Dooya (and clones) electric roller shutters / blinds

Sub-GHz
#1

Hello!
I would like to request support for dooya remotes.

  1. They operate between 433.887MHz and 443.92 Mhz
  2. I think the signal is PWM with 350 µs short 720 µs long with a 4800 initial sync (This is what worked for me in the plotter)
  3. Static code
  4. The flipper zero is capable of recording the signal in raw mode and it can effortlessly control the electric roller shutters by replaying the recorded data.

I have to break down this to several posts, because of the “Sorry, new users can only put 5 embedded media items in a post.” error.

I will attach pictures of 2 remotes. Both are completely functional. The first is a cheap counterfeit with no FCC ID and the second is an official Dooya remote. The raw recordings have been recorded from the counterfeit, because I no longer own the official.

Raw recordings (1/2):
Down_long.sub (19.8 KB)
Down_short.sub (5.9 KB)

#2

Raw recordings (2/2):
Stop.sub (16.9 KB)
Up_long.sub (18.5 KB)
Up_short.sub (4.8 KB)

#3

Pictures of my counterfeit remote (single channel, no FCC ID)

photo1670267089 (3)
photo1670267089 (3)591×1280 85.6 KB

photo1670267089 (2)
photo1670267089 (2)591×1280 67 KB

photo1670267089 (1)
photo1670267089 (1)591×1280 43 KB

photo1670267089
photo1670267089591×1280 61.5 KB

#4

Pictures of a real compatible Dooya controller I no longer own (multi channel) (FCC ID: VYY-DC1662)

2318338-0 (1)
2318338-0 (1)865×1396 105 KB

2318337-0 (1)
2318337-0 (1)865×1396 60.6 KB

#5

I implement support for this system, if it is possible to find records of a multi-channel remote control, in order to find out where the system channel is encoded

1 Like
#6

Please check before adding to DEV. there are several questions about the performance of the implementation

1 Like
#7

and give entries S4, S5, S6, S9 buttons. And it will be EXTREMELY useful to record buttons from another remote

1 Like
#8

Cool !

#9

https://wiki.razgovorov.ru/index.php/Dooya_tubular_motor

#10

Шторы_пульт_DC1673.zip (136.7 KB)

#11
#12

Hi, I have DOOYA DC306A remote https://fccid.io/2AJXR-DC306A/User-Manual/User-Manual-3204581
I have 4 roller shutters programmed, fifth option was not programed to anything AFAIK, I also added option to run them all together. If you need dumps from RTL-SDR I can help with that too.

I named files counting them from top to bottom, the bottom option is the one I don’t use.
Dooya.zip (289.9 KB)

#13

@SkorP tested with latest dev and it detects properly, what is weird is that on button press it sends commands, button_short and button_long but roller shutter only reacts to the long one.

#14

in the original package, with a short press, 2 different packets are sent, with a long press, only 1 and what exactly the system reacts to, I can’t know, let it be as in the original

#15

Hi, I got a DC90 5 channel remote (labeled DC174) with light for my blinds.

It looks like this: https://photos.app.goo.gl/YvLwZxvYmr8TrCSU9
and has the same Schematic as https://fccid.io/VYY-DC90

These are the values I got from it:

/*
 * 																	serial       s/m  ch      key
 * long press down (S1)		X * B51C1B D133, 40b		101101010001110000011011 1101 0001 00110011
 *
 * short press down (S1)	3 * B51C1B D133, 40b		101101010001110000011011 1101 0001 00110011
 *							3 * B51C1B D13C, 40b		101101010001110000011011 1101 0001 00111100
 *
 * press stop (S2)			3 * B51C1B D155, 40b		101101010001110000011011 1101 0001 01010101
 *
 * long press up (S3)		X * B51C1B D111, 40b		101101010001110000011011 1101 0001 00010001
 *
 * short press up (S3)		3 * B51C1B D111, 40b		101101010001110000011011 1101 0001 00010001
 *							3 * B51C1B D11E, 40b		101101010001110000011011 1101 0001 00011110
 *
 * press light (S6)		1 * 3 * B51C1B D10F, 40b		101101010001110000011011 1101 0001 00001111
 *
 * press prog (P2)			3 * B51C1B D1CC, 40b		101101010001110000011011 1101 0001 11001100
 *
 * press circle (S7)		does nothing
 */

It seems the s/m and the ch values are different and dooya.c doesn’t recognize it (Normal Read). Only Read Raw works. Replaying and manually running .sub files works with these values. (Tested with Firmware 0.83.1)

Sub files (can't upload them)

DC174_S1_UP_11.sub

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Dooya
Bit: 40
Key: 00 00 00 B5 1C 1B D1 11

DC174_S2_STOP_55.sub

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Dooya
Bit: 40
Key: 00 00 00 B5 1C 1B D1 55

DC174_S3_DOWN_33.sub

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Dooya
Bit: 40
Key: 00 00 00 B5 1C 1B D1 33

DC174_S6_LIGHT_0F.sub

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Dooya
Bit: 40
Key: 00 00 00 B5 1C 1B D1 0F