Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Nexa 433MHz RF-light switch protocol reverse engineered

Nexa RF switch protocol reverse-engineered

I connected a 433MHz receiver directly to computer microphone port and powered it on (aka poor man's oscilloscope). Then I used Audacity to record at 48kHz the raw signal coming in and pressed the different buttons on the remote.

A sample of what a single broadcast looks like: https://www.dropbox.com/s/3hhdx8r5iyuurtk/Screenshot%202017-03-03%2008.05.27.png?dl=0

RF protocol

Resolution 48000 Hz - 1 sample is 20.83us

form samples duration symbol
Up 16 333us U
Short down 10 208us -
Long down 58 1208us D

Words?

Start

 U      D      D
 _
| |_________________

"Zero" bit

 U   U    D
 _   _
| |_| |_______

"One" bit

 U    D    U
 _         _
| |_______| |_

End

 U
 _
| |

Light 1 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UUD UUD U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   0   0

Light 2 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UUD UDU U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   0   1

Light 3 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UDU UUD U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   1   0

Light 2 off

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UUD UUD UUD UUD UDU U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   0   0   0   0   1

Side by side

                                                              on/off   channel
L1 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 0 0
L2 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 0 1
L3 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 1 0
L2 off  0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 0  0 0 0 1

Protocol

  • Each press of a button transmits four times the same message
  • Each message starts with the start sequence and then has 8 * 4 bits payload, followed by a single end sequence
  • 6 * 4 bits header
  • 4 bits on/off command (1001 on, 1000 off)
  • 4 bits channel designation
  • There's a 10ms break between messages
  • One message is about 71ms long

Helpful resources

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.