Control RAEX Motorised blinds by emulating their 433.92MHz RF protocol.
- esp-firmware: WIP: A ESP8266 firmware for sending remote codes to blinds using an RF transmitter. Interface via MQTT.
- remote-gen: A (golang) tool to generate new remote codes and calculate the apropriate checksum.
- rf-process: A collection of tooling for converting 433MHz signal captures in WAV files to binary data for analysis and processing.
A detailed writing explaining the process I took to reverse engineer the protocol RAEX are using to control the motorised blinds.
Research Resources, Scripts & Tools.
- RF Blinds Spreadsheet A spreadsheet where I worked on analysing the processed data from the
rf-processtool, identifying visual patterns in the bits.
- sketches/receive_manchester.ino Sniff 433MHz transmissions.
- sketches/transmit.ino An early prototype of transmitting a captured remote code.
- research/initial-captures.txt Early captures taken via
- research/initial-captures-analysis.txt Early capture analysis of
YR1526Remote on FCCID
- Reversing via dumping transmitter firmware
- Somfy blind protocol, Reversing somfy RTS
- BlindsT4 in RFXTRX
- Controlling Blinds.com RF Dooya Motors with Arduino and Vera
- 433MHz RF Modules
- A Lesson In Blind Reverse Engineering, PDF Writeup
- Reverse Engineer Wireless Temperature / Humidity / Rain Sensors