Hackster is hosting Hackster Holidays, Ep. 6: Livestream & Giveaway Drawing. Watch previous episodes or stream live on Monday!Stream Hackster Holidays, Ep. 6 on Monday!
Garrett Bartley
Published © GPL3+

434 MHz Remote Outlet Sniffing

Sniffing 434 MHz remote outlet codes to repeat the codes with a microcontroller.

IntermediateFull instructions provided5,936
434 MHz Remote Outlet Sniffing

Things used in this project

Hardware components

NooElec RTL-SDR
×1
SparkFun RF Link Transmitter - 434MHz
×1
La Crosse Technology RS-204U Remote Control Outlet System
×1
Arduino UNO
Arduino UNO
×1
SparkFun RF Link Transmitter - 434MHz
×1

Software apps and online services

SDR#
To scan and record the 434 MHz signal. I used the free version.
Audacity
To analyze the "audio" output of SDR#.

Story

Read more

Code

Arduino 434 MHz Transmitter

Arduino
// Preamble common to all transmissions
static const bool preamble_bits[14] = {1,0,0,1,1,0,1,1,1,0,0,1,1,1};

// Button 1 On
static bool OneOn[24]    = {0,1,1,1,1,1,1,1,0,1,0,1, 0,1,1,1,0,0,1,1,1,0,0,1};
// Button 1 Off
static bool OneOff[24]   = {1,1,1,1,1,0,1,1,1,0,0,1, 0,1,1,1,0,0,1,1,1,0,0,1};

// Button 2 On
static bool TwoOn[24]    = {1,1,1,0,1,1,1,1,1,1,0,0, 1,1,1,0,0,0,1,1,0,0,0,0};
// Button 2 Off
static bool TwoOff[24]   = {0,1,1,0,1,0,1,1,0,0,0,0, 1,1,1,0,0,0,1,1,0,0,0,0};

// Button 3 On
static bool ThreeOn[24]  = {1,1,0,1,1,1,1,1,1,0,1,1, 1,1,0,1,0,0,1,1,1,1,1,1};
// Button 3 Off
static bool ThreeOff[24] = {0,1,0,1,1,0,1,1,1,1,1,1, 1,1,0,1,0,0,1,1,1,1,1,1};

// Button 4 On
static bool FourOn[24]   = {0,1,0,0,1,1,1,1,0,0,1,0, 0,1,0,0,0,0,1,1,0,1,1,0};
// Button 4 Off
static bool FourOff[24]  = {1,1,0,0,1,0,1,1,0,1,1,0, 0,1,0,0,0,0,1,1,0,1,1,0};

// Button All On
static bool AllOn[24]    = {0,0,1,0,1,1,1,1,0,0,0,0, 0,0,1,0,0,0,1,1,0,1,0,0};
// Button All Off
static bool AllOff[24]   = {1,0,1,0,1,0,1,1,0,1,0,0, 0,0,1,0,0,0,1,1,0,1,0,0};


// Short pulse duration (binary 0)
uint16_t short_pulse = 571;
// Long pulse duration (binary 1)
uint16_t long_pulse = 1331;
// Short delay duration (between bits)
uint16_t short_delay = 3154;
// Long delay duration (between sets)
long long_delay = 24140L;


void setup() {
  // Set pin 2 as output
  pinMode(2, OUTPUT);
  
  // Short delay to give us time to click "Record" in SDR#
  delay(1000);
}


void loop() {
  // Transmit the code for Button 1 On
  broadcast(OneOn);
  
  // Wait 5 seconds
  delay(5*1000);

  // Transmit the code for Button 1 Off
  broadcast(OneOff);
  
  // Wait 5 seconds
  delay(5*1000);
}


// Transmit the preamble
void preamble() {
  // Loop through 14 preamble bits
  for(uint8_t i=0; i<14; i++) {
    if(preamble_bits[i]==1)
      pulse_long();
    else
      pulse_short();

    delay_short();
  }
}


// Broadcast code
void broadcast(bool * Device) {
  // Repeat first set 3 times
  for(uint8_t i=0; i<3; i++) {
    // Send the preamble
    preamble();
    
    // Loop through and transmit remaining 12 bits of this set
    for(uint8_t j=0; j<12; j++) {
      if(Device[j]==1)
        pulse_long();
      else
        pulse_short();

      delay_short();
    }

    delay_long();
  }


  // Repeat second set 3 times
  for(uint8_t i=0; i<3; i++) {
    // Send the preamble
    preamble();
    
    // Loop through and transmit the remaining 12 bits of this set
    for(uint8_t j=12; j<24; j++) {
      if(Device[j]==1)
        pulse_long();
      else
        pulse_short();

      delay_short();
    }

    delay_long();
  }
}


// Send a long pulse
void pulse_long() {
  digitalWrite(2, HIGH);
  
  delayMicroseconds(long_pulse);

  digitalWrite(2, LOW);
}


// Send a short pulse
void pulse_short() {
  digitalWrite(2, HIGH);

  delayMicroseconds(short_pulse);

  digitalWrite(2, LOW);
}


// Long delay between sets
void delay_long() {
  digitalWrite(2, LOW);

  // A little hackery here since delayMicroseconds() doesn't
  // work with values over 32,767 and our long delay could
  // exceed that value.  Instead, we break it up into
  // "chunks" of 10,000 microseconds.
  for(uint8_t i=0; i<long_delay/10000; i++) {
    delayMicroseconds(10000);
  }

  // Now we delay for the remainder after the last 10,000
  // microsecond "chunk".
  delayMicroseconds(long_delay%10000);
}


// Short delay between bits
void delay_short() {
  digitalWrite(2, LOW);

  delayMicroseconds(short_delay);
}

Credits

Garrett Bartley

Garrett Bartley

16 projects • 52 followers
Husband, father, maker.

Comments

Related channels and tags
  • Arduino
  • Debugging
  • Debugging
  • SparkFun