I have a Petrainer PET998DRU shock collar (similar to this one) that got partially chewed up by the dog it is supposed to train. I salvaged it to the point where I have the following buttons:
- Mode (to select light, beep, vibrate, and zap
- Activate (to send appropriate stimulation)
- Up arrow (to increase the amount of stim)
The display does not work so I don't know what the setting (which stim and how much) is on other than trial and error.
I have followed the method on here: http://brettleaver.com/collar/ to get as far as I have gotten but the protocol differs on this model and I have only been able to figure out the device ID and the stim type (I think). I can replay the packets on a separate 433Mhz transmitter and the collar responds appropriately but I want to figure out the whole packet. The amount of stim is what I need helping decoding.
I decoded this as 0xDF 7E DE ED 7F D6 AB
If this is wrong, then please let me know because it may give me a clue as to why I can't figure out the rest.
I decoded this as 0xDF DE DE ED 6F 7A AA C0
. The last bits to finish up the last octet are assumed to be logic 0's. Maybe this assumption is wrong though.
I decoded the other packets similarly but I won't post all the images.
EDIT: I have since gotten captures of vibrates and zaps where I know the duration is 0.
- Light:
0xDE FE DE ED 7F D5 AB
- Beep:
0xDF 7E DE ED 7F D6 AB
- Zap:
0xDF DE DE ED 7F EA AB
- Vibrate
0xDF BE DE ED 7F DA AB
All the packets except the Light start out with 0XDF
. The next position (7, F, D, or B) seems to determine stim type. The next 5 are always0xE DE ED
so that seems to determine the device ID. All the characters after that are encoding the duration of the zap or buzz and then something to do with a checksum of some sort.
Here is what I got for the buzz stim in sequential order. After recording each one, I incremented by one and then sent the command again:
0xDF BE DE ED
7F AD 55 80
0xDF BE DE ED
7F 6D 55 80
0xDF BE DE ED
7F 56 AA C0
0xDF BE DE ED
7E ED 55 80
0xDF BE DE ED
7E D6 AA C0
...
An interesting thing I found is that one of the following patterns are always present but I can't figure out the significance:
0x__ _B 55 60
0x__ _D 55 80
0x__ _6 AA C0
0x__ _5 AA B0
EDIT: Another interesting thing to note is that there is never 2 consecutive zeros.
Assuming I haven't made a huge mistake from the beginning (this is my first attempt at reverse engineering something), does anyone see an obvious encoding scheme or checksum that is being used?
My end goal is to code up a new 433MHz transmitter and make it controllable with a yet to be made mobile app.