Paradox Wireless Reed Switch

Sub-GHz
#13

so if anyone is interested, we follow the hands … we have an unknown protocol in an unknown encoding … we collect as many records from the consoles as possible and just paint, insert 1 parcel in the scale under the other

image
image2698×593 113 KB

looking for similarities and differences… trying to figure out how the transmission is encoded… my first guess was that it was Manchester. but if you look closely at the levels, you can see that there is no clear 2 short in a row (this is mandatory in Manchester)

We also know that the last 2 parcels have serial numbers that differ by only one. that is, the signals should be similar. but the serial number must differ by 1 bit. what we see…
that is, if you look carefully, we see that the bits are encoded 3t and since the penultimate sending is less than the last by 1, then the different bit should be (in theory) 0 (2t up 1t low =0), (1t up 2t low =1). let’s stop there for now and write a decoder for this waveform

3 Likes
#14

we continue our research. we wrote a decoder that decodes the package. received parcels from different consoles. we know which button we pressed and sometimes the serial number of the remote control is written on the key fob itself. we have a set of decoded parcels. we translate it into BIN and start looking for similarities and differences

image
image2129×1186 64.1 KB

we notice that parcels from key fobs with serial numbers with similar serial numbers almost do not differ at the beginning.
the penultimate byte of the send is repeated in different sends when you press the same button (maybe this is the button code). the last byte is always different, but the same when the button is pressed again. so this is (presumably) the CRC of the send, so this is 1 byte, again assume that this is CRC-8 (maybe this is not so, maybe just the sum of all bytes with overflow or something else). we run the CRC-8 brute over the entire range of the polynomial and the start bit. and O miracle!!!

2 Likes
#15

Wow SkorP, Impressive Work. Being quite new to subGhz, everytime you reply I have a ton of research I’m doing to try and keep up. I’m supposed to be learning Dynet at the same time so really appreciating all the work your putting in mate :+1:t2: having access to this protocol will help heaps debugging at work.

#16

serial number encoding assumptions.

## Mommy Ali͎na *—* Сегодня, в 13:23

236 dec = 11101100; reversed 00110111 … now see where you can spot that sequence in the serials. maybe they're encoded in packets of 3 decimal digits. Let's test the theory serial is 117:236 117 dec = 1110101; reversed that's 1010111(0) right padded to 8 places 236 dec = 11101100; reversed that's 00110111 00110111 : 10101110 there's your first serial, let's try with the last one serial is 236:079 236 dec = 11101100; reversed that's 00110111 079 dec = 1001111; reversed that's 1111001(0) right padded to 8 places 11110010 : 00110111 bam
2 Likes
#17

and so we see. that the serial number is “encoded” simply as a 2-byte number with bits reversed.

image
image2275×911 42.2 KB

2 Likes
#18

Way to go ‘mommy alina’ great pickup

#19

as a result, for the correct decoding of the signal, we need

  1. correctly receive the signal and check its checksum (last byte)
    image
    image1817×983 20.1 KB
  2. bitwise reverse the first 3 bytes and parse the values
    image
    image1703×257 7.55 KB
  3. display all values ​​on the screen
    image
    image1757×661 17.5 KB
1 Like
#20

@Russell_Coight
please check the reception and most importantly tell me what button numbers are displayed on the screen and what do they mean? in the torii, the numbers of buttons with the same functions must match on different remotes

#21

Thanks @SkorP I will test these out as soon as I have access to my programming software, I know you are anxiously waiting, i will attempt to test out the protocol this afternoon🙏

#22

ok, so far so very good :slight_smile:
the decoder is picking up and tracking the signal.
the decoder i miss labelled, should be labelled ‘magellen’ not Paradox, as they make their transmitters for more companies than just paradox, that was my mistake :frowning: however, to testing…

the remote transmits 3x when a button is pressed.
Closed = 0x12
Open = 0x13

if i press and hold the ‘Tamper’, than release it so it is active
it transmits ~20x with a mix of buttons from the 2 serials, i will try to order it

  1. SN#2-BTN=0x11
  2. SN#1-BTN=0x11
  3. SN#2-BTN=0x11
  4. SN#1-BTN=0x11
  5. SN#2-BTN=0x11
  6. SN#2-BTN=0x11
  7. SN#2-BTN=0x11
  8. SN#1-BTN=0x11
  9. SN#2-BTN=0x11
  10. SN#2-BTN=0x13
  11. SN#2-BTN=0x13
  12. SN#2-BTN=0x13
  13. SN#1-BTN=0x13
  14. SN#2-BTN=0x13
  15. SN#2-BTN=0x1A
  16. SN#1-BTN=0x1A
  17. SN#2-BTN=0x1A
  18. SN#1-BTN=0x1A
  19. SN#1-BTN=0x1A
  20. SN#2-BTN=0x1A

the amount of signals transmitted for each tamper button press varies and the amount each SN# transmits also varies,
i believed the signals are transmitted from both SN at same time and the flipper loses some as they overlap, however the start code is always 0x11 and final transmissions are 0x1A. the Middle code 0x13 is due to my leaving the transmitter in the ‘OPEN’ mode
edit
if i leave SN1 closed, and SN2 open- More Buttons appear SN1 starts with 0x10 while SN2 starts with typical 0x11
if i press the tamper quickly, to be good than bad, i than get 0x1B and 0x1C

so far i have only been testing while tamper is active, as the transmitter casing is removed.

i will Leave flipper next to the device for a few hours as it will send a periodic transmission to let the receiver know it is still active, i will post the Button Code when it comes through

#23

didn’t quite understand you. name of the magellen system, ca.
open button 0x13 (always?)
close button 0x12 (always?)
What is a tamper and what is its function?

#24

Sorry, i rush my words.

Tamper, is a switch that tells the system that someone has opened the transmitter and no longer secure, this can set alarm off, it is bad.
i just realise that all numbers so far i test with the transmitter cover off.

i retested to provide more CODE.
open Button, but system insecure 0x13 (with transmitter cover open and tamper switch released) (trouble)
Close Button, but system insecure 0x12 (with transmitter cover open and with tamper switch released) (trouble)
open Button, 0x11 (No Tamper, system secure) (intruder alert)
Close Button 0x10 (No Tamper, system secure, alarm happy)
Power on 0x18
Tamper Detected first code 0x11 followed by final Code 0x1A

same codes across 4x SN

#25

i have a motion detector using same signal
motion detected = 0x21
motion Detected (with tamper) = 0x23
power on = 0x28

the SN# is correct for new device :slight_smile:

#26

6 buttons are useful.
Open (Tamper) 0x13
Close (Tamper) 0x12
Open 0x11
Close 0x10
Motion (Tamper) 0x23
Motion 0x21

#27

so we will dance from this … + power on 0x28. Are there any other situations?

Example of unknown protocol analysis for SubGhz
#28

No, however, I am trying to transmit the current button codes using flipper, the RX light on the receiver doesn’t light up and it doesn’t recognise the code :confused:
I did notice that the raw files work but it takes 0.5sec before the RX begins to flash?

#29

0x18 = power on for product model DCT10
0x28 = power on for product model PMD75
I have also seen 0x1B and 0x1C
But I do not know what function they have

#30

and it won’t, I didn’t finish sending, only receiving, the button code stopped me. today I want to send and add

1 Like
#31

As I get other product models, I may be able to add a few more buttons, but this may take time. Is it difficult to add extra buttons later? what I have now is plenty :). The main thing would be, being able to change the SN to generate a new transmitter

#32

serial number can be changed. on the buttons it’s more for beauty

1 Like