Wow SkorP, Impressive Work. Being quite new to subGhz, everytime you reply I have a ton of research I’m doing to try and keep up. I’m supposed to be learning Dynet at the same time so really appreciating all the work your putting in mate 
having access to this protocol will help heaps debugging at work.
serial number encoding assumptions.
## Mommy Ali͎na *—* Сегодня, в 13:23
236 dec = 11101100; reversed 00110111 … now see where you can spot that sequence in the serials. maybe they're encoded in packets of 3 decimal digits. Let's test the theory serial is 117:236 117 dec = 1110101; reversed that's 1010111(0) right padded to 8 places 236 dec = 11101100; reversed that's 00110111 00110111 : 10101110 there's your first serial, let's try with the last one serial is 236:079 236 dec = 11101100; reversed that's 00110111 079 dec = 1001111; reversed that's 1111001(0) right padded to 8 places 11110010 : 00110111 bam
2 Likes
2 Likes
Way to go ‘mommy alina’ great pickup
as a result, for the correct decoding of the signal, we need
- correctly receive the signal and check its checksum (last byte)
- bitwise reverse the first 3 bytes and parse the values
- display all values on the screen
1 Like
@Russell_Coight
please check the reception and most importantly tell me what button numbers are displayed on the screen and what do they mean? in the torii, the numbers of buttons with the same functions must match on different remotes
Thanks @SkorP I will test these out as soon as I have access to my programming software, I know you are anxiously waiting, i will attempt to test out the protocol this afternoon🙏
ok, so far so very good 
the decoder is picking up and tracking the signal.
the decoder i miss labelled, should be labelled ‘magellen’ not Paradox, as they make their transmitters for more companies than just paradox, that was my mistake 
however, to testing…
the remote transmits 3x when a button is pressed.
Closed = 0x12
Open = 0x13
if i press and hold the ‘Tamper’, than release it so it is active
it transmits ~20x with a mix of buttons from the 2 serials, i will try to order it
- SN#2-BTN=0x11
- SN#1-BTN=0x11
- SN#2-BTN=0x11
- SN#1-BTN=0x11
- SN#2-BTN=0x11
- SN#2-BTN=0x11
- SN#2-BTN=0x11
- SN#1-BTN=0x11
- SN#2-BTN=0x11
- SN#2-BTN=0x13
- SN#2-BTN=0x13
- SN#2-BTN=0x13
- SN#1-BTN=0x13
- SN#2-BTN=0x13
- SN#2-BTN=0x1A
- SN#1-BTN=0x1A
- SN#2-BTN=0x1A
- SN#1-BTN=0x1A
- SN#1-BTN=0x1A
- SN#2-BTN=0x1A
the amount of signals transmitted for each tamper button press varies and the amount each SN# transmits also varies,
i believed the signals are transmitted from both SN at same time and the flipper loses some as they overlap, however the start code is always 0x11 and final transmissions are 0x1A. the Middle code 0x13 is due to my leaving the transmitter in the ‘OPEN’ mode
edit
if i leave SN1 closed, and SN2 open- More Buttons appear SN1 starts with 0x10 while SN2 starts with typical 0x11
if i press the tamper quickly, to be good than bad, i than get 0x1B and 0x1C
so far i have only been testing while tamper is active, as the transmitter casing is removed.
i will Leave flipper next to the device for a few hours as it will send a periodic transmission to let the receiver know it is still active, i will post the Button Code when it comes through
didn’t quite understand you. name of the magellen system, ca.
open button 0x13 (always?)
close button 0x12 (always?)
What is a tamper and what is its function?
Sorry, i rush my words.
Tamper, is a switch that tells the system that someone has opened the transmitter and no longer secure, this can set alarm off, it is bad.
i just realise that all numbers so far i test with the transmitter cover off.
i retested to provide more CODE.
open Button, but system insecure 0x13 (with transmitter cover open and tamper switch released) (trouble)
Close Button, but system insecure 0x12 (with transmitter cover open and with tamper switch released) (trouble)
open Button, 0x11 (No Tamper, system secure) (intruder alert)
Close Button 0x10 (No Tamper, system secure, alarm happy)
Power on 0x18
Tamper Detected first code 0x11 followed by final Code 0x1A
same codes across 4x SN
i have a motion detector using same signal
motion detected = 0x21
motion Detected (with tamper) = 0x23
power on = 0x28
the SN# is correct for new device
6 buttons are useful.
Open (Tamper) 0x13
Close (Tamper) 0x12
Open 0x11
Close 0x10
Motion (Tamper) 0x23
Motion 0x21
so we will dance from this … + power on 0x28. Are there any other situations?
No, however, I am trying to transmit the current button codes using flipper, the RX light on the receiver doesn’t light up and it doesn’t recognise the code 
I did notice that the raw files work but it takes 0.5sec before the RX begins to flash?
0x18 = power on for product model DCT10
0x28 = power on for product model PMD75
I have also seen 0x1B and 0x1C
But I do not know what function they have
and it won’t, I didn’t finish sending, only receiving, the button code stopped me. today I want to send and add
1 Like
As I get other product models, I may be able to add a few more buttons, but this may take time. Is it difficult to add extra buttons later? what I have now is plenty :). The main thing would be, being able to change the SN to generate a new transmitter
serial number can be changed. on the buttons it’s more for beauty
1 Like
So tomorrow I will be going to a Jobsite with a few commonly used transmitters of a different model, I will try to test them and check the codes.
