I'm trying to break into a doorbell. It has a clearly labeled TX pin.
Here's the output from my Labrador oscilloscope/logic analyzer.. I can't get it to make any sense though. Any ideas? I have the settings at 9600 baud/8/N.
3
-
(It’s my doorbell :))– justinJun 27, 2019 at 11:36
-
Does it have an Rx pin that you could tap into and try to feed in input and see what happens?– theTheodidactJun 27, 2019 at 18:05
-
Yes it does, I'll give that a look later tonight if I can.– justinJun 27, 2019 at 23:50
Add a comment
|
1 Answer
Every UART packets contains a start bit what is always 0 and 1 or 2 stop bit(s) what is/are always 1. If you check the middle of your trace there are single 1 bits with some spaces between them. Every single bits are stop bit and after every stop bits a new start bit begins. These are the borders of a packet. If you draw some rectangles with the same width you can separate the picture to 12 UART packages .
Now our job is easy we just need to figure out the values inside each packets. According to my measurements the message is: 0x5F 0xAC 0x11 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x32.
Regarding the communication settings if you measure the duration of a single stop bit you can calculate by the f = 1/t formula what is the baud rate. It is hard to figure out from this low resolution picture but if I assume the delta 14.02 ms time is the total length of the packets and we have 12*(1+8+1) = 120 bits inside then a single bit duration is 116.83 us, so the baud rate is 8559 baud. The nearest valid UART baud rate is 9600 baud, so I think it should be the correct value.
I think the baud rate is 9600baud (it should be measured by tool), there is 1 start bit, 1 stop bit, no parity and the packet data length is 8 bits.
-
That’s a pretty awesome analysis! Thanks. I’ve monkeyed around and can’t get it to do anything g different. I noticed that there’s a label called GND and SGND. Should I be using SGND instead? Also, any thought this might be encrypted?– justinJul 12, 2019 at 11:36
-
Some of the RF devices has two grounds, one for the logic circuit of IC (SGND - Signal GND) and the other one for power line (GND). It is application specific that those ground are connected to each other or not. If you measured this signal between TX pin and GND of your device than the SGND & GND might be connected to each other therefore I do not expect different signal on the scope. Why would you like to use the SGND? Jul 12, 2019 at 14:10
-
Regarding the encryption it is impossible to answer from a single sample message. Sometimes for signal integration check the transmitter calculates a checksum at the end of the message. I tested with the most regular 8 bit algorithms but no result, maybe there is no integration check at all. If it is only a doorbell I assume it sends only one message,isn't? What is the purpose of your project? Would you like to build your own remote? Jul 12, 2019 at 14:10
-
1. Asking about SGND simply bc I was wondering if it would give a different/better signal, and learning. 2. Purpose is to see if there is a way to make this not be dependent on the internet, and because it’s fun learning stuff! Trying to get shell access.– justinJul 12, 2019 at 21:25
-
Where are we now in the progress? Did you try to use the reverse the reversed message? Jul 13, 2019 at 6:28