433Mhz transmitters deciphering and teardown

I've been doing yet more digging around with these little 433Mhz transmitters. These are the ones found in a lot of home automation hardware now, as well as wireless alarm system, remote garage door and shutter controllers and a lot more.
I've got a few different ones here at home, so I thought I'd go through each one and work out how they work and what different functions they leverage for their operation. The main goal behind this was to determine reliability (Which I'll get onto later).

Here are the 5 different models I have:

X11 alarm remote	X11 light control
Garage door/Shutter remote	Alarm door sensor
Alarm remote control

All five of these have remote control capabilities and operate in a similar way, so the first thing was to take a look at how they all operated.

The first was the X11 alarm remote:

That's both sides of the small board inside. Difficult to see, but on the top photo is the battery source (2x3v) and to the right of it is the 433Mhz transmitter 'can' with 433 printed onto it, so I know it's a 433mhz transmission type. Looking on the back was interesting though, it didn't have one of the 'standard' chips used for 433Mhz transmission, and actually had a custom 14-pin chip in it with no markings at all on it. My guess is this is a custom mini microcontroller with custom firmare burnt onto it. There were very few other components, a diode, resistors and an LED. So not much to go on. I started my 433Mhz sniffer application (Using an arduino with a 433Mhz receiver chip connected) and got no signal at all on any mode. This makes me think they are doing custom modulation with the 433Mhz signal and no much chance of decoding it.

The second one I tried was another X11 remote, this time just used for lighting control:

On this one there was the transmitter can in the middle (With the red insulating foam around it) but no mention of 433Mhz. I assumed it would be. I then looked into the chip in the middle, which was a EM78P153AN. Looking this up, I found it to be an 8-bit microcontroller with OTP ROM, so again a chip with custom firmware burnt onto it. Again not many other components on either side of the board, a few resistors, diodes and that was about it. Running my 433Mhz sniffer I didn't get anything I could decode, so again assuming this is using similar coding to the previous X11 remote and can't get into what it was sending.

The above two isn't entirely surprising, X11 protocols for their remotes are 'encrypted' or at least made to not be easy to hack or replicate using standard duplication techniques. Whether they use rolling codes or not I'm unsure, but they certainly have the ability to do this since they have the custom microcontroller on board which could run all sorts of interesting code.

I then turned my attention to the more 'basic' 433Mhz transmitters. Firstly the one for the garage door/shutters:

This one was for a commercial shutter. Any to my surprise when opened up, the 'can' said it all! 13,560Mhz! Now this was supplied by a shutter company for use here in the UK, I'm not 100% sure but I don't believe these are legal to use in the UK due to licensing.
Looking at the rest of the board, there is a 430G2332 chip which is a mixed signal microcontroller, and beside it the 7110FE which is either a second microcontroller or a voltage regulator chip. Either way this remote wasn't much use since it wasn't 433Mhz so I didn't investigate any further.


This then takes me onto the alarm sensor unit:

On the front of the board (Bottom photo) you can see the multicolour LED top left (Red and Green), then the top right is the can for the 433Mhz crystal. To the left is the reed switch (for the door) a capacitor and then to the bottom (above the battery slot) are 4 dip switches. These vary the code transmitted (well, the first two, the 3rd and 4th don't seem to make a difference).
On the back of the board we can see the main chip (towards the bottom of the board). It's covered in resin gunk but I could still make out the chip which was EV1527 OTP encoder which is on most of the 433Mhz boards. The 8-pin schematic shows:

And can take a voltage range from 3v to 12v. And by setting K0-3 to either 1 or 0 it will change the data output (D0-3). In this units case it only appears to have two of these linked to the dip switches but I'd assume you could connect the rest up if you wished. Looking at a close-up of the circuit I can see where the traces are missing:

So the common row of 4 pins along the top of the DIP switches go to a connection pad (see below, this is the reed switch connection). Then only one line is brought down from the chip (pin5 K0) so this is the only one that will be affected by changing the DIP switches. So effectively this version allows two values to be chosen.
However, this is almost unrequired, as the chip itself has a burnt-in at factory value as part of the output code:

So the C0~C19 is burnt into the chip and forms part of the initial code, followed by the user-defined 4 character selection. This should therefore mean that no two chips are identical (assuming we don't hit the same code from the choice of 1 million!) in their transmitted codes, so should be safe from colliding with another unit.
The reed switch lower solder joint goes to the top row of pins on the DIP switches (and so ultimately to pin 5 K0). The other side of the reed switch goes to capacitor C1 (tiny smd) and to J3Y which is a switching transistor, which will be to handle the switching voltage for the chip.
Pin 6 is pulled to ground constantly (as it the ground pin for the chip).
The positive pin (2) for the chip is only energised when the transmitter needs to be powered up, and so is therefore controlled by the rest of the circuits switching transistors and trigger with a timed value. This therefore allows the circuit to detect when the reed switch is broken it will trigger a timed burst of voltage to the chip and transmit it's signal. This only works because this is a one-way circuit, it only transmits, so has no method of testing battery voltage and letting the alarm know, nor does it know the state of the alarm or any other state. It simply gets woken up by voltage being sent to the chip which immediately starts transmitting it's value and then gets power removed.
This method is good for low power consumption as when not transmitting it'll use very little idle power (Just a transistor switch, remember we want to trigger the signal when the circuit is broken, so it's known as a NC normally closed circuit).

However this also highlights the weakness in this system. Firstly the system only has one go at sending data, if that fails then there are no retries. In practice I've tested this with my 433Mhz receiver and I do only see a single transmitted value from the unit when the reed switch is removed. So the alarm receiver has to get the signal the first time, otherwise it would be missed. This is where an improvement should be made and setup so the signal repeats several times.

Another unknown for now is the multi-colour LED. It has both red and green in the package, and will trigger both colours. When the reed switch is triggered the red LED will come on then flicker red and green (and off) until completely off. This seems to be a capacitor discharge timer/reduction of power, so I think the circuit must charge the capacitor (47uF 16v on the front of the board?) and then use the capacitor discharge to supply power to the transmitter circuit. I'm therefore unsure what the different colours indicate. There is also the push button on the front of the board. This forces the transmission of the code. I'd expected this to simply bridge the reed switch, but upon learning about the circuit (and realising it's NC) then this couldn't be possible. Therefore it seems to force a power 'jolt' to the circuitry and forcibly power up the chip. This keeps repeating the code so it is powered direct from the battery I think. This causes the LED to flicker red and green constantly until I release the button, at which point the LED stays lit up GREEN! It won't go off until I remove the battery, so is almost like a power indicator showing that power is being supplied by the battery (but not supplied to the chip).

UPDATE: I did a bit more testing and worked out the LED colour conditions! They indicate battery state. The battery I was testing with was an older one (These are 23A/MN21 12v batteries) and actually on testing with the meter showed only a 6v output without load. Therefore this shows that I believe the green/orange light indicates low battery/poor output state. I think it was keeping the green LED on to show that voltage was low and needed replacing! (Would be better the other way round, red instead of green!) Putting a full battery in (showing 12v) when moving the reed switch away the LED lit bright RED and transmitted it's code twice before the LED flickered and went off. (No green shown on the LED at all) So this appears to be a basic indicator for battery state, when low it will show yellow/orange/green to tell you to replace!

The transmitted code can be read by my 433Mhz receiver and I can see it's a simple code being sent at 24-bit, an example of a code would be 3528277. This I can see repeated at each trigger, so they aren't rolling codes or anything sophisticated.
I can therefore transmit this code and 'emulate' the sensor if for whatever reason I needed to.


The alarm remote control was the last unit I took a look at.

It contains four buttons for 'SET', 'UNSET', 'HOME-SET' and 'PANIC'. These four seem to send different codes, so I suspect they simply set the different K0-3 pins on the same chip.

Here is the circuit itself, you can see the BXR433A can to the top middle, the 12v battery sits in the middle.
At the bottom middle you can see the SCT2260 (Also known as the PT2260) chip which does the RF encoding. This uses a similar technique to the other 433Mhz transmitter chips and the pin-out along with an example 4-button transmitter is on the datasheet:

So that looks like how this unit is being used.


Finally, I wanted to find out a constant bug that was appearing on my setup. On the remote transmitters, these seemed to sometimes fail and not set or unset the units. This is strange as the LED on the transmitter always lit up and it always appeared to send a code. Sniffing the codes I can see a code transmitted at every press of the buttons. HOWEVER the code sometimes changed (and not just once. When it happened the transmitter would send 3 or 4 of this incorrect code, not changing). Initially I dismissed this as just because of poor antenna or receivers or similar, so this is something to investigate further.
That's for the next part of debugging I think!

Follow up: Wireless home alarm system from ebay 433Mhz

I've finally installed and setup the alarm I bought from eBay a few weeks ago (See post: http://www.thebmwz3.co.uk/2016/08/wireless-home-alarm-system-from-ebay.html ) and found a few extra little notes to add to anyone using it or looking to buy.
Firstly, the setup is actually straight forward, as per my previous blog post on it, configuring it and getting it working was simple enough.

I ordered a sim card (It needs to be an older 2G version) from o2, put some credit on and installed it, works great it sent me a text when power failed, power returned and when the alarm had triggered and the reason for the trigger. Pretty neat. I found that it was better to power off before inserting the sim as sometimes if you inserted it with power on it didn't recognise it and start to use it. A few interesting features I found, firstly if you ring the alarm from another phone it'll answer (give it quite a few rings) and it'll ask for your pin code (just the standard pin/alarm code) and give you the options: 1 to arm, 2 to disarm, 3 to monitor (listen) or 4 for intercom. There are also a couple of hidden options, press 5 and it triggers SOS/panic and goes to alarm straight away. I also found the * option played back what sounded like a technician setting the system up (In a language I didn't recognise so can't tell what he was saying!), I'm assuming that was a pre-recording loaded onto the sound chip by mistake and they probably didn't intend anyone to find it!
Unfortunately it didn't tell you the current state of the alarm which was one thing I was after.

Installing the wireless sensors was easy enough, they came with fixing brackets and also double-sided sticky pads, and it was easy to fit and test.
These are very basic 433Mhz devices, found in a lot of hobby electronics (and arduino kits), and in this alarm they seem to be only 1-way units, i.e. the sensor sends it's alarm state to the control panel, no return path from the alarm to tell it when it's armed (to save battery life), whether it's been tampered, if it's still alive (dead battery), if it's signal is OK (doesn't detect jamming/malicious signals), etc. So this is the true weakness of the system.

Here are the insides of one of the door sensors.

You can see the typical 433Mhz can at the top right (R433A), along with the spring antenna it uses. On the left is the reed switch and top left is the tri-colour LED. On the back are the electronics and it's all controlled by the chip you can see middle right of the photo. The chip is the typical EV1527 OTP encoder with configurable code setting.

I did like that they left in the jumpers for helping to set a 'random' coded sequence on them, the theory being you set these to random positions so they're unique to your alarm and individual sensor setup. I changed mine just because I could and in theory thought anyone near me (There is probably only one house close to me!) wouldn't bother/know this. They also need to be unique otherwise two sensors will share the same code and trigger the same input.

Note that they came with the 23A 12v battery installed, and I've had at least two die since installation, so I'd say go out and buy a pack of them and replace them as soon as you purchase.
This has also exposed another weakness, knowing when the batteries run down. Most of the time you notice the little red flicker when you open the doors, but that means you wait until they're dead before replacing. There is also an odd flicker pattern. When you open the door it goes bright red then flickers 3 or 4 times getting dimmer each time. (Capacitor discharge timer?) If you press the button and hold it the red light flickers then goes orange and green. I've got no idea what the different colours of the lights mean, so when I've replaced the batteries with new ones I'll add extra info here on them, my hope is they are green for good battery and drop to red/orange when low battery (Too much to ask?).

Next was wiring up an external bellbox. Although one came with the unit, I also had a traditional bellbox that I could use. As normal this had various feeds into it, labelled:
holdoff - and + = These are the power supply (12v) to the unit that charged the battery and also acted as the power feed.
STB - = Strobe negative switched trigger
TRG = Siren negative switched trigger
LOOP = negative feed from alarm (This acts as a tamper circuit)

The problem here is that the alarm uses positive switching for it's alarm trigger output (On the back of the alarm it's BZ+ and BZ-, BZ- is common to ground so not switched), so therefore I had to be a little creative. A cheap 12v optocoupled relay looked like the best option (http://r.ebay.com/EvgMbn)

Which you feed with 12v constant and then when the IN terminal goes high it'll activate the relay (If you set the switchable trigger to HIGH). This way it protects the alarm from any noise/spikes from the relay itself and triggers on high. You can then connect the holdoff - (supply) to COM on the relay and then feed NO to the TRG and STB terminals, so when the relay is triggered it'll set the alarm off. It also has the advantage that the battery built into your bellbox can be enabled so if wires are cut, etc, then it will trigger the sounder on it's own.

The next part to tackle was a magnetic door switch (non wireless), this was for the garage doors. So I had the relevant magnetic reed switch, just needed to feed two wires back to the alarm from it, and wire them into the Z1 contact. This is wired in between common/ground and the zone input (with a resistor in series too). The manual wasn't very good at explaining how to wire it, so it was a bit trial and error!

So if you have normally closed contacts (Like most magnetic door switches are) then you put the resistor inline (10k ohm supplied in the box) and connect back to ground.
For a normally open contact you put the resistor in parallel to your sensor and wire it into ground and the zone you need.
(Ignore the Pusitive (!) and power supply lines, I have no idea why they included them on this diagram unless to show electrical isolation)

Setting up the wired zones didn't seem to go right to start with, but I finally figured it out.
Each zone you can setup with one of the following modes:
0) Sensor will not trigger in any status (disabled zones)
1) Sensor will trigger the alarm when in out or home alarm state
2) Sensor will trigger the alarm when set to out state only (for PIRs, etc)
3) Sensor will trigger the alarm in any status (for smoke alarm, panic alarm, etc)

So to set the wired alarm into state 1 you are supposed to use key function
47811 (47 is the menu code, 81 is the wired zone code range [81-88])
However when I did this the alarm didn't confirm the setting, just returned to the menu, like it was an invalid setting. I then tried each one in turn and it seems 81 didn't accept it, but 82-88 did. I have my sensor still in zone1 and it works in mode 1, so not sure if that is a constant setting for that or something similar, but it seems to work.

All in all, I'm quite impressed. It installed without too much challenge and is working great with the remotes.
A few negative points:

• Remote-only 'home' alarm mode. There is no way of setting the home mode from the panel itself, so you need a remote to set that mode.
• Positive triggers (for sounders) as noted above, so needed a relay to solve this
• No indication (that I've found) that it'll alert me to batteries going low on the sensors
• No remote way of determining if alarm is armed or not
• Timer is always active on zones, so no matter which zone is triggering the alarm, the timer starts counting before the alarm sounds

I'm also thinking of changing the resistor on the speaker as now it's in 'production' use it's actually a little bit too quiet, so might change this in the near future.

Next up I'm also going to start to sniff the protocol and traffic going through the 433Mhz system and see if I can also 'read' the sensor states and anything else the units chatter about during normal operations, this may prove interesting as may help determine how 'secure' or at least tamper resistant the system will be. Again this is in theory, because as usual an intruder would need to know this was the system in use, and sniff/understand the frequencies involved to try to use them to their advantage. I suspect brute-force attempts to jam it won't work very well from outside the house, otherwise they would need to learn/replay the remote control codes to help de-activate it, as all other signals would trigger the alarm. (All just conjecture at this point in time)

UPDATE 12/sept:
I've done a little sniffing using my Arduino 433Mhz receivers, and sure enough I can see some of the communications. Generally I can see the PIRs sending their current movement state, so when movement is detected they send a stream of their code. I've not seen any values from the door sensors as yet or other sensors but this may be the mode I've been testing using my Arduino. I've also seen some limited codes from the remotes, they don't appear to be rolling code units but I do see several codes sent on each keypress that I'm going to investigate further.
My conclusion is that it's not got a very secure wireless component to it, it uses hobby electronic frequencies which increase the chance of interference and also jamming/hacking into it. I've not yet tried to replay codes and see if the system accepts or rejects them at this point in time.

Wireless 433Mhz home alarm system from ebay

Following on with my faulty alarm problems at home (The X10 system) I've been looking for an alternative, waiting for when the current one acts up enough to warrant buying a replacement.
This week it did just that, making strange noises from the sounder and forgetting the remote fobs. So I decided to look around.
I had a few requirements:

• wireless (to avoid the need for long wiring runs to the sensors)
• gsm/remote alerting (to sms or ring me during alarm conditions or let me remotely check status, arm/disarm, etc)
• keychain/remote arm/disarm (Wife and daughter prefer these to tapping in a code)
• Interface with my home automation systems (More tricky, but basically have some I/O I can tap into)
• "nice" appearance. It'll be in a prime location in the house so don't want it to look terrible.
• Cheap (ish) as I'm a cheap-skate so don't want to spend a lot of money on a solution that I'll never be 100% happy with (I also have a high expectation for electronics, so I'm never happy!)

So after a lot of searching, I found a system that might fit the majority of my requirements, and have the potential for expansion and tinkering. It's also not mega-expensive which gives me more incentive to take a look inside and tinker with it!

The ebay listing I found was this one, so the unit came with the control box (and PSU), 3 door sensors, 3 motion/pir sensors, 1 smoke sensor, two keychain remotes, one additional sounder and an outside bell/sounder box. Not a bad package for the price I feel.

Delivery was in a couple of days, so now I have the unit I've started to play with it. So here are my findings on the unit. Firstly it's not the best plastic casing I've ever encountered. It's distinctly cheap, but rounded corners and smooth edges so it's not going to win a fashion award, but it's also not too hideous to put in your hallway!

This is the main control unit, front. At the front you have the two speaker grills either side (As I found out, one is a microphone and one is a speaker). Behind the clip down door is the push button keypad. At the top you have the LCD screen and a series of LED indicators either side for constant system status.

This is the rear view. You can see the 12v power cable going in, the SIM slot and the various I/O screw terminals. To the left you can see an on/off switch. This worried me slightly immediately when I found it, assuming it would turn the whole system on and off. However as it turns out this is only the battery master switch, normal power was not controlled by this switch!

The screw terminals provide 8 wired inputs (and can take normally open or normally closed with the use of a set of resistors supplied), it also has a sounder +/- terminal, a constant 9v output for supplying alarm boxes, etc. Two GND terminals for the I/O ports, then the final two are COM and NO which I've yet to work out their function or use.

Powering it up for the first time, I found the speaker to be VERY loud, even normal arm/disarm and voice prompts were at a volume unbearable for setting it up. The volume level I suspect was fixed so it always ran at that level, no configuration to set it either which was disappointing. So the first job I'd have to do was change this, as it was almost unusable in this state as soon as it was put up it would annoy me!

So, the back came off and I discovered some very recognisable components inside:

Looking at the board, top left (blue square) is a relay, which I think will be the alarm output switched contact.

Below it is a ZTE cellular modem which supports SMS and telephone calls. The coil to the left of it I think is the internal antenna for it (There is also the on-chip connector for external antenna if you need it). To the right of it is the SIM card (with mine inserted). NOTE: This is 2G only (EDGE/GPRS) so you need to find a mobile company that supports this (So O2, T-Mobile/EE I believe should be OK. Three is NOT an option - I tested this). So the potential here is that this won't work very well, and not for long as mobile networks phase out their 2G networks, so something to be aware of here. However chances are you can just swap the board for a newer equivalent that uses the same AT command set.

Over to the top right (with the yellow outline) is a small backup battery, this probably keeps power to the EEPROM for storage of data, time, system state, etc.

The to the very right of the board (which has the black wire coming out of it) is a very recognisable part! It is a 477Mhz receiver that is commonly used in Arduino and hobby electronics, soldered on as a daughterboard. The black wire is the antenna.

If you then look to the bottom left, you'll see the matching 477Mhz transmitter board with it's own black antenna wire running along the left towards the top. So these two are standard boards that you can buy for Arduino development.

Here are similar modules you can buy easily for Arduino development:

Above the transmitter board is a two-pin connector, this connects to the speaker round the front.

Here is the front of the board:

Here you can see the microphone to the top right (I've flipped the board) and the LCD screen and various status LEDs. You can also see the copper contacts for the buttons.

These may need to be altered as the key button presses aren't very accurate, so probably need some better contacts here which i'll work on another time.

This is the front casing, showing the 8 Ohm 5W speaker and plastic casing and buttons.

So, first job is to reduce the volume output of the speaker. Since it's not used much and doesn't carry high current I'm going to simply wire a resistor in series with one of the leads.

The final soldering and resistor work looks like this:

That was a larger value than I'd wanted to apply (120 ohm) but it should reduce the volume appropriately. I powered it up and it reduced the volume pretty well, perhaps a little low (as it had distorted the spoken voice slightly) but that should do for now (It was the lowest resistor value I had!)

Now onto the 433Mhz sensors. These attached to the doors/windows and had a magnet one side and a reed switch a the other, very simple typical design really, so taking a look inside it:

Top left is the red LED which flashes when triggered. Top right is the 433Mhz transmitter crystal, the spring to the right is the antenna.

The push button is brought to the front of the unit as a press button (This is for setting, to trigger a signal). At the bottom is a 12v battery, and above it is a set of 4 jumper pin positions. I'm assuming these set a unique code for the unit so you can change it if so desired, adding a little more security to your setup. Naturally, no instructions on this! To the left you can see the reed switch soldered in there (and without trimming the excess wire!), so quite a simple design once again.

On the other side of the board is all of the transmitter electronics:

Which I was actually surprised it was so complex, as again this is just a simple 477Mh transmitter when the reed switch was activated. I'll dig into the wiring at some future date.

So there it is, all in all there are good points and bad points. For example, 477Mhz is hobby electronics, so you CAN sniff the traffic and protocols, and no doubt spend enough time to watch the data and decode/decrypt them. But for the average user and average building security this unit will do the job nicely.

UPDATE:
I've noted down all the relevant chips I've discovered and looked up so far:

Follow-up to this is HERE: http://www.thebmwz3.co.uk/2016/09/follow-up-wireless-home-alarm-system.html