Reverse engineering of an unknown 868MHz protocol

It is long time ago, but today I had a little bit time to go ahead with my investigations.

After some playing with URH I found out, that the sensor bit per sample must be 1200.

So I have two decoded sensors with the following values

9B49B6D249A6D249268

D26D24D249B4D249268

I have tried a bit more with "Universal Radio Hacker". And now I think I found the right configuration to decode the signal. I read that 600 is a typical baudrate for FSK. So I configured the URH interpretation module to this value (Samples/Symbol) and here we are!

Window sensor 1:

Window sensor 2:

The signal from sensor 1 is decoded to  349B.4934.926D.3492.49A.

The signal from sensor 2 is decoded to 26D2.6BB4.9269.B492.49A.

The next step is to modify the SignalDuino firmware for the nanoCUL, to receive the same signal.

The first part of the signal seems to be a synchronization pattern. One bit has a length of ~325µs.

If I now know the sample/symbol rate the signal should be decoded.

So this tool seems to be the right choice helping me, to decode the signal!

First of all I recorded the signal.

URH can now show the spectrogram:

The analog view shows this:

URH can also show the demodulated signal:

That looks very promising. :-)

I did a little research what no I can do with AIRSPY to interpret this unknown signal. I read that the signal can be exported to an audio file. This audio file can be imported by Audacity for example. I played a little bit with both tools but I was not really successful.

But then (by accident) I found URH (Universal Radio Hacker) !!!

I got an cheap SDR-RTL USB dongle on ebay for ~ 20 euros.

The dongle contains a Realtek RTL2812 and a Realtek R828D chip, which can receive radio signals between ~30 and 1700MHz.

In the next step I try to receive a signal with an SDR Dongle and the software AIRSPY (SDR#).

OK, this looks good. I got a signal on 868.475MHz. the two peaks left and right beside the mid frequency is typical for a FSK (frequency shift keying) modulation.

There are simple and cheap USB dongles that can detect 868 MHz devices. I got myself a "nanoCUL" for this purpose.

This consists of an Arduino Nano and a Texas Instruments CC1101 radio chip which can be connected to a PC via USB.

There are several firmware projects for the dongle. SignalDuino, culfw, a-culfw, ...

I tried them all but unfortunately the protocol is not supported. So I must dig deeper here.