X2D decoding attempt

[jimmy2cv]

Hi all,

I don't have a lot of time to work on it but I saw your messages.
I think it's not possible to associate a standart harware with S2D hardware.
I think in the process to associate two hardwares, both exange some key.

Olivier, you wrote : "PS. Sorry for my bad english."
I think you are french and if you want, you can send a french messages with personnal message (in this forum).

Jimmy

[SixK]

I think it's not possible to associate a standart harware with S2D hardware.
I think in the process to associate two hardwares, both exange some key.

I'm scared about this, but if I can change RFbee firmware, I think I will at least be able to catch X2D messages.
And maybe I will be able to associate my hardware. (I know probably only have 1% to succeed...)

SixK

[SixK]

Received my UARTSBee, I can now play with RFbee.
Sadly the tools I thought I could use to help me, seem's specific to dedicated hardware and are not working straight forward with RFbee+UARTSbee.

Work will be a bit more hard... I don't know how long It will take me to see at least a single message captured by RFBee.

@ervplecter could you provide me your modified RFbee firmware ?

It could save me lot of time.

SixK

[SixK]

Well, spent half the night trying to upload new firmware to RFbee without success !
RFbee is taking AT commands I send, but I can't change its firmware ! ;(

I'll try again using my Leonardo as ISP programmer.
https://www.arduino.cc/en/Tutorial/ArduinoISP

Maybe the boot loader is corrupted or something ?

SixK

[SixK]

I finally found how to upload custom firmware to RFbee.

I had to set Arduino IDE with :
card type : Lilypad Arduino
processor : ATMega328
Programmer : AVRISP

In this configuration upload baudrate is set to 57600.

It's not really what is said on seeeduino wiki, but till it works I don't care

Next step... configure CC1101 chip for X2D...

[UPDATE]
I should have started looking at this, on RFbee 1.2, uC is an ATMega328 (not an ATMega168 as on V1.1)
I now understand why it was not working.

SixK

[SixK]

Thank's to ervplecter, I can now catch some data with my RFbee, unfortunately I'm quite sure that messages I get are not some valid X2D data.

Here are some samples :
data: 76 93 75 55 BD 52 2A AA 8E 3 C0 1F D7 69 32 AA B3 54 8A 95 51 C0 7B FC 1 77 9 CA AA CD 52 2A 1 33 2B 54 CA B7 55 55 C0 1F D7 69 32 AA B3 54 8A AA A0 79 E0 F EB B4 99 55 59 AA 45 55 50 3C 0 0 0 1 0 55 0 FF 68 7C D1 18 0 4F 1E C 0 E3 1 .
data: C7 0 7F AE D2 65 55 66 A9 35 79 5F 87 1F F0 14 4B 60 55 52 15 62 54 2A 7 8E 1 C3 FF CC 33 33 FC C0 2B 54 CA B7 55 55 C0 1F D7 69 32 AA B3 54 8A AA A0 79 E0 F EB B4 99 55 59 AA 45 55 50 3C 0 0 0 1 0 55 0 FF 74 81 D5 18 0 45 20 C 0 E3 1 0 0 E8 3 0 0 0 0 0 0 C5 0 C4 0 C0 .

Good thing some parts are common to both messages, but I really don't know what I get, and it's far from messages already catched by ervplecter, so it may only be some garbages ...

I will have to get an RTL_SDR compatible USB tuner TV Key to help me a bit.

SixK

[poloalexis]

Here is my devs on CUL hardware (including the python code).
GIT: https://[email protected]/pauleb ... on-cul.git
Branch: ask_rf

Here is a brief description:
Rf use ask modulation @ 868.3MHz (config CONFIG_868MHZ_ASK for C1100)
Data rate is 4800bits/sec (4.8kHz)

The C1100 outputs timings on serial port, 4bytes by detected edge
on rising edge: DC('R'); DC(val1); DC(val2); DC(crc);
on falling edge: DC('F'); DC(val1); DC(val2); DC(crc);
with crc = byte0^byte1^byte2;

The python code (rf_sniffer.py) setup the rf and analyse the given serial port.
It is a generic system.

[poloalexis]

Hi everybody,

Sorry for my english (I am french )

About the protocol named X2D, I have some information.
I use the USB key (emulate a port COM) with delta dore reference : Tydom360.
This key was sold by the company Myxyty (an other french company) with in reference : MyDomokit.
About this protocol, all french companies signed a special commitment to limit the sending information.

In the attach file, you can see the package with source code to use test this key. I tested it an it's work fine.
I search some people to create a new package with all parameters :
#Champ Adresse Maison 2 octets 0 à FFFFh => House adress
#Champ Adresse Source 1 octet 0 à FFh => Source adress
#Champ Adresse Destinataire 1 octet 0 à FFh => Receiver adress
#Champ Adresse Transmetteur 1 octet 0 à FFh => Sender adress

and to manage a lot of devices.

Best regards
Jimmy

Thanks a lot for this jar. I can update the stream decoding thanks to that. !!!!

Envoyé de mon MotoG3 en utilisant Tapatalk

[poloalexis]

Lo, Nice topic.

I have decompiled X2D java library too.
This could help a bit to understand X2D protocol, but it will be far more difficult than decoding low cost temperature/humidity weather station external sensors.

If someone interested, I have decoded Otio SHT-10 temperature/humidity sensor and an Astrell (now probably Innnovalley) temperature sensor.
https://github.com/SixK/Otio_SHT-10_protocol

I have to find an 868Mhz receiver/transmitter to play with X2D.

SixK

Hi SixK, I cannot answer you private message: I have not enough rights for.

Envoyé de mon MotoG3 en utilisant Tapatalk

[SixK]

Ok, for private message, you should have the same right than me.
Just click on name you want to write a private message, then click on "send a private message".

For your python code, It seem's I don't have acces even creating a bitbucket account.
Can you open me an access ? (I will send you my e-mail address in private message)
Or make it public ?

Ok, playing with a TNT USB key, I Agree about ASK modulation, and it seem's Manchester encoded as I can see 3 kind of timings.
It seem's there is no synchro bit as on a 433Mhz low cost weather station.

I actually did not succeed to decode any message using gnuRadio compagnon.

It seem's you have progressed on X2D protocol ?

As far as frequency is concerned, it seem's that the right frequency is about : 868.403577 Mhz for my deltia, I don't know if it is such important ? But you may have only noise configuring exactly to 868.3Mhz.
I have to play again with my TNT TV USB key, as I'm not sure I had set the PPM deviation (about 60/70 PPM)

SixK

[deennoo]

I had playing alot with rtl-sdr.

Fréquence setting depand a lot of crystal inside dvbkey (nom anglais pour une clef TNT).

Have a look to : https://github.com/merbanan/rtl_433

Even if this ils for 433 it can be set for 868

[SixK]

Nice tool, I tried it quickly with my Astrell weather station sensor, it seem's to work directly
My Astrell sensor is seen as Prologue sensor 5 :
Prologue sensor 5 58: Channel 1, Battery OK, Button 0, Temperature 24.20 C, Humidity 30 %
All this is ok, except for humidity as my sensor is not intended to mesure humidity


I tried it using my X2D device and setting frequency to 868403577 and it seem's to catch things.
I'll have to tweak a bit more and understand what exactly this tool is showing me.

I also did a test with my Velux / io-homecontrol remote and results are interesting.
I only have 2 bits, but if I push Stop button I always have 01, and if I push up or down, I always have 10...

SixK

[SixK]

Well, this tool is really great !

Tool say's it's OOK modulated (ok, It was looking ASK to me, but I'm really not an RF expert) and manchester encoded.

Frequency is set to 868.3, If I set it to 868.4 I get nothing. (So I was probably wrong with my 868403755 value)

If I set PPM to 60, I get nothing. (ok this is probably not necessary anyway).

Here are some data I get playing with my Deltia 3 areas switching between ECO / Confort mode on my 3rd zone :

Code: Select all

[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca d5 32 ad d5 55 7e 27 80 3f ae d2 65 6a 99 56 ea aa bf 13 c0 1f d7 69 32 b5 4c ab 75 55 5f 89 e0 0f eb b4 99 5a a6 55 ba aa af c4 f0 07 f5 da 4c ad 53 2a dd 55 57 e2 78 03 fa ed 26 56 a9 95 6e aa ab f1 3c 00     
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 55 7e 08 7f c0 51 2d 9a b5 66 a9 15 55 40 fb c0 1f d7 69 32 a5 4c ab 75 55 5f 82 1f f0 14 4b 66 ad 59 aa 45 55 50 3e f0 07 f5 da 4c a9 53 2a dd 55 57 e0 87 fc 05 12 d9 ab 56 6a 91 55 54 0f bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad d5 15 7e 28 7f c0 51 2d 9a b5 66 a9 15 75 40 eb c0 1f d7 69 32 a5 4c ab 75 45 5f 8a 1f f0 14 4b 66 ad 59 aa 45 5d 50 3a f0 07 f5 da 4c a9 53 2a dd 51 57 e2 87 fc 05 12 d9 ab 56 6a 91 57 54 0e bc 00 
[00] {590} 55 7f 5d a4 ca 95 32 ad 95 0a 81 f3 80 3f ae d2 65 4a 99 56 ca 85 40 f9 c0 1f d7 69 32 a5 4c ab 65 42 a0 7c e0 0f eb b4 99 52 a6 55 b2 a1 50 3e 70 07 f5 da 4c a9 53 2a d9 50 a8 1f 38 03 fa ed 26 54 a9 95 6c a8 54 0f 9c 00 
[00] {590} 55 7f 5d a4 ca d5 32 ad 95 0a 81 dc 7f c0 51 2d 9a 95 66 a9 35 7a bf 11 c0 1f d7 69 32 b5 4c ab 65 42 a0 77 1f f0 14 4b 66 a5 59 aa 4d 5e af c4 70 07 f5 da 4c ad 53 2a d9 50 a8 1d c7 fc 05 12 d9 a9 56 6a 93 57 ab f1 1c 00 

Playing with this data in Excel, some line are strictly identical !??? I thought X2D was using a rolling code !???
I'm starting to think that X2D is not that secured as I tought !??
Some lines are not exactly identical to others, but I think the Deltia was sending order to another zone.

OK this data may be nothing, but I must admit it looks rather nice.

SixK

[SixK]

OK, did more tests :

When switching between ECO to Comfort, Each time I get 2 messages. This messages are sent a second time about 1 second (or more) later.

Here are my results using the following command :
./rtl_433 -A -D -f 868330000

Code: Select all

Area3 – ECO to Comfort 1	[00]	{590}	55	7f	5d	a4	ca	95	32	ad	d5	15	7e	28	7f	c0	51	2d	9a	b5	66	a9	15	75	40	eb	c0	1f	d7	69	32	a5	4c	ab	75	45	5f	8a	1f	f0	14	4b	66	ad	59	aa	45	5d	50	3a	f0	7	f5	da	4c	a9	53	2a	dd	51	57	e2	87	fc	5	12	d9	ab	56	6a	91	57	54	0e	bc	0
Area3 – ECO to Comfort 2	[00]	{590}	55	7f	5d	a4	ca	95	32	ad	95	0a	81	f3	80	3f	ae	d2	65	4a	99	56	ca	85	40	f9	c0	1f	d7	69	32	a5	4c	ab	65	42	a0	7c	e0	0f	eb	b4	99	52	a6	55	b2	a1	50	3e	70	7	f5	da	4c	a9	53	2a	d9	50	a8	1f	38	3	fa	ed	26	54	a9	95	6c	a8	54	0f	9c	0
																																																																												
Area3 – Comfort to ECO 1	[00]	{590}	55	7f	5d	a4	ca	95	32	ad	d5	55	7e	8	7f	c0	51	2d	9a	b5	66	a9	15	55	40	fb	c0	1f	d7	69	32	a5	4c	ab	75	55	5f	82	1f	f0	14	4b	66	ad	59	aa	45	55	50	3e	f0	7	f5	da	4c	a9	53	2a	dd	55	57	e0	87	fc	5	12	d9	ab	56	6a	91	55	54	0f	bc	0
Area3 – Comfort to ECO 2	[00]	{590}	55	7f	5d	a4	ca	95	32	ad	95	0a	81	f3	80	3f	ae	d2	65	4a	99	56	ca	85	40	f9	c0	1f	d7	69	32	a5	4c	ab	65	42	a0	7c	e0	0f	eb	b4	99	52	a6	55	b2	a1	50	3e	70	7	f5	da	4c	a9	53	2a	d9	50	a8	1f	38	3	fa	ed	26	54	a9	95	6c	a8	54	0f	9c	0
																																																																												
Area1 – ECO to Comfort 1	[00]	{590}	55	7f	5d	a4	ca	aa	cd	52	2a	ea	81	c8	7f	c0	51	2d	9a	aa	99	56	ea	8a	bf	1b	c0	1f	d7	69	32	aa	b3	54	8a	ba	a0	72	1f	f0	14	4b	66	aa	a6	55	ba	a2	af	c6	f0	7	f5	da	4c	aa	ac	d5	22	ae	a8	1c	87	fc	5	12	d9	aa	a9	95	6e	a8	ab	f1	bc	0
Area1 – ECO to Comfort 2	[00]	{590}	55	7f	5d	a4	ca	aa	cd	52	6a	f5	7e	1c	7f	c0	51	2d	9a	aa	99	56	ca	85	40	f1	c0	1f	d7	69	32	aa	b3	54	9a	bd	5f	87	1f	f0	14	4b	66	aa	a6	55	b2	a1	50	3c	70	7	f5	da	4c	aa	ac	d5	26	af	57	e1	c7	fc	5	12	d9	aa	a9	95	6c	a8	54	0f	1c	0
																																																																												
Area1 – Comfort to ECO 1	[00]	{590}	55	7f	5d	a4	ca	aa	cd	52	2a	aa	81	e7	80	3f	ae	d2	65	55	66	a9	15	55	40	f3	c0	1f	d7	69	32	aa	b3	54	8a	aa	a0	79	e0	0f	eb	b4	99	55	59	aa	45	55	50	3c	f0	7	f5	da	4c	aa	ac	d5	22	aa	a8	1e	78	3	fa	ed	26	55	56	6a	91	55	54	0f	3c	0
Area1 – Comfort to ECO 2	[00]	{590}	55	7f	5d	a4	ca	aa	cd	52	6a	f5	7e	1c	7f	c0	51	2d	9a	aa	99	56	ca	85	40	f1	c0	1f	d7	69	32	aa	b3	54	9a	bd	5f	87	1f	f0	14	4b	66	aa	a6	55	b2	a1	50	3c	70	7	f5	da	4c	aa	ac	d5	26	af	57	e1	c7	fc	5	12	d9	aa	a9	95	6c	a8	54	0f	1c	0
																																																																												
Area2 – ECO to Comfort 1	[00]	{590}	55	7f	5d	a4	ca	d5	32	ad	d5	15	7e	17	80	3f	ae	d2	65	6a	99	56	ea	8a	bf	0b	c0	1f	d7	69	32	b5	4c	ab	75	45	5f	85	e0	0f	eb	b4	99	5a	a6	55	ba	a2	af	c2	f0	7	f5	da	4c	ad	53	2a	dd	51	57	e1	78	3	fa	ed	26	56	a9	95	6e	a8	ab	f0	bc	0
Area2 – ECO to Comfort 2	[00]	{590}	55	7f	5d	a4	ca	d5	32	ad	95	0a	81	dc	7f	c0	51	2d	9a	95	66	a9	35	7a	bf	11	c0	1f	d7	69	32	b5	4c	ab	65	42	a0	77	1f	f0	14	4b	66	a5	59	aa	4d	5e	af	c4	70	7	f5	da	4c	ad	53	2a	d9	50	a8	1d	c7	fc	5	12	d9	a9	56	6a	93	57	ab	f1	1c	0
																																																																												
Area2 – Comfort to ECO 1	[00]	{590}	55	7f	5d	a4	ca	d5	32	ad	d5	55	7e	27	80	3f	ae	d2	65	6a	99	56	ea	aa	bf	13	c0	1f	d7	69	32	b5	4c	ab	75	55	5f	89	e0	0f	eb	b4	99	5a	a6	55	ba	aa	af	c4	f0	7	f5	da	4c	ad	53	2a	dd	55	57	e2	78	3	fa	ed	26	56	a9	95	6e	aa	ab	f1	3c	0
Area2 – Comfort to ECO 2	[00]	{590}	55	7f	5d	a4	ca	d5	32	ad	95	0a	81	dc	7f	c0	51	2d	9a	95	66	a9	35	7a	bf	11	c0	1f	d7	69	32	b5	4c	ab	65	42	a0	77	1f	f0	14	4b	66	a5	59	aa	4d	5e	af	c4	70	7	f5	da	4c	ad	53	2a	d9	50	a8	1d	c7	fc	5	12	d9	a9	56	6a	93	57	ab	f1	1c	0

Messages seem's to be exactly the same than yesterday.
If I compare with results from ervplecter, data seem's different, by size and content. (I wonder if it's data has really been Manchester decoded ?)

Converting Hexa to binary in excel (copy/past lines above, then convert spaces to columns, remove weird caracters by copy/past + replace to nothing, then apply the following formula french excel : =HEXBIN(EPURAGE(I6);8) )

55 7F give : 01010101 0111111 I really like those binary values at frame start
Between 1rst message and second message: some values are exactly the same, some are inverted (00101001 --> 11010110), some are nearly the same (00101001 --> 00111001).
I actually don't really understand why we have 2 frames, but probably second one should help to validate the first one ? (or the contrary) Or is it for something like repetitor or something else ?

In Area 3, Comparing ECO->Comfort vs Comfort->ECO, I really have few bits changing only 1 / bytes that are moving.

2nd message seem's to never change in an Area, so it's probably something like a Mask to validate 1rst message


In Area 1, Comparing ECO->Comfort vs Comfort->ECO, I have far more bits moving. I wonder if this assomething to do with number of heaters in Area ? (In Area 1 : 4 Heaters, In Area 2 : 3 heaters, In Area 3 : 1 heater)

In Area 2, Comparing ECO->Comfort vs Comfort->ECO,Few bits are moving, same columns as in Area3 (only 1 exception).

I'll have to understand why there is such a difference between Area 1 and other areas.

If someone could do the same tests, it will be interesting to compare and could help to identify some bytes. (House Address for exemple)

SixK

[poloalexis]

A message repeats about 26 times the same frame, in order to let a chance for the receiver ti catch one of those. The rolling code is mainly use for alarm applications.

Envoyé de mon MotoG3 en utilisant Tapatalk

[poloalexis]

A message start with 10 zeros (ie 10 long pulses). A frame start with 1111110 and end with 0xFE. And you have about 26 frames per message.

Envoyé de mon MotoG3 en utilisant Tapatalk

[poloalexis]

Last trick: when decoding a frame, if you have this sequence 111110x remove the 0 in order to have 11111x. With this last trick, which prevent from false 0xFE decoding, I can compute the right crc: not(sum bytes[0,len-2])+1

Envoyé de mon MotoG3 en utilisant Tapatalk

[SixK]

@poloalexis, to sum up what you says, data I get are not X2D data ?

I seen you use biphase mark decoding, RTL_433 use Manchester decoding.
Are you sure about bi-phase mark use ?

Manchester seem's ok since 55 7f appear to me as a comon pattern for preambule+sync word.
1rst message as data + 2nd message as mask or configuration seem's ok too.
75 bits packet seem's ok too. I think I read this packet size somewhere else in an X2D description.

Can you past data you get ?

If we want to command our heaters, decoding X2D protocol is probably not necessary, we juste need to send same data as we got using the same coding we used to decode.

SixK

[SixK]

If you look at raw message, On start, you will see 5 long pulse then 6 short pulses.
With Manchester encoding, I would interprete this as :
01 01 01 01 + 01 1 1 1 1 1 1 (I would have said 10 10 10 10 + 10 1 1 1 1 1 1, but rtl_433 says it's 01 01 01 01 + 01 1 1 1 1 1 1)
55 + FF

I didn't seen 10 long pulse in a row in raw message.

X2D_raw_data.png (23.7 KiB) Viewed 3884 times

What X2D device do you use ? Deltia for heaters or something else ?

SixK

[mikelelere]

It seems to me that the rtl_433 app is Manchester-decoding the data LSB first, while it seems that the actual order should be MSB first. Just reverse each data byte and you'll find the same preamble and frame delimiter reported by poloalexis. Still, I think that further coding is required for this app to remove the zero insertions to avoid decoding false frame delimiters and get the actual frames.

Regards