$$\   $$\  $$$$$$\ $$$$$$$$\ $$$$$$$$\  $$$$$$\  
$$$\  $$ |$$  __$$\\__$$  __|$$  _____|$$  __$$\ 
$$$$\ $$ |$$ /  $$ |  $$ |   $$ |      $$ /  \__|
$$ $$\$$ |$$ |  $$ |  $$ |   $$$$$\    \$$$$$$\  
$$ \$$$$ |$$ |  $$ |  $$ |   $$  __|    \____$$\ 
$$ |\$$$ |$$ |  $$ |  $$ |   $$ |      $$\   $$ |
$$ | \$$ | $$$$$$  |  $$ |   $$$$$$$$\ \$$$$$$  |
\__|  \__| \______/   \__|   \________| \______/ 
        
------------------------------------------------------------
HOME | TOR | GITHUB | NOTES | ABOUT | CONTACT | LOGIN
------------------------------------------------------------

    +--------------------+-------------+---------------------+------+---------+    
    | TOUCHTUNES_JUKEBOX | KESTREL_BLE | CHEMION_LED_GLASSES | MATH | IRIDIUM |    
+-+--------------------+-------------+--------+------------+----+-+---------+-+
| DUMPING_NRF51822_FIRMWARE | YAESU_VX-7R_RPi | UNIPAGER POCSAG | MMDVM_GM300 |
+---------------------------+-----------------+-----------------+-------------+
            
            
████████╗ ██████╗ ██╗   ██╗ ██████╗██╗  ██╗████████╗██╗   ██╗███╗   ██╗███████╗███████╗
╚══██╔══╝██╔═══██╗██║   ██║██╔════╝██║  ██║╚══██╔══╝██║   ██║████╗  ██║██╔════╝██╔════╝
   ██║   ██║   ██║██║   ██║██║     ███████║   ██║   ██║   ██║██╔██╗ ██║█████╗  ███████╗
   ██║   ██║   ██║██║   ██║██║     ██╔══██║   ██║   ██║   ██║██║╚██╗██║██╔══╝  ╚════██║
   ██║   ╚██████╔╝╚██████╔╝╚██████╗██║  ██║   ██║   ╚██████╔╝██║ ╚████║███████╗███████║
   ╚═╝    ╚═════╝  ╚═════╝  ╚═════╝╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝

                    ██╗██╗   ██╗██╗  ██╗███████╗██████╗  ██████╗ ██╗  ██╗              
                    ██║██║   ██║██║ ██╔╝██╔════╝██╔══██╗██╔═══██╗╚██╗██╔╝              
                    ██║██║   ██║█████╔╝ █████╗  ██████╔╝██║   ██║ ╚███╔╝               
               ██   ██║██║   ██║██╔═██╗ ██╔══╝  ██╔══██╗██║   ██║ ██╔██╗               
               ╚█████╔╝╚██████╔╝██║  ██╗███████╗██████╔╝╚██████╔╝██╔╝ ██╗              
                ╚════╝  ╚═════╝ ╚═╝  ╚═╝╚══════╝╚═════╝  ╚═════╝ ╚═╝  ╚═╝              
 
                            
//=====< 2019-11-21T08:58:58+00:00 >==============================================\\
||                                                                                ||
||     Hi again!                                                                  ||
||                                                                                ||
||     I'm not a big fan of writing blogs so I figure shearing my notes on        ||
||     what I've been working on be a good compromise. Below is the story of      ||
||     the first cool thing I've done with a radio. :3                            ||
||                                                                                ||
||     When I used to go to bars, I always thought to myself how neat it would    ||
||     be to just play music from the Jukebox for free. You know? like 'The Fonz' ||
||     from the 70's sitcom 'Happy Days'? My target was an IOT jukebox made by    ||
||     TouchTunes®️ and they where popular in the Seattle area. After reading up   ||
||     on some of their manuals, I learned that they used a wireless remote that  ||
||     TXed on 433.92MHz. Promotional credits where another feature I found that  ||
||     could be exploited with the remote. Armed with that knologe, I bought      ||
||     myself a remote from eBay for about $40.                                   ||
||                                                                                ||
||     Having never done this before, I Youtubed everything I could on reversing  ||
||     wireless protocols. I realy owe thanks for the foaks at Hak5 and Michael   ||
||     Osman from GSG for spending the time to create detailed videos on the      ||
||     the topic. Using a HackRF and the program inspectrum I was able to learn   ||
||     enough about the wireless remote to program a Yard Stick One to stream     ||
||     line the process. The next step was to the record all the messages and     ||
||     compare them with each other.                                              ||
||                                                                                ||
||     TL;DR, when I first looked at this protocol, I only knew the modulation    ||
||     type (ASK/OOK), the symbol rate (1766), preamble (0xFFFF00), and the       ||
||     encoded sync word. Not knowing what the encoding method was I recorded     ||
||     every possable message from pin 000 to 255, created three ugly look up     ||
||     tables, and used a little Python hackery to make it work! And it did!      ||
||                                                                                ||
||     About a year later, a VERRY talented person (Furrtek) ported my work       ||
||     over to his portapack firmware fork, Havoc. I didn't figure this out       ||
||     untill I updated my portapack with his firmware. TBH I was a bit tickled   ||
||     to see a TX option for TouchTunes®️ at the bottom. definitely a feel good   ||
||     moment! :D                                                                 ||
||                                                                                ||
||     So not only did he port my work, he also figured out the encoding schema   ||
||     from my hacked together code. It turned out to be NEC which is an IR       ||
||     protocol used for TV remotes. NEC is simple, 1's are encoded to (1 0 0 0)  ||
||     which for OOK is (ON OFF OFF OFF) per the symbol rate and 0's are just     ||
||     (1 0) or (ON OFF). NEC isn't something wireless engineers go out of their  ||
||     way to use for a fire and forget application but there it was. :D          ||
||                                                                                ||
||     With a better understanding of how the TouchTunes®️ remotes worked, I       ||
||     updated my code to encode and decode the NEC protocol. I also added a few  ||
||     other 'features' such as a brute forcing method where it runs a command    ||
||     from pin 000 to 255 and an Electronic Warfare (EW) mode. EW is DOD speak   ||
||     for jamming when you want to jam and not jamming when you don't want to    ||
||     jam... Clear as mud? If not read the sorce code because it's unlawful AF!  ||
||     Only use EW mode for testing and in a closed RF environment!               ||
||                                                                                ||
||     --> Test Environment: IMG                                                  ||
||     --> FFT:              IMG                                                  ||
||                                                                                ||
||     SO! if you're interested in poking some jukeboxs feel free and check out   ||
||     'The-Fonz' project for the Yard Stick One. Furrtek also ported this over   ||
||     to the portapack with the Havor firmware. Also, I wrote an app for the     ||
||     goodwatch project so this research is now supported on three platforms!    ||
||     :D                                                                         ||
||                                                                                ||
||     --> The-Fonz:  https://github.com/notpike/The-Fonz                         ||
||     --> Havoc:     https://github.com/furrtek/portapack-havoc                  ||
||     --> goodwatch: https://github.com/travisgoodspeed/goodwatch                ||
||                                                                                ||
||                                                                                ||
||     ======================================================================     ||
||                                                                                ||
||                                                                                ||
||     Below is all the technical data regarding the remote...                    ||
||                                                                                ||
||     * FCC ID: 2AHXI-T1                                                         ||
||     * FCC Info: https://fccid.io/2AHXI-T1                                      ||
||     * Frequency: 433.92MHz                                                     ||
||     * Modulation: ASK/OOK                                                      ||
||     * Protocol: NEC                                                            ||
||     * Symbol Rate: 1766                                                        ||
||     * Symbol Period: 566us                                                     ||
||                                                                                ||
||       ==NEC Format==                                                           ||
||     * Short(0): 10   (ON OFF)                                                  ||
||     * Long (1): 1000 (ON OFF OFF OFF)                                          ||
||                                                                                ||
||     * Structure:                 {SYNC} {PREAMBLE} {PIN} {COMMAND} {TAIL}      ||
||     * Sync (Literal Symbols):    0xFFFF00                                      ||
||     * Preamble (Decoded NEC):    0x5D                                          ||
||     * PIN 000-255 (Decoded NEC): 0x00-0xFF (LSB)                               ||
||     * Tail (Literal Symbols):    0x8                                           ||
||                                                                                ||
||     * Commands:                                                                ||
||     * Note: Commands are doubled with the 2nd half being reversed.             ||
||             For example, Pause 0x32 will translate to 0x3223 before            ||
||             being encoded to the literal symbols. \xA8\x8A\x8A\xA2\xA8\x80     ||
||                                                                                ||
||                               0x32, // Pause                                   ||
||                               0x78, // On/Off                                  ||
||                               0x70, // P1                                      ||
||                               0x60, // P2 Edit Queue                           ||
||                               0xCA, // P3 Skip                                 ||
||                               0x20, // F1 Restart                              ||
||                               0xF2, // Up                                      ||
||                               0xA0, // F2 Key                                  ||
||                               0x84, // Left                                    ||
||                               0x44, // OK                                      ||
||                               0xC4, // Right                                   ||
||                               0x30, // F3 Mic A Mute                           ||
||                               0x80, // Down                                    ||
||                               0xB0, // F4 Mic B Mute                           ||
||                               0xF0, // 1                                       ||
||                               0x08, // 2                                       ||
||                               0x88, // 3                                       ||
||                               0x48, // 4                                       ||
||                               0xC8, // 5                                       ||
||                               0x28, // 6                                       ||
||                               0xA8, // 7                                       ||
||                               0x68, // 8                                       ||
||                               0xE8, // 9                                       ||
||                               0x18, // * Music_Karaoke                         ||
||                               0x98, // 0                                       ||
||                               0x58, // # Lock_Queue                            ||
||                               0xD0, // Zone 1 Vol+                             ||
||                               0x90, // Zone 2 Vol+                             ||
||                               0xC0, // Zone 3 Vol+                             ||
||                               0x50, // Zone 1 Vol-                             ||
||                               0x10, // Zone 2 Vol-                             ||
||                               0x40, // Zone 3 Vol-                             ||
||                                                                                ||
||       ==Example==                                                              ||
||     * Command:             Pin 000 - On/Off                                    ||
||     * Literal Symbols HEX: ffff00 a2888a2 aaaa 8888aa2aa2220                   ||
||     * Literal Symbols BIN: 11111111111111110000 10 1000 10 1000 1000 1000      ||
||                            10 1000 10 10 10 10 10 10 10 10 10 1000 1000        ||
||                            1000 1000 10 10 10 1000 10 10 10 10 1000 1000       ||
||                            1000 100000                                         ||
||                                                                                ||
||     * Decoded Symbols:     SYNC         S  L    S  L    L    L    S  L         ||
||                            S  S  S  S  S  S  S  S  S  L    L    L    L         ||
||                            S  S  S  L    S  S  S  S  L    L    L    TAIL       ||
||                                                                                ||
||                                                                                ||
||     -- NotPike                                                                 ||
||                                                                                ||
\\================================================================================//
                                                            \                       
                                                             \   ^__^               
                                                              \  (><)\_______       
                                                                 (__)\       )\/\   
                                                                     ||----w |      
                                                                     ||     ||