IOWNHOMCTL
The reference of all researches : https://github.com/Velocet/iown-homecontrol
https://www.lafois.com/2020/12/20/rooting-the-cozytouch-aka-kizbox-mini-part-5/ (This guy is strange, so take care.. when you talk with him.)
https://blog.unauthorizedaccess.nl/2021/04/07/no-clouds-just-sunshine.html
si446x
https://blog.laplante.io/2019/01/11/reverse-engineering-the-tempur-pedic-adjustable-base-remote-control/
https://jmswrnr.com/blog/hacking-a-smart-home-device
https://github.com/BlackVS/ESP32-reversing
Désignation : Radiateur avec carte radio i2g
Caractéristiques :
Bandes de fréquence radio utilisées par l’Emetteur-Récepteur
868.0MHz à 868.6MHz
868.7MHz à 869.2MHz
869.7MHz à 870.0MHz
Compatibles iO-homecontrol…
RMG3H-i2g – Horizontal
Thermostat électronique : MK31 Référence : 71 60 0004
Soft reference: U0532702
RTL-433
rtl_433-win-x64-nightly>rtl_433 -c 0 -R 0 -g 37.2 -f868.65M -M time:usec -M level -s 2048k -X "name=I2G,m=FSK_PCM,s=26,l=26,r=1024,tolerance=1,preamble=557FD9" -F http://0.0.0.0:8433 -F log -M stats -F mqtt://192.168.1.40,events=homeassistant/sensor/rtl_433/I2G
URH
Private Thermor/Atlantic/Sauter Command: 0x20
Message 0c60 012c Allumage power général.
Message 0c61 0110 01/00 Présence/Fin Présence
Message 0c61 0103 c300 -> 0xC3 = 195 = 19.5°C set with button
Message 0c61 0103 d200 -> 0xD2 = 210 = 21.0°C set with button
0c61 0100 00 Mode AUTO
0c61 0100 01 Mode MANUEL
0c61 0100 02 Mode PROG
0c61 0100 04 Mode OFF
Mode PROG :
Message 0c61 010c 00/01 Pilotage interne/Externe
Message 0c61 0104 32 00 -> 0x32 = 50 = 5°C abaissement T° ECO max
Message 0c61 011e 05 0c 2c 00 00 00 00 00 00 00 00 -> 05 Samedi, 06h->22h Confort
Message 0c61 011e 01 0A 12 22 2E 00 00 00 00 00 00 ->
00->06 day of week
0x0A SHR1 = 05H - 0x12 SHR1 = 09H - 0x22 SHR1 = 17H - 0x2E SHR1 = 23H
Error when setting a wrong temperature
2W S 1 E 0 FROM BA11AD TO 487902 CMD 20 . PRIVATE REQ 0x20 DATA(6)0c6101031100 set to 1.7°C
2W S 0 E 1 FROM 487902 TO BA11AD CMD 21 . PRIVATE ACK 0x21 DATA(6)0c6101034600 ack with 7.0°C the minimal accepted
Message 0c61 010f 1d3413070404e707 Date Time
SubCommand 010F -> In decimal the data is :
029 052 019 007 004 004 231 007*
*Frame is dated 2023-04-07 19:45:11.315573
So there's the 23, the 04 the 07 the 19 and maybe 52 for the minutes (07 is 19 if am/pm) (am/pm is Probably the '1' after 231
So according the last private commands everything is in clear
029 is exactly in mn, the 'anticipation time' available in the physical menu
2023-04-22 00:03:32.533824
016, 005, 000, 022, 005, 004, 231, 007
UNK MIN HOU DAY UNK MON YEA UNK
2023-05-09T07:05:56.463274000Z [rtl_433_simple] time : 2023-05-09T09:05:56.367566+0200
2023-05-09T07:05:56.463634000Z [rtl_433_simple] Protocol : 189
2023-05-09T07:05:56.463762000Z [rtl_433_simple] model : Somfy-IOHC
2023-05-09T07:05:56.463890000Z [rtl_433_simple] Source : b49b04
2023-05-09T07:05:56.464076000Z [rtl_433_simple] Target : 8ccb31
23-05-09T07:05:56.464324000Z [rtl_433_simple] Command : 20
2023-05-09T07:05:56.464563000Z [rtl_433_simple] Message : 0c61010f
-> 0e0500010501d007
[Thermor heaters]
Updated Private Commands (0x20)
Sub command 0x0121 followed by a counter is radio test frame send to broadcast 0x3F with LPM flag using the expert menu
Command 0x28 (Discover) broadcast 0xfffb is receive security key with the expert menu
Allumé avec le bouton général (10 frames)
2023-05-09T07:00:28.535387000Z [rtl_433_simple] Source : b49b04
2023-05-09T07:00:28.535524000Z [rtl_433_simple] Target : 8ccb31
2023-05-09T07:00:28.535806000Z [rtl_433_simple] Command : 20
2023-05-09T07:00:28.536398000Z [rtl_433_simple] Message : 0c60012c
Réponse : This show the paired device to synchronize (displayed on device...)
0c60012c 02 8ccb31 795b12 000100
0c60012c 02 8ccb31 ed5c12 000100
237-92-18
0c60012c 02 8ccb31 140f1e 000100
20-15-30Menu : Voir les jumeaux
12:14:28.814 > (10) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 1E > DATA(02) 0000 12:14:28.821 > (09) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD FE < DATA(01) 05 12:15:04.806 > (10) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 1E > DATA(02) 0177 12:15:04.812 > (09) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD FE < DATA(01) 05
Reccurent every midnight 00:05:38.188 >
heat1 Send temp to paired heat2
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(6)0c6101037800
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(6)0c6101037800
Midnight (Not Paired)
48 > 000c00000300000152 49 < 00040802
48 > 000c00000300000154 49 < 00042000
48 > 000c00000300000153 49 < 02000153
Ask for memorized day (Paired Only)
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 48 . DATA(9)000c00000300000153
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020013
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020012
Data
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17
04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 b3
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020012
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020011 04040404040404040404040404040404043f
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020011
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020010 0404040404040404040404040404040404b3
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020010
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB310 CMD 4A . DATA(21)02000f 0404040404040404040404040404040404b3
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000f
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)02000e 040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000e
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)02000d 040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000d
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)02000c 040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000c
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)02000b 040404040404040404040404040404040400
2W S 0 E 10m FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000b
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)02000a 040404040404040404040404040404040400
2W S 0 E 10m FROM 8CCB31 TO 477706 CMD 4B . DATA(3)02000a
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020009040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020009
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31m CMD 4A . DATA(21)020008040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020008
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020007040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020007
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)020006040404040404040404040404040404040400
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020006
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)0200050404040404040404040404040404040404b3
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B . DATA(3)020005
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A . DATA(21)0200040404040404040404040404040404040404b3
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(12)0c61010f1c050010000ae707
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(12)0c61010f1c050010000ae707
00:05:38.336 > (17) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 48, > DATA(09) 000c00000300000153
00:05:38.360 > (12) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 49, < DATA(04) 22000153
00:05:38.386 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, < DATA(21) 220013010101010101010101040606060606060606
00:05:38.412 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, < DATA(03) 220013 00:05:38.440 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +25.137, -44.5dBm -3294.000000 < DATA(21) 220012060405040606060606060605060606050606 00:05:38.446 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.669, -41.5dBm 3294.000000 < DATA(06) 09396287b596 00:05:38.456 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +8.977, -44.5dBm -3294.000000 < DATA(06) 4de75798e377 00:05:38.464 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.257, -41.5dBm 3294.000000 < DATA(03) 220012 00:05:38.490 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +25.114, -45.0dBm -2440.000000 < DATA(21) 220011060606060504050101010101010101010101 00:05:38.499 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.742, -41.0dBm 1952.000000 < DATA(06) 2f87a9784065 00:05:38.508 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +8.927, -44.5dBm -2684.000000 < DATA(06) 606851e70c40 00:05:38.516 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.264, -41.5dBm 1952.000000 < DATA(03) 220011 00:05:38.542 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +25.067, -44.5dBm -3416.000000 < DATA(21) 220010010101010606060606060606060606050106 00:05:38.551 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.758, -41.0dBm 2684.000000 < DATA(06) a03a2a7c91bb 00:05:38.560 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +8.879, -44.5dBm -2074.000000 < DATA(06) d9e82eef60ae 00:05:38.568 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.392, -41.0dBm 2440.000000 < DATA(03) 220010 00:05:38.595 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +25.022, -44.5dBm -3904.000000 < DATA(21) 22000f060606060106060606060606060606060604 00:05:38.602 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.786, -41.0dBm 2806.000000 < DATA(06) 3c9d0c84f46a 00:05:38.613 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.811, -44.5dBm -2928.000000 < DATA(06) 01de13a78712 00:05:38.621 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.379, -41.0dBm 2928.000000 < DATA(03) 22000f 00:05:38.647 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.994, -44.5dBm -3172.000000 < DATA(21) 22000e060101040101010101010101010101060606 00:05:38.656 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.828, -41.0dBm 2806.000000 < DATA(06) af9511fc9dfb 00:05:38.666 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.830, -44.5dBm -2562.000000 < DATA(06) 20f8e3cc54aa 00:05:38.675 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.396, -41.5dBm 2562.000000 < DATA(03) 22000e 00:05:38.701 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.975, -45.0dBm -2562.000000 < DATA(21) 22000d060606060606060506060606060606060606 00:05:38.709 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.877, -41.0dBm 3904.000000 < DATA(06) c560f92e49fb 00:05:38.719 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.752, -45.0dBm -2318.000000 < DATA(06) 385f891622cf 00:05:38.726 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.454, -41.5dBm 2318.000000 < DATA(03) 22000d 00:05:38.753 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.917, -45.0dBm -2440.000000 < DATA(21) 22000c060606060606060604060503000000000000 00:05:38.761 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +8.907, -41.0dBm 2318.000000 < DATA(06) 5098381c0a35 00:05:38.772 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.740, -44.5dBm -1952.000000 < DATA(06) 229c842e6c70 00:05:38.779 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.483, -41.0dBm 2074.000000 < DATA(03) 22000c 00:05:38.805 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.889, -44.5dBm -3416.000000 < DATA(21) 22000b000000000000000000000606060606060406 00:05:38.813 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +8.921, -41.0dBm 3294.000000 < DATA(06) 284f146b74a7 00:05:38.824 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.808, -44.5dBm -2562.000000 < DATA(06) 13ca217c64b2 00:05:38.831 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.436, -41.0dBm 2562.000000 < DATA(03) 22000b 00:05:38.858 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.822, -44.5dBm -2562.000000 < DATA(21) 22000a050505060605060606060506060606060606 00:05:38.865 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +8.972, -41.0dBm 2684.000000 < DATA(06) bc012f786bd7 00:05:38.875 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.669, -45.0dBm -2928.000000 < DATA(06) 00e8711c4e7d 00:05:38.883 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.576, -41.5dBm 2440.000000 < DATA(03) 22000a 00:05:38.910 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.797, -44.5dBm -2318.000000 < DATA(21) 220009060606050604060300000000000000000000 00:05:38.918 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.012, -71.5dBm 3172.000000 < DATA(06) 1712567b5453 00:05:38.926 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.632, -44.5dBm -3416.000000 < DATA(06) 64ea3ada99b7 00:05:38.936 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.595, -41.0dBm 3782.000000 < DATA(03) 220009 00:05:38.961 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.776, -44.5dBm -2928.000000 < DATA(21) 220008000000000606060606060606060606060606 00:05:38.970 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.074, -41.0dBm 2318.000000 < DATA(06) c9645fa8db0c 00:05:38.978 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.553, -44.5dBm -2806.000000 < DATA(06) 29515a5ffee8 00:05:38.988 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.645, -41.0dBm 2928.000000 < DATA(03) 220008 00:05:39.013 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.731, -44.5dBm -3416.000000 < DATA(21) 220007060606050606060606060606050506060604 00:05:39.022 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.080, -41.0dBm 3660.000000 < DATA(06) ceefafd2e5fa 00:05:39.031 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.555, -45.0dBm -2196.000000 < DATA(06) ed1d70818f67 00:05:39.039 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.687, -41.0dBm 2318.000000 < DATA(03) 220007 00:05:39.068 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.682, -41.5dBm -1952.000000 < DATA(21) 220006010101010101010404010401040404040606 00:05:39.073 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.132, -41.5dBm 3050.000000 < DATA(06) 6293028f15ff 00:05:39.083 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.618, -44.5dBm -3294.000000 < DATA(06) b621d3b587be 00:05:39.090 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.606, -41.5dBm 2684.000000 < DATA(03) 220006 00:05:39.117 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.665, -44.5dBm -3294.000000 < DATA(21) 220005060606060606060606060606060604010104 00:05:39.126 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.147, -41.0dBm 2440.000000 < DATA(06) 3188e8bec4a0 00:05:39.134 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.480, -45.0dBm -2196.000000 < DATA(06) bcbc6c6985de 00:05:39.143 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.757, -41.0dBm 3294.000000 < DATA(03) 220005 00:05:39.170 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.614, -44.5dBm -3294.000000 < DATA(21) 220004040405050404040506060504060101010101 00:05:39.177 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.196, -41.0dBm 2806.000000 < DATA(06) 64c05f734908 00:05:39.187 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.442, -44.5dBm -1830.000000 < DATA(06) 9438d9104441 00:05:39.196 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.804, -41.0dBm 2196.000000 < DATA(03) 220004 00:05:39.222 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.569, -44.5dBm -2928.000000 < DATA(21) 220003010101010101010101010606060606060606 00:05:39.229 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.284, -41.0dBm 2684.000000 < DATA(06) 55a54bf80f00 00:05:39.239 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.360, -44.5dBm -3294.000000 < DATA(06) 5d1749b771f7 00:05:39.247 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.827, -41.0dBm 2562.000000 < DATA(03) 220003 00:05:39.274 > (29) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +24.547, -44.5dBm -1952.000000 < DATA(21) 220002040606060606060605060606040506060606 00:05:39.282 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.263, -41.5dBm 2074.000000 < DATA(06) 57fc6abd798e 00:05:39.291 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.363, -44.5dBm -2684.000000 < DATA(06) 9c8e20f5d5cc 00:05:39.300 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.872, -41.5dBm 2562.000000 < DATA(03) 220002 00:05:39.324 > (26) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +23.719, -44.5dBm -2318.000000 < DATA(18) 220001060606060606030006000300860806 00:05:39.332 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.093, -41.5dBm 2562.000000 < DATA(06) 160f4a1507c4 00:05:39.341 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.325, -44.5dBm -3050.000000 < DATA(06) 3c48f7431b27 00:05:39.351 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.908, -41.0dBm 3416.000000 < DATA(03) 220001 00:05:39.370 > (11) 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 4A, F868.950 +19.775, -44.5dBm -2684.000000 < DATA(03) 220000 00:05:39.380 > (14) 2W S 0 E 0 FROM 8CCB31 TO 477706 CMD 3C, F868.950 +9.080, -41.0dBm 3172.000000 < DATA(06) 963ca98f6854 00:05:39.389 > (14) 2W S 0 E 0 FROM 477706 TO 8CCB31 CMD 3D, F868.950 +9.258, -45.0dBm -2074.000000 < DATA(06) 80096c0d5e5d 00:05:39.398 > (11) 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 4B, F868.950 +8.929, -41.0dBm 2562.000000 < DATA(03) 220000 00:09:38.476 >
Un voisin
Porte garage et/ou portail entrée télécommande
07:04:59.370 > 1W S 1 E 1 FROM 9A5CA0 TO 3F CMD 1 DATA 0143000162 SEQ 16B3 MAC 2f7a12b090b5
07:04:59.393 > 1W S 1 E 1 FROM 9A5CA0 TO 3F CMD 1 DATA 0143000162 SEQ 16B3 MAC 2f7a12b090b5
07:05:18.405 > 1W S 1 E 1 FROM 9A5CA0 TO 3F CMD 1 DATA 0143000163 SEQ 16B5 MAC 4685a8b4e2f1
07:05:18.427 > 1W S 1 E 1 FROM 9A5CA0 TO 3F CMD 1 DATA 0143000163 SEQ 16B5 MAC 4685a8b4e2f1
time : 2023-05-07 08:59:45.997342
model : Somfy-IOHC Source : 315824
Target : 0842e3 Command : fe Message : 05 Mode : Two-way
Version : 0 End flag : 1 Start flag: 0 Mode flag : 0 Beacon flag: 0
Routed flag: 0 LPM flag : 0 Integrity : CRC
Modulation: FSK Freq1 : 868.9 MHz Freq2 : 869.0 MHz
RSSI : -12.1 dB SNR : 15.2 dB Noise : -27.4 dB
time : 2023-04-07 19:45:11.315573
model : Somfy-IOHC Source : b49b04
Target : 8ccb31 Command : 20 Message : 0c61 010f 1d3413070404e707 Mode : Two-way
Version : 0 End flag : 0 Start flag: 1 Mode flag : 0 Beacon flag: 0
Routed flag: 0 LPM flag : 0 Integrity : CRC
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time : 2023-04-07 19:45:11.354229
model : Somfy-IOHC Source : 8ccb31
Target : b49b04 Command : 21 Message : 0c61 010f 1d3413070404 e707 Mode : Two-way
Version : 0 End flag : 1 Start flag: 0 Mode flag : 0 Beacon flag: 0
Routed flag: 0 LPM flag : 0 Integrity : CRC
Simple Associate a gateway (DONE)
Seams so easy. As we can send any key to be associated….
(Optional part if we know the target..)
2W S 1 E 1 FROM BA11AD TO 00FFFB CMD 28 DISCOVER REQ 0x28 DATA(0)
2W S 1 E 1 FROM B49B04 TO BA11AD CMD 29 DISCOVER_ANSWER_0x29 DATA(9)ffc0 b49b04 0ccc0000
2W S 1 E 1 FROM BA11AD TO B49B04 CMD 2C DISCOVER ACTUATOR REQ 0x2C DATA(0)
2W S 0 E 1 FROM B49B04 TO BA11AD CMD 2D DISCOVER_ACTUATOR_ACK_0x2D DATA(0)
2W S 0 E 0 FROM BA11AD TO B49B04 CMD 38 LAUNCH KEY TRANSFERT 0x38 DATA(6)123456789abc
Confirmed
08:12:35.579 > 2W S 1 E 0 FROM BA11AD TO 477706 CMD 2C . DISCOVER ACTUATOR REQ 0x2C DATA(0)
08:12:35.669 > 2W S 0 E 1 FROM 477706 TO BA11AD CMD 2D . DISCOVER ACTUATOR ACK 0x2D DATA(0)
08:12:35.672 > 2W S 1 E 0 FROM BA11AD TO 477706 CMD 38 . LAUNCH KEY TRANSFERT 0x38 DATA(6)000000000000
Better Confirmation
08:07:21.593 > 2W S 1 E 0 FROM BA11AD TO 477706 CMD 38 . LAUNCH KEY TRANSFERT 0x38 DATA(6)000000000000
08:07:21.625 > 2W S 0 E 1 FROM 477706 TO BA11AD CMD 32 . KEY TRANSFERT REQ 0x32 DATA(16)3ff4690a2b437b76194cbf978520e92f
08:07:21.629 > 2W S 0 E 1 FROM BA11AD TO 477706 CMD FE . ERROR 0xFE DATA(1)05
Real simple Pairing (missing parts)
(28)(29)…(2C)(2D)(48)(49)(4A)(4B)(4A)(4B)(4A)(4B)(4A)(4B)(4A)(4B)(2E)(2F)(20)(3C)(3D)(21)
2W S 1 E 1 FROM 477706 TO 00FFFB CMD 28 . DISCOVER REQ 0x28 DATA(0)
...
2W S 1 E 1 FROM 8CCB30 TO 00FFFB CMD 28 . DISCOVER REQ 0x28 DATA(0)
2W S 1 E 1 FROM 477706 TO 8CCB30 CMD 29 . DISCOVER ACK 0x29 DATA(9)ffc04777060ccc0000
AUTH 2
2W S 1 E 0 FROM 8CCB30 TO 477706 CMD 2C . DISCOVER ACTUATOR REQ 0x2C DATA(0)
2W S 1 E 0 U3 FROM 8CCB30 TO 477706 CMD 38 . LAUNCH KEY TRANSFERT 0x38 DATA(6)ae51c324ea69
2W S 0 E 0 U3 FROM 477706 TO 8CCB30 CMD 32 . KEY TRANSFERT REQ 0x32 DATA(16)e310c1be764a7b3b3b00c49167d37802
2W S 1 E 0 U3 FROM 8CCB30 TO 477706 CMD 38 . LAUNCH KEY TRANSFERT 0x38 DATA(6)6727215a05cc
2W S 0 E 0 U3 FROM 477706 TO 8CCB30 CMD 32 . KEY TRANSFERT REQ 0x32 DATA(16)38476d5ab2ac38a3b425b20626356f1b
2W S 1 E 1[LPM] FROM 477706 TO 000D3B CMD 2A . DISCOVER REMOTE REQ 0x2A DATA(12)c3ff13f27282cb8db67e17c2
2W S 1 E 1[LPM] FROM 477706 TO 00FFFB CMD 2A . DISCOVER REMOTE REQ 0x2A DATA(12)23018079673e60b66eae9824
2W S 1 E 1[LPM] FROM 477706 TO 00FFFB CMD 2A . DISCOVER REMOTE REQ 0x2A DATA(12)6d75ea0d42d115a7e21e31b8
2W S 1 E 0 FROM 477706 TO 8CCB30 CMD 48 . DATA(9)000000000100000014
2W S 0 E 1 FROM 8CCB30 TO 477706 CMD 49 . DATA(4)01000014
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB30 CMD 4A . DATA(21)0100024879020d01cc0c4879028ccb310d01dc0cf8
2W S 0 E 1 FROM 8CCB30 TO 477706 CMD 4B . DATA(3)010002
2W S 1 E 0 FROM 477706 TO 8CCB30 CMD 4A . DATA(5)010001cb31
2W S 1 E 0 FROM 477706 TO 8CCB30 CMD 4A . DATA(3)010000
Set 4 Plages Horaires
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA( 4)0c60011f
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA( 5)0c60011f 04
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(17)0c610131 000000010000000a12222e0000
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(17)0c610131 000000010000000a12222e0000
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(18)0c610133 030a12222e0000040a12222e0000
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(18)0c610133 030a12222e0000040a12222e0000
Set Date/Time
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(12)0c61010f 2b37070c030ae707
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(12)0c61010f 2b37070c030ae707
AUTH 3
2W S 1 E 1 FROM 477706 TO 00FFFB CMD 28 . DISCOVER REQ 0x28 DATA(0)
2W S 1 E 1[LPM] FROM 477706 TO 000D3B CMD 2A . DISCOVER REMOTE REQ 0x2A DATA(12)9c7f19efe475f6d0a0f4e1a3
2W S 1 E 1 FROM 8CCB31 TO 477706 CMD 2B . DISCOVER REMOTE ACK 0x2B DATA(9)0d018ccb310cdc010a
2W S 1 E 1[LPM] FROM 477706 TO 00FFFB CMD 2A . DISCOVER REMOTE REQ 0x2A DATA(12)ffc76f057055903eb6f4b0b0
2W S 1 E 1 FROM 8CCB30 TO 477706 CMD 2B . DISCOVER REMOTE ACK 0x2B DATA(9)ffc08ccb300ccc0000
2W S 1 E 0 FROM 477706 TO 8CCB30 CMD 2C . DISCOVER ACTUATOR REQ 0x2C DATA(0)
Set Temps params & 4 Plages Horaires
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(4)0c60011f
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(5)0c60011f04
Bad CRC 2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 PRIVATE REQ 0x20 DATA(21)0c610130 4600230028000000040100000102000000
Bad CRC 2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(21)0c610130 4600230028000000040100000102000000
2W S 1 E 0 FROM 477706 TO 8CCB31 CMD 20 . PRIVATE REQ 0x20 DATA(18)0c610133 030a12222e0000040a12222e0000
2W S 0 E 1 FROM 8CCB31 TO 477706 CMD 21 . PRIVATE ACK 0x21 DATA(18)0c610133 030a12222e0000040a12222e0000
Menu expert – Receive Security Key :
2W S 1 E 1 FROM 477706 TO 00FFFB CMD 28 DISCOVER_0x28 DATA(0)
2W S 1 E 1 FROM BA11AD TO 477706 CMD 29 DISCOVER_ANSWER_0x29 DATA(9)ffc0b49b040ccc0000
2W S 1 E 0 FROM 477706 TO BA11AD CMD 2C DISCOVER_ACTUATOR_0x2C DATA(0)
2W S 1 E 1 FROM BA11AD TO 477706 CMD 2D DISCOVER_ACTUATOR_ACK_0x2D DATA(0)
2W S 1 E 0 FROM 477706 TO BA11AD CMD 38 LAUNCH_KEY_TRANSFERT_0x38 DATA(6)58710295d99c
Debug Frame38 Using key transfert: 38 58 71 02 95 D9 9C
Initial value used for key encryption: 38 58 71 02 95 D9 9C 55 02 F4 58 71 02 95 D9 9C
Encrypted 2-way key to be sent with 0x32: 8C 42 3A E9 44 F4 EA E2 CA 97 08 11 5A 27 7A B6
2W S 1 E 1 FROM BA11AD TO 477706 CMD 32KEY_TRANSFERT_0x32
2W S 1 E 1 FROM BA11AD TO 477706 CMD 31 DATA(0)
Envoi clé sécurité
07:24:50.442 > 2W S 1 E 1 FROM 477706 TO BA11AD CMD 29 DATA(9)ffc04777060ccc0000
07:24:50.442 > DISCOVER_ANSWER_0x29
Menu Expert – Autoriser association avec un gestionnaire Energie (DONE)
2W S 0 E 0 FROM BA11AD TO 487902 CMD 31 . ASK_CHALLENGE_0x31 DATA(0)
2W S 0 E 0 FROM 487902 TO BA11AD CMD 3C . CHALLENGE REQ 0x3C DATA(6)cb0c8dd0f09a
1) Challenge asked after cmdId 31 : CB 0C 8D D0 F0 9A
2) Create Frame 32
2) Initial value used for key encryption: 31 55 55 55 55 55 55 55 00 62 CB 0C 8D D0 F0 9A
2) Encrypted 2-way key to be sent with 0x32: 83 79 42 9A D0 6C E6 A4 73 EE DB 90 4C 71 F6 5A
2W S 0 E 1 FROM BA11AD TO 487902 CMD 32 . KEY TRANSFERT REQ 0x32 DATA(16)8379429ad06ce6a473eedb904c71f65a
2W S 0 E 0 FROM 487902 TO BA11AD CMD 3C . CHALLENGE REQ 0x3C DATA(6)a5372ac181d2
1) Challenge asked after cmdId 32 : A5 37 2A C1 81 D2
1) Saved key transfert: 83 79 42 9A D0 6C E6 A4 73 EE DB 90 4C 71 F6 5A
2) Using challenge: A5 37 2A C1 81 D2
2) Using data: 32 83 79 42 9A D0 6C E6 A4 73 EE DB 90 4C 71 F6 5A
2) Initial value used for key encryption: 32 83 79 42 9A D0 6C E6 D1 9F A5 37 2A C1 81 D2
2) Challenge to be sent with 0x3D: 07 0F D6 17 6D E1
2W S 0 E 0 FROM BA11AD TO 487902 CMD 3D . CHALLENGE ACK 0x3D DATA(6)070fd6176de1
2W S 0 E 1 FROM 487902 TO BA11AD CMD 33 . KEY TRANSFERT ACK 0x33 DATA(0)
Errors
2W S 1 E 0 FROM BA11AD TO 487902 CMD 20 . PRIVATE REQ 0x20 DATA(5)0c61011001
2W S 0 E 0 FROM 487902 TO BA11AD CMD 3C . CHALLENGE REQ 0x3C DATA(6)72af7959eac2
1) Challenge asked after cmdId 20 : 72 AF 79 59 EA C2
1) Saved Private data: 0C 61 01 10 01
2) Using challenge: 72 AF 79 59 EA C2
2) Using data: 20 0C 61 01 10 01
2) Initial value used for key encryption: 20 0C 61 01 10 01 55 55 0F DA 72 AF 79 59 EA C2
2) Challenge to be sent with 0x3D: 61 4F 82 E9 47 C8
2W S 0 E 0 FROM BA11AD TO 487902 CMD 3D . CHALLENGE ACK 0x3D DATA(6)614f82e947c8
2W S 0 E 1 FROM 487902 TO BA11AD CMD FE . ERROR 0xFE DATA(1)18
Unkown command FE 08 2W S 1 E 1 FROM BA11AD TO 477706 CMD 28 DATA(0)
2W S 0 E 1 FROM 477706 TO BA11AD CMD FE DATA(1)58
Une commande correcte répond FE 05:
2W S 0 E 1 FROM 315824 TO 842E3 CMD FE DATA(1)05
Device not ready (startup after powerOn) FE 80 or not in pairing/associate mode
Bad Challenge 0x3D FE 70
manufacturer(0c if not used, answer the right one) + subcommands: 60(system infos) 61(set/unset params) 62(répond uniquement aabb)