Reverse engineering of an unknown 868MHz protocol

Description

A few years ago I bought an alarm system that works with wireless sensors.

Now I have an openHAB installation running to make my house a little smarter.
Unfortunateley the alarm system is a closed system - not able to interact with openHAB.
The old sensors are installed on a lot of doors and windows and of course I like to reuse them instead of buying new ones.

The sensors have "868 FSK" printed on them. More information I do not have.

Project Logs

Collapse

More decoding
hebel23 • 08/26/2023 at 18:51 • 0 comments

It is long time ago, but today I had a little bit time to go ahead with my investigations.
After some playing with URH I found out, that the sensor bit per sample must be 1200.
So I have two decoded sensors with the following values
9B49B6D249A6D249268
D26D24D249B4D249268
First signals decoded!
hebel23 • 01/28/2022 at 18:41 • 0 comments

I have tried a bit more with "Universal Radio Hacker". And now I think I found the right configuration to decode the signal. I read that 600 is a typical baudrate for FSK. So I configured the URH interpretation module to this value (Samples/Symbol) and here we are!
Window sensor 1:
Window sensor 2:
The signal from sensor 1 is decoded to 349B.4934.926D.3492.49A.
The signal from sensor 2 is decoded to 26D2.6BB4.9269.B492.49A.
The next step is to modify the SignalDuino firmware for the nanoCUL, to receive the same signal.
Decoding attempts
hebel23 • 01/21/2022 at 22:19 • 0 comments

The first part of the signal seems to be a synchronization pattern. One bit has a length of ~325µs.

If I now know the sample/symbol rate the signal should be decoded.
URH - Universal Radio Hacker
hebel23 • 01/21/2022 at 21:54 • 0 comments

So this tool seems to be the right choice helping me, to decode the signal!
First of all I recorded the signal.
URH can now show the spectrogram:
The analog view shows this:
URH can also show the demodulated signal:
That looks very promising. :-)
AIRSPY and Audacity
hebel23 • 01/21/2022 at 21:43 • 0 comments

I did a little research what no I can do with AIRSPY to interpret this unknown signal. I read that the signal can be exported to an audio file. This audio file can be imported by Audacity for example. I played a little bit with both tools but I was not really successful.

But then (by accident) I found URH (Universal Radio Hacker) !!!
SDR-RTL Dongle
hebel23 • 01/21/2022 at 21:34 • 0 comments

I got an cheap SDR-RTL USB dongle on ebay for ~ 20 euros.
The dongle contains a Realtek RTL2812 and a Realtek R828D chip, which can receive radio signals between ~30 and 1700MHz.
AIRSPY SDR Dongle
hebel23 • 01/21/2022 at 21:30 • 0 comments

In the next step I try to receive a signal with an SDR Dongle and the software AIRSPY (SDR#).
OK, this looks good. I got a signal on 868.475MHz. the two peaks left and right beside the mid frequency is typical for a FSK (frequency shift keying) modulation.
First steps with nanoCUL
hebel23 • 01/21/2022 at 21:25 • 0 comments

There are simple and cheap USB dongles that can detect 868 MHz devices. I got myself a "nanoCUL" for this purpose.

This consists of an Arduino Nano and a Texas Instruments CC1101 radio chip which can be connected to a PC via USB.

There are several firmware projects for the dongle. SignalDuino, culfw, a-culfw, ...

I tried them all but unfortunately the protocol is not supported. So I must dig deeper here.

View all 8 project logs

Discussions

Daniel Sendas wrote 07/26/2022 at 20:58

Hello,

this is an interesting analysis for me, because I have exactly the same alarm system and I was looking for a long time for documentation about decoding 868Mhz .

With your detailed explanations, I arrived at the same result, and was able to decode my windows sensors.

Thank you very much.

I am now interested in the next step, which consists in integrating the state of my windows sensors in Home Assistant.
I first did some research around EspHome but I did not find anything very concrete.
The only thing that seems obvious to me, is that I will have to use a CC1101 driven by an ESP32, ESP8266 or Arduino.
I didn't know SignalDuino, FEHM, or nanoCul interfaces.
This way seems very interesting.
Have you made any progress ?

Sorry my bad English.

Daniel

Are you sure? yes | no

Arya wrote 02/06/2022 at 16:37

can't wait for updates! this is already shaping up well, and when finished, would be an amazing and simple primer on URH and RF RE work!

Are you sure? yes | no

Dewey wrote 01/25/2022 at 19:08

Thank you for posting this project! I have always wanted to know more about how to untangle unknown formats, coding schemes and the like. I wasn't aware of the tools you used, so this is really exciting. Good luck in getting these sensors figured out!

Are you sure? yes | no

hebel23 wrote 01/27/2022 at 11:29

Thank you Dewey,
I'm also curious to see if i can get the things to work.
We will see. ;-)

Are you sure? yes | no

Tom Nardi wrote 01/24/2022 at 19:33

Love seeing unknown protocols decoded, and Universal Radio Hacker is an absolutely fantastic tool. Very interested to see how you progress with this project.

Are you sure? yes | no

hebel23 wrote 01/27/2022 at 11:31

Thank you Tom,
If you have experience with these things, feel free to make your comments here and there - if you like. ;-)

Are you sure? yes | no

Reverse engineering of an unknown 868MHz protocol

Become a Hackaday.io member

Just one more thing

Description

Project Logs Collapse

Enjoy this project?

Discussions

Become a Hackaday.io Member

Does this project spark your interest?

Report project as inappropriate

Send message

Remove Member

Project Logs

Collapse