Learn Code for Broadlink TC2 smart home wireless wall light

[preamptive]

I have a broadlink TC2 Light switch which I want to use with rmcontrol. It doesn't appear to work in the same way and requires pairing. Is it possible to control this with rmcontrol and if so how?

Thanks in advance.

[NightRang3r]

@preamptive I am working to find a solution for TC2

In the meantime here's what I found online so far:

Capture traffic and replay code (may need to use the key from broadlink python to decrypt the UDP packet data)

https://translate.googleusercontent.com/translate_c?depth=1&nv=1&rurl=translate.google.com&sl=auto&tl=en&u=https://www.v2ex.com/t/317266&usg=ALkJrhgD4BrgaB_x7kddw1dDL3P7HRUCBw

Second method:

See this thread:

https://github.com/mjg59/python-broadlink/issues/21

Looks like it is possible to clone using a universal garage rf remote matching the TC2 frequency

I ordered some remotes from eBay and I will test it, they probably arrive in a month or so.

And I am also working on the packets capture method.

[preamptive]

@NightRang3r thanks for the heads up. I have a garage remote so will try the second option later today. I will post back here how I get on!

[NightRang3r]

@preamptive I think the remote should support 433Mhz frequency.

[NightRang3r]

@preamptive I think there's another way...I was looking at the android application (on an emulator), I extracted the codes database file from e-control app (/data/data/com.broadlink.rmt/databases/rmt.db) it's an SQLite file that contains all learned codes (among other things)

Relevant tables (I use DB Browser for SQLite)

Example:

subIRTable : Your TC2 have an id of 31 (in the id column, you can tell by looking at the name column) buttonTable : Look at the "subIRId" column you should see the same value 31, Now look at the id column you should see something like "325" (which is the button id) codeTable: look at the "buttonId" column you should see "325" and the code should be in the "irCode" column (you should view it in binary mode in DB Browser for SQLite)

It looks something like this:

e90a4200df0909161609160909161609160909161609091616091609091609161609160909160916160916091609160909160916160909161609091616091609160909161609

Now we should test the "send_data" function to send the code (you need to obtain the authentication key using device.auth() before sending the code):

hex_data = codeinhex device.send_data(hex_data.decode('hex'))

I think that if you take this code and use the broad link python to send it should work, I will test it when I get home.

If it works it can be useful to import the database automatically to RMControl by "uploading" the sqlite db file and parse the relevant information @ericmagnuson

UPDATE:

It works!

just need to duplicate the code so it will be in the right length

#!/usr/bin/python

import broadlink
import time
import sys

device = broadlink.rm(host=("IP ADDRESS",80), mac=bytearray.fromhex("MAC ADDRESS"))

device.auth()
time.sleep(1)
time.sleep(1)
device.host

myhex = "e90a4200df0909161609160909161609160909161609091616091609091609161609160909160916160916091609160909160916160909161609091616091609160909161609e90a4200df0909161609160909161609160909161609091616091609091609161609160909160916160916091609160909160916160909161609091616091609160909161609"

device.send_data(myhex.decode('hex'))
print "Code Sent...."

[NightRang3r]

@preamptive @ericmagnuson

I wrote a quick python script to "parse" the database file and dump the codes maybe someone will find it useful, maybe it can be a good idea to allow rmcontrol to add codes manually and not just in learning mode.

import sqlite3 as lite

# You need to get the "rmt.db" file from your (rooted) android device or emulator (ARM), the file is located in "/data/data/com.broadlink.rmt/databases/rmt.db" and put it in the same folder as this script.

buttonIDS = []
buttonNames = []

# e-Control Database file
con = lite.connect('rmt.db')

# Get All Accessories
with con:
    cur = con.cursor()
    cur.execute("SELECT id, name FROM subIRTable")

    rows = cur.fetchall()

    for row in rows:
        print "Accessory ID: " + str(row[0]) + " | Accessory Name: " + row[1]

# Choose Accessory

accessory = input("Select Accessory ID: ")

cur.execute("SELECT name FROM subIRTable where id =" + str(accessory))

accessory_name = cur.fetchone()[0]

print "[+] You selected: " + accessory_name
print "[+] Dumping codes to " + accessory_name + ".txt"

# Get Buttons id
with con:
    cur = con.cursor()
    cur.execute("SELECT name, id FROM buttonTable where subIRId=" + str(accessory))
    rows = cur.fetchall()

    for row in rows:
        buttonIDS.append(row[1])
        buttonNames.append(row[0])

    codesFile = open(accessory_name + '.txt', 'w')

    # Get Codes

    for i in range(0, len(buttonIDS)):
        cur.execute("SELECT irCode FROM codeTable where buttonId=" + str(buttonIDS[i]))
        code = cur.fetchone()[0]
        result = "Button Name: " + buttonNames[i] + "| Button ID: " + str(buttonIDS[i]) + " | Code: " + str(code).encode('hex') + "\n"
        codesFile.writelines(result)
    codesFile.close()

[williamccc]

I found another way to export the TC2 commands. First, on an android device, using the broadlink e-control app, pair the TC2 switch with the app. Then, on the same android device, install RM Tasker Lite which is free. In the app, follow the instruction to import e-control commands to RM Tasker. After that, enable Web Acess in RM Tasker Lite. Using a browser, open that web site and you will see a session showing all the commands imported as JSON format. With that JSON strings, you may digest the actual RF commands for each button ON/OFF function. I've tested those commands with RM Bridge and they all work properly.

[ericmagnuson]

@NightRang3r That's great that you got a way to dump the codes! I propose that at some point we build an import feature that parses the database and migrates it into the RM Control DB (the schema is different for RM Control's DB, but it shouldn't get too messy).

Until then, it seems like it's still possible to learn TC2 codes like any other RF remote as @alesms points out.

(I won't be able to help out with this enhancement much as I don't have a TC2...yet.)

[NightRang3r]

@ericmagnuson even adding an option to enter the code manually instead of learning mode will be great, I imported all manually to the rmcontrol db.

[uvandres]

@NightRang3r @williamccc Tried getting the JSON using the RM plugin but for the TC2 I have this type of hex: e90a4200df0909160916160916091609160916091609091616090916160909161609091616091609091609160916160909160916091616091609160909161609160909161609

when tried to send this hex:

myhex = "e90a4200df0909161609160916090916160909161609160916090916160909161609091609161609160916090916091609160916160909160916091609160916160916090916" device.send_data(myhex.decode('hex'))

return self._cipher.encrypt(plaintext)

ValueError: Input strings must be a multiple of 16 in length

What could be wrong?

[NightRang3r]

@uvandres I already mentioned it in the posts above, you need to duplicate it like this:

e90a4200df0909160916160916091609160916091609091616090916160909161609091616091609091609160916160909160916091616091609160909161609160909161609e90a4200df0909160916160916091609160916091609091616090916160909161609091616091609091609160916160909160916091616091609160909161609160909161609

myhex = "e90a4200df0909161609160916090916160909161609160916090916160909161609091609161609160916090916091609160916160909160916091609160916160916090916e90a4200df0909161609160916090916160909161609160916090916160909161609091609161609160916090916091609160916160909160916091609160916160916090916" device.send_data(myhex.decode('hex'))

[uvandres]

@NightRang3r Missed that part! Thanks very much. It works like a charm.

[mikehole]

Hi, I am making an attempt to send the codes via the HomeAssistant.io Broadlink Component and have posted in the forum there but not having any luck :( 

The problem is that the component takes the hex as a Base 64 encoded string. Am I missing a step that is required to ensure that the Base 64 string is correctly formed?

I have tried using the duplicated codes.

[preamptive]

So ive finally found some time to re look at this again! I couldn't seem to capture the TC2 codes using a universal garage rf remote. So ended up installing nox android emulator to get the rtm.db file.

I have managed to export the codes using @NightRang3r script but now im unsure how to setup the accessory in the homebridge config.json to send the code or if required where to add the code in rmcontrol.

Can someone point me in the right direction? Thanks!

[preamptive]

@NightRang3r how did you go about manually adding the codes to rmcontrol db?

[NightRang3r]

@preamptive I added it manually to the rm control db using this tool:

http://sqlitebrowser.org

I created a document describing how to use broadlink with Alexa on a raspberry pi, I decided not to use rm control and I used another script instead :

https://drive.google.com/open?id=0B2-DXeKeq1abaS1sTTFTcGQyVG8

[preamptive]

Excellent! Thank you so much @NightRang3r.

It now works flawlessly. I have my broadlink TC2 working with homebridge and understand a bit more about how to edit databases ;-)

[ericmagnuson]

Thanks, @NightRang3r, for providing your solution. When I originally coded RM Control, I didn't expose the codes in the front-end as I didn't think people would need to see/edit the raw hex. As it turns out though, it looks like it would be really handy. The next time I sit down to work on RM Control, I will add a way to edit this code from the web front-end.

[yfaykya]

The code I get from a db dump or using rm tasker is always 149 chars. Doubling this still does not make it a multiple of 16. Any ideas?

eg: { repeat: 0, order: 0, sendUrl: "http://192.168.1.171:9876/send?deviceMac=34ea34e46d0f&codeId=15", displayName: "Kitchen • 2-Gang", code: "e9144600df090916091609160916091609160916091609160916160916090916091609161609091609161609091609160916091616090916091609160916160909160916091609000148", learnedByMac: "34ea34e46d0f", remoteName: "Kitchen", codeLength: 148, id: "15", name: "2-Gang", index: 2, remoteType: 15, type: 0, delay: 0 },

[eldanb]

Hi, I'm trying to create my own remote for a TC-2 switch. The packet above starts with 0xe9 which isn't documented in the protocol page (https://github.com/mjg59/python-broadlink/blob/master/protocol.md states 0x26 is IR etc., but nothing for 0xe9). Anyone knows the actual RF specification for this signal? I'm assuming a 433MHz but what coding / timing?

Thanks in advance

[cby016]

@preamptive I know this is an old thread however I was wondering how you extracted the rmt.db file from nox. I've installed it on mac and I can't seem to locate it.

[preamptive]

@cby016. I did that ages ago. Im not sure you still need to. You just need to search for the specific directory. (sorry i cant remember which one) but.....

Have you tried installing homebridge-broadlink-rm instead and using learn mode?

https://www.npmjs.com/package/homebridge-broadlink-rm

rmcontrol was great but i dont think its still been developed. homebridge-broadlink-rm is much easier to get the codes etc.

[cby016]

@preamptive I installed homebridge-broadlink-rm and was able to retrieve the codes in hex format quite easily. I then used this site http://tomeko.net/online_tools/hex_to_base64.php to convert them into the format that Home Assistant can read. Thanks a lot for the heads up.

For those that want to use nox I did find out how to access the files. Inside nox using "ES File Explorer" you can zip up the /mnt/sdcard/broadlink/newremote/SharedData folder and move it into /mnt/shared/Other. This file will then be accessible on your mac in ~/Library/Application Support/Nox App Player/Nox_share/Other.

[ericmagnuson]

@preamptive @cby016 Yea, I think homenbridge-broadlink-rm is now the way to go. When I started this project, there was hardly anything out there for Broadlink devices, but it seems to not be the case anymore. The homebridge ecosystem is really powerful, so I've switched to that myself as well 😄.

[Referor]

Another way, but you still need 2 devices and RM Pro plus (this way work for TC2) for me:

1. First IOS device(to control e-control app). In your e-control application you need to have already educated TC2 remote / TC1 remote.
2. Second IOS device with homekit and homebridge with scan_frequency function (to control your homebridge) / Mac (OS Mojave beta have home kit application) Algorithm: 1) You need to start "Scan_frequency" in your homebridge with second device 2) You need to push the preferred button at your first device several times And you can add buttons step-by-step to your homebridge. I think we can use this algorithm because RM Pro can scan frequency and send frequency in same time. We start scanning process and then we send some RF frequency in this one RM Pro plus device