Fanju Temperature sensor transmission protocol

Fanju temperature sensor
On AliExpress you find cheap wireless (RF433) weather stations compatible with the ‘Fanju’ weather station model FJ3378/74/79C/65/89 (according to AE). Following is the description of the data transmission protocol.

First the RF signal was analysed to determine the physical layer, OOK using e.g. Manchester encoding or pulse-width modulation.

Helpful in reverse engineering a checksum is data differing one bit only. The sensor uses a rolling-code for its identification. That means, when powered off, c.q. batteries are changed, it generates a new id.
With help of the ATTiny and a FET, the sensor is switched off and on for a few hours. The data sent was logged using a Python script. With the thus collected dataset the ‘attack’ started.

To make a long story short, the physical layer uses on-off keying and pulse-width modulation. Pulse durations (mark/space in µs) are as follows (pilight-debug timings between parenthesis):
Sync: 1000/1000 (936/936),
Head: 600/7900 (468/7956)
Data 0: 600/1900 (468/1872)
Data 1: 600/3800 (468/3744-4212)
Tail: 600/16000 (468/15912)
A message comprises 4xSYNC, 1xHEAD, 40xDATA 0/1, 1xTAIL.
Every ±80s the station transmits a burst of six messages.

Physical layer

The checksum turns out to be a Linear-feedback Shift Register (LFSR) hash with seed 0xC and feedback 0x9. The following script calculates the masks used for generating the checksum:

  mask = 0xC
  for i in range(40):
      lsb = (mask & 0x1 == 0x1)
      mask >>= 1
      if lsb:
          mask ^= 0x9
      print("Mask: {:2x} {:04b}".format(mask, mask))
      if ((i + 1) % 4) == 0:
          print(i + 1)

Hardware used
Raspberry Pi 4
RF 433MHz superheterodyne receiver *)
ATTiny85 development board *)
A FET and two resistors lying around here
*) AliExpress

Python Tk GUI
A Python script for data analysis and checksum verification
Protocol code has been submitted to the PiLight project and is under review. PiLight GitHub repo

Pilight Webserver