![\"Fanju](\"https:\/\/www.chaosgeordend.nl\/mt-blog-cg\/images\/RF433TemperatureHumiditySensor.jpeg\")
\nOn AliExpress you find cheap wireless (RF433) weather stations compatible with the ‘Fanju’ weather station model FJ3378\/74\/79C\/65\/89 (according to AE). Following is the description of the data transmission protocol.<\/p>\n
\nOn AliExpress you find cheap wireless (RF433) weather stations compatible with the ‘Fanju’ weather station model FJ3378\/74\/79C\/65\/89 (according to AE). Following is the description of the data transmission protocol.<\/p>\n
<\/p>\n
Details<\/strong> Helpful in reverse engineering a checksum is data differing one bit only. The sensor uses a rolling-code for its identification. That means, when powered off, c.q. batteries are changed, it generates a new id. To make a long story short, the physical layer uses on-off keying and pulse-width modulation. Pulse durations (mark\/space in µs) are as follows (pilight-debug timings between parenthesis): The checksum turns out to be a Linear-feedback Shift Register (LFSR<\/a>) hash with seed 0xC and feedback 0x9. The following script calculates the masks used for generating the checksum:<\/p>\n Generate_hash_mask.py<\/a>:<\/p>\n Hardware used<\/strong> On AliExpress you find cheap wireless (RF433) weather stations compatible with the ‘Fanju’ weather station model FJ3378\/74\/79C\/65\/89 (according to AE). Following is the description of the data transmission protocol.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43,31,49],"tags":[],"class_list":["post-828","post","type-post","status-publish","format-standard","hentry","category-arduino","category-electronicaelectronics","category-raspberrypi"],"_links":{"self":[{"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/posts\/828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/comments?post=828"}],"version-history":[{"count":33,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/posts\/828\/revisions"}],"predecessor-version":[{"id":949,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/posts\/828\/revisions\/949"}],"wp:attachment":[{"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/media?parent=828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/categories?post=828"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.chaosgeordend.nl\/wordpress\/wp-json\/wp\/v2\/tags?post=828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nFirst the RF signal was analysed to determine the physical layer, OOK using e.g. Manchester encoding or pulse-width modulation.<\/p>\n
\nWith help of the ATTiny and a FET, the sensor is switched off and on for a few hours. The data sent was logged using a Python script. With the thus collected dataset the ‘attack’ started.<\/p>\n
\nSync: 1000\/1000 (936\/936),
\nHead: 600\/7900 (468\/7956)
\nData 0: 600\/1900 (468\/1872)
\nData 1: 600\/3800 (468\/3744-4212)
\nTail: 600\/16000 (468\/15912)
\nA message comprises 4xSYNC, 1xHEAD, 40xDATA 0\/1, 1xTAIL.
\nEvery \u00b180s the station transmits a burst of six messages.<\/p>\n![\"Physical](\"https:\/\/www.chaosgeordend.nl\/mt-blog-cg\/images\/RF433Sync.bmp\")
<\/p>\n mask = 0xC\r\n print(\"0\")\r\n for i in range(40):\r\n lsb = (mask & 0x1 == 0x1)\r\n mask >>= 1\r\n if lsb:\r\n mask ^= 0x9\r\n print(\"Mask: {:2x} {:04b}\".format(mask, mask))\r\n if ((i + 1) % 4) == 0:\r\n print(i + 1)\r\n<\/pre>\n
\nRaspberry Pi 4
\nRF 433MHz superheterodyne receiver *)
\nATTiny85 development board *)
\nA FET and two resistors lying around here
\n*) AliExpress<\/p>\n![\"Python](\"https:\/\/www.chaosgeordend.nl\/mt-blog-cg\/images\/RF433TkGui.png\")
\nSoftware<\/strong>
\nA Python script<\/a> for data analysis and checksum verification
\nProtocol code has been submitted to the PiLight<\/a> project and is under review. PiLight GitHub repo<\/a><\/p>\n![\"Pilight](\"https:\/\/www.chaosgeordend.nl\/mt-blog-cg\/images\/RF433PilightWebserver.png\")
\nSoftware<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"