5

I am trying to reverse some communication protocol between transmitter (controlled by PCF7952 chip) and receiver on 433 Mhz frequency

I know how to prepare the "right" package which would be received and controller on the receiver's side 100% will act by this command.

But, the last 2 bits of command are unknown for me, it seems that it's a some kind of checksum / crc (but why it's only 2 bits?)

For now everytime I'm sending 4 commands with equal "body" but with 00, 01, 11, 10 in the end.

One of them is eventually working for the receiver but the goal is to execute the command from the first attempt (now it's 25% probability that the first attempt would be successful, definitely because of wrong last 2 bits)

I used to think that transmitter uses standard CRC calculation methods and the program just adds, let's say, kind of lower bits from this CRC8 / CRC16 / CRC32 sequence generated for the body of command.

I tried to use possible CRC algo from http://www.lammertbies.nl/comm/info/crc-calculation.html but did not find any positive matches in these sequences

Also I tried to check any parity bits algorithms also no luck with that

Here is samples of bit sequences (last 2 bits is checksum (maybe), third bit from the end is always 0, at least in my 2200 samples grabbed), which are grabbed from working device (transmitter)

0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1001 1010 1010 1101 10 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1111 0101 0100 1101 0101 11 000
0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1011 1010 1000 1111 10 011
0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1101 1101 1101 0101 1010 01 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 1011 0011 0011 1011 0000 1111 10 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1101 1101 1101 1100 11 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1111 1111 1101 1110 11 001
0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 0000 0101 0000 0011 01 011
0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 0110 0010 0010 0100 0011 11 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 1000 1101 0000 1011 01 010

Also here is the file with all bit sequences grabbed - https://drive.google.com/file/d/0B6VO67TWi9UOSkt4VHJNQmtSTXc/view

Honestly, I don't know where else to look.

Any hints/help or anything at all is much appreciated.

  • At least this doesn't seem to be a simple xor encoding of the bits. Do you have any examples that are closer to each other, for example, most of the payload identical, but 2 or 3 bits counting up from 0 to 3 resp. 7 ? – Guntram Blohm supports Monica Aug 29 '15 at 20:20
  • For example I have this one – Alexander Dimchenko Aug 29 '15 at 20:28
  • 01111001110110110001100011000111110000001000000010010000100001001 01111001110110110001100011000111110000001000000010010000101001011 – Alexander Dimchenko Aug 29 '15 at 20:34
  • this is an example of 2 samples with 2 different bits, one for the body, one for the crc – Alexander Dimchenko Aug 29 '15 at 20:39
  • also here is the link to the excel file containing all samples grabbed, you can use filtering option to get more close samples - drive.google.com/file/d/0B6VO67TWi9UOSkt4VHJNQmtSTXc/… – Alexander Dimchenko Aug 29 '15 at 20:42
2

(I was trying to add this as a comment, but don't have enough reputation points)

I noticed the consecutive checksums {00,00,10,00,10} repeat 21 times in the first 1100 samples of which 8 times with 19 samples in between while the data remains random/different.

E.g.

repetition of 00,00,10,00,10 pattern

This makes me wonder if the checksum is maybe time/clock based? With only 2 bits of checksum repetitions are of course very likely, but not sure if up to this extent it is "just a coincidence".

There are also a lot of repetions of {11,01,11,11,01}. Not sure if this helps, it's just something I noticed.

  • thank you! this chip definitely has not timer onboard, only constantly changing value is the counter of button press. maybe it depends on it? – Alexander Dimchenko Sep 1 '15 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.