Help translating command code to flipper zero format

Davidko · May 10, 2023, 10:56am

Hi,

I want to use the flipper as a IR remote for my Bluetooth speaker. I lost the remote and therefore cannot scan it with the flipper.

The user manual mentions the following:
NEC factory code 1x01
Power command 0x40

I’m IRDB, the power button is assigned the following:

name: Power
type: parsed
protocol: NEC
address: 80 00 00 00
command: 02 00 00 00

For volume down, manual mentions 0xA0 but the ir file in IRDB is set as follow:
name: Minus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 05 00 00 00

How did they convert 0x40 to 02 00 00 00 and 0xA0 to 05 00 00 00

Asking this so I can add some missing commands to the IRDB for that device (KEF LSX speaker).

Thanks

LupusE · May 10, 2023, 6:50pm

I appreciate the idea. But after a little research, I wonder.

If I google for ‘KEX LSX remote’, the pictures showing a 8 button remote.
The Flipper-IRDB File KEF_LSX_Speakers.ir contains 8 commands.

Are you searching hidden function?

jmr · May 10, 2023, 7:38pm

I’ve not been able to decipher a formula and I’ve wondered whether there is a formula at all. It may be a database. To translate codes I use a universal remote app and just broadcast the code I want then capture that code with the Flipper.

Davidko · May 10, 2023, 7:38pm

Hi,

Yes the remote has 8 buttons but there are some hidden functions. See manual page 76 here: https://assets.kef.com/pdf_doc/LSX/LSXmanual_EN_v4-20200220.pdf

Some of those functions are very useful, for instance the one to select one particular audio source (instead of toggling source button from the default 8 commands).

Thanks for your help.

jmr · May 10, 2023, 7:41pm

I’m going to put that into a spreadsheet and see what I can do with it.

jmr · May 10, 2023, 8:01pm

I don’t see a pattern but I can make you a brute force file. I just ask people share the codes when I do that.

LupusE · May 11, 2023, 12:57pm

So, you already put some effort in the research. very good. Let’s go from there.

At first, the manuals says:

LSX works with universal programmable remote control
provided that the remote control controls. manufacturers
have implemented KEF IR command codes in their
remote.

What are KEF IR codes? I thought is kind of a protocol, on top of the NEC header. But lets take a look, deeper in the rabbit hole.

I opened a spreadsheet (excel, calc, …) and copy and pasted the values from the manual in the first row.
‘Libre Office Calc’ is not very handy, the result was:
1 Power On/Off Toggle 0x40 so I started in row 2, with =RIGHT(A9;4) → 0x04

Then I used the given IR file and started to match the buttons:

Maual	Extract	FZ_IR	BtnName
1 Power On/Off Toggle 0x40	0x40	02 00 00 00	Power
2 Mute/ Unmute Toggle 0x20	0x20	04 00 00 00	Mute
3 Play/Pause 0x18	0x18	18 00 00 00	Play_pause
4 Next 0x52	0x52	4A 00 00 00	Next

Not very helpful. But in the end it is all zero and one. Most spreadsheets got a function, like ‘Hex2Bin’
Convert manual codes: =REPT("0";8-LEN(HEX2BIN(RIGHT(A9;2))))&(HEX2BIN(RIGHT(A9;2)))
Convert IR file codes: =REPT("0";8-LEN(HEX2BIN(LEFT(C9;2))))&(HEX2BIN(LEFT(C9;2)))

Maual	Extract	FZ_IR	BtnName	h2b_man	h2b_ir
1 Power On/Off Toggle 0x40	0x40	02 00 00 00	Power	01000000	00000010
2 Mute/ Unmute Toggle 0x20	0x20	04 00 00 00	Mute	00100000	00000100
3 Play/Pause 0x18	0x18	18 00 00 00	Play_pause	00011000	00011000
4 Next 0x52	0x52	4A 00 00 00	Next	01010010	01001010
5 Source toggle 0x58	0x58	1A 00 00 00	Source	01011000	00011010
6 Volume Up 0x60	0x60	06 00 00 00	Plus	01100000	00000110
7 Volume Down 0xA0	0xA0	05 00 00 00	Minus	10100000	00000101
8 Previous 0xD2	0xD2	4B 00 00 00	Previous	11010010	01001011

The 8 codes are just Reversed?

Reversing in Spreadsheet is crap. But luckily we have only 8 digits:
=RIGHT(E17;1)&LEFT(RIGHT(E17;2);1)&LEFT(RIGHT(E17;3);1)&LEFT(RIGHT(E17;4);1)&LEFT(RIGHT(E17;5);1)&LEFT(RIGHT(E17;6);1)&LEFT(RIGHT(E17;7);1)&LEFT(RIGHT(E17;8);1)

And back to a flipper zero .ir file code: =BIN2HEX(F17)&" 00 00 00"

Result in Row ‘FZ_IR’:

Manual	Extract	FZ_IR	BtnName	h2b_man	h2b_ir
1 Power On/Off Toggle 0x40	0x40	02 00 00 00	Power	01000000	00000010
2 Mute/ Unmute Toggle 0x20	0x20	04 00 00 00	Mute	00100000	00000100
3 Play/Pause 0x18	0x18	18 00 00 00	Play_pause	00011000	00011000
4 Next 0x52	0x52	4A 00 00 00	Next	01010010	01001010
5 Source toggle 0x58	0x58	1A 00 00 00	Source	01011000	00011010
6 Volume Up 0x60	0x60	06 00 00 00	Plus	01100000	00000110
7 Volume Down 0xA0	0xA0	05 00 00 00	Minus	10100000	00000101
8 Previous 0xD2	0xD2	4B 00 00 00	Previous	11010010	01001011
9 Power ON 0x38	0x38	1C 00 00 00		00111000	00011100
10 Power OFF 0x3A	0x3A	5C 00 00 00		00111010	01011100
11 Mute 0x48	0x48	12 00 00 00		01001000	00010010
12 Un-Mute 0x4A	0x4A	52 00 00 00		01001010	01010010
13 Source: Wi-Fi 0x30	0x30	C 00 00 00		00110000	00001100
14 Source: Bluetooth 0x2A	0x2A	54 00 00 00		00101010	01010100
15 Bluetooth Pairing 0x98	0x98	19 00 00 00		10011000	00011001
16 Source: AUX 0x02	0x02	40 00 00 00		00000010	01000000
17 Source: Optical 0x0A	0x0A	50 00 00 00		00001010	01010000
18 Source: USB 0x1A	0x1A	58 00 00 00		00011010	01011000
19 Preset Volume (30%) 0x78	0x78	1E 00 00 00		01111000	00011110

The leading 0 is missing at the code ‘13 source:Wifi’ … but it should be good enough.

Brute force is never a solution. It is the sledge hammer, if the situation is not enough analyzed

jmr · May 12, 2023, 4:31pm

I was doing the same thing in calc but I didn’t get as far as you. Good job! I love a good spreadsheet though so I took your work a step further and heavily used CONCATENATE() to write the text of the .ir file. I had to look up how to add newlines in calc(“Ctrl”+ “Enter”).

Filetype: IR signals file
Version: 1
#
name: Power
type: parsed
protocol: NEC
address: 80 00 00 00
command: 02 00 00 00
#
name: Mute
type: parsed
protocol: NEC
address: 80 00 00 00
command: 04 00 00 00
#
name: Play_pause
type: parsed
protocol: NEC
address: 80 00 00 00
command: 18 00 00 00
#
name: Next
type: parsed
protocol: NEC
address: 80 00 00 00
command: 4A 00 00 00
#
name: Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1A 00 00 00
#
name: Plus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 06 00 00 00
#
name: Minus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 05 00 00 00
#
name: Previous
type: parsed
protocol: NEC
address: 80 00 00 00
command: 4B 00 00 00
#
name: Power_On
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1C 00 00 00
#
name: Power_Off
type: parsed
protocol: NEC
address: 80 00 00 00
command: 5C 00 00 00
#
name: Mute_On
type: parsed
protocol: NEC
address: 80 00 00 00
command: 12 00 00 00
#
name: Mute_Off
type: parsed
protocol: NEC
address: 80 00 00 00
command: 52 00 00 00
#
name: WiFi_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: C 00 00 00
#
name: Bluetooth_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 54 00 00 00
#
name: Bluetooth_Pairing
type: parsed
protocol: NEC
address: 80 00 00 00
command: 19 00 00 00
#
name: Aux_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 40 00 00 00
#
name: Optical_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 50 00 00 00
#
name: USB_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 58 00 00 00
#
name: Volume_30
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1E 00 00 00

Davidko · May 13, 2023, 4:55am

Great analysis !
The reverse part makes me wonder if that is due to the NEC protocol sending the command code then the natural inverse of the command code, and somehow KEF picked the inverse part for their user manual…
anyway great find, I will test this and come back with the results.

thanks

LupusE · May 14, 2023, 1:41pm

A good NEC protocol explanation is here: https://exploreembedded.com/wiki/NEC_IR_Remote_Control_Interface_with_8051

Notice the same code is transmitted ‘forward’ and ‘logical reversed’. After the 9ms mark + 4,5ms space, at first the address 2 times (straight than inversed), than the command 2 times (straight than reversed).

I assume the flipper firmware want to safe space, so the code is saved only one time and played 2 times. If you store only 50% of the code and replay it: which one is the ‘real’ and which is the ‘mirrored’?
The KEF documentation goes the same way, but decided inverse?

jmr · May 14, 2023, 10:05pm

Great job!

Davidko · May 16, 2023, 2:01pm

Thanks.
I quickly checked tonight with your brute force file and definitely some commands are missing.
I can’t understand the discrepancy between the manual provided IR code and the working codes based on Brite force. I may purchase a spare remote to help understand.

Once I have some time, I’ll update the IR DB with the new commands I tested with the brute force.

Davidko · May 16, 2023, 2:22pm

It’s working.
I’ll update the IRDB once I have some time.
Thanks