgs)):
    #msg = msgs[i];
    #msg = [0x14, 0x97, 0xCE, 0xDD, 0x1C, 0xBB, 0x54, 0xB0] # button up pressed      msg[2] = 0x20
    #msg = [0x34, 0x65, 0x7E, 0xA1, 0x0C, 0x56, 0xB4, 0xAA] # button up relased      msg[2] = 0x00
    #msg = [0xE3, 0x79, 0x0F, 0x8F, 0x29, 0x39, 0xE3, 0xF3] # stop pressed           msg[2] = 0x10  
    #msg = [0xB3, 0x4C, 0x8F, 0xCE, 0x99, 0xEC, 0x33, 0xE4] # button down pressed    msg[2] = 0x40
    #msg = [0x5A, 0xF0, 0x15, 0xB7, 0x6A, 0xD0, 0xA6, 0x7B] # button down pressed    msg[2] = 0x00
    
    msg = sys.argv[1:];
        
    print_msg(msg);
    decode_nibbles(msg);
    print_msg(msg);
    sub_r20_from_nibbles(msg, 0xFE, 0, 2);
    print_msg(msg);
    xor_2byte_in_array(msg, msg[0], msg[1]);
    print_msg(msg);
    sub_r20_from_nibbles(msg, 0xBA, 2, 8);
    print_msg(msg);
    print();