Page 8 of 9

Re: X2D decoding attempt

Posted: Monday 14 November 2016 11:52
by SixK
@gbraux2 and others,

Could you please publish your Deltia captured messages ? (For sun, moon, etc...)
I think the more we will have messages, the more we will be able to understand X2D protocol.

SixK

Re: X2D decoding attempt

Posted: Monday 14 November 2016 15:15
by gbraux2
Hi,

Just tested your code with my Arduino Nano + 868Mhz CC1101 module, and it works perfectly !!
IMG_4787.JPG
IMG_4787.JPG (109.1 KiB) Viewed 6110 times
Bellow are my codes acquired with my RTL-SDR dongle (2 messages are sent each time I trigger an action):

Zone 1 Moon
[00] {590} 55 7f 7b 0e ca aa ca ad d5 55 7e 2b ff c0 42 78 9a aa 9a a9 15 55 40 ea 00 1f de c3 b2 aa b2 ab 75 55 5f 8a ff f0 10 9e 26 aa a6 aa 45 55 50 3a 80 07 f7 b0 ec aa ac aa dd 55 57 e2 bf fc 04 27 89 aa a9 aa 91 55 54 0e a0 00
[00] {590} 55 7f 7b 0e ca aa ca ad 95 0a 81 d1 ff c0 42 78 9a aa 9a a9 35 7a bf 17 00 1f de c3 b2 aa b2 ab 65 42 a0 74 7f f0 10 9e 26 aa a6 aa 4d 5e af c5 c0 07 f7 b0 ec aa ac aa d9 50 a8 1d 1f fc 04 27 89 aa a9 aa 93 57 ab f1 70 00

Zone 1 Sun
[00] {590} 55 7f 7b 0e ca aa ca ad d5 15 7e 1e 00 3f bd 87 65 55 65 56 ea 8a bf 0f 00 1f de c3 b2 aa b2 ab 75 45 5f 87 80 0f ef 61 d9 55 59 55 ba a2 af c3 c0 07 f7 b0 ec aa ac aa dd 51 57 e1 e0 03 fb d8 76 55 56 55 6e a8 ab f0 f0 00
[00] {590} 55 7f 7b 0e ca aa ca ad 95 0a 81 d1 ff c0 42 78 9a aa 9a a9 35 7a bf 17 00 1f de c3 b2 aa b2 ab 65 42 a0 74 7f f0 10 9e 26 aa a6 aa 4d 5e af c5 c0 07 f7 b0 ec aa ac aa d9 50 a8 1d 1f fc 04 27 89 aa a9 aa 93 57 ab f1 70 00

Zone 2 Moon
[00] {596} 55 7f 7b 0e ca d5 35 52 2a aa 81 f8 ff e0 21 3c 4d 4a b2 ab 75 55 5f 81 c0 07 f7 b0 ec ad 53 55 22 aa a8 1f 8f fe 02 13 c4 d4 ab 2a b7 55 55 f8 1c 00 7f 7b 0e ca d5 35 52 2a aa 81 f8 ff e0 21 3c 4d 4a b2 ab 75 55 5f 81 c0 00
[00] {596} 55 7f 7b 0e ca d5 35 52 6a f5 7e 04 ff e0 21 3c 4d 4a b2 ab 65 42 a0 7e c0 07 f7 b0 ec ad 53 55 26 af 57 e0 4f fe 02 13 c4 d4 ab 2a b6 54 2a 07 ec 00 7f 7b 0e ca d5 35 52 6a f5 7e 04 ff e0 21 3c 4d 4a b2 ab 65 42 a0 7e c0 00

Zone 2 Sun
[00] {590} 55 7f 7b 0e ca d5 35 52 2a ea 81 de 00 3f bd 87 65 6a 9a a9 15 75 40 ef 00 1f de c3 b2 b5 4d 54 8a ba a0 77 80 0f ef 61 d9 5a a6 aa 45 5d 50 3b c0 07 f7 b0 ec ad 53 55 22 ae a8 1d e0 03 fb d8 76 56 a9 aa 91 57 54 0e f0 00
[00] {596} 55 7f 7b 0e ca d5 35 52 6a f5 7e 04 ff e0 21 3c 4d 4a b2 ab 65 42 a0 7e c0 07 f7 b0 ec ad 53 55 26 af 57 e0 4f fe 02 13 c4 d4 ab 2a b6 54 2a 07 ec 00 7f 7b 0e ca d5 35 52 6a f5 7e 04 ff e0 21 3c 4d 4a b2 ab 65 42 a0 7e c0 00

Zone 3 Moon
[00] {590} 55 7f 7b 0e ca 95 35 52 2a aa 81 c1 ff c0 42 78 9a b5 65 56 ea aa bf 1f 00 1f de c3 b2 a5 4d 54 8a aa a0 70 7f f0 10 9e 26 ad 59 55 ba aa af c7 c0 07 f7 b0 ec a9 53 55 22 aa a8 1c 1f fc 04 27 89 ab 56 55 6e aa ab f1 f0 00
[00] {590} 55 7f 7b 0e ca 95 35 52 6a f5 7e 39 ff c0 42 78 9a b5 65 56 ca 85 40 e3 00 1f de c3 b2 a5 4d 54 9a bd 5f 8e 7f f0 10 9e 26 ad 59 55 b2 a1 50 38 c0 07 f7 b0 ec a9 53 55 26 af 57 e3 9f fc 04 27 89 ab 56 55 6c a8 54 0e 30 00

Zone 3 Sun
[00] {590} 55 7f 7b 0e ca 95 35 52 2a ea 81 f1 ff c0 42 78 9a b5 65 56 ea 8a bf 07 00 1f de c3 b2 a5 4d 54 8a ba a0 7c 7f f0 10 9e 26 ad 59 55 ba a2 af c1 c0 07 f7 b0 ec a9 53 55 22 ae a8 1f 1f fc 04 27 89 ab 56 55 6e a8 ab f0 70 00
[00] {590} 55 7f 7b 0e ca 95 35 52 6a f5 7e 39 ff c0 42 78 9a b5 65 56 ca 85 40 e3 00 1f de c3 b2 a5 4d 54 9a bd 5f 8e 7f f0 10 9e 26 ad 59 55 b2 a1 50 38 c0 07 f7 b0 ec a9 53 55 26 af 57 e3 9f fc 04 27 89 ab 56 55 6c a8 54 0e 30 00


Zone 1 Off
[00] {590} 55 7f 7b 0e ca aa ca ad d5 15 7e 1e 00 3f bd 87 65 55 65 56 ea 8a bf 0f 00 1f de c3 b2 aa b2 ab 75 45 5f 87 80 0f ef 61 d9 55 59 55 ba a2 af c3 c0 07 f7 b0 ec aa ac aa dd 51 57 e1 e0 03 fb d8 76 55 56 55 6e a8 ab f0 f0 00
[00] {590} 55 7f 7b 0e ca aa ca ad 95 4a 81 f1 ff c0 42 78 9a aa 9a a9 35 5a bf 07 00 1f de c3 b2 aa b2 ab 65 52 a0 7c 7f f0 10 9e 26 aa a6 aa 4d 56 af c1 c0 07 f7 b0 ec aa ac aa d9 54 a8 1f 1f fc 04 27 89 aa a9 aa 93 55 ab f0 70 00

Zone 2 Off
[00] {590} 55 7f 7b 0e ca aa ca ad 95 4a 81 f1 ff c0 42 78 9a aa 9a a9 35 5a bf 07 00 1f de c3 b2 aa b2 ab 65 52 a0 7c 7f f0 10 9e 26 aa a6 aa 4d 56 af c1 c0 07 f7 b0 ec aa ac aa d9 54 a8 1f 1f fc 04 27 89 aa a9 aa 93 55 ab f0 70 00
[00] {590} 55 7f 7b 0e ca d5 35 52 6a b5 7e 31 ff c0 42 78 9a 95 65 56 ca a5 40 e7 00 1f de c3 b2 b5 4d 54 9a ad 5f 8c 7f f0 10 9e 26 a5 59 55 b2 a9 50 39 c0 07 f7 b0 ec ad 53 55 26 ab 57 e3 1f fc 04 27 89 a9 56 55 6c aa 54 0e 70 00

Zone 3 Off
[00] {590} 55 7f 7b 0e ca 95 35 52 2a ea 81 f1 ff c0 42 78 9a b5 65 56 ea 8a bf 07 00 1f de c3 b2 a5 4d 54 8a ba a0 7c 7f f0 10 9e 26 ad 59 55 ba a2 af c1 c0 07 f7 b0 ec a9 53 55 22 ae a8 1f 1f fc 04 27 89 ab 56 55 6e a8 ab f0 70 00
[00] {590} 55 7f 7b 0e ca 95 35 52 6a b5 7e 11 ff c0 42 78 9a b5 65 56 ca a5 40 f7 00 1f de c3 b2 a5 4d 54 9a ad 5f 84 7f f0 10 9e 26 ad 59 55 b2 a9 50 3d c0 07 f7 b0 ec a9 53 55 26 ab 57 e1 1f fc 04 27 89 ab 56 55 6c aa 54 0f 70 00

Zone 1 HG
[00] {590} 55 7f 7b 0e ca aa ca ad d5 15 7e 1e 00 3f bd 87 65 55 65 56 ea 8a bf 0f 00 1f de c3 b2 aa b2 ab 75 45 5f 87 80 0f ef 61 d9 55 59 55 ba a2 af c3 c0 07 f7 b0 ec aa ac aa dd 51 57 e1 e0 03 fb d8 76 55 56 55 6e a8 ab f0 f0 00
[00] {590} 55 7f 7b 0e ca aa ca ad 95 35 7e 31 ff c0 42 78 9a aa 9a a9 35 65 40 e7 00 1f de c3 b2 aa b2 ab 65 4d 5f 8c 7f f0 10 9e 26 aa a6 aa 4d 59 50 39 c0 07 f7 b0 ec aa ac aa d9 53 57 e3 1f fc 04 27 89 aa a9 aa 93 56 54 0e 70 00

Zone 2 HG
[00] {596} 55 7f 7b 0e ca d5 35 52 2a aa 81 f8 ff e0 21 3c 4d 4a b2 ab 75 55 5f 81 c0 07 f7 b0 ec ad 53 55 22 aa a8 1f 8f fe 02 13 c4 d4 ab 2a b7 55 55 f8 1c 00 7f 7b 0e ca d5 35 52 2a aa 81 f8 ff e0 21 3c 4d 4a b2 ab 75 55 5f 81 c0 00
[00] {590} 55 7f 7b 0e ca d5 35 52 6a ca 81 ee 00 3f bd 87 65 6a 9a a9 35 65 40 f7 00 1f de c3 b2 b5 4d 54 9a b2 a0 7b 80 0f ef 61 d9 5a a6 aa 4d 59 50 3d c0 07 f7 b0 ec ad 53 55 26 ac a8 1e e0 03 fb d8 76 56 a9 aa 93 56 54 0f 70 00

Zone 3 HG
[00] {590} 55 7f 7b 0e ca 95 35 52 2a ea 81 f1 ff c0 42 78 9a b5 65 56 ea 8a bf 07 00 1f de c3 b2 a5 4d 54 8a ba a0 7c 7f f0 10 9e 26 ad 59 55 ba a2 af c1 c0 07 f7 b0 ec a9 53 55 22 ae a8 1f 1f fc 04 27 89 ab 56 55 6e a8 ab f0 70 00
[00] {590} 55 7f 7b 0e ca 95 35 52 6a ca 81 d1 ff c0 42 78 9a b5 65 56 ca 9a bf 17 00 1f de c3 b2 a5 4d 54 9a b2 a0 74 7f f0 10 9e 26 ad 59 55 b2 a6 af c5 c0 07 f7 b0 ec a9 53 55 26 ac a8 1d 1f fc 04 27 89 ab 56 55 6c a9 ab f1 70 00

Re: X2D decoding attempt

Posted: Monday 14 November 2016 16:34
by SixK
If you send Zone1 Off, and then the 2nd message of Sun1 or Moon 1, your heater will turn On.

As I said, 2nd message is to turn On or Off heaters.
If you send Sun1 or Moon1 message you are supposed to want your heaters to heat, so they turn heaters On.

In fact you have to keep in mind that Deltia emitter don't know real heaters state.

If you send Turn off message, if my memory is good, Deltia emitter send last known state as 1rst message and 2nd one is to turn heater Off.

It's a great news that my code is portable to any other CC1101 device. ;)

SixK

Re: X2D decoding attempt

Posted: Monday 14 November 2016 16:54
by gbraux2
Yes, as you documented, I extrapolated the ON message by using the first bytes of the second message of a Sun trigger.

Regarding the ON/OFF stuff, you could make a slight change to your code to also send the ON message every time you call Sun1/Moon1.
As of today, if you send the Sun1 command to the Arduino, and if the heaters are OFF, they won't wake-up :-)

Just a matter of always sending a ON1 message after every Sun1/Moon1 ...

Guillaume.

Re: X2D decoding attempt

Posted: Wednesday 16 November 2016 23:44
by SixK
@gbraux2,

Not sending "Turn On" message is a choice, I find this useless.
But implementing this is not really difficult, it's just another message.

SixK

Re: X2D decoding attempt

Posted: Saturday 19 November 2016 17:57
by SixK
@gbraux2,

I fixed error with pyDeltia.py when between 23h30 and 00h00.
It was a wrong convertion in chauffage.ods 24:00:00 was converted to 00:00:00, I simply changed cell type to Text.

Note that with chauffage.ods/chauffage.csv, you can choose any time to do actions.
By default, you can set orders each 30 minutes just as Original Deltia emitter, but you could also choose to send orders only 1 time per hour during night and each 5 minutes in the morning if you need.
To be a bit more clear, you can suppress or add any arbitrary time column in chauffage.ods/chauffage.csv you then just have to adapt your crontab.

SixK

Re: X2D decoding attempt

Posted: Monday 06 February 2017 12:36
by antrax95
Hi all,

Somebody have try to command x2d shutter?

my house as this kind of shutter and for now i need to command them with a raspberry with a relay card. it's not very cheap because i need to buy a new remote command for each shutter.

It will be really cool if i can control my shutter with Rflink

Re: X2D decoding attempt

Posted: Thursday 23 February 2017 12:57
by SixK
Hi Antrax,

Well, X2D for shutter is probably a bit more secure (rolling code).
To be sure, you will have to buy an USB TV Tuner SDR compatible key (something like the keys you will find here : http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/) and capture, with rtl_433 tool, messages sent by your remote.

If messages are always the same for the same action, you will probably be able to command your shutters reproducing your remote signals.

Note, for X2D shutters, you will also have to find if signal is sent at 433.92 Mhz or 868Mhz.
If signal is sent at 433Mhz, you will have to adapt my source code to be able to emit at this frequency.
I'm not sure that CC1101 will be able to emit at this frequency either. (Theorically it can, but there are some specific module for 433Mhz and for 868Mhz)
Consider you have really few chances to succeed with 433Mhz frequency unless you have minimum knowledge about RF electronic and arduino programming.
With 868Mhz, if messages don't change, it should not be too difficult to make your shutter work with my source code and hardware described here : https://github.com/SixK/CC1101-X2D-Heaters

SixK

Re: X2D decoding attempt

Posted: Tuesday 21 March 2017 13:17
by Stuntteam
antrax95 wrote:Hi all,
Somebody have try to command x2d shutter?
It will be really cool if i can control my shutter with Rflink
The next RFlink version will support X2D. (receive and transmit)
We can use more 'RFlink - X2D' debug logs!

Re: X2D decoding attempt

Posted: Wednesday 29 May 2019 22:21
by SuperCed
SixK wrote: Friday 22 January 2016 11:44 Well, I read again documentation about Tydom520 module, it may work with association functions I have coded.
But don't expect too much, it's not clear about what can be done. Maybe in this case, you need full message (74 bytes instead of 14 bytes ) ? Maybe messages are different ? And maybe it's not a use case covered by the module ?

You possibly have 2 ways to command Heaters with TyDom520 :
- Simulate a TyDom Remote (maybe my Association command will work ? You can catch messages and send them with RFbee if you have such a remote)
- Simulate a X2D Alaram device (but if you don't have such a device, it will be hard to get messages. Maybe Poloalexis could help in this case ?)


For others, my heaters are now driven since 2 days by my RFbee connected to Raspberry pi ;) (My Deltia emmitter is turned off in manual mode)
Python Planning script is working fine. I'll have to see if there is an interest to program Heaters 15 minutes by 15 minutes (or less).

Next step, PHP script to drive heaters online...

SiXK
Hi, I read that, I have same problem. Il want to control a Tydom 520, I have a rflink 868 and domoticz installed, but I don't know what is the procedure to find the commands I have to send ...
Can you help me, I am new to domoticz and jeedom ?
Thanks!

Re: X2D decoding attempt

Posted: Saturday 23 November 2019 17:24
by sev2000
Hello,

I have created an X2D-Internet gateway. It is inserted in my X2D network and can override the information coming from the controller (Driver130, Deltia, Tydom, etc..). I'm able to synchronize with the commands coming from the controller and derogate via a web page. I have managed the association of the gateway in the X2D network and able to manage more than 3 zones. I worked with CPL module but the protocole is quite similaire.
Now, I want to improve my gateway by associating it with my controller as a Typhone could do. Could someone record some logs when associate the Typhone to the system and when the Typhone send the OFF command?

Thank you.

Re: X2D decoding attempt

Posted: Saturday 23 November 2019 18:42
by SuperCed
Problem is that we need a controller in order to find commands.

So I just bought a little door detector to set driver on or off.

The problem is that if I want to do more command from rflink, I have to buy a full controller like tydom 315 which is very expensive... And it's not very useful for me.

Now I use also a web page or an automatic scheduler (which is a PHP and a MySQL DB) which sets driver on or off and it's ok for me.

Re: X2D decoding attempt

Posted: Sunday 24 November 2019 10:59
by sev2000
SuperCed wrote: Saturday 23 November 2019 18:42 Problem is that we need a controller in order to find commands.

So I just bought a little door detector to set driver on or off.

The problem is that if I want to do more command from rflink, I have to buy a full controller like tydom 315 which is very expensive... And it's not very useful for me.

Now I use also a web page or an automatic scheduler (which is a PHP and a MySQL DB) which sets driver on or off and it's ok for me.
Most of the command can be found by guessing, like I did for zone 4, 5. I'm trying to guess the commands from Typhone but I fear the frames are very differents.
Also in your case it would have been possible to interface directly your heater with your web interface, why do you use an additional on/off switch?

Re: X2D decoding attempt

Posted: Sunday 24 November 2019 18:15
by SuperCed
It is said that it's not good to switch ON and OFF heater directly. You have to pass by pilot wire. So I use delta dore because it's my historic installation.

I have these kind of command :
Sun Nov 24 2019 16:33:07 GMT+0000 (UTC) - Send Value : 20;AE;X2D;ID=003e8ea;SWITCH=29;CMD=ON;EXT=Contact;BAT=OK;
Sun Nov 24 2019 16:33:08 GMT+0000 (UTC) - Send Value : 20;AF;X2D;ID=003e8ea;SWITCH=29;CMD=OFF;EXT=Contact;BAT=OK;
With that, how can I guess new commands ?

Re: X2D decoding attempt

Posted: Sunday 24 November 2019 21:18
by sev2000
SuperCed wrote: Sunday 24 November 2019 18:15 It is said that it's not good to switch ON and OFF heater directly. You have to pass by pilot wire. So I use delta dore because it's my historic installation.

I have these kind of command :
Sun Nov 24 2019 16:33:07 GMT+0000 (UTC) - Send Value : 20;AE;X2D;ID=003e8ea;SWITCH=29;CMD=ON;EXT=Contact;BAT=OK;
Sun Nov 24 2019 16:33:08 GMT+0000 (UTC) - Send Value : 20;AF;X2D;ID=003e8ea;SWITCH=29;CMD=OFF;EXT=Contact;BAT=OK;
With that, how can I guess new commands ?
With that there is nothing to do. It would be possible with RF logs. You can contact me by PM.

Re: X2D decoding attempt

Posted: Monday 02 March 2020 21:43
by telent
I realise this is quite an old thread, at least in parts. I have a luaradio decoder for extracting x2d frames from the transmissions of a Delta Dore Tybox 33 (boiler thermostat), though I've really only got as far as making the checksum work and haven't yet discovered what the data bytes mean

It's at https://github.com/telent/luaradio/ and accepts IQ data, which I have captured with rtl_433

Code: Select all

 rtl_433  -A -f 868300000 -S all
Refer in particular to https://github.com/telent/luaradio/blob ... g-dore.lua for the overall structure, and to
https://github.com/telent/luaradio/blob ... ecoder.lua for the frame decoding.

Some observations for this particular hardware, most of which are consistent with the findings of at least one previous poster

- it's biphase mark coding, not manchester
- after biphase mark decoding , the packet preamble is 0,0,0,0 (may be longer, I only look for four)
- frames start with 111110
- frames end with 1,1,1,1,1,1,1,1,0
- in the body of a frame, 111110 needs to be replaced with 11111
- in the body of a frame, bits are transmitted in lsb order (e.g. 48 appears as 000011, not 110000)
- the final two bytes of a frame are the checksum, which is given by bitwise xor of (sum(payload) - 1) with 0xffff. Yes, this is exactly what poloalexis said it would be ,

Some captured decoded data for you:

Code: Select all

[nix-shell:~/src/luaradio]$ cat /tmp/*json |grep payload |sort |uniq
{"payload":[136,66,0,1,5,144,12,0],"checksumValid":true}
{"payload":[136,66,0,1,5,144,2,0],"checksumValid":true}
{"payload":[136,66,0,1,5,144,2,3],"checksumValid":true}
{"payload":[136,66,0,1,5,144,2,5],"checksumValid":true}
{"payload":[188,187,72,1,5,144,1,0],"checksumValid":true}
{"payload":[188,187,72,1,5,144,1,3],"checksumValid":true}
{"payload":[188,187,72,1,5,144,1,5],"checksumValid":true}
{"payload":[188,187,72,1,5,144,2,0],"checksumValid":true}
{"payload":[188,187,72,1,5,144,2,3],"checksumValid":true}
{"payload":[188,187,72,1,5,144,2,5],"checksumValid":true}
I can't make a whole lot of sense of this yet, but:

- 1,5,144 are consistent in every single message - maybe that's sender/receiver/transmitter IDs? as far as I know, I have only one transmitter and one receiver
- if two of these bytes are supposed to be for the "house" id, apparently I'm controlling two houses? I didn't configure this initially, I left that to the engineer who fitted the boiler. I suppose it's not impossible he did the association twice and it's remembered both?
- all of these messages were received at times when I switched between comfort/reduced/anti-frost settings on the thermostat, but sadly I have now lost my notes which told me which messages were which scenario. I'll do some more captures later tonight and then update the thread again

Re: X2D decoding attempt

Posted: Tuesday 03 March 2020 14:48
by telent
telent wrote: Monday 02 March 2020 21:43 I'll do some more captures later tonight and then update the thread again
Here we are:

[136,66,0,1,5,144,12,48] heating demand on
[136,66,0,1,5,144,12,16] also demand on (different occasion)
[136,66,0,1,5,144,12,0] heating demand off

[136,66,0,1,5,144,2,0] night mode
[188,187,72,1,5,144,1,0]
[188,187,72,1,5,144,2,0]

[136,66,0,1,5,144,2,3] day mode
[188,187,72,1,5,144,1,3]
[188,187,72,1,5,144,2,3]

[136,66,0,1,5,144,2,5] frost mode
(no messages starting 188,187 emitted in frost mode)

The messages for switching day<->night correspond with the FunctioningMode constants that appeared in the java sdk linked previously:

Code: Select all

  public static final FunctioningMode Reduced = new FunctioningMode(0, "Reduced", 0);
  public static final FunctioningMode Comfort = new FunctioningMode(3, "Comfort", 3);
  public static final FunctioningMode AntiFrost = new FunctioningMode(5, "AntiFrost", 5);

Re: X2D decoding attempt

Posted: Sunday 22 March 2020 17:38
by sev2000
Hello,

I would be interested to know if it's realy works. Because in your decoding description you are omitting 2 things.
It's not manchester : correct, but RTL perform the manchester conversion, then you have to revert this convertion.

You also have to remove start bit.

I think it's why sometime you have 136 and some other time you have 188.

A decoded payload, without House address, should look like that:
Hex : 05 00 05 90 01 03 = Src, Dest, Transmitter, Ctrl, zone, mode (3= sun)

and you have (in Hex):
00 01 05 90 0C 30; not so far

Can you send the output of the RTl to see where it's wrong?

Re: X2D decoding attempt

Posted: Sunday 05 April 2020 17:17
by jcdemay
Hi guys,

For the same reasons as you, I also ended up reversing the X2D protocol and came up with similar results except that I don't seem to have a CRC in my frames. This is maybe because my remote controller model is quite old, 2008 at least. Anyway, here is a draft of my findings, maybe it will be of help to someone: http://offsec.online.fr/x2d/x2d_reverse.html

KR,
Jonathan.

Re: X2D decoding attempt

Posted: Saturday 11 April 2020 0:09
by jcdemay
Well, I think I move from the SDR to the CC1111 to soon because I have clock rate synchronization problems with the CC (which I don't have with the SDR). I definitely had too many 0's in my frames... I will update my draft as soon as I have new findings.

KR,
Jonathan.