Reverse engineering ELRO HA51 wireless - Revision history

Fish at 14:08, 22 October 2012

2012-10-22T14:08:56Z

Fish at 10:53, 1 August 2012

2012-08-01T10:53:34Z

Fish: Todo added

2012-08-01T10:20:55Z

Todo added

Fish: /* Results */

2012-07-30T19:37:30Z

‎Results

Fish: /* Setup */

2012-07-30T19:37:02Z

‎Setup

Fish at 19:27, 30 July 2012

2012-07-30T19:27:33Z

Fish: |200px added

2012-07-30T19:25:04Z

|200px added

Fish: Initial reverse enginering Elro HA51

2012-07-30T19:19:56Z

Initial reverse enginering Elro HA51

New page

=What is it=
It's a alarm system, used with wireless accessories.
We have a central and a remote control:

[[File:Elro_HA51.jpg]][[File:Elro_HA51_remote.jpg]]

=Setup=
We opened the device, no internal alarm trigger's where used.
The system contains 2 board:
*Logic board
*433 receiver

We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams: 
We opened the remote to change the dipswitches:
[[File:Elro_HA51_remoteinside.jpg]][[File:Elro_HA51_remoteinsidedips.jpg]] 

After sniffing a few times this the result: 
"Put alarm off" with all dips off: 
[[File:Elro_HA51_433_alloff_alarmoff.jpg]] 
"Put alarm off" with all dips on: 
[[File:Elro_HA51_433_allon_alarmoff.jpg]] 
As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

@@ Line 32: / Line 32: @@
 Panic button: 0011<br>
 <br>
-Other codes will be added after analysing (PIR, door detection etc)
+Other codes will be added after analysing (PIR, door detection etc)<br>
 =What to do=

← Older revision		Revision as of 10:53, 1 August 2012
Line 37:		Line 37:
	*Create pulse system to brute force the system and check for hidden codes		*Create pulse system to brute force the system and check for hidden codes
	*Use a 433 transmitter to create a remote brute forcer		*Use a 433 transmitter to create a remote brute forcer
		+	*Get a new/more current system and test it
		+	*Reverse a bunch of other alarm systems
		+
		+	[[Category:Projects]]
		+	[[Category:Reverse enginering]]

← Older revision		Revision as of 10:20, 1 August 2012
Line 33:		Line 33:
	<br>		<br>
	Other codes will be added after analysing (PIR, door detection etc)		Other codes will be added after analysing (PIR, door detection etc)
		+
		+	=What to do=
		+	*Create pulse system to brute force the system and check for hidden codes
		+	*Use a 433 transmitter to create a remote brute forcer

@@ Line 22: / Line 22: @@
 [[File:Elro_HA51_433_allon_alarmoff.png]]<br>
 As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".
+<br>
-Also we have seen the last 4 pulses are used to control the system:
+Also we have seen the last 4 pulses are used to control the system:<br>
-Wide=1
+Wide=1<br>
-Small=0
+Small=0<br>
+<br>
-System off: 1100
+System off: 1100<br>
-System on: 1110
+System on: 1110<br>
-System Delayed on: 1011
+System Delayed on: 1011<br>
-Panic button: 0011
+Panic button: 0011<br>
 Other codes will be added after analysing (PIR, door detection etc)

@@ Line 12: / Line 12: @@
 We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>
-We opened the remote to change the dipswitches:
+We opened the remote to change the dipswitches:<br>
 [[File:Elro_HA51_remoteinside.jpg|200px]][[File:Elro_HA51_remoteinsidedips.jpg|200px]]<br>
 After sniffing a few times this the result:<br>
 "Put alarm off" with all dips off:<br>
@@ Line 21: / Line 22: @@
 [[File:Elro_HA51_433_allon_alarmoff.png]]<br>
 As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

@@ Line 17: / Line 17: @@
 After sniffing a few times this the result:<br>
 "Put alarm off" with all dips off:<br>
-[[File:Elro_HA51_433_alloff_alarmoff.jpg]]<br>
+[[File:Elro_HA51_433_alloff_alarmoff.png]]<br>
 "Put alarm off" with all dips on:<br>
-[[File:Elro_HA51_433_allon_alarmoff.jpg]]<br>
+[[File:Elro_HA51_433_allon_alarmoff.png]]<br>
 As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

@@ Line 3: / Line 3: @@
 We have a central and a remote control:
-[[File:Elro_HA51.jpg]][[File:Elro_HA51_remote.jpg]]
+[[File:Elro_HA51.jpg|200px]][[File:Elro_HA51_remote.jpg|200px]]
 =Setup=
@@ Line 13: / Line 13: @@
 We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:<br>
 We opened the remote to change the dipswitches:
-[[File:Elro_HA51_remoteinside.jpg]][[File:Elro_HA51_remoteinsidedips.jpg]]<br>
+[[File:Elro_HA51_remoteinside.jpg|200px]][[File:Elro_HA51_remoteinsidedips.jpg|200px]]<br>
 After sniffing a few times this the result:<br>