[New protocol] 433.92 MHz, AM650: Dewenwils Remote Outlet Switch (0000-9999 addressable)

Sub-GHz
#1

In brief

Item Value
Product Dewenwils RF remote outlet switches
Frequency 433.92 MHz
Modulation AM650
FCC ID Q92-BH-U (similar filing via Q92BHOP: list of exhibits, FCC application)
Control IC HS2260C-R4 / G2CTN datasheet
Source https://smile.amazon.com/gp/product/B07TVB44T3/ ($22 as of 2022-4-23)

Details

Based on the internal solder bridge and the external labeling, these appear to support up to 9999 unique on/off pairs. When you buy a set, it comes with a remote and some matching receptacles. The receptacles can be reprogrammed to accept multiple inputs, but the remotes appear to be fixed.

The behavior sounds a lot like what Clive (bigclivedotcom on YouTube) has documented for generic 433 MHz RF switches on eBay, so I imagine Dewenwils is taking generic hardware and adding their branding atop.

I’ve attached the raw recordings of 10× pressing the 3 on/off buttons (6 buttons) to this post, however, there should be a wide range of potential codes. Some remotes come with 5 buttons, others only a single on/off pair.

I’ve also confirmed that all these files when played back on the Flipper control the devices as expected.

Recordings

Dewenwils remote 0304.zip (129.4 KB)

Filename Description
Dewen_1_off.sub 10× pressing #1 Off
Dewen_1_on.sub 10× pressing #1 On
Dewen_2_off.sub 10× pressing #2 Off
Dewen_2_on.sub 10× pressing #2 On
Dewen_3_off.sub 10× pressing #3 Off
Dewen_3_on.sub 10× pressing #3 On

Photos

Back cover with FCC ID

Dewenwils cover backside, revealing the FCC ID and details
Dewenwils cover backside, revealing the FCC ID and details4032×3024 3.8 MB

Back of PCB with control IC

Dewenwils PCB backside, revealing the control chip
Dewenwils PCB backside, revealing the control chip4032×3024 2.88 MB

Front of PCB with oscillator, buttons

Dewenwils PCB frontside, revealing the button layout
Dewenwils PCB frontside, revealing the button layout4032×3024 2.56 MB

1 Like
#2

I forgot to provide a link back to the pinned post that I followed to report this. Posted as a reply given new user restrictions.

Edit: New user restrictions lifted. I’ll keep this as a separate reply though.

1 Like
#3

I have a similar remote with the same chip, it uses the Princeton protocol. and supported by flipper

16508049405968040165242419950498
165080494059680401652424199504982016×4032 2.41 MB

1650804983083812873568783673798
16508049830838128735687836737982016×4032 2.52 MB

1 Like
#4

although yes. you also have the Princeton protocol BUT in very short periods. Now I’ll see what I can do with it.

image
image1311×1274 148 KB

working )
fix

this protocol supports receiving saving downloading transmission

1 Like
#5

Thank you! I’ve flashed your firmware changes and now both reading and emulating work!

The remote appears to send a unique code for each button pressed, then a non-specific “buttons released” code whenever any button is released. I imagine this would be for press-and-hold functionality, but the Dewenwils receptacles at least only care about the button press event, not the released event, so you only have to save/emulate the first part.

Dewenwils remote 0304 - Princeton test.zip (789 Bytes)

Filename Description
Dewen_1_off_down.sub Down press of #1 Off
Dewen_1_on_down.sub Down press of #1 On
Dewen_buttons_released.sub Releasing any button (#1 Off, #1 On tested)

In the future, a way to combine multiple recognized protocol events to a single file on the Flipper itself would be handy. I haven’t tried this, but I’m assuming you can just merge together the text contents of multiple .sub files on desktop/mobile.

#6

the microcircuit is standard, and the protocol too, I think that this is just a bug of this microcircuit, and the code with button calls is not necessary, also if you look at the logic analyzer, there is not always a code with released buttons, it feels like if the microcircuit starts the transmission, then it should not finish and the buttons are already released

1 Like