Reverse engineering ELRO Flamingo HA31 wireless alarm - Revision history

Fish at 13:53, 22 April 2013

2013-04-22T13:53:22Z

Kahits: /* Analysis */

2013-04-10T11:45:12Z

‎Analysis

Fish at 18:39, 2 August 2012

2012-08-02T18:39:00Z

Fish at 18:31, 2 August 2012

2012-08-02T18:31:25Z

Fish: /* Analysis */

2012-08-02T18:26:04Z

‎Analysis

Fish: jpg > png

2012-08-02T18:16:38Z

jpg > png

Fish: Added flamingo elro alarm flamingo HA31

2012-08-02T18:15:54Z

Added flamingo elro alarm flamingo HA31

New page

=Intro=
The Elro flamingo HA31 is a alarm with wireless sensors. 
The set contains:
*A central unit with keypad, battery holder and a power-adapter
*PIR motion sensor
*Door contact sensor
*External sounder
*Accessories to mount the sensors etc
[[File:Elro_flamingo_ha31_package.jpg|200px]]

=Analysis=
After unwrapping the package the outside looks decent, the central has a extra contact on the back so if you break it of the wall it does activate the alarm. When we did opened the casing we where kinda of surprised about the quality of the PCB's, yes it's cheap Chinese quality but it does do the job. 
[[File:Elro_flamingo_ha31_backdips.jpg|200px]] 
We also found 4 dip-switches (also accessible if you open one of the standard openings), you can create your "home code" with 4 dip-switches. In theory that means you can create 2*2*2*2 = 16 codes which isn't a lot. It's easy to activate the alarm of your neighbor if he/she uses the same system. 
 
The internal of the central system does contain 3 PCB's, one with the numeric keypad attached to the main logic board and a wireless 433 receiver.
Between the wireless receiver and the main board are 2 wires, it's power and "signal". The wireless control board doesn't contain a lot of hardware but most interesting is the chip, it is a M1D chip. After google-ing we found a [http://www.hobbyelektronica.nu/23/05.pdf NLdatasheet] of the chip, it's a chip mostly used for door bells.
After opening the sensors we did saw the "other-side", same story...bad PCB's and... a doorbell chip..
[[File:Elro_flamingo_ha31_centralwchip.jpg|200px]][[File:Elro_flamingo_ha31_sensorchip.jpg|200px]][[File:Elro_flamingo_ha31_PIRchip.jpg|200px]] 
After hooking up an analyzer to the central wireless receiver it also became clear what was happening, if the door bell rings (aka sensor got activated) a pulse is send to the main logic board and the alarm will be triggered if it's armed. 
 
So how about the wireless signal and encoding? 
The system is simple: 
All dips on: [[File:Elro_flamingo_ha31_wireless_alldipson.jpg|200px]] 
All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.jpg|200px]] 
Dips 1001: [[File:Elro_flamingo_ha31_wireless_dips1001.jpg|200px]] 
=Todo's=
*Investigate the main logic board
*brute force all codes and functions on the keypad
*Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)

← Older revision		Revision as of 13:53, 22 April 2013
Line 31:		Line 31:
	*Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)		*Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)
	*Create a 433Mhz jammer and test what you need in what range, create a heatmap in a "normal" house"		*Create a 433Mhz jammer and test what you need in what range, create a heatmap in a "normal" house"
		+	[[Category:Projects]]
		+	[[Category:Reverse enginering]]

@@ Line 10: / Line 10: @@
 =Analysis=
-After unwrapping the package the outside looks decent, the central has a extra contact on the back so if you break it of the wall it does activate the alarm. When we did opened the casing we where kinda of surprised about the quality of the PCB's, yes it's cheap Chinese quality but it does do the job.<br>
+After unwrapping the package the outside looks decent. The unit has an extra contact on the back of it which will get switched on when ever you try to dismount the unit from the wall. If you do take it of the wal it will activate the alarm. After unscrewing the unit we where kind of surprised about the quality of the PCB's. Yes, all in all it IS cheap Chinese quality. But appearantly it does it's job.<br>
 [[File:Elro_flamingo_ha31_backdips.jpg|200px]]<br>
-We also found 4 dip-switches (also accessible if you open one of the standard openings), you can create your "home code" with 4 dip-switches. In theory that means you can create 2*2*2*2 = 16 codes which isn't a lot. It's easy to activate the alarm of your neighbor if he/she uses the same system.<br>
+We also found 4 dip-switches (also accessible via one of the standard openings). These switches are used to make up your own "house code". With only four switches to use for making up your own house code, it is in theory possible to create at max 16 unique codes (2*2*2*2). It's easy to activate the alarm of your neighbor if he/she uses the same system.<br>
 <br>
 The internal of the central system does contain 3 PCB's, one with the numeric keypad attached to the main logic board and a wireless 433 receiver.
@@ Line 25: / Line 25: @@
 All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.png|200px]]<br>
 Dips 1001:   [[File:Elro_flamingo_ha31_wireless_dips1001.png|200px]]<br>
 =Todo's=
 *Investigate the main logic board

@@ Line 29: / Line 29: @@
 *brute force all codes and functions on the keypad
 *Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)
-=More pics=
+*Create a 433Mhz jammer and test what you need in what range, create a heatmap in a "normal" house"

@@ Line 7: / Line 7: @@
 *External sounder
 *Accessories to mount the sensors etc
-[[File:Elro_flamingo_ha31_package.jpg|200px]]
+[[File:Elro_flamingo_ha31_package.jpg|300px]]
 =Analysis=
@@ Line 16: / Line 16: @@
 The internal of the central system does contain 3 PCB's, one with the numeric keypad attached to the main logic board and a wireless 433 receiver.
 Between the wireless receiver and the main board are 2 wires, it's power and "signal". The wireless control board doesn't contain a lot of hardware but most interesting is the chip, it is a M1D chip. After google-ing we found a [http://www.hobbyelektronica.nu/23/05.pdf NLdatasheet] of the chip, it's a chip mostly used for door bells.<br>
-After opening the sensors we did saw the "other-side", same story...bad PCB's and... a doorbell chip..<br>
+After opening the sensors we did saw the "other-side", same story...bad PCB's and... the doorbell chip..[http://www.digchip.com/datasheets/parts/datasheet/922/M1EA.php]<br>
-[[File:Elro_flamingo_ha31_centralwchip.jpg|200px]][[File:Elro_flamingo_ha31_sensorchip.jpg|200px]][[File:Elro_flamingo_ha31_PIRchip.jpg|200px]]<br>
+[[File:Elro_flamingo_ha31_centralwchip.jpg|200px]][[File:Elro_flamingo_ha31_sensorchip.jpg|200px]][[File:Elro_flamingo_ha31_PIRpsb.jpg|200px]]<br>
 After hooking up an analyzer to the central wireless receiver it also became clear what was happening, if the door bell rings (aka sensor got activated) a pulse is send to the main logic board and the alarm will be triggered if it's armed.<br>
 <br>
@@ Line 25: / Line 25: @@
 All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.png|200px]]<br>
 Dips 1001:   [[File:Elro_flamingo_ha31_wireless_dips1001.png|200px]]<br>
 =Todo's=
 *Investigate the main logic board
 *brute force all codes and functions on the keypad
 *Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)

@@ Line 15: / Line 15: @@
 <br>
 The internal of the central system does contain 3 PCB's, one with the numeric keypad attached to the main logic board and a wireless 433 receiver.
-Between the wireless receiver and the main board are 2 wires, it's power and "signal". The wireless control board doesn't contain a lot of hardware but most interesting is the chip, it is a M1D chip. After google-ing we found a [http://www.hobbyelektronica.nu/23/05.pdf NLdatasheet] of the chip, it's a chip mostly used for door bells.
+Between the wireless receiver and the main board are 2 wires, it's power and "signal". The wireless control board doesn't contain a lot of hardware but most interesting is the chip, it is a M1D chip. After google-ing we found a [http://www.hobbyelektronica.nu/23/05.pdf NLdatasheet] of the chip, it's a chip mostly used for door bells.<br>
-After opening the sensors we did saw the "other-side", same story...bad PCB's and... a doorbell chip..
+After opening the sensors we did saw the "other-side", same story...bad PCB's and... a doorbell chip..<br>
 [[File:Elro_flamingo_ha31_centralwchip.jpg|200px]][[File:Elro_flamingo_ha31_sensorchip.jpg|200px]][[File:Elro_flamingo_ha31_PIRchip.jpg|200px]]<br>
 After hooking up an analyzer to the central wireless receiver it also became clear what was happening, if the door bell rings (aka sensor got activated) a pulse is send to the main logic board and the alarm will be triggered if it's armed.<br>
@@ Line 25: / Line 25: @@
 All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.png|200px]]<br>
 Dips 1001:   [[File:Elro_flamingo_ha31_wireless_dips1001.png|200px]]<br>
 =Todo's=
 *Investigate the main logic board
 *brute force all codes and functions on the keypad
 *Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)

@@ Line 22: / Line 22: @@
 So how about the wireless signal and encoding?<br>
 The system is simple:<br>
-All dips on: [[File:Elro_flamingo_ha31_wireless_alldipson.jpg|200px]]<br>
+All dips on: [[File:Elro_flamingo_ha31_wireless_alldipson.png|200px]]<br>
-All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.jpg|200px]]<br>
+All dips off:[[File:Elro_flamingo_ha31_wireless_alldipsof.png|200px]]<br>
-Dips 1001:   [[File:Elro_flamingo_ha31_wireless_dips1001.jpg|200px]]<br>
+Dips 1001:   [[File:Elro_flamingo_ha31_wireless_dips1001.png|200px]]<br>
 =Todo's=
 *Investigate the main logic board
 *brute force all codes and functions on the keypad
 *Create a re-player for the 16 codes to activate all alarms and call it: "Alarm-B-on" (named after Mitch his TV-B-Gobe)