Reverse engineering ELRO HA51 wireless - Revision history

Fish at 14:08, 22 October 2012

2012-10-22T14:08:56Z

← Older revision		Revision as of 14:08, 22 October 2012
Line 32:		Line 32:
	Panic button: 0011<br>		Panic button: 0011<br>
	<br>		<br>
	Other codes will be added after analysing (PIR, door detection etc)		Other codes will be added after analysing (PIR, door detection etc)<br>
			After replay function we also did test these codes:<br>
			Alarm trips when set: 1111<br>
			Does nothing: 0000<br>

	=What to do=		=What to do=

Fish at 10:53, 1 August 2012

2012-08-01T10:53:34Z

← Older revision		Revision as of 10:53, 1 August 2012
Line 37:		Line 37:
	*Create pulse system to brute force the system and check for hidden codes		*Create pulse system to brute force the system and check for hidden codes
	*Use a 433 transmitter to create a remote brute forcer		*Use a 433 transmitter to create a remote brute forcer
			*Get a new/more current system and test it
			*Reverse a bunch of other alarm systems

			[[Category:Projects]]
			[[Category:Reverse enginering]]

Fish: Todo added

2012-08-01T10:20:55Z

Todo added

← Older revision		Revision as of 10:20, 1 August 2012
Line 33:		Line 33:
	<br>		<br>
	Other codes will be added after analysing (PIR, door detection etc)		Other codes will be added after analysing (PIR, door detection etc)

			=What to do=
			*Create pulse system to brute force the system and check for hidden codes
			*Use a 433 transmitter to create a remote brute forcer

Fish: /* Results */

2012-07-30T19:37:30Z

Results

← Older revision		Revision as of 19:37, 30 July 2012
Line 22:		Line 22:
	[[File:Elro_HA51_433_allon_alarmoff.png]]<br>		[[File:Elro_HA51_433_allon_alarmoff.png]]<br>
	As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".		As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".
			<br>
	Also we have seen the last 4 pulses are used to control the system:		Also we have seen the last 4 pulses are used to control the system:<br>
	Wide=1		Wide=1<br>
	Small=0		Small=0<br>
			<br>
	System off: 1100		System off: 1100<br>
	System on: 1110		System on: 1110<br>
	System Delayed on: 1011		System Delayed on: 1011<br>
	Panic button: 0011		Panic button: 0011<br>
			<br>
	Other codes will be added after analysing (PIR, door detection etc)		Other codes will be added after analysing (PIR, door detection etc)

Fish: /* Setup */

2012-07-30T19:37:02Z

Setup

← Older revision		Revision as of 19:37, 30 July 2012
Line 12:		Line 12:

	We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>		We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>
	We opened the remote to change the dipswitches:		We opened the remote to change the dipswitches:<br>
	[[File:Elro_HA51_remoteinside.jpg\|200px]][[File:Elro_HA51_remoteinsidedips.jpg\|200px]]<br>		[[File:Elro_HA51_remoteinside.jpg\|200px]][[File:Elro_HA51_remoteinsidedips.jpg\|200px]]<br>

			=Results=
	After sniffing a few times this the result:<br>		After sniffing a few times this the result:<br>
	"Put alarm off" with all dips off:<br>		"Put alarm off" with all dips off:<br>
Line 21:		Line 22:
	[[File:Elro_HA51_433_allon_alarmoff.png]]<br>		[[File:Elro_HA51_433_allon_alarmoff.png]]<br>
	As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".		As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

			Also we have seen the last 4 pulses are used to control the system:
			Wide=1
			Small=0

			System off: 1100
			System on: 1110
			System Delayed on: 1011
			Panic button: 0011
			Other codes will be added after analysing (PIR, door detection etc)

Fish at 19:27, 30 July 2012

2012-07-30T19:27:33Z

← Older revision		Revision as of 19:27, 30 July 2012
Line 17:		Line 17:
	After sniffing a few times this the result:<br>		After sniffing a few times this the result:<br>
	"Put alarm off" with all dips off:<br>		"Put alarm off" with all dips off:<br>
	[[File:Elro_HA51_433_alloff_alarmoff.~~jpg~~]]<br>		[[File:Elro_HA51_433_alloff_alarmoff.png]]<br>
	"Put alarm off" with all dips on:<br>		"Put alarm off" with all dips on:<br>
	[[File:Elro_HA51_433_allon_alarmoff.~~jpg~~]]<br>		[[File:Elro_HA51_433_allon_alarmoff.png]]<br>
	As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".		As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

Fish: |200px added

2012-07-30T19:25:04Z

|200px added

← Older revision		Revision as of 19:25, 30 July 2012
Line 3:		Line 3:
	We have a central and a remote control:		We have a central and a remote control:

	[[File:Elro_HA51.jpg]][[File:Elro_HA51_remote.jpg]]		[[File:Elro_HA51.jpg\|200px]][[File:Elro_HA51_remote.jpg\|200px]]

	=Setup=		=Setup=
Line 13:		Line 13:
	We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>		We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>
	We opened the remote to change the dipswitches:		We opened the remote to change the dipswitches:
	[[File:Elro_HA51_remoteinside.jpg]][[File:Elro_HA51_remoteinsidedips.jpg]]<br>		[[File:Elro_HA51_remoteinside.jpg\|200px]][[File:Elro_HA51_remoteinsidedips.jpg\|200px]]<br>

	After sniffing a few times this the result:<br>		After sniffing a few times this the result:<br>

Fish: Initial reverse enginering Elro HA51

2012-07-30T19:19:56Z

Initial reverse enginering Elro HA51

New page

=What is it=
It's a alarm system, used with wireless accessories.
We have a central and a remote control:

[[File:Elro_HA51.jpg]][[File:Elro_HA51_remote.jpg]]

=Setup=
We opened the device, no internal alarm trigger's where used.
The system contains 2 board:
*Logic board
*433 receiver

We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams: 
We opened the remote to change the dipswitches:
[[File:Elro_HA51_remoteinside.jpg]][[File:Elro_HA51_remoteinsidedips.jpg]] 

After sniffing a few times this the result: 
"Put alarm off" with all dips off: 
[[File:Elro_HA51_433_alloff_alarmoff.jpg]] 
"Put alarm off" with all dips on: 
[[File:Elro_HA51_433_allon_alarmoff.jpg]] 
As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".