Brute forcing IR

Infrared Transceiver
#1

Anybody know if there’s a way to brute force the IR information?

I have an old Logitech Z-5500 that used to have an IR remote. I can’t seem to find any DBs with the IR codes. I’ve tried the Universal remote app for “Audio Players” and it triggered a “Pink Noise” audio check when running the “power” button. I don’t know what part of it triggered it.

I also have a car stereo (Stinger UN1810) that uses remotes that I’d like to figure out.

#2

It makes no sense just to fire IR bursts an wait what happens. This will take a very long time and a lot of energy

At first there are protocols. If you are lucky, your devices are using known (by the Flipper) protocols.
Let’s take the NEC protocol as example. There is a Address part and Command part. Both are 2 digit hex values. You can start and go:
00 00
00 01
00 02
…

And as it is not bidirectional, just sit hours, days, weeks, … and wait until anything happens… Or leave it unattended and something happens at some time, but you’ll never know the triggered codes.

Another approach could be search within a Flipper-IRDB. First search your device. If it not there, look out for similar devices of the same brand. If no match, look out for the similar category… Try to find the best match you can.
Based on that you still can brute force the command, if you have an idea of the address.
1 X 255 is 254 times less than 255x255.

Maybe anyone has a Logitech Harmony which maybe can be programmed for the Z-5500 and could read out some signals?

Just my 2 cent. But I am not an expert in IR bruteforce technique.

2 Likes
#3

Another device, but from the same brand. Looks promising as start point.

GitHub - Lucaslhm/Flipper-IRDB: A collective of different IRs for the FlipperConverted/CSV/L/Logitech/Unknown_z5500
What does ‘unknown’ even mean? I would give this one a shot.

https://github.com/Lucaslhm/Flipper-IRDB/blob/main/Converted/IR_Plus/L/LOGITECH/Z5500.ir
Now even I am curious about the differences.

#4

As @LupusE says it’s time consuming. I know because that’s what I did but I was looking for codes that weren’t documented. Brute force is a last resort technique and even then only works well if you can find at least one button through another means. In my case I had the power button to start with. Sounds like that is a possibility for one of your devics but it may take days.

I would try a programmable remote that I could find codes for. Then I would copy those to the Flipper. This has worked very well for me to find codes on many devices.

I’ll look for your codes in an app I have later. Let us know if the file @LupusE linked works.

#5

Tried those. Nothing.

However, I did notice the all use the same protocol and address. Now I wonder if there’s documentation for commands for this NECext protocol.

#6

Hey there, i also have the Logitech Z-5500 and lost my remote. Lucky for you i got the IR command and made a custom remote file. You just need need to add the code below in a file ending with .ir for example “Logitech_Z5500.ir” and add this file to your SD Card/infrared folder on your flipper zero.

Filetype: IR signals file
Version: 1
#
name: Power On/Off
type: parsed
protocol: NEC
address: 08 00 00 00
command: 10 00 00 00
#
name: Mute
type: parsed
protocol: NEC
address: 08 00 00 00
command: 16 00 00 00
#
name: Volume +
type: parsed
protocol: NEC
address: 08 00 00 00
command: 1A 00 00 00
#
name: Volume -
type: parsed
protocol: NEC
address: 08 00 00 00
command: 0E 00 00 00
#
name: Input Change
type: parsed
protocol: NEC
address: 08 00 00 00
command: 09 00 00 00
#
name: Input Direct
type: parsed
protocol: NEC
address: 08 00 00 00
command: 0A 00 00 00
#
name: Input Optical
type: parsed
protocol: NEC
address: 08 00 00 00
command: 0B 00 00 00
#
name: Input Coax
type: parsed
protocol: NEC
address: 08 00 00 00
command: 0C 00 00 00
#
name: Subwoofer +
type: parsed
protocol: NEC
address: 08 00 00 00
command: 03 00 00 00
#
name: Subwoofer -
type: parsed
protocol: NEC
address: 08 00 00 00
command: 01 00 00 00
#
name: Surround +
type: parsed
protocol: NEC
address: 08 00 00 00
command: 00 00 00 00
#
name: Surround -
type: parsed
protocol: NEC
address: 08 00 00 00
command: 04 00 00 00
#
name: Center +
type: parsed
protocol: NEC
address: 08 00 00 00
command: 02 00 00 00
#
name: Center -
type: parsed
protocol: NEC
address: 08 00 00 00
command: 06 00 00 00
#
name: Effect
type: parsed
protocol: NEC
address: 08 00 00 00
command: 1D 00 00 00
#
name: Settings
type: parsed
protocol: NEC
address: 08 00 00 00
command: 1F 00 00 00
#
name: Test
type: parsed
protocol: NEC
address: 08 00 00 00
command: 05 00 00 00
2 Likes
#7

Would you like to add that to the Github repo?

#8

Perfect. It works! Awesome.

#9

It should be. I’ve verified it and it works.

#10

yes, would be great to add it to the github repo

1 Like
#11

Just let me know whether you want to do it of if you want me to do it.

1 Like