Paradox Wireless Reed Switch

Sub-GHz
#22

ok, so far so very good :slight_smile:
the decoder is picking up and tracking the signal.
the decoder i miss labelled, should be labelled ‘magellen’ not Paradox, as they make their transmitters for more companies than just paradox, that was my mistake :frowning: however, to testing…

the remote transmits 3x when a button is pressed.
Closed = 0x12
Open = 0x13

if i press and hold the ‘Tamper’, than release it so it is active
it transmits ~20x with a mix of buttons from the 2 serials, i will try to order it

  1. SN#2-BTN=0x11
  2. SN#1-BTN=0x11
  3. SN#2-BTN=0x11
  4. SN#1-BTN=0x11
  5. SN#2-BTN=0x11
  6. SN#2-BTN=0x11
  7. SN#2-BTN=0x11
  8. SN#1-BTN=0x11
  9. SN#2-BTN=0x11
  10. SN#2-BTN=0x13
  11. SN#2-BTN=0x13
  12. SN#2-BTN=0x13
  13. SN#1-BTN=0x13
  14. SN#2-BTN=0x13
  15. SN#2-BTN=0x1A
  16. SN#1-BTN=0x1A
  17. SN#2-BTN=0x1A
  18. SN#1-BTN=0x1A
  19. SN#1-BTN=0x1A
  20. SN#2-BTN=0x1A

the amount of signals transmitted for each tamper button press varies and the amount each SN# transmits also varies,
i believed the signals are transmitted from both SN at same time and the flipper loses some as they overlap, however the start code is always 0x11 and final transmissions are 0x1A. the Middle code 0x13 is due to my leaving the transmitter in the ‘OPEN’ mode
edit
if i leave SN1 closed, and SN2 open- More Buttons appear SN1 starts with 0x10 while SN2 starts with typical 0x11
if i press the tamper quickly, to be good than bad, i than get 0x1B and 0x1C

so far i have only been testing while tamper is active, as the transmitter casing is removed.

i will Leave flipper next to the device for a few hours as it will send a periodic transmission to let the receiver know it is still active, i will post the Button Code when it comes through

#23

didn’t quite understand you. name of the magellen system, ca.
open button 0x13 (always?)
close button 0x12 (always?)
What is a tamper and what is its function?

#24

Sorry, i rush my words.

Tamper, is a switch that tells the system that someone has opened the transmitter and no longer secure, this can set alarm off, it is bad.
i just realise that all numbers so far i test with the transmitter cover off.

i retested to provide more CODE.
open Button, but system insecure 0x13 (with transmitter cover open and tamper switch released) (trouble)
Close Button, but system insecure 0x12 (with transmitter cover open and with tamper switch released) (trouble)
open Button, 0x11 (No Tamper, system secure) (intruder alert)
Close Button 0x10 (No Tamper, system secure, alarm happy)
Power on 0x18
Tamper Detected first code 0x11 followed by final Code 0x1A

same codes across 4x SN

#25

i have a motion detector using same signal
motion detected = 0x21
motion Detected (with tamper) = 0x23
power on = 0x28

the SN# is correct for new device :slight_smile:

#26

6 buttons are useful.
Open (Tamper) 0x13
Close (Tamper) 0x12
Open 0x11
Close 0x10
Motion (Tamper) 0x23
Motion 0x21

#27

so we will dance from this … + power on 0x28. Are there any other situations?

Example of unknown protocol analysis for SubGhz
#28

No, however, I am trying to transmit the current button codes using flipper, the RX light on the receiver doesn’t light up and it doesn’t recognise the code :confused:
I did notice that the raw files work but it takes 0.5sec before the RX begins to flash?

#29

0x18 = power on for product model DCT10
0x28 = power on for product model PMD75
I have also seen 0x1B and 0x1C
But I do not know what function they have

#30

and it won’t, I didn’t finish sending, only receiving, the button code stopped me. today I want to send and add

1 Like
#31

As I get other product models, I may be able to add a few more buttons, but this may take time. Is it difficult to add extra buttons later? what I have now is plenty :). The main thing would be, being able to change the SN to generate a new transmitter

#32

serial number can be changed. on the buttons it’s more for beauty

1 Like
#33

So tomorrow I will be going to a Jobsite with a few commonly used transmitters of a different model, I will try to test them and check the codes.

#34

And so, we continue the series of research. analysis of buttons (event codes)

image
image1563×939 13.3 KB

1 Like
#35

check decoder/encoder/parse event

#36

Oh no the new dfu isn’t downloadable on github

#37

It was merged, so guess you can install dev.

#38

Derr, I’m stupid, thanks man, appreciate it

#39

Thanks SkorP, this is very close :slight_smile:
I have not tested tamper yet.
But I tested product model DCT2, and it is the same results as the DCT10.

The label changes I can think of so far would be.

Bit_0 = ‘Open/Motion’ - if alarm system disabled, than this code is ‘ok’

bit_4 = ‘wireless reed’ or just ‘reed’ - that is how they are called in the ‘security business’.

When I get home I will test tamper for button label and I will send to you the result.

You are amazing, this project gives me so much joy. There are many brands of wireless security systems. I will have to learn to decode them myself with what you have taught me👍🏻

#40

Hey SkorP, so I was able to play with a pmd75 in tamper mode. Alot of interesting code.
So coding/button name looks good while tamper active or disabled.
But when first open device and tamper activated, I get
Event 0x2A
Stat:ok,tamper on(alarm),power on, motion sensor.

I also get
Event 0x2B
Stat: alarm, tamper on,power on, motion sensor.

So it would seem, when tamper is first triggered, the device first tells the alarm system, that the reed is open 5x to trigger an alarm, than it tells that it is in tamper mode and that the power is on, than it follows by finishing its transmission by saying the actual position (open/close) and that it is still in tamper.

#41

did not understand anything). just tell me what you would change and by what logic events should be displayed