Decoding for Tuya Blinds

[Westiewombat]

Hi Sebmillet

Hope you can assist with the decoding of this blind - the keys are up/down/stop. The receiver register seems to change with each key I have also added sniffer dumps for the sequence of keys below the receiver register and graphic here

Data: fc cc 00 f3 f0 c3 cf 33 fc cf cc c0 c3 03 cf 3f 33 3f

-----CODE START----- // [WRITE THE DEVICE NAME HERE] rf.register_Receiver(

, // mod 65535, // initseq 2040, // lo_prefix 4068, // hi_prefix 0, // first_lo_ign 396, // lo_short 612, // lo_long 416, // hi_short (0 => take lo_short) 1016, // hi_long (0 => take lo_long) 236, // lo_last 3120, // sep 144 // nb_bits ); -----CODE END----- Data: ff fc 03 f0 f3 c0 cc 30 ff cc cf c3 c0 00 cc 3c 30 0c -----CODE START----- // [WRITE THE DEVICE NAME HERE] rf.register_Receiver( , // mod 65535, // initseq 2040, // lo_prefix 4076, // hi_prefix 0, // first_lo_ign 400, // lo_short 612, // lo_long 420, // hi_short (0 => take lo_short) 1020, // hi_long (0 => take lo_long) 236, // lo_last 3116, // sep 144 // nb_bits ); -----CODE END----- Data: c0 ff 3c cf cc ff f3 0f c0 f3 f0 fc ff 3f f3 03 0f 30 -----CODE START----- // [WRITE THE DEVICE NAME HERE] rf.register_Receiver( , // mod 65535, // initseq 2044, // lo_prefix 4076, // hi_prefix 0, // first_lo_ign 400, // lo_short 608, // lo_long 416, // hi_short (0 => take lo_short) 1024, // hi_long (0 => take lo_long) 240, // lo_last 3116, // sep 144 // nb_bits ); -----CODE END----- ^ |---> < 1943032088 us > elapsed without recording v Signal duration: 313932 us N LOW, HIGH -----BEGIN RF433 LOW HIGH SEQUENCE----- , 10696 000 352, 424 001 564, 1036 002 560, 1028 003 568, 1028 004 560, 1028 005 564, 1032 006 360, 420 007 576, 1020 008 368, 412 009 368, 412 010 376, 412 011 376, 420 012 364, 420 013 368, 428 014 360, 424 015 568, 1036 016 360, 428 017 568, 1028 018 372, 412 019 372, 412 020 380, 408 021 580, 1028 022 576, 1028 023 368, 420 024 568, 1036 025 368, 412 026 380, 412 027 372, 412 028 376, 412 029 376, 412 030 584, 1020 031 576, 1028 032 368, 420 033 572, 1028 034 576, 1020 035 384, 408 036 380, 408 037 580, 1024 038 584, 1020 039 576, 1028 040 372, 416 041 572, 1028 042 376, 412 043 584, 1020 044 376, 412 045 584, 1024 046 372, 412 047 376, 416 048 576, 1028 049 568, 1028 050 372, 408 051 384, 404 052 384, 408 053 580, 1020 054 576, 1020 055 376, 420 056 576, 1024 057 376, 416 058 568, 1028 059 384, 404 060 584, 1020 061 372, 412 062 380, 416 063 372, 416 064 572, 1028 065 368, 420 066 376, 420 067 568, 976 068 228, 3100 069 2008, 4072 070 380, 404 071 380, 404 072 588, 1012 073 592, 1012 074 384, 404 075 584, 1032 076 576, 1028 077 568, 1032 078 580, 1024 079 580, 1020 080 384, 404 081 584, 1020 082 372, 416 083 368, 416 084 376, 416 085 372, 420 086 368, 412 087 380, 404 088 380, 412 089 580, 1020 090 376, 412 091 584, 1020 092 372, 420 093 368, 420 094 368, 424 095 568, 1028 096 580, 1012 097 384, 412 098 584, 1020 099 372, 412 100 380, 404 101 380, 412 102 376, 420 103 368, 416 104 572, 1036 105 576, 1020 106 376, 412 107 580, 1024 108 580, 1020 109 376, 412 110 376, 420 111 576, 1028 112 568, 1028 113 584, 1020 114 384, 404 115 584, 1020 116 380, 404 117 580, 1024 118 376, 420 119 576, 1028 120 368, 412 121 384, 412 122 576, 1020 123 584, 1020 124 384, 404 125 384, 412 126 376, 420 127 568, 1028 128 576, 1028 129 376, 412 130 584, 1012 131 384, 412 132 576, 1020 133 380, 412 134 576, 1028 135 368, 420 136 376, 420 137 368, 420 138 568, 1020 139 376, 416 140 380, 408 141 580, 976 142 220, 3108 143 2000, 4072 144 392, 396 145 392, 404 146 584, 1020 147 580, 1024 148 376, 412 149 584, 1020 150 584, 1012 151 588, 1012 152 584, 1020 153 584, 1024 154 372, 420 155 576, 1020 156 384, 404 157 384, 404 158 384, 412 159 376, 412 160 376, 412 161 384, 412 162 376, 412 163 576, 1028 164 372, 416 165 572, 1028 166 376, 412 167 376, 404 168 376, 412 169 584, 1020 170 580, 1024 171 376, 416 172 568, 1028 173 376, 420 174 368, 420 175 376, 412 176 376, 412 177 376, 412 178 584, 1020 179 576, 1020 180 384, 412 181 576, 1028 182 576, 1028 183 372, 412 184 372, 412 185 580, 1020 186 584, 1020 187 580, 1024 188 376, 412 189 576, 1028 190 376, 420 191 568, 1028 192 372, 412 193 580, 1012 194 384, 412 195 384, 396 196 584, 1020 197 572, 1032 198 376, 420 199 368, 412 200 380, 404 201 584, 1020 202 584, 1024 203 380, 408 204 580, 1032 205 368, 420 206 576, 1028 207 368, 416 208 576, 1020 209 380, 404 210 380, 404 211 384, 412 212 584, 1012 213 380, 412 214 376, 420 215 568, 984 216 212, 3100 217 2016, 4076 218 376, 412 219 376, 412 220 584, 1020 221 580, 1008 222 388, 404 223 584, 1020 224 584, 1020 225 568, 1028 226 576, 1020 227 584, 1020 228 380, 404 229 580, 1024 230 384, 404 231 384, 404 232 376, 420 233 376, 412 234 376, 420 235 368, 428 236 360, 412 237 584, 1020 238 380, 412 239 576, 1020 240 380, 404 241 384, 412 242 376, 420 243 568, 1028 244 576, 1028 245 372, 408 246 580, 1020 247 368, 412 248 384, 404 249 384, 412 -----END RF433 LOW HIGH SEQUENCE----- Waiting for signal... ^ |---> < 2825800 us > elapsed without recording v Signal duration: 341804 us N LOW, HIGH -----BEGIN RF433 LOW HIGH SEQUENCE----- , 4076 000 596, 996 001 592, 1008 002 388, 400 003 380, 404 004 584, 1008 005 588, 1008 006 392, 396 007 584, 1012 008 384, 396 009 384, 404 010 576, 1028 011 368, 420 012 572, 1024 013 588, 1016 014 592, 1012 015 588, 1016 016 584, 1020 017 584, 1028 018 576, 1020 019 380, 404 020 588, 1012 021 384, 404 022 592, 1020 023 572, 1028 024 576, 1020 025 376, 420 026 368, 412 027 584, 1020 028 380, 408 029 588, 1012 030 584, 1020 031 584, 1024 032 580, 1028 033 576, 1020 034 380, 404 035 380, 412 036 584, 1016 037 380, 404 038 380, 412 039 576, 1036 040 568, 1036 041 364, 416 042 380, 408 043 380, 408 044 580, 1020 045 376, 412 046 584, 1020 047 376, 420 048 576, 1024 049 372, 416 050 568, 1020 051 584, 1020 052 380, 396 053 384, 412 054 584, 1024 055 576, 1028 056 576, 1028 057 364, 420 058 372, 412 059 580, 1024 060 380, 404 061 584, 1020 062 376, 412 063 584, 1028 064 364, 416 065 572, 1036 066 568, 1020 067 580, 1020 068 380, 408 069 372, 408 070 580, 1020 071 376, 368 072 220, 3108 073 2008, 4072 074 584, 1020 075 584, 1020 076 380, 404 077 388, 408 078 580, 1012 079 592, 1016 080 380, 404 081 580, 1020 082 368, 412 083 376, 420 084 576, 1028 085 376, 404 086 588, 1016 087 588, 1024 088 584, 1012 089 584, 1028 090 576, 1028 091 576, 1020 092 584, 1020 093 380, 408 094 588, 1020 095 376, 412 096 584, 1020 097 584, 1028 098 568, 1028 099 376, 412 100 384, 412 101 584, 1020 102 376, 412 103 584, 1024 104 572, 1028 105 576, 1036 106 576, 1016 107 588, 1008 108 376, 412 109 380, 404 110 584, 1020 111 376, 420 112 376, 412 113 576, 1036 114 572, 1028 115 376, 412 116 380, 412 117 376, 412 118 584, 1020 119 376, 412 120 584, 1020 121 372, 416 122 576, 1020 123 380, 412 124 580, 1020 125 576, 1024 126 380, 412 127 372, 408 128 584, 1028 129 568, 1036 130 568, 1028 131 372, 412 132 380, 404 133 584, 1020 134 384, 412 135 576, 1028 136 372, 404 137 576, 1028 138 368, 420 139 576, 1020 140 584, 1016 141 588, 1024 142 376, 412 143 376, 412 144 584, 1028 145 368, 368 146 212, 3108 147 2016, 4072 148 584, 1020 149 584, 1020 150 384, 404 151 384, 404 152 592, 1012 153 592, 1016 154 380, 412 155 580, 1028 156 368, 420 157 368, 420 158 576, 1020 159 380, 404 160 588, 1012 161 592, 1012 162 584, 1032 163 576, 1028 164 576, 1012 165 576, 1024 166 580, 1020 167 384, 404 168 592, 1020 169 376, 412 170 576, 1028 171 576, 1028 172 576, 1020 173 380, 408 174 380, 412 175 580, 1020 176 376, 412 177 584, 1028 178 576, 1028 179 576, 1020 180 584, 1020 181 584, 1020 182 372, 412 183 380, 408 184 580, 1028 185 368, 420 186 368, 428 187 568, 1028 188 584, 1020 189 372, 412 190 372, 412 191 384, 408 192 576, 1028 193 368, 412 194 576, 1028 195 368, 416 196 584, 1020 197 376, 412 198 584, 1020 199 576, 1032 200 372, 416 201 376, 416 202 576, 1028 203 568, 1028 204 584, 1012 205 380, 412 206 380, 408 207 580, 1020 208 376, 412 209 584, 1028 210 376, 412 211 576, 1024 212 380, 404 213 584, 1020 214 584, 1020 215 584, 1020 216 376, 416 217 368, 420 218 576, 1028 219 368, 368 220 228, 3100 221 2008, 4080 222 572, 1024 223 584, 1020 224 384, 404 225 384, 404 226 592, 1012 227 580, 1028 228 372, 412 229 576, 1028 230 376, 404 231 380, 412 232 584, 1020 233 372, 412 234 584, 1020 235 584, 1020 236 576, 1028 237 576, 1028 238 584, 1020 239 584, 1016 240 588, 1020 241 376, 412 242 584, 1020 243 372, 412 244 576, 1020 245 584, 1020 246 584, 1012 247 380, 416 248 380, 408 249 580, 1028 -----END RF433 LOW HIGH SEQUENCE----- Waiting for signal... ^ |---> < 1928812 us > elapsed without recording v Signal duration: 333992 us N LOW, HIGH -----BEGIN RF433 LOW HIGH SEQUENCE----- ,111572 000 2032, 4052 001 596, 1000 002 588, 1004 003 392, 396 004 592, 996 005 600, 1004 006 384, 400 007 580, 1016 008 380, 404 009 376, 404 010 376, 412 011 580, 1024 012 576, 1020 013 592, 1016 014 588, 1016 015 592, 1012 016 384, 412 017 576, 1028 018 580, 1028 019 576, 1020 020 584, 1024 021 576, 1020 022 384, 404 023 584, 1028 024 364, 420 025 572, 1032 026 368, 416 027 376, 412 028 372, 412 029 380, 404 030 584, 1020 031 584, 1020 032 380, 412 033 572, 1028 034 576, 1020 035 384, 404 036 592, 1012 037 580, 1020 038 380, 404 039 384, 412 040 376, 420 041 568, 1036 042 368, 420 043 368, 420 044 576, 1024 045 580, 1020 046 384, 412 047 576, 1020 048 580, 1028 049 576, 1028 050 368, 412 051 576, 1020 052 384, 412 053 376, 416 054 380, 404 055 580, 1024 056 384, 412 057 576, 1028 058 376, 420 059 368, 420 060 368, 420 061 376, 404 062 580, 1024 063 384, 408 064 372, 412 065 376, 412 066 584, 1020 067 584, 1020 068 376, 420 069 364, 420 070 572, 1032 071 376, 412 072 376, 360 073 224, 3108 074 2000, 4076 075 592, 1012 076 588, 1016 077 380, 408 078 576, 1020 079 584, 1020 080 384, 408 081 580, 1020 082 384, 404 083 384, 404 084 384, 412 085 584, 1020 086 576, 1028 087 576, 1028 088 584, 1012 089 584, 1024 090 380, 404 091 588, 1020 092 576, 1028 093 572, 1032 094 572, 1020 095 584, 1020 096 380, 404 097 580, 1024 098 380, 404 099 584, 1028 100 368, 420 101 376, 420 102 368, 420 103 368, 420 104 576, 1024 105 584, 1020 106 376, 412 107 584, 1020 108 584, 1024 109 372, 412 110 576, 1028 111 576, 1024 112 380, 408 113 380, 408 114 372, 408 115 580, 1020 116 376, 412 117 376, 420 118 568, 1036 119 564, 1028 120 376, 412 121 584, 1020 122 576, 1024 123 580, 1024 124 384, 412 125 576, 1028 126 368, 428 127 368, 412 128 376, 412 129 580, 1024 130 376, 412 131 584, 1020 132 384, 412 133 368, 420 134 376, 412 135 376, 420 136 568, 1032 137 376, 412 138 380, 408 139 372, 412 140 576, 1028 141 584, 1020 142 376, 412 143 372, 412 144 572, 1032 145 368, 416 146 368, 368 147 224, 3096 148 2016, 4076 149 584, 1012 150 588, 1020 151 372, 408 152 584, 1020 153 584, 1020 154 376, 412 155 584, 1024 156 380, 408 157 384, 404 158 384, 412 159 584, 1020 160 584, 1020 161 576, 1028 162 576, 1028 163 576, 1024 164 380, 412 165 580, 1024 166 584, 1012 167 588, 1012 168 580, 1032 169 576, 1028 170 376, 404 171 592, 1012 172 380, 416 173 580, 1012 174 384, 412 175 376, 412 176 376, 420 177 368, 420 178 576, 1036 179 568, 1020 180 384, 412 181 584, 1012 182 584, 1024 183 380, 412 184 580, 1020 185 576, 1028 186 372, 412 187 372, 408 188 384, 404 189 584, 1020 190 380, 412 191 376, 412 192 576, 1028 193 576, 1028 194 372, 416 195 572, 1028 196 584, 1020 197 584, 1020 198 372, 412 199 580, 1020 200 376, 420 201 368, 420 202 376, 412 203 576, 1020 204 384, 412 205 584, 1016 206 380, 412 207 380, 408 208 380, 412 209 376, 412 210 576, 1028 211 376, 420 212 368, 420 213 368, 420 214 576, 1024 215 580, 1020 216 384, 404 217 384, 412 218 584, 1020 219 376, 412 220 376, 368 221 216, 3100 222 2016, 4072 223 584, 1020 224 584, 1020 225 384, 404 226 584, 1016 227 588, 1024 228 384, 404 229 584, 1020 230 384, 412 231 376, 412 232 376, 412 233 584, 1020 234 580, 1024 235 584, 1020 236 584, 1020 237 572, 1032 238 376, 420 239 568, 1028 240 584, 1012 241 588, 1012 242 592, 1012 243 584, 1028 244 372, 412 245 572, 1028 246 376, 412 247 584, 1012 248 380, 412 249 376, 412 -----END RF433 LOW HIGH SEQUENCE----- Waiting for signal...

[sebmillet]

Hello

I don't see that the receiver register really changes between buttons. There are a few minor differences, due to measure differences when receiving signal. But these differences are small, it is beyond doubt the receivers are interchangeable, if for example you want to use rf433recv, you'll have to register one only, that'll work for the three buttons.

Just take one of the codes, round the timings reasonably and it'll work. For example:

rf.register_Receiver( 65535, // initseq 2000, // lo_prefix 4000, // hi_prefix 0, // first_lo_ign 400, // lo_short 600, // lo_long 400, // hi_short (0 => take lo_short) 1000, // hi_long (0 => take lo_long) 250, // lo_last 3116, // sep 144 // nb_bits );

Regards

[Westiewombat]

The compiler is looking for another int entry - I'm assuming a mod. I have tried all three mods and "". The latter provides an assertion error on line 793 of RF433recv.cpp, the other mods dont output any results from call back. Can you tell the mod? The product is actually manufactured by Zemismart. The description says it uses either FSK, GFSK or OOK modulation

[sebmillet]

Hello

I have to amend my last resp, there is more to it. Looking at your codes more carefully, I saw the scheme is unusual. It is sequences of either "low-short then low-short", or, "low-long then low-long".

RF433any cannot decode it. It assumes tribit or tribit-inverted, that is based on the scheme "short-then-long" versus "long-then-short" (tribit: low short then high long versus low long then high short, tribit-inverted: high short then low long versus high long then low short).

I coded a sender (using lib rf433send) that emits a signal close to yours, and RF433any produced the below output:

-----BEGIN ARDUINO OUTPUT----- Waiting for signal Data: ff f0 f0 f0 00 00 ff 0f ff 00 f0 0f f0 ff 0f 0f ff f0

-----CODE START----- // [WRITE THE DEVICE NAME HERE] rf.register_Receiver(

, // mod 3052, // initseq 0, // lo_prefix 0, // hi_prefix 0, // first_lo_ign 388, // lo_short 592, // lo_long 440, // hi_short (0 => take lo_short) 1040, // hi_long (0 => take lo_long) 188, // lo_last 3052, // sep 144 // nb_bits ); -----CODE END----- The "data" printed out is the recognition of long or low signals, bit=1 for long, bit=0 for short. It is not "data" in the sense of *decoded* bits, it is simply the recognition by RF433any of short or long signals. In the end it gives you the length in "bits" of 144, that's actually the number of short and long sequences that is saw. It is NOT the number of decoded bits (RF433any could not decode so it has no idea of what the number of decoded bits is.) Admittedly, this output of RF433any is not clear, I may change it so that when an *unmanaged* encoding is encountered, more output is given to warn people that *nb_bits* is NOT the number of decoded bits, it is instead the number of transitions between low and high. And so, what's next? Actually the encoding is a modified tribit, that is, sequences of "short then short" versus "long then long". RF433any cannot handle it, but rf433send and rf433recv can. The sender I coded that produces a signal that resembles yours: (obviously you got to install the library rf433send) I insert below only useful code, I removed license disclaimer: #include "RF433send.h" #define PIN_RFOUT 4 RfSend *tx_whatever; void setup() { pinMode(PIN_RFOUT, OUTPUT); Serial.begin(115200); // rfsend_builder performs some asserts that, it failed, write details // to Serial and then block execution. // If construction is done before setup() execution (as is the case with // global variables), no output is done and we loose interesting debug // information. // Therefore I prefer this style over using a global radio object. tx_whatever = rfsend_builder( RfSendEncoding::TRIBIT, PIN_RFOUT, RFSEND_DEFAULT_CONVENTION, // Do we want to invert 0 and 1 bits? No. 6, // Number of sendings nullptr, // No callback to keep/stop sending (if you want to send // SO LONG AS a button is pressed, the function reading the // button state is to be put here). 4000, // initseq 0, // lo_prefix 0, // hi_prefix 0, // first_lo_ign 400, // lo_short 600, // lo_long 1000, // hi_short 400, // hi_long 200, // lo_last 3000, // sep 72 // nb_bits ); } byte data[] = { 0xfc, 0xcc, 0x00, 0xf3, 0xf0, 0xc3, 0xcf, 0x33, 0xfc }; void loop() { static int count = 0; byte n = tx_whatever->send(sizeof(data), data); Serial.print("Envoi effectué "); Serial.print(n); Serial.print(" fois\n"); delay(5000); } And rf433recv that could decode it: #include "RF433recv.h" #include #define PIN_RFINPUT 2 // Specifying the interrupt number is optional, you can leave it to the // constructor to work it out. #define INT_RFINPUT 0 void callback(const BitVector *recorded) { Serial.print(F("Code received: ")); char *printed_code = recorded->to_str(); if (printed_code) { Serial.print(recorded->get_nb_bits()); Serial.print(F(" bits: [")); Serial.print(printed_code); Serial.print(F("]\n")); free(printed_code); } } RF_manager rf(PIN_RFINPUT); void setup() { pinMode(PIN_RFINPUT, INPUT); Serial.begin(115200); // Replace the below code with your telecommand timings. // See RF433any (https://github.com/sebmillet/RF433any) as to how to // work out these timings. In particular, you can use example: // examples/01_main/01_main.ino // to output exactly what is needed to call register_Receiver(). // This example complete URL is: // https://github.com/sebmillet/RF433any/blob/main/examples/01_main/01_main.ino // [WRITE THE DEVICE NAME HERE] rf.register_Receiver( RFMOD_TRIBIT, // mod 4000, // initseq 0, // lo_prefix 0, // hi_prefix 0, // first_lo_ign 400, // lo_short 600, // lo_long 1000, // hi_short (0 => take lo_short) 400, // hi_long (0 => take lo_long) 200, // lo_last 3000, // sep 72, // nb_bits callback, 0 ); Serial.print(F("Waiting for signal\n")); rf.activate_interrupts_handler(); } void loop() { rf.do_events(); } IMPORTANT As you can see in the timings of both the sender and the receiver, the high signal has inverted durations. That is, the short duration is longer than the long duration!!! For the sender it is not an issue (the sender just uses the timings you give it), but for the RECEIVER, I was unsure such an invertion would work. It does apparently. But it is a hack obviously. Also your signal timings seem to use weird init sequences, I'm not sure the rf433recv I give you above will work fine with your real devices emitting real code... to be continued. FYI to answer to your point about FSK, GFSK and OOK: all the libs I wrote (rf433any, rf433recv, rf433snif, rf433send) are using OOK. FSK or GFSK require specific demodulation devices. Simple receivers like MX-RM-5V (and alike) can work only with OOK. Regards