Building Poor Man's Logic Analyzer with an Arduino - Reverse Engineering A/C Remote part 1

Key Takeaways

in this miniseries I want to explore a hardware reversing project I have this air conditioner which uses a remote and we want to understand how it works so in this miniseries I want to reverse engineer the communication between the remote and the AC unit it's not Advanced or New in any way it was done countless of times already but if you have never done any electronic stuff I think is an awesome example to get started I have not done this before either I just know theoretically how it should work so I want to take you along how I approach this project first we try to understand the behavior of the remote and AC unit because from that we can already infer a lot of information and after that we will use some electronics and build a poor man's logic analyzer with an Arduino I have here this remote with a display showing the temperature and other settings such as cooling or fan motors and some other stuff the first question is how does the click information on the remote travel to the AC and is there any communication back from the AC because we can see the temperature on the remote screen this is easy to test we can simply walk into another room far away from the AC change a few settings and then walk back to the main unit and look at the display and we can see that the set settings on the main unit hasn't changed but the remote says something else and when we click now another button on the remote the AC unit immediately jumps to that value this already tells us so much on how the protocol works not every single press is transmitted alone so when I press temperature up it doesn't send an up command it actually transmit the whole state of the settings this means there's some kind of packet that is transmitted that contains all values to verify this assumption we can also change the settings on the unit and see if the remote changes which it doesn't and as soon as we press something on the remote it jumps back to that value so this reveals so much about the protocol already it's one way from the remote to the AC unit and it seems to be a bigger packet containing all the settings information so how does the remote transmit this information well when when we look at the remote we can see at the front what looks like any normal LED and you probably know that that is an infrared LED just a quick refresher about the electromagnetic spectrum not that I claim to know any physics in any meaningful way but we should have some idea about it so visible light is a tiny area of the electromagnetic radiation our cells just happen to respond to those wavelengths and our eyes are dark for all others that's bad for a few things so for example we cannot see dangerous Gamma or x-rays but also good because we can use the nonvisible EM spectrum to transmit data so your Wi-Fi Bluetooth Mobile Radio is all just different kinds of electromagnetic radiation it just happens to be a different wavelength our eyes can't pick up an infrared is also defined as a certain wavelength which is just barely out of our capabilities to see though there are some animals that can see infrared light also most of our photo sensors in our cameras react to the wavelength of infrared light we can also point the remote at our phone camera to see that light um I can barely see it well a lot of times camera use an IR filter because humans can't see infrared th capturing infrared could falsify the colors and stuff I'm using an iPhone here and I know that the front-facing camera doesn't have an IR filter so we can see it better with that one and also if we go into a darker room we can really see it easily so to properly analyze this because it just quickly flashes we need something that captures this the 24 or maybe 60 frames a second of a camera are way too slow to capture the fast flickering so we will build a small circle to analyze this we need a sensor that reacts to infrared light but not other light there are light sensors so called photo resistors which increase or decrease resistance depending on the amount of light though this one one is calibrated for regular visible light so it's no good use to us but I have here this IR receiver which works more like a transistor it has three pins two pins are basically the power supply Plus 5 volt and ground and the third pin is either high or low depending on if it captures a significant amount of IR light or not I put this here on a so called breadboard that is a convenient rapid prototyping platform so for example the long red blue lines on the sides are all connected in a row which are used for the power supply so I can connect the IR receiver's power supply with those lines and the holes in the middle are also connected in columns but divided in the middle so I can plug in the IR here and it will get the power there's also this great hobby electronics platform which you probably know called Arduino which makes it super easy to use by everybody I use an Arduino compatible board from Saints smart because it came in this cheap ronics tutorial learning box but you should definitely check out all those Arduino learning packs and resources they are awesome those $50 $60 are worth more than buying a game you learn so much anyhow this board has some pins and they are labeled and we can see here a 5V and gnd which stands for ground pin so we can use that to supply the breadboard with power and can use one of the digital input and output pins to connect to the Third Leg of of the receiver if you have never done this yourself it might look already a bit complicated but it's really really easy you just have to do it once yourself here's also the schematics of how the setup looks like we have the IR receiver it's connected to ground here and to VCC which refers to the power supply and the third pin is connected to the digital pin of the Arduino or St smart Leonard board arduinos have a super easy programming IDE where you can program and see and simply upload the compiled program to the board and it just works so we want to write some code that reads the output of the IR receiver so we can analyze it we can take an aino example that would read the state of a button and just modify to read the state of the IR receiver so there are two main functions the setup function which initializes the serial communication uh that's a protocol so the computer can communicate with the board and send text and out of scope right now but we will look at seral some other time and we initiate the pin number eight as an input pin then the loop function here is like an endless while loop this is what will be executed constantly in a loop and here we want to read the state of input pin 8 and send this input via serial to our computer then we can compile it we have to make sure the board is properly recognized with the software and then we can push it onto the board now it's running there we can open the serial console and see the output So currently it's sending only once so the I IR receiver outputs always High 5 Vol which is a digital one and now we point the remote at it and when we press it we can see some zeros rushing by that's cool but a bit hard to analyze so let's modify the code to use a so-called trigger we can start with a state zero where we constantly read the input and once it drops to a zero for the the first time we switch to State one where we now send the input including the microsc so we have some timing information as well to the computer now we push it to the board wait until it's booted and now we see no input being sent to the computer but if we point now the remote at the IR receiver and press the button we get the first zero and now the data is rushing in that's better now we can simply copy this output into a text file to analyze we can now collect multiple samples for example the packet to select Fahrenheit or Celsius or turning it on and off then I use two pyer notebooks to work with stuff like this it's basically python just with an awesome interface to do explorative scripts I first start by including some important modules so we can plot data and then we read one of the lock data files with numpy and specify that the data is comma separate ated this will give us a big numpy array and we can then extract the microsc and the single bits next we can use P plot to plot this data in steps looks a bit awkward so let's play around a little bit with the limits of the Y and xaxis as well as the figure size of the plot and maybe also cut the data points at some length because we only are interested in the data at the front we might want to add some points so we can see exactly where our data points are we can now also wrap this into a function so we can simply call load with a file name and get this nice digital logic plot awesome look at this this is great this is a great Poor Man's logic analyzer and we can compare for example Celsius to Fahrenheit packet and the on and off packet but how do we read this they clearly look similar so this is not some random wiggling this is some kind of real pattern this is the infrared LED flickering on and off in a specific way but how the LED flickers is defined in the protocol and somehow we have to understand how the protocol works so one attack you can do without knowing the protocol is compare multiple packets of the same command like multiple turning on packets and then you could see that this always the same so there's no crypto or time stamp or whatever involved so replay attack is easily possible without knowing what the bits mean we can just reset sent the pattern to perform this action another thing to work out uh the protocol is to compare similar packets like Celsius and Fahrenheit and we notice that some spikes are very close together and some spikes are far apart and we can try to see if this pattern is different for both of them because Fahrenheit and Celsius can be represented by one bit it's either zero or one we can inere from that what a bit zero or one might look like in this pattern maybe you can pause this video here and try to extract the single bits from those packets but there's a big problem here each single dot is a point where we read the state of the receiver and they are so little compared to amount of spikes thus maybe we miss some spikes or some spikes appear wider or thinner even though they were the same in proper terms we have a way too low sampling rate for the frequency of the input signal so this aino and laptop setup is a great start but it's not very precise it is enough to work out the protocol but next video I want to show you how you can do this a little bit more advanced and we will start reversing the packets [Music] [Applause] [Music]