Help translating command code to flipper zero format

Hi,

I want to use the flipper as a IR remote for my Bluetooth speaker. I lost the remote and therefore cannot scan it with the flipper.

The user manual mentions the following:
NEC factory code 1x01
Power command 0x40

I’m IRDB, the power button is assigned the following:

name: Power
type: parsed
protocol: NEC
address: 80 00 00 00
command: 02 00 00 00

For volume down, manual mentions 0xA0 but the ir file in IRDB is set as follow:
name: Minus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 05 00 00 00

How did they convert 0x40 to 02 00 00 00 and 0xA0 to 05 00 00 00

Asking this so I can add some missing commands to the IRDB for that device (KEF LSX speaker).

Thanks

1 Like

I appreciate the idea. But after a little research, I wonder.

If I google for ‘KEX LSX remote’, the pictures showing a 8 button remote.
The Flipper-IRDB File KEF_LSX_Speakers.ir contains 8 commands.

Are you searching hidden function?

I’ve not been able to decipher a formula and I’ve wondered whether there is a formula at all. It may be a database. To translate codes I use a universal remote app and just broadcast the code I want then capture that code with the Flipper.

Hi,

Yes the remote has 8 buttons but there are some hidden functions. See manual page 76 here: https://assets.kef.com/pdf_doc/LSX/LSXmanual_EN_v4-20200220.pdf

Some of those functions are very useful, for instance the one to select one particular audio source (instead of toggling source button from the default 8 commands).

Thanks for your help.

1 Like

I’m going to put that into a spreadsheet and see what I can do with it.

I don’t see a pattern but I can make you a brute force file. I just ask people share the codes when I do that.

1 Like

So, you already put some effort in the research. very good. Let’s go from there.

At first, the manuals says:

LSX works with universal programmable remote control
provided that the remote control controls. manufacturers
have implemented KEF IR command codes in their
remote.

What are KEF IR codes? I thought is kind of a protocol, on top of the NEC header. But lets take a look, deeper in the rabbit hole.

I opened a spreadsheet (excel, calc, …) and copy and pasted the values from the manual in the first row.
‘Libre Office Calc’ is not very handy, the result was:
1 Power On/Off Toggle 0x40 so I started in row 2, with =RIGHT(A9;4)0x04

Then I used the given IR file and started to match the buttons:

Maual Extract FZ_IR BtnName
1 Power On/Off Toggle 0x40 0x40 02 00 00 00 Power
2 Mute/ Unmute Toggle 0x20 0x20 04 00 00 00 Mute
3 Play/Pause 0x18 0x18 18 00 00 00 Play_pause
4 Next 0x52 0x52 4A 00 00 00 Next

Not very helpful. But in the end it is all zero and one. Most spreadsheets got a function, like ‘Hex2Bin’
Convert manual codes: =REPT("0";8-LEN(HEX2BIN(RIGHT(A9;2))))&(HEX2BIN(RIGHT(A9;2)))
Convert IR file codes: =REPT("0";8-LEN(HEX2BIN(LEFT(C9;2))))&(HEX2BIN(LEFT(C9;2)))

Maual Extract FZ_IR BtnName h2b_man h2b_ir
1 Power On/Off Toggle 0x40 0x40 02 00 00 00 Power 01000000 00000010
2 Mute/ Unmute Toggle 0x20 0x20 04 00 00 00 Mute 00100000 00000100
3 Play/Pause 0x18 0x18 18 00 00 00 Play_pause 00011000 00011000
4 Next 0x52 0x52 4A 00 00 00 Next 01010010 01001010
5 Source toggle 0x58 0x58 1A 00 00 00 Source 01011000 00011010
6 Volume Up 0x60 0x60 06 00 00 00 Plus 01100000 00000110
7 Volume Down 0xA0 0xA0 05 00 00 00 Minus 10100000 00000101
8 Previous 0xD2 0xD2 4B 00 00 00 Previous 11010010 01001011

The 8 codes are just Reversed?

Reversing in Spreadsheet is crap. But luckily we have only 8 digits:
=RIGHT(E17;1)&LEFT(RIGHT(E17;2);1)&LEFT(RIGHT(E17;3);1)&LEFT(RIGHT(E17;4);1)&LEFT(RIGHT(E17;5);1)&LEFT(RIGHT(E17;6);1)&LEFT(RIGHT(E17;7);1)&LEFT(RIGHT(E17;8);1)

And back to a flipper zero .ir file code: =BIN2HEX(F17)&" 00 00 00"

Result in Row ‘FZ_IR’:

Manual Extract FZ_IR BtnName h2b_man h2b_ir
1 Power On/Off Toggle 0x40 0x40 02 00 00 00 Power 01000000 00000010
2 Mute/ Unmute Toggle 0x20 0x20 04 00 00 00 Mute 00100000 00000100
3 Play/Pause 0x18 0x18 18 00 00 00 Play_pause 00011000 00011000
4 Next 0x52 0x52 4A 00 00 00 Next 01010010 01001010
5 Source toggle 0x58 0x58 1A 00 00 00 Source 01011000 00011010
6 Volume Up 0x60 0x60 06 00 00 00 Plus 01100000 00000110
7 Volume Down 0xA0 0xA0 05 00 00 00 Minus 10100000 00000101
8 Previous 0xD2 0xD2 4B 00 00 00 Previous 11010010 01001011
9 Power ON 0x38 0x38 1C 00 00 00 00111000 00011100
10 Power OFF 0x3A 0x3A 5C 00 00 00 00111010 01011100
11 Mute 0x48 0x48 12 00 00 00 01001000 00010010
12 Un-Mute 0x4A 0x4A 52 00 00 00 01001010 01010010
13 Source: Wi-Fi 0x30 0x30 C 00 00 00 00110000 00001100
14 Source: Bluetooth 0x2A 0x2A 54 00 00 00 00101010 01010100
15 Bluetooth Pairing 0x98 0x98 19 00 00 00 10011000 00011001
16 Source: AUX 0x02 0x02 40 00 00 00 00000010 01000000
17 Source: Optical 0x0A 0x0A 50 00 00 00 00001010 01010000
18 Source: USB 0x1A 0x1A 58 00 00 00 00011010 01011000
19 Preset Volume (30%) 0x78 0x78 1E 00 00 00 01111000 00011110

The leading 0 is missing at the code ‘13 source:Wifi’ … but it should be good enough.

Brute force is never a solution. It is the sledge hammer, if the situation is not enough analyzed :wink:

2 Likes

I was doing the same thing in calc but I didn’t get as far as you. Good job! I love a good spreadsheet though so I took your work a step further and heavily used CONCATENATE() to write the text of the .ir file. I had to look up how to add newlines in calc(“Ctrl”+ “Enter”).

Filetype: IR signals file
Version: 1
#
name: Power
type: parsed
protocol: NEC
address: 80 00 00 00
command: 02 00 00 00
#
name: Mute
type: parsed
protocol: NEC
address: 80 00 00 00
command: 04 00 00 00
#
name: Play_pause
type: parsed
protocol: NEC
address: 80 00 00 00
command: 18 00 00 00
#
name: Next
type: parsed
protocol: NEC
address: 80 00 00 00
command: 4A 00 00 00
#
name: Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1A 00 00 00
#
name: Plus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 06 00 00 00
#
name: Minus
type: parsed
protocol: NEC
address: 80 00 00 00
command: 05 00 00 00
#
name: Previous
type: parsed
protocol: NEC
address: 80 00 00 00
command: 4B 00 00 00
#
name: Power_On
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1C 00 00 00
#
name: Power_Off
type: parsed
protocol: NEC
address: 80 00 00 00
command: 5C 00 00 00
#
name: Mute_On
type: parsed
protocol: NEC
address: 80 00 00 00
command: 12 00 00 00
#
name: Mute_Off
type: parsed
protocol: NEC
address: 80 00 00 00
command: 52 00 00 00
#
name: WiFi_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: C 00 00 00
#
name: Bluetooth_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 54 00 00 00
#
name: Bluetooth_Pairing
type: parsed
protocol: NEC
address: 80 00 00 00
command: 19 00 00 00
#
name: Aux_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 40 00 00 00
#
name: Optical_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 50 00 00 00
#
name: USB_Source
type: parsed
protocol: NEC
address: 80 00 00 00
command: 58 00 00 00
#
name: Volume_30
type: parsed
protocol: NEC
address: 80 00 00 00
command: 1E 00 00 00


Great analysis !
The reverse part makes me wonder if that is due to the NEC protocol sending the command code then the natural inverse of the command code, and somehow KEF picked the inverse part for their user manual…
anyway great find, I will test this and come back with the results.

thanks

1 Like

A good NEC protocol explanation is here: https://exploreembedded.com/wiki/NEC_IR_Remote_Control_Interface_with_8051

Notice the same code is transmitted ‘forward’ and ‘logical reversed’. After the 9ms mark + 4,5ms space, at first the address 2 times (straight than inversed), than the command 2 times (straight than reversed).

I assume the flipper firmware want to safe space, so the code is saved only one time and played 2 times. If you store only 50% of the code and replay it: which one is the ‘real’ and which is the ‘mirrored’?
The KEF documentation goes the same way, but decided inverse?

1 Like

Great job!

Thanks.
I quickly checked tonight with your brute force file and definitely some commands are missing.
I can’t understand the discrepancy between the manual provided IR code and the working codes based on Brite force. I may purchase a spare remote to help understand.

Once I have some time, I’ll update the IR DB with the new commands I tested with the brute force.

1 Like

It’s working.
I’ll update the IRDB once I have some time.
Thanks

2 Likes