[New Protocol] CW Products PowerSmart / SolarSmart Roller Shutters RF433.43 Raw Captures

plains203 · June 17, 2022, 2:10am

I have some CW Product PowerSmart Roller Shutters.
The can be controlled by RF remotes once they have been paired.
The keys are static codes and I can play them back.
The remote also works for their SolarSmart range.
I could only find an FCC report for their SensiFire product. This does integrate with the Controllers.

Button Captures
41-500-106.zip (222.0 KB)
These are 10x captures for all 6 channels on one remote. The remote frequency is 433.43Mhz and seem to be OOK.

Additional Captures
These are from 2 identical remotes to the other capture. I have only captured the stop button on channel 1 and 2 10x each. I think you should be able to find the remote ID with these additional captures.
Remote 1 Captures.zip (25.9 KB)
Remote 2 Captures.zip (24.7 KB)

You can group the channels and command multiple at once but I haven’t captured any of those transmissions.

The remotes are paired by a sequence of removing the battery from the blind controller and then plugging it back in and out in sequence then pressing stop then up on the remote.

Remote Control PCB Back

Remote Control PCB Front

Shutter Control Unit Front

Shutter Control Unit PCB Back

Shutter Control Unit PCB Front

Shutter Control Unit Back

Catalogue Entries

Edit:
Posts have been consolidated now that I can post more images per post. Added the additional remote captures.

SkorP · June 17, 2022, 8:12pm

Ok I’ll check this

plains203 · June 17, 2022, 11:02pm

Thanks

I am happy to capture some presses on each remote with multiple channels transmitting at once if you are happy with the captures and would like to fully emulate the remote.

SkorP · June 19, 2022, 8:28am

everything is fine, you made a LOT of recordings. BUT! not 1 when holding the button for a long time and it was not necessary to make each press a separate file. you can do everything in 1 … I beg you to make more records, you can 1 remote control. 3 files and each with 5 key presses with 15 + sec holding the button

SkorP · June 19, 2022, 9:20am

although there is a Manchester. and det streaming. I’ll figure out how to feed it to the flipper

plains203 · June 19, 2022, 10:14am

What software have you used there to get the signals into a format where you are able to analyse them?

I will do the additional captures now. I had tested with the short captures and replaying them would operate the shutters.

Thanks

plains203 · June 19, 2022, 10:25am

remote3btn1long.zip (29.6 KB)
I have here the longer captures of Remote 3 Channel 1 for Up, Stop & Down.

Astra · June 19, 2022, 10:45am

That’s Saleae Logic. You’ll need a logic analyzer to use it. Basically, you connect the analyzer to the CC1101 (our subghz chip) output pin and analyze the data coming out of it.

plains203 · June 19, 2022, 10:54am

Ah I have one of those. I also have yardstick one and a hackrf portapack along with a Nooelec SDR stick if any of those things are helpful.

SkorP · June 19, 2022, 11:10am

>: subghz decode_raw /any/subghz/power_smart/41/btn1down/1.sub
SubGhz test: Load_keystore OK
Listening at /any/subghz/power_smart/41/btn1down/1.sub.

Press CTRL+C to stop

Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0
Power Smart 64bit
Key:0x550337AD02FCC853
Btn:0

Packets recieved 7

>: subghz decode_raw /any/subghz/power_smart/41/btn1stop/1.sub
SubGhz test: Load_keystore OK
Listening at /any/subghz/power_smart/41/btn1stop/1.sub.

Press CTRL+C to stop

Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0
Power Smart 64bit
Key:0x558337AD027CC853
Btn:0

Packets recieved 7

>: subghz decode_raw /any/subghz/power_smart/41/btn1up/1.sub
SubGhz test: Load_keystore OK
Listening at /any/subghz/power_smart/41/btn1up/1.sub.

Press CTRL+C to stop

Power Smart 64bit
Key:0x558336AD027CC953
Btn:0
Power Smart 64bit
Key:0x558336AD027CC953
Btn:0
Power Smart 64bit
Key:0x558336AD027CC953
Btn:0
Power Smart 64bit
Key:0x558336AD027CC953
Btn:0
Power Smart 64bit
Key:0x558336AD027CC953
Btn:0
Power Smart 64bit
Key:0x558336AD027CC953
Btn:0

Packets recieved 6

>:

so accepts, it is necessary to make another sending and parsing.
program Logic 1.2.18, but this will not give you much. it is not intended for this and just like that it cannot be connected to a flipper

plains203 · June 19, 2022, 11:23am

So you can now make it decode on the flipper but it will need more work to be able to transmit it?
Do you need any more captures or information from me?
Thanks

SkorP · June 19, 2022, 1:58pm

I need more recording of different remotes, with different combinations of button presses. cheto I can not understand what bits are encoded buttons. but at the same time, the packet format and checksums are already clear, it is already possible to receive a signal, save it, and in theory reproduce it, but with decryption it is not completely clear

plains203 · June 19, 2022, 4:22pm

Ok I will capture more today. I will do it the same as the long press capture I did which got a capture of the each button held down until the sequence stopped transmitting. I can do that easily enough for every single channel and button across the 3 remotes. I might even hook the logic Analyzer up to receiver chip output pin on the control unit and see what that captures alongside the flipper.

SkorP · June 19, 2022, 6:07pm

no need to connect. but the long-term rattling of all the buttons and in different combinations, and in particular DIFFERENT paths, is what you need. 10 presses of each button is not enough for 2

plains203 · June 19, 2022, 9:56pm

Will do

plains203 · June 20, 2022, 2:06am

Remote 1 Long Captures.zip (197.3 KB)
Remote 2 Long Captures.zip (190.2 KB)

I have captured all the channels on the other 2 remotes now. I have held the button until the pattern stops repeating for each channel and button and done that twice.

SkorP · June 20, 2022, 7:23pm

Check pls

You still need to figure out the buttons … but check how it saves and transmits.

SkorP · June 21, 2022, 6:58am

add parsing btn, serial

plains203 · June 21, 2022, 8:19am

I couldn’t get the first version of the firmware to build.
I worked on setting up the docker environment and then saw you had pushed some changes.
The latest version compiled with docker and I have flashed it and tested it.

The button presses capture and replay

plains203 · June 21, 2022, 9:52am

I just found the install link that is on the pull request.
That wasn’t there when it wouldn’t build earlier could have saved myself the hassle of compiling it myself. At least I can now if I make my own changes haha.